DEA-C01 Mock Exam 92 — 25 Questions

Question 1

A data engineer is configuring an S3 bucket policy to allow cross-account access for a partner account to read objects. The bucket is encrypted with SSE-KMS using a customer-managed key. What additional configuration is needed to allow the partner account to decrypt the objects?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Update the KMS key policy to grant the partner account kms:Decrypt permission. For cross-account access with SSE-KMS, the KMS key policy must grant the partner account access to use the key. The bucket policy alone is insufficient. The partner account does not need VPC endpoints, and the bucket policy for decryption is not needed. The partner account does not need access to the S3 bucket's encryption configuration.

Answer

Add a bucket policy that grants the partner account s3:GetObject

Answer

Create a VPC endpoint for S3 and add it to the bucket policy

Answer

Add a bucket policy that grants s3:GetObject and s3:GetEncryptionConfiguration

Question 2

A data engineer is investigating a failed AWS Glue job. The engineer runs the CLI command shown in the exhibit to retrieve the latest log stream. The output shows storedBytes: 0. What does this indicate?

Accepted Answer

The Glue job failed before writing any log events to CloudWatch.. StoredBytes: 0 means no log events were stored, likely because the job failed before writing any logs or logging was not enabled. Option A is wrong because logs are not expired; they were never written. Option B is wrong because the stream exists. Option D is wrong because the command retrieved the latest stream.

Answer

The log stream is from a different Glue job.

Answer

The log stream is empty because the job is still running.

Answer

The log stream has been expired and deleted.

Question 3

A data engineer is troubleshooting a slow AWS Glue ETL job that reads from Amazon S3 and writes to Amazon Redshift. The job processes 10 GB of CSV data. The engineer notices that the job runs with a single DPU and takes longer than expected. Which change would MOST likely improve performance?

Accepted Answer

Increase the number of DPUs and configure the job to use the S3 list implementation for parallel reads.. The job runs with a single DPU, which limits parallelism. Increasing the number of DPUs allows the job to process data in parallel across multiple workers. Additionally, configuring the S3 list implementation enables the job to list objects in parallel, reducing the overhead of discovering input files. This combination directly addresses the bottleneck of a single-threaded read from S3.

Answer

Replace Redshift with Amazon Redshift Spectrum.

Answer

Change the input format to Parquet and enable predicate pushdown.

Answer

Use a JDBC connection to read data directly from S3.

Question 4

Refer to the exhibit. A data engineer runs the commands shown. What can be determined about the key with ID 1234abcd-12ab-34cd-56ef-1234567890ab?

Accepted Answer

It is an AWS managed key.. The command output shows that the key's KeyManager is 'AWS', indicating it is an AWS managed key, which corresponds to option D. Option A is incorrect because the key state is 'Enabled', not 'PendingDeletion'. Option B is incorrect because the ARN does not specify a region; the key was created in us-east-1 by default. Option C is incorrect because AWS managed keys have KeyManager set to 'AWS', not 'CUSTOMER'.

Answer

It is pending deletion.

Answer

It was created in us-west-2.

Answer

It is a customer managed key.

Question 5

Which TWO statements are true about Amazon Redshift distribution styles? (Choose TWO.)

Accepted Answer

ALL distribution copies the entire table to every node.. The ALL distribution style in Amazon Redshift copies the entire table to every node in the cluster. This is ideal for small, slowly changing dimension tables (like date or location tables) that need to be joined with large fact tables, as it eliminates the need to redistribute data across nodes during query execution.

Answer

KEY distribution is always the best choice to minimize data skew.

Answer

AUTO distribution always selects EVEN distribution.

Answer

Redshift automatically assigns a ROUND ROBIN distribution style by default.

Question 6

A company runs an Amazon Redshift cluster with 10 RA3 nodes. The data warehouse stores 50 TB of data. The company notices that queries are slow and the cluster's storage utilization is high. The data engineer needs to improve query performance and reduce storage costs without changing the cluster's node count. Which action should the engineer take?

Accepted Answer

Use Redshift Spectrum to offload historical data to Amazon S3 and query it in place.. Redshift Spectrum allows you to query data directly from Amazon S3 without loading it into the cluster. By offloading historical or less-frequently accessed data to S3, you reduce the storage utilization on the RA3 nodes, which frees up managed storage and can improve query performance. This approach also lowers storage costs because S3 is cheaper than Redshift managed storage, and it does not change the node count.

Answer

Change the distribution style of large tables to DISTSTYLE ALL.

Answer

Migrate the cluster to Dense Compute node types.

Answer

Enable concurrency scaling to handle more concurrent queries.

Question 7

A startup is building a data pipeline to ingest user activity logs from a mobile app. The logs are sent in real-time via HTTP POST requests. The data volume is low (a few hundred requests per second) but can spike to a few thousand during promotions. The team wants to store the logs in Amazon S3 for analysis. They also need to be able to query the data using Amazon Athena with minimal latency. The data must be transformed from JSON to Parquet and partitioned by date. The team is considering using Amazon API Gateway with AWS Lambda to receive the logs and write to S3. However, they are concerned about Lambda cold starts and the complexity of handling spikes. Which alternative solution should they choose?

Accepted Answer

Use Amazon Kinesis Data Firehose with a HTTP endpoint as source, enable Parquet conversion, and deliver to S3 with dynamic partitioning. Amazon Kinesis Data Firehose is the best choice because it can directly receive HTTP POST requests (via its HTTP endpoint or integrated with API Gateway), automatically buffer incoming data, convert JSON to Parquet, and deliver to S3 with dynamic partitioning by date. This handles traffic spikes without custom code or Lambda cold starts, meeting all requirements with minimal operational overhead. Option A (API Gateway + Lambda → SQS → Lambda) adds complexity and still involves Lambda cold starts. Option C (Kinesis Data Streams + Lambda) also requires Lambda and cold start management. Option D (EMR Spark Streaming) is overkill for this low-volume use case.

Answer

Use Amazon API Gateway with AWS Lambda that sends logs to Amazon SQS, then a separate Lambda reads from SQS and writes to S3

Answer

Use Amazon Kinesis Data Streams with AWS Lambda to process and write to S3

Answer

Use Amazon EMR with Spark Streaming to ingest logs from a custom endpoint

Question 8

A company stores its application logs in Amazon S3. The logs are generated daily and need to be retained for 3 years for compliance. The logs are accessed frequently for the first 30 days, occasionally for the next 6 months, and rarely after that. The data engineering team wants to minimize storage costs while ensuring that logs are available for retrieval within 12 hours for the first 6 months and within 48 hours after that. The team also wants to automatically delete logs after 3 years. Which lifecycle policy should the team implement?

Accepted Answer

Transition to S3 Standard-IA after 30 days, to S3 Glacier Deep Archive after 6 months, delete after 3 years.. It aligns with the access patterns and retrieval requirements: S3 Standard-IA after 30 days for occasional access with immediate retrieval, then S3 Glacier Deep Archive after 6 months for rare access with a 12-hour retrieval time (via expedited or standard retrieval), and deletion after 3 years. This minimizes storage costs while meeting the 48-hour retrieval window for older logs.

Answer

Transition to S3 One Zone-IA after 30 days, delete after 6 months.

Answer

Transition to S3 Standard-IA after 30 days, delete after 3 years.

Answer

Transition to S3 Standard-IA after 30 days, to S3 Glacier after 6 months, delete after 3 years.

Question 9

Refer to the exhibit. A data engineer is running an AWS Glue job that reads data from an S3 source. The job fails with the error shown. What is the MOST likely cause?

Accepted Answer

One of the source files is empty or corrupted.. The error message indicates that the Glue job encountered a 'NullPointerException' or similar parsing failure when reading from S3. This typically occurs when a source file is empty or corrupted, causing the Spark DataFrame reader to fail during schema inference or data parsing. AWS Glue jobs rely on Spark's ability to read files; an empty or malformed file triggers a runtime error because Spark cannot extract any records or infer a valid schema from it.

Answer

The IAM role does not have s3:GetObject permission.

Answer

The file is in JSON format but the schema expects Parquet.

Answer

The Glue job has insufficient memory allocated.

Question 10

A data engineer is troubleshooting a nightly AWS Glue ETL job that reads from an Amazon RDS for MySQL table and writes to an Amazon S3 bucket in Parquet format. The job runs successfully most days, but occasionally fails with the error 'ERROR: An error occurred while calling o67.pyWriteDynamicFrame. The transaction log for the database is full due to 'LOG_BACKUP'.' What is the MOST likely cause of this error?

Accepted Answer

The MySQL database transaction log needs to be backed up to free space.. The error message 'The transaction log for the database is full due to 'LOG_BACKUP'' indicates that the MySQL database's transaction log has reached its maximum size because it has not been backed up and truncated. In MySQL, the transaction log (often the InnoDB redo log or binary log) must be backed up periodically to free space; otherwise, write operations fail. This is a database-side issue, not a Glue or permissions problem, so the correct action is to back up the transaction log to release space.

Answer

The MySQL database has reached its maximum number of concurrent connections.

Answer

The AWS Glue job does not have sufficient permissions to write to the S3 bucket.

Answer

The AWS Glue job is configured with an incorrect 'writeDynamicFrame' method.

Question 11

An IAM policy is attached to a role assumed by authenticated users via Amazon Cognito. What does this policy allow?

Accepted Answer

Users can read items in the Orders table only if the partition key matches their Cognito identity ID.. The policy uses a condition key like `dynamodb:LeadingKeys` with a value referencing `${cognito-identity.amazonaws.com:sub}`. This restricts DynamoDB actions to items where the partition key matches the user's Cognito identity ID, ensuring fine-grained access control. Option D correctly states that users can read items only when the partition key equals their identity ID, which is the intended behavior for row-level security.

Answer

Users can read and write items in the Orders table where the partition key matches their Cognito identity ID.

Answer

Users can read any item in the Orders table using GetItem and Query.

Answer

Users can scan the entire Orders table but only if they use a filter expression.

Question 12

A data engineer is designing a data lake on Amazon S3. The data is partitioned by year, month, day, and hour. The engineer needs to ensure that queries using Amazon Athena are cost-effective and performant. The data is written in Parquet format, and the total volume is 50 TB. Which approach minimizes query costs?

Accepted Answer

Partition the data by year, month, day, and hour. Partitioning by year, month, day, and hour allows Athena to use partition pruning, reading only the relevant S3 prefixes instead of scanning the entire 50 TB dataset. This drastically reduces the amount of data scanned per query, which directly lowers query costs (Athena charges per TB scanned). The existing Parquet format further optimizes performance through columnar storage and compression.

Answer

Use AWS Glue Data Catalog to catalog the data

Answer

Convert data to CSV format

Answer

Use S3 Intelligent-Tiering storage class

Question 13

A data engineer needs to store semi-structured JSON logs from multiple microservices in a cost-effective manner for later analysis using Amazon Athena. The logs are generated continuously, and the total volume is about 1 TB per day. The data must be queryable within minutes of arrival. Which storage solution is most appropriate?

Accepted Answer

Amazon S3 bucket with partitioned folders. Amazon S3 with partitioned folders is the most appropriate solution because it provides a cost-effective, scalable storage layer for semi-structured JSON logs, and integrates natively with Amazon Athena for serverless querying. By partitioning the data by time (e.g., year/month/day/hour), Athena can use partition pruning to minimize scanned data, enabling queries within minutes of arrival. S3's low cost per GB and lifecycle policies further optimize storage for the 1 TB/day volume.

Answer

Amazon DynamoDB table with JSON attribute

Answer

Amazon RDS for PostgreSQL table with JSON column

Answer

Amazon Redshift cluster with JSON ingestion

Question 14

A company uses Amazon S3 to store historical financial records. A compliance policy requires that all objects be encrypted with a customer-managed key stored in AWS KMS. The bucket is already configured with SSE-S3. What is the LEAST disruptive way to change the encryption to SSE-KMS?

Accepted Answer

Copy all objects to a new bucket that has default encryption set to SSE-KMS.. Changing the default encryption settings of an existing bucket (SSE-S3 to SSE-KMS) does not retroactively encrypt objects that were already stored with SSE-S3. Copying all objects to a new bucket that has default encryption set to SSE-KMS ensures every object is encrypted with a customer-managed key, as the copy operation re-encrypts each object using the new bucket's default settings. This approach is the least disruptive because it avoids modifying the original bucket's configuration or policies, which could break existing applications or access patterns.

Answer

Add a bucket policy to enforce SSE-KMS.

Answer

Update the bucket's default encryption settings to SSE-KMS.

Answer

Use S3 Batch Operations to apply SSE-KMS to all existing objects.

Question 15

Refer to the exhibit. A data engineer sees this output from the AWS CLI for a failed Glue job. The job uses 10 workers of Standard type. What is the MOST appropriate action to resolve the OutOfMemoryError?

Accepted Answer

Change WorkerType to G.1X. The OutOfMemoryError occurs because each Standard worker has a memory limit of 4 GB. Increasing MaxCapacity to 20 does not increase memory per worker when NumberOfWorkers is explicitly set; it only increases the total DPU allocation but the job still uses 10 workers each with 1 DPU. The correct solution is to change the worker type to G.1X, which provides 2 DPUs (8 GB memory) per worker, effectively doubling the memory per worker and resolving the error. Option A (increase workers) adds parallelism but does not increase per-worker memory. Option B (reduce workers) decreases parallelism and may aggravate memory pressure. Option D (increase MaxCapacity) is ineffective when NumberOfWorkers is fixed.

Answer

Increase NumberOfWorkers to 20

Answer

Reduce NumberOfWorkers to 5

Answer

Increase MaxCapacity to 20

Question 16

Arrange the steps to set up a streaming ETL pipeline using Amazon Kinesis Data Firehose to Amazon S3.

Accepted Answer

1. Create a Kinesis Data Firehose stream
2. Configure the data source
3. Set the S3 destination
4. Enable optional Lambda transformation
5. Test the pipeline. First, create the Firehose stream, configure source, set S3 destination, enable optional Lambda transformation, and test.

Answer

1. Configure the data source
2. Create a Kinesis Data Firehose stream
3. Enable optional Lambda transformation
4. Set the S3 destination
5. Test the pipeline

Answer

1. Create a Kinesis Data Firehose stream
2. Set the S3 destination
3. Configure the data source
4. Enable optional Lambda transformation
5. Test the pipeline

Answer

1. Configure the data source
2. Set the S3 destination
3. Create a Kinesis Data Firehose stream
4. Enable optional Lambda transformation
5. Test the pipeline

Question 17

A data engineer is designing a data lake on Amazon S3 with sensitive data. The engineer needs to ensure that data at rest is encrypted and that access is logged for compliance. Which TWO actions should the engineer take? (Choose TWO.)

Accepted Answer

Enable CloudTrail data events for S3 object-level operations.. Enabling CloudTrail data events for S3 object-level operations captures detailed logs of all read, write, and delete actions on objects, which is essential for compliance auditing. Option D is correct because enabling default encryption on the S3 bucket using SSE-KMS ensures that all objects stored in the bucket are encrypted at rest with AWS Key Management Service (KMS) keys, providing centralized control and auditability of encryption keys.

Answer

Enable S3 Select to filter data at read time.

Answer

Enable S3 Transfer Acceleration.

Answer

Enable S3 Block Public Access on the account.

Question 18

Refer to the exhibit. A data engineer has attached this bucket policy to an S3 bucket. What is the effect of this policy?

Accepted Answer

It allows the DataLakeRole to read and write objects, but only over HTTPS.. The bucket policy uses a condition key `aws:SecureTransport` set to `true`, which restricts access to HTTPS (TLS) connections only. The `Principal` is `DataLakeRole`, and the `Action` includes `s3:GetObject` and `s3:PutObject`, so the policy allows that role to read and write objects exclusively over HTTPS, enforcing encrypted data in transit.

Answer

It enforces server-side encryption for all objects written to the bucket.

Answer

It allows anonymous access to the bucket for HTTPS requests.

Answer

It denies all access to the bucket except for requests from the DataLakeRole.

Question 19

A company runs a nightly batch processing pipeline using AWS Glue ETL jobs. The pipeline reads data from an Amazon S3 bucket, transforms it, and writes results to an Amazon Redshift cluster. Recently, the data volume has increased significantly, and some Glue jobs are failing with the error 'java.lang.OutOfMemoryError: Java heap space'. The data engineer needs to modify the job configuration to prevent these failures without changing the code. The job currently uses 10 DPUs and processes data in a single Spark DataFrame. Which of the following is the MOST effective solution?

Accepted Answer

Increase the number of DPUs to 20 and enable job bookmarking for incremental processing.. Increasing DPUs from 10 to 20 provides more memory and compute resources, directly addressing the 'java.lang.OutOfMemoryError: Java heap space' caused by insufficient memory for the single DataFrame. Enabling job bookmarking allows incremental processing, which reduces the volume of data processed per run, further mitigating memory pressure without code changes.

Answer

Reduce the number of DPUs to 5 and increase the Spark executor memory by setting 'spark.executor.memory' in job parameters.

Answer

Change the script to use DynamicFrame instead of DataFrame and disable the 'spark.sql.shuffle.partitions' configuration.

Answer

Add a 'coalesce(1)' operation before writing to Redshift to reduce the number of output files.

Question 20

A company uses Amazon Kinesis Data Firehose to ingest JSON logs from multiple sources into an S3 data lake. The data is then consumed by Amazon Athena for analysis. Recently, some queries have been failing with the error 'HIVE_BAD_DATA: Field xyz's type is an unsupported type'. The firehose delivery stream transforms the data using a Lambda function that converts timestamps to Unix epoch. What is the MOST likely cause of the query failure?

Accepted Answer

Some records contain timestamps that were not converted to epoch, so Athena infers the column as a string.. The error 'HIVE_BAD_DATA: Field xyz's type is an unsupported type' occurs when Athena's schema inference encounters inconsistent data types for the same column. Since the Lambda function converts timestamps to Unix epoch, but some records may have failed conversion (e.g., due to malformed input or Lambda errors), those records retain the original string timestamp. Athena then sees a mix of numeric epoch values and string timestamps, causing it to infer the column as a string type, which is unsupported for the expected numeric operations in the query.

Answer

The data is in JSON format instead of Parquet.

Answer

The S3 partitions are not registered in the Glue Data Catalog.

Answer

The IAM role for Firehose does not have permission to write to S3.