DEA-C01 Practice Test 9 — 10 Questions

Question 1

A company stores IoT sensor data in an Amazon S3 bucket. The data is ingested every minute and each object is about 10 KB. The data must be stored for at least 7 years for compliance. Which lifecycle policy configuration minimizes storage costs?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Transition to S3 Glacier Deep Archive after 30 days and expire after 2555 days.. S3 Glacier Deep Archive is the lowest-cost storage class for long-term archival data, and transitioning directly after 30 days minimizes costs for 10 KB objects that are accessed infrequently. The 2555-day expiration (7 years) meets the compliance requirement. Other options incur higher costs by using more expensive intermediate tiers or by delaying the transition to the cheapest storage class.

Answer

Transition to S3 One Zone-IA after 30 days, then to S3 Glacier Deep Archive after 365 days, and expire after 2555 days.

Answer

Transition to S3 Glacier Flexible Retrieval after 90 days and expire after 2555 days.

Answer

Transition to S3 Standard-IA after 30 days, then to S3 Glacier Deep Archive after 365 days, and expire after 2555 days.

Question 2

Refer to the exhibit. A data engineer sees this error log from an Amazon EC2 instance that is trying to access an S3 bucket in the us-west-2 region. The EC2 instance is in a VPC with a private subnet and no internet gateway. What is the MOST likely cause of this error?

Accepted Answer

The VPC does not have a VPC endpoint for S3.. The EC2 instance is in a private subnet without an internet gateway, so it cannot reach S3 over the internet. A VPC endpoint (Gateway or Interface) for S3 is required for private connectivity. The error log shows a connection timeout, which is consistent with the lack of a VPC endpoint. Option A is incorrect because the bucket's region is us-west-2 as specified, and the bucket exists (DNS resolves). Option C is incorrect because the error is a timeout, not a 404 (bucket not found). Option D is incorrect because the error is a connection timeout, not an access denied (403), so IAM permissions are not the issue.

Answer

The S3 bucket is in a different region than us-west-2.

Answer

The S3 bucket does not exist.

Answer

The IAM role attached to the EC2 instance does not have s3:GetObject permission.

Question 3

An IAM policy is attached to an IAM role used by an EC2 instance in the 10.0.0.0/8 VPC. The EC2 instance cannot read objects from the S3 bucket. What is the most likely cause?

Accepted Answer

The S3 bucket has a bucket policy that denies public access, and the IAM policy alone is insufficient.. The most likely cause is that the S3 bucket has a bucket policy that denies access or does not explicitly grant access to the IAM role. Even if the IAM policy attached to the role allows S3 actions, a bucket policy can override it with an explicit deny or by not granting access to the role. Option A is incorrect because the s3:GetObject operation does not require s3:ListBucket permission. Option C is incorrect because SSE-KMS is not mentioned and would require specific kms:Decrypt permission, but it is not the most likely cause. Option D is incorrect because the EC2 instance's private IP is within the 10.0.0.0/8 VPC range, and the public IP is irrelevant for in-VPC communication.

Answer

The policy does not grant s3:ListBucket permission.

Answer

The bucket is encrypted with SSE-KMS and the role does not have kms:Decrypt permission.

Answer

The EC2 instance's public IP is not in the 10.0.0.0/8 range.

Question 4

A company uses DynamoDB with global tables in two AWS Regions. The data engineer observes that a write to the table in us-east-1 is not immediately visible in a read from eu-west-1. What is the most likely reason?

Accepted Answer

Replication between regions is eventually consistent.. DynamoDB global tables use asynchronous replication between regions. When a write occurs in us-east-1, the change is propagated to eu-west-1 with a replication lag that is typically sub-second but not instantaneous. Reads in eu-west-1 are eventually consistent by default, meaning they may not reflect the most recent write until replication completes. This is the expected behavior of DynamoDB global tables, which prioritize availability and partition tolerance over immediate consistency across regions.

Answer

The read is using strongly consistent reads.

Answer

There is a write conflict that needs to be resolved.

Answer

DynamoDB Streams is not enabled on the table.

Question 5

A data engineer is troubleshooting a Kinesis Data Analytics application that processes streaming data. The application is falling behind, and the metric 'MillisBehindLatest' is consistently above 60000. The source Kinesis stream has 10 shards, and the application uses a Flink application with default parallelism. What is the MOST likely cause of the lag?

Accepted Answer

The Flink application parallelism is set to 1.. In Kinesis Data Analytics with Flink, the default parallelism is 1. With 10 shards in the source Kinesis stream, a single parallel task must read from all shards, creating a bottleneck and causing the 'MillisBehindLatest' metric to be consistently high (above 60000). Option A is wrong because while a throttling sink can cause backpressure, the question specifically states the application is falling behind and the metric is high, which is more directly explained by insufficient parallelism. Option C is wrong because 10 shards is typically sufficient; the issue is how they are consumed. Option D is wrong because the retention period does not affect the lag metric; it only controls how long data is stored.

Answer

The sink (destination) is throttling writes.

Answer

The Kinesis stream has too few shards.

Answer

The retention period of the Kinesis stream is too short.

Question 6

Which TWO actions are effective ways to monitor the health of an Amazon DynamoDB table? (Choose two.)

Accepted Answer

Enable DynamoDB Streams and process with Lambda to detect failures.. Options C and D are correct. DynamoDB Streams with Lambda can detect failures by processing change events, and CloudWatch alarms on ConsumedReadCapacityUnits help monitor throughput and potential throttling. Option A is wrong because S3 inventory tracks S3 objects, not DynamoDB. Option B is wrong because EC2 instance status checks are for EC2 instances, not DynamoDB tables. Option E is wrong because there is no 'TableHealth' metric in CloudWatch; DynamoDB health is monitored via metrics like ConsumedReadCapacityUnits, ThrottledRequests, and SystemErrors.

Answer

Use AWS S3 inventory to track table size.

Answer

Use EC2 instance status checks.

Answer

Monitor the 'TableHealth' metric in CloudWatch.

Question 7

A company is using Amazon S3 to store sensitive data. To meet compliance requirements, they need to automatically transition objects to S3 Glacier Deep Archive after 90 days and delete them after 7 years. What is the MOST cost-effective way to configure this?

Accepted Answer

Configure an S3 Lifecycle policy to transition objects to Glacier Deep Archive after 90 days and expire them after 7 years.. An S3 Lifecycle policy can automate both the transition of objects to S3 Glacier Deep Archive after 90 days and their expiration (permanent deletion) after 7 years. This is the most cost-effective approach as it eliminates manual effort and leverages S3's native, serverless lifecycle management, which incurs no additional cost beyond the storage and transition fees.

Answer

Manually move objects to Glacier Deep Archive and delete them using a script.

Answer

Use S3 Intelligent-Tiering to automatically move objects to Glacier Deep Archive and set expiration.

Answer

Enable S3 Object Lock with a retention period of 7 years and use a lifecycle policy to transition to Glacier Deep Archive.

Question 8

A data engineer is troubleshooting a failed AWS Glue ETL job that reads from an S3 bucket and writes to an Amazon Redshift table. The job logs show a permission error. Which IAM policy change would resolve the issue?

Accepted Answer

Add redshift:DataAPI access to the Glue job's IAM role. The Glue job's IAM role needs the redshift:DataAPI permission to write to the Redshift table via the Data API. Option A is irrelevant because enabling encryption on the S3 bucket does not resolve permission errors related to Redshift. Option B is incorrect because s3:GetObject is needed for reading from S3, but the error is about writing to Redshift, not reading. Option D is incorrect because attaching an IAM role to the Redshift cluster grants permissions to the cluster itself, not to the Glue job's role; the Glue job's role must have the redshift:DataAPI permission directly.

Answer

Enable encryption on the S3 bucket using AWS KMS

Answer

Add s3:GetObject permission to the Glue job's IAM role

Answer

Attach an IAM role with redshift:GetClusterCredentials to the Redshift cluster

Question 9

A data engineer is setting up Amazon CloudWatch alarms for an Amazon Redshift cluster. The engineer wants to be alerted when the disk space usage exceeds 80% for more than 5 minutes and when the CPU utilization exceeds 90% for more than 10 minutes. Which TWO CloudWatch metrics and conditions should the engineer use? (Choose two.)

Accepted Answer

Metric: CPUUtilization; Condition: > 90 for 10 minutes. The correct metrics and conditions are: for disk space usage exceeding 80% for more than 5 minutes, use PercentageDiskSpace with a threshold of 80 and a period of 5 minutes; for CPU utilization exceeding 90% for more than 10 minutes, use CPUUtilization with a threshold of 90 and a period of 10 minutes. These correspond to options A and E. Option B (DatabaseConnections) monitors connections, not disk or CPU. Option C (NetworkReceiveThroughput) measures network traffic. Option D (WLMQueueLength) tracks query queue length, not disk or CPU.

Answer

Metric: DatabaseConnections; Condition: > 500 for 5 minutes

Answer

Metric: NetworkReceiveThroughput; Condition: > 1 GB for 10 minutes

Answer

Metric: WLMQueueLength; Condition: > 100 for 5 minutes

Question 10

A company uses AWS Glue DataBrew to clean and normalize data. The data contains sensitive columns that must be masked before being written to the output. Which DataBrew action should be applied?

Accepted Answer

Apply a Mask transform to the sensitive columns.. DataBrew provides a built-in 'Mask' transform that obfuscates sensitive data by applying masking patterns. Option A is incorrect because the Hash transform produces a hash value, which is not true masking as it can be reversed via brute force. Option B is incorrect because Encrypt is not a DataBrew transform; encryption is handled at the storage layer (e.g., S3 SSE). Option C is incorrect because Delete removes the column entirely, which may not be desired if the column is needed for analysis but just needs sensitive data hidden.

Answer

Apply a Hash transform to the sensitive columns.

Answer

Apply an Encrypt transform to the sensitive columns.

Answer

Apply a Delete transform to remove the sensitive columns.