DEA-C01 Mock Exam 91 — 25 Questions

Question 1

A company uses Amazon Redshift for analytics. The data engineer notices that some queries are slow and the EXPLAIN plan shows a 'Seq Scan' on a large table. Which data store management action would most likely improve query performance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Define appropriate sort keys and distribution styles.. A Seq Scan indicates that Redshift is scanning the entire table because it lacks efficient data organization. Defining appropriate sort keys and distribution styles organizes data on disk and across nodes, enabling Redshift to use zone maps to skip large portions of data and to execute parallel, co-located joins, which directly reduces the need for full table scans.

Answer

Run the ANALYZE command to update table statistics.

Answer

Enable automatic compression on the table.

Answer

Run the VACUUM command to reclaim space.

Question 2

A data engineer needs to ingest log files from multiple EC2 instances into Amazon S3. The logs are written to local disk on each instance. The engineer wants a simple agent-based solution that can collect, compress, and upload logs to S3 with minimal configuration. The solution must support incremental uploads (only new log lines) and handle log rotation. What should the engineer use?

Accepted Answer

Install and configure Amazon CloudWatch Agent to collect logs and send them to Amazon CloudWatch Logs, then use a subscription filter to export logs to S3.. Amazon CloudWatch Agent is a lightweight agent that can tail log files, compress them on the fly, and send them to CloudWatch Logs. From CloudWatch Logs, a subscription filter can export the logs to Amazon S3, supporting incremental uploads and log rotation. Option B (AWS CLI cp) is manual and does not handle incremental uploads efficiently. Option C (AWS DataSync) is designed for bulk data transfers, not real-time log ingestion. Option D (S3 sync) is also not real-time and lacks agent-based tailing and compression.

Answer

Use AWS CLI cp command with --recursive in a cron job to copy logs to S3 every minute.

Answer

Install AWS DataSync agent on each EC2 instance to sync logs to S3 daily.

Answer

Use an S3 sync command from the AWS CLI scheduled every hour.

Question 3

Refer to the exhibit. A data engineer queries AWS CloudTrail to investigate a PutObject event. What does the exhibit reveal about the object sensitive.csv?

Accepted Answer

The object was uploaded with server-side encryption using AWS KMS.. The CloudTrail event contains `x-amz-server-side-encryption: aws:kms`, which confirms the object was uploaded with server-side encryption using AWS KMS (SSE-KMS). Option A is incorrect because the event shows a successful upload, not a failure. Option C is incorrect because the event indicates encryption was applied. Option D is incorrect because SSE-S3 would show `AES256`, not `aws:kms`.

Answer

The upload failed due to encryption mismatch.

Answer

The object was not encrypted at rest.

Answer

The object was encrypted with SSE-S3.

Question 4

A data engineer is configuring an S3 bucket for storing sensitive customer data. The bucket must be encrypted at rest using an AWS Key Management Service (KMS) key that is managed by the data engineering team. The team wants to ensure that only users with explicit permission can decrypt the data. Which S3 encryption option should be used?

Accepted Answer

SSE-KMS. SSE-KMS is the correct option because it uses a customer-managed AWS KMS key, allowing the data engineering team to control access and permissions for decryption. Client-side encryption is not an S3 server-side encryption option and does not use KMS. SSE-S3 uses Amazon S3-managed keys, which do not provide customer-controlled access. SSE-C requires the customer to manage their own encryption keys and does not use KMS, nor does it allow the same level of access control as a CMK.

Answer

Client-side encryption

Answer

SSE-S3

Answer

SSE-C

Question 5

A data engineer is designing a data lake on S3 with sensitive data. The security policy mandates that data must be encrypted at rest and in transit, and that an inventory of all objects must be maintained for compliance. Which actions should be taken?

Accepted Answer

Enforce HTTPS via bucket policy, enable default SSE-S3 encryption, and enable S3 Inventory.. It covers all requirements: encryption in transit (HTTPS enforcement via bucket policy), encryption at rest (default SSE-S3), and compliance inventory (S3 Inventory). Option B uses SSE-KMS which is not required and lacks inventory. Option C includes at-rest encryption and inventory but misses in-transit encryption. Option D includes in-transit encryption but lacks at-rest encryption and compliance inventory.

Answer

Use SSE-KMS encryption and enable CloudTrail for S3 events.

Answer

Enable S3 default encryption using SSE-S3 and enable S3 Inventory.

Answer

Enforce HTTPS using bucket policy and enable S3 Server Access Logging.

Question 6

A company is using Amazon RDS for MySQL with Multi-AZ deployment. The primary DB instance experiences a hardware failure, causing automatic failover to the standby. After the failover, the application reports that the database endpoint is unreachable for about 60 seconds. What is the MOST likely cause?

Accepted Answer

The DNS record for the DB instance endpoint needed to update to point to the new primary.. After an automatic failover in Amazon RDS Multi-AZ, the DNS record for the DB instance endpoint is updated to point to the new primary. This DNS change can take up to 60 seconds to propagate, during which the application may receive 'unreachable' errors if it caches the old DNS resolution. The 60-second outage aligns with the typical TTL (Time To Live) of 30 seconds for RDS DNS records plus propagation delays.

Answer

The standby instance took longer than expected to promote to primary.

Answer

The standby instance was not in a synchronized state and required a manual promotion.

Answer

The application was using the wrong endpoint and needed to be reconfigured.

Question 7

A company uses Amazon Kinesis Data Firehose to deliver data to Amazon S3. The Firehose delivery stream has a buffer size of 64 MB and a buffer interval of 300 seconds. The data volume is 1 GB per minute, and the average record size is 1 KB. The data must be delivered to S3 within 5 minutes of ingestion. The engineer notices that some files are being delivered after 10 minutes. What is the most likely cause?

Accepted Answer

The S3 bucket is throttling PUT requests due to high throughput. Amazon S3 buckets have a default limit of 3,500 PUT requests per second per prefix. With a data volume of 1 GB per minute and an average record size of 1 KB, Firehose generates approximately 1,000,000 records per minute, resulting in roughly 16,667 PUT requests per second (since each 64 MB buffer yields about 65,536 records, and 1 GB/min ÷ 64 MB = ~15.6 buffers per minute, each requiring a PUT). This far exceeds the S3 PUT request limit, causing throttling (HTTP 503 Slow Down errors) and delivery delays beyond the 5-minute target.

Answer

The buffer size of 64 MB is too small for the data volume

Answer

The data is not compressed, causing larger file sizes

Answer

The buffer interval of 300 seconds is too long

Question 8

A data engineer is designing a data lake on Amazon S3. The data is ingested from multiple sources and stored in a partitioned structure under the 'landing' prefix. The engineer needs to ensure that only authorized applications can write to the 'landing' zone, while all AWS accounts in the organization can read the data. Which combination of S3 bucket policies and IAM policies should be used?

Accepted Answer

Create a bucket policy with a Deny for all principals except the authorized IAM roles on the 'landing' prefix. Add a separate statement allowing read access to the organization.. It uses a bucket policy with an explicit Deny on the 'landing' prefix for all principals except the authorized IAM roles, ensuring only those roles can write. A separate Allow statement grants read access to the entire organization (e.g., via the `aws:PrincipalOrgID` condition key), which satisfies the requirement that all AWS accounts in the organization can read the data. This approach leverages S3 bucket policies for cross-account access control without relying on ACLs or IAM policies alone.

Answer

Use bucket ACLs to grant write access to the authorized IAM roles and read access to all authenticated users.

Answer

Use S3 Object Ownership to enforce bucket owner enforced. Grant write access via IAM roles.

Answer

Create an IAM policy that allows s3:PutObject only for the 'landing' prefix and attach it to the authorized roles. Allow read access via an S3 Access Point.

Question 9

A data engineer needs to ingest streaming data from an IoT fleet into Amazon S3 for near-real-time analytics. The data volume is approximately 5 GB per hour, and each event is less than 1 KB. Which AWS service should be used as the ingestion endpoint?

Accepted Answer

AWS IoT Core. AWS IoT Core is purpose-built for ingesting data from IoT devices, supporting MQTT, HTTP, and WebSocket protocols. It can handle millions of devices and high-throughput, small-message payloads (each event <1 KB) and integrates directly with Amazon S3 via IoT Core rules, making it the ideal ingestion endpoint for near-real-time analytics on streaming IoT data.

Answer

AWS DataSync

Answer

Amazon AppFlow

Answer

Amazon Kinesis Data Streams

Question 10

A company needs to ingest data from multiple SaaS applications (Salesforce, Marketo) and load it into Amazon Redshift. The data must be transformed before loading. Which AWS service should be used to build the ingestion pipelines?

Accepted Answer

AWS Glue (crawlers and ETL jobs). AWS Glue is the correct choice because it provides a fully managed ETL service that can connect to various data sources (including SaaS applications via JDBC or custom connectors), transform the data using Apache Spark or Python scripts, and load it into Amazon Redshift. Glue crawlers can catalog the source schemas, and Glue ETL jobs handle the transformation logic required before loading into Redshift, making it ideal for building ingestion pipelines from multiple SaaS sources.

Answer

AWS Database Migration Service (DMS)

Answer

AWS Data Pipeline

Answer

Amazon AppFlow

Question 11

A data engineer needs to store large amounts of data that is accessed infrequently but must be retrieved immediately when needed. Which Amazon S3 storage class is most cost-effective?

Accepted Answer

S3 Standard-IA. S3 Standard-IA (Infrequent Access) is the most cost-effective choice because it offers low per-GB storage costs for data accessed infrequently, while still providing millisecond retrieval latency for immediate access when needed. This matches the requirement of storing large amounts of data that is rarely accessed but must be available instantly.

Answer

S3 Intelligent-Tiering

Answer

S3 One Zone-IA

Answer

S3 Glacier Deep Archive

Question 12

A company runs a data pipeline that ingests streaming data from an IoT fleet into Amazon Kinesis Data Streams (KDS) with 50 shards. A Lambda function processes records from the stream and writes them to an Amazon DynamoDB table for real-time analytics. The Lambda function is configured with a batch size of 100 and a maximum batching window of 60 seconds. Recently, the company has been seeing an increasing number of 'WriteProvisionedThroughputExceededException' errors from DynamoDB, causing Lambda to retry and eventually send records to a dead-letter queue (DLQ). The DynamoDB table is provisioned with 5000 read capacity units (RCU) and 5000 write capacity units (WCU). The average item size is 1 KB. The KDS stream receives an average of 8000 records per second, each 2 KB in size. The Lambda function performs a simple transformation and writes each record individually to DynamoDB. The company wants to reduce the throttling errors without increasing the DynamoDB WCU provision. Which course of action is most likely to achieve this?

Accepted Answer

Increase the Lambda batch size to 500 and reduce the batching window to 30 seconds.. Increasing the Lambda batch size to 500 reduces the number of Lambda invocations per second from approximately 80 to 16, and reducing the batching window to 30 seconds helps spread writes more evenly across time. This lowers the concurrency of write operations to DynamoDB, which can reduce the frequency of 'WriteProvisionedThroughputExceededException' errors by staying within the provisioned 5000 WCU more consistently, even though the total write capacity required (16000 WCU) exceeds provisioned. Options A and B do not reduce the write load—batching writes (A) still consumes the same WCU, and increasing concurrency (B) worsens throttling. Option C is irrelevant as timeout does not affect write rate.

Answer

Modify the Lambda function to use DynamoDB BatchWriteItem to write records in batches of 25.

Answer

Increase the Lambda function's reserved concurrency to 1000.

Answer

Increase the Lambda function timeout to 5 minutes to allow more time for retries.

Question 13

A data engineer is designing a disaster recovery plan for an Amazon RDS for MySQL database. The database must have a Recovery Point Objective (RPO) of less than 5 minutes and a Recovery Time Objective (RTO) of less than 30 minutes. Which TWO actions should the engineer take to meet these requirements?

Accepted Answer

Enable automated backups with a 1-day retention period and point-in-time recovery.. Options A and B are correct. Multi-AZ deployment (B) provides automatic failover to a standby in a different Availability Zone, meeting the RTO of less than 30 minutes. Automated backups with point-in-time recovery (A) allow recovery to any point within the retention period, enabling an RPO of less than 5 minutes. Option C is wrong because automated backups have a minimum retention of 1 day; you cannot set a 5-minute retention. Option D is wrong because a cross-Region read replica requires manual promotion and does not provide automatic failover, resulting in higher RTO. Option E is wrong because a single-AZ instance without Multi-AZ does not provide automatic failover, leading to RTO exceeding 30 minutes.

Answer

Enable automated backups with a 5-minute retention period.

Answer

Create a cross-Region read replica.

Answer

Use a single-AZ instance with a standby in another Region.

Question 14

Which THREE considerations are important when designing a DynamoDB table for high-traffic gaming leaderboards? (Choose three.)

Accepted Answer

Enable DynamoDB Accelerator (DAX) for low-latency reads. DynamoDB Accelerator (DAX) provides in-memory caching for DynamoDB tables, reducing read latency from single-digit milliseconds to microseconds. For high-traffic gaming leaderboards, where millions of players query scores concurrently, DAX offloads read traffic from the main table, preventing throttling and ensuring consistent low-latency responses for the most frequently accessed data.

Answer

Use strongly consistent reads for all queries

Answer

Enable DynamoDB Streams for real-time updates

Question 15

A company uses AWS Database Migration Service (DMS) to continuously replicate data from an on-premises Oracle database to Amazon S3. The data is stored as CSV files. The downstream team requires the data to be in Apache Parquet format. Which change should the data engineer make to the DMS task?

Accepted Answer

Modify the DMS task to use Apache Parquet as the target table preparation mode.. AWS DMS supports specifying Apache Parquet as the target data format for Amazon S3 targets directly within the task configuration. By setting the 'Data format' to 'Parquet' in the S3 target endpoint or task settings, DMS automatically converts the replicated data into Parquet files, eliminating the need for post-processing. This is the most efficient and native approach to meet the downstream team's requirement.

Answer

Add an S3 lifecycle rule to convert CSV to Parquet.

Answer

Change the DMS task to use full load instead of continuous replication.

Answer

Configure a Lambda function to transform data after DMS writes to S3.

Question 16

A company is streaming IoT data from thousands of devices into Amazon Kinesis Data Streams. The data must be transformed in real time before being stored in Amazon S3. Which service should be used to perform the transformation as the data streams through Kinesis?

Accepted Answer

Amazon Kinesis Data Analytics for Apache Flink. Amazon Kinesis Data Analytics for Apache Flink is the correct choice because it is purpose-built for running Apache Flink applications that can perform real-time transformations, filtering, and enrichment on data streaming through Kinesis Data Streams before outputting the results to destinations like Amazon S3. It integrates natively with Kinesis Data Streams as a source and can write transformed data directly to S3 using a Flink sink, making it ideal for this streaming ETL use case.

Answer

AWS Glue

Answer

Amazon EMR

Answer

AWS Lambda

Question 17

Which TWO AWS services can be used as sources for AWS Glue ETL jobs? (Choose two.)

Accepted Answer

Amazon S3. Amazon S3 is a fully managed object storage service that serves as a common source for AWS Glue ETL jobs. Glue can read data from S3 using its built-in crawlers and connectors, supporting formats like Parquet, JSON, CSV, and Avro. The Glue Data Catalog can reference S3 locations, and ETL scripts can directly read from S3 buckets via the s3:// protocol.

Answer

Amazon Route 53

Answer

Amazon CloudFront

Answer

Amazon API Gateway

Question 18

A company uses Kinesis Data Firehose with a Lambda function for data transformation. The transformation is failing intermittently due to Lambda timeouts. The maximum record size is 1 MB. What is the most cost-effective way to reduce failures without losing data?

Accepted Answer

Increase the Lambda function timeout and memory allocation. The most cost-effective way to reduce failures from Lambda timeouts without losing data is to increase the Lambda function's timeout and memory allocation (Option D). Lambda timeouts occur when the transformation takes longer than the allocated timeout. Increasing memory also increases CPU, which can speed up processing and reduce timeouts. This approach is cost-effective because you only pay for the increased resources when the function runs, and it avoids data loss since all records are still transformed. Option A (Kinesis Data Analytics) adds unnecessary complexity and cost. Option B (decreasing batch size) reduces the number of records per invocation, which can help but may increase costs because more invocations are needed; also, it doesn't directly address timeouts. Option C (sending failed records to an S3 dead-letter bucket) would result in data loss for those records, as they are not transformed, and the question says 'without losing data'. Thus, D is the best choice.

Answer

Use Kinesis Data Analytics to pre-process data before Firehose

Answer

Decrease the Firehose batch size to reduce the number of records per invocation

Answer

Configure the Firehose delivery stream to send failed records to an S3 dead-letter bucket

Question 19

A media company stores video files in an Amazon S3 bucket with S3 Standard storage class. The files are accessed frequently for the first 30 days, then rarely after that. However, the company must be able to restore any deleted file within 7 days. The company wants to minimize storage costs while meeting the access and retention requirements. What should a data engineer do?

Accepted Answer

Use S3 Intelligent-Tiering and enable S3 Versioning on the bucket.. S3 Intelligent-Tiering automatically moves objects between access tiers (frequent, infrequent, and archive instant access) based on changing access patterns, which minimizes storage costs for data with unknown or changing access patterns. Enabling S3 Versioning allows the company to restore any deleted file within 7 days by reverting to a previous version, meeting the retention requirement without additional cost for a separate backup.

Answer

Use S3 Standard-IA storage class from the start.

Answer

Use a lifecycle policy to transition objects to S3 One Zone-IA after 30 days.

Answer

Use S3 Glacier Deep Archive after 30 days and enable S3 Object Lock for retention.

Question 20

A data engineer needs to ingest data from an Amazon S3 bucket into an Amazon Redshift table on a daily schedule. The data is in CSV format and the schema matches. Which service is simplest for this batch ingestion?

Accepted Answer

Amazon Redshift COPY command. The Amazon Redshift COPY command is the simplest and most efficient method for batch loading data from Amazon S3 into Redshift when the schema matches and the data is in CSV format. It leverages Redshift's massively parallel processing (MPP) architecture to read data directly from S3, automatically handling compression, encryption, and error logging without requiring any intermediate services or custom code.

Answer

AWS Glue ETL job with JDBC connection

Answer

AWS Data Pipeline

Answer

Amazon Athena CREATE TABLE AS SELECT