DEA-C01 Mock Exam 93 — 25 Questions

Question 1

A company is using AWS Glue to run ETL jobs that write data to an Amazon S3 data lake. The jobs are failing with '503 Slow Down' errors. The data engineering team has already implemented retries. What is the BEST long-term solution?

Accepted Answer

Implement a backoff strategy to reduce the request rate.. The '503 Slow Down' error from Amazon S3 indicates that the request rate is too high and S3 is throttling the requests. The best long-term solution is to implement a backoff strategy (exponential backoff) to reduce the request rate, which allows the Glue job to automatically slow down and retry with increasing delays, aligning with S3's request rate limits and avoiding sustained throttling.

Answer

Enable S3 Transfer Acceleration.

Answer

Use S3 multipart upload for all objects.

Answer

Increase the number of retries in the Glue job.

Question 2

A company uses Amazon Redshift for data warehousing. The data engineering team notices that queries are slow due to high disk I/O. The team wants to improve query performance without changing the cluster configuration. Which action should the team take?

Accepted Answer

Redesign tables with appropriate sort keys and distribution styles.. Redesigning tables with appropriate sort keys and distribution styles directly addresses high disk I/O by minimizing data scanning and reducing data movement across nodes. Sort keys enable Redshift to skip irrelevant blocks via zone maps, while distribution styles (KEY, ALL, EVEN) optimize data locality for joins and aggregations, reducing I/O without changing cluster configuration.

Answer

Increase the number of nodes in the cluster.

Answer

Run the ANALYZE command to update table statistics.

Answer

Run the VACUUM command to reclaim disk space.

Question 3

The exhibit shows the output of describe-table for a DynamoDB table. The application is experiencing throttling errors when reading data. What is the MOST likely cause?

Accepted Answer

The table's provisioned read capacity is too low.. The describe-table output shows the table has provisioned read capacity set to 5, but the application is experiencing throttling errors. Throttling occurs when read requests exceed the provisioned read capacity units (RCUs). Increasing the read capacity or implementing retries with exponential backoff would resolve this. The throttling is directly caused by insufficient provisioned read capacity for the workload.

Answer

The sort key is not used correctly for queries.

Answer

The table has a hot partition due to the HASH key.

Answer

The table size is too large, causing slow reads.

Question 4

A company is using Amazon S3 to store sensitive data. They need to automatically transition objects to S3 Glacier Deep Archive after 90 days and delete them after 7 years. Which S3 lifecycle configuration action should be used?

Accepted Answer

Transition. Option A is correct because the S3 lifecycle 'Transition' action is specifically designed to move objects between storage classes. To automatically move objects to S3 Glacier Deep Archive after 90 days, you define a transition rule with a 'Days' value of 90 and a 'StorageClass' of 'DEEP_ARCHIVE'. This action directly meets the requirement for transitioning data to a colder storage tier.

Answer

AbortIncompleteMultipartUpload

Answer

Expiration

Answer

NoncurrentVersionExpiration

Question 5

A data engineer is managing an Amazon RDS for PostgreSQL instance that serves as a source for change data capture (CDC) using AWS DMS. The DMS task is a full load followed by ongoing replication. The full load completed successfully, but the ongoing replication is failing with the error 'Value too long for character type'. The engineer has verified that the target database schema matches the source. The source table has a VARCHAR(256) column, and the target has VARCHAR(256) as well. However, some source rows contain values longer than 256 characters. What should the engineer do to resolve the issue?

Accepted Answer

Alter the target table column to a larger data type, such as VARCHAR(512).. Option B is correct because the error indicates that source data exceeds the column length. The source column definition may not enforce the length, or the data was inserted bypassing constraints. The engineer should alter the target column to a larger size to accommodate the actual data. Option A is wrong because truncating data may cause data loss. Option C is wrong because the error is not about character set. Option D is wrong because DMS maps columns by name; renaming would cause mapping issues.

Answer

Modify the DMS task to truncate data that exceeds the column length.

Answer

Rename the target column to match a different source column.

Answer

Change the target column to a CLOB data type.

Question 6

Your company runs a data pipeline that ingests data from AWS Database Migration Service (DMS) into Amazon S3 in Parquet format. An AWS Glue ETL job then transforms the data and loads it into an Amazon Redshift cluster. The Glue job uses a JDBC connection to Redshift. Recently, the Glue job started failing with a 'communication failure' error when writing to Redshift. The Redshift cluster is in a VPC with public accessibility disabled. The Glue job runs in a VPC with a subnet that has a route to a NAT gateway. The security group for Redshift allows inbound traffic from the Glue job's security group. The Glue job's IAM role has the necessary permissions. What is the most likely cause?

Accepted Answer

The Glue job and Redshift cluster are in different VPCs that are not peered or connected via VPC Transit Gateway.. Option C is correct because even though the security group allows inbound traffic, the Glue job's VPC may not have a route to the Redshift cluster's VPC if they are in different VPCs. Option A is wrong because IAM permissions are not the issue. Option B is wrong because the Redshift cluster is in a VPC and not publicly accessible. Option D is wrong because the NAT gateway is for outbound internet, not for connecting to Redshift within the same VPC.

Answer

The Glue job's IAM role does not have the redshift:DescribeClusters permission.

Answer

The Redshift cluster's public accessibility is disabled, but the Glue job is trying to connect over the internet.

Answer

The NAT gateway is not configured to allow traffic to the Redshift cluster's subnet.

Question 7

A company runs a data pipeline using AWS Step Functions to orchestrate multiple AWS Lambda functions and AWS Glue jobs. The pipeline processes large CSV files from Amazon S3, transforms them, and loads them into Amazon Redshift. Recently, the pipeline has been failing intermittently with a 'StateMachineExecutionLimitExceeded' error. The error occurs when multiple pipeline runs are triggered simultaneously. The current execution limit for the state machine is 1000. The team expects up to 200 concurrent executions during peak hours. Which action should the team take to resolve the issue?

Accepted Answer

Request a service quota increase for the maximum number of state machine executions from AWS Support.. Option D is correct because the error indicates the state machine execution limit has been reached. The team should request a limit increase from AWS Support. Option A is wrong because reducing concurrency does not solve the limit issue; it only reduces the number of concurrent executions. Option B is wrong because increasing Lambda concurrency limits does not affect Step Functions execution limits. Option C is wrong because the error is not about execution timeout; it's about exceeding the maximum number of concurrent executions.

Answer

Increase the execution timeout for the state machine to 1 hour.

Answer

Increase the Lambda function concurrency limits to allow more parallel processing.

Answer

Implement a queue (e.g., Amazon SQS) to buffer the pipeline triggers and process them sequentially.

Question 8

A company uses Amazon S3 to store log files from multiple sources. The logs are partitioned by year, month, day, and hour. A data engineer uses Amazon Athena to query the logs. Recently, users have reported that queries are taking longer than expected. The engineer notices that many queries are scanning large amounts of data even when filtering on partition columns. The total data size is 10 TB, and the average query scans 2 TB. The partition columns are properly defined in the table schema. What is the most likely cause of the slow queries?

Accepted Answer

The table is not partitioned, or the partitions are not properly defined in the table DDL.. Option A is correct because Athena queries only use partition pruning if the table is partitioned by those columns and the data is organized accordingly. If the table is not partitioned, Athena scans all data, leading to high scan volumes. Option B is wrong because file compression reduces scan size, not increases it. Option C is wrong because the number of partitions does not cause high scan volume; it helps reduce it. Option D is wrong because the data format (CSV vs. Parquet) affects performance but not partition pruning.

Answer

The number of partitions is too large, causing Athena to spend time listing partitions.

Answer

The log files are stored in compressed format (e.g., gzip), which increases the amount of data scanned.

Answer

The log files are stored in CSV format instead of columnar formats like Parquet.

Question 9

A company runs a data lake on AWS using S3 for storage and AWS Glue for ETL. The security team discovers that a contractor who left the company two months ago still has access to an S3 bucket containing sensitive data. The access was granted via an IAM user that was not deleted. The data engineer is asked to implement a solution to prevent future occurrences. The company uses AWS Organizations and has multiple accounts. The requirement is to automatically detect and remediate IAM users that have not been used for 90 days by disabling their access keys and notifying the security team. The solution must be least privilege and use AWS-native services. Which approach should the data engineer take?

Accepted Answer

Use AWS IAM Access Analyzer to generate findings for unused access and create an AWS Config custom rule with a Lambda function that automatically disables the access keys and sends a notification via SNS.. Option D is correct. AWS IAM Access Analyzer can generate findings for unused access, and AWS Config with a custom rule can auto-remediate by invoking a Lambda function to disable keys and notify via SNS. Option A is wrong because IAM roles are not relevant for user access keys. Option B is wrong because CloudTrail does not automatically disable keys. Option C is wrong because Lake Formation does not manage IAM users.

Answer

Use AWS IAM Access Analyzer to generate findings for unused access and create an AWS Config managed rule to automatically disable the IAM user's access keys.

Answer

Use AWS CloudTrail to monitor IAM user activity and set up a CloudWatch alarm that triggers an SNS notification to the security team to manually disable the keys.

Answer

Use AWS Lake Formation to revoke the permissions of the IAM user and set up a scheduled Lambda function to check for unused IAM users.

Question 10

A data engineer is managing an Amazon Redshift cluster used for analytics. The cluster has a single node of type dc2.large. The engineer notices that queries are slowing down as data volume grows. The cluster's disk space is at 70% usage. The engineer needs to improve query performance and accommodate future growth. The budget allows for moderate cost increase. Which action should the engineer take?

Accepted Answer

Add another dc2.large node to the cluster.. Redshift's dc2 nodes are dense compute nodes limited by storage. Adding a node increases both compute and storage capacity, improving performance and scalability. Option B is correct. Option A: resizing to a larger node type (ds2) increases storage but not necessarily compute proportionally; ds2 is dense storage. Option C: switching to ra3 nodes with managed storage allows compute scaling independent of storage, but ra3 nodes have a higher cost. Option D: enabling concurrency scaling adds cost for additional clusters, not addressing the single node bottleneck.

Answer

Resize the cluster to a single ds2.xlarge node.

Answer

Migrate the cluster to a single ra3.xlplus node with managed storage.

Answer

Enable concurrency scaling and maintain the current cluster.

Question 11

A data analytics company uses Amazon Athena to query data stored in an S3 bucket. The data contains personally identifiable information (PII). The security team wants to ensure that only authorized users can access the data through Athena, and that the data is encrypted at rest in S3. Which combination of actions should the company take? (Choose two.)

Accepted Answer

Attach an IAM policy to users that grants Athena access and S3 read access to the bucket.. Option A and D are correct. Option A enables encryption at rest. Option D restricts Athena access via IAM policies and bucket policies. Option B is wrong because Lake Formation is not required for basic access control; IAM policies suffice. Option C is wrong because S3 Access Points can provide granular access but are not necessary. Option E is wrong because Athena does not support Kinesis.

Answer

Use AWS Lake Formation to define data lake permissions.

Answer

Use AWS Kinesis to stream data to Athena.

Answer

Create an S3 Access Point with a restricted policy.

Question 12

A company ingests streaming data from social media feeds into Amazon Kinesis Data Streams. The data is consumed by an AWS Lambda function that transforms and writes to Amazon S3. Recently, the Lambda function started timing out and dropping records. The data volume has tripled. Which actions should the data engineer take to resolve this? (Choose TWO.)

Accepted Answer

Increase the number of shards in the Kinesis data stream. Options A and D are correct because increasing the number of shards increases throughput, and increasing Lambda memory can improve processing speed and reduce timeouts. Option B (Lambda concurrency) may cause throttling. Option C (Lambda timeout) may not be sufficient without more resources. Option E (Data Firehose) is a different service; replacing Lambda with Firehose could be an alternative but not a direct fix for current architecture.

Answer

Replace Lambda with Amazon Kinesis Data Firehose for the transformation

Answer

Increase the Lambda function timeout to 15 minutes

Answer

Set a reserved concurrency on the Lambda function

Question 13

A company is using Amazon S3 to store sensitive data. They need to ensure that all objects are encrypted at rest. Which combination of actions should be taken? (Choose TWO.)

Accepted Answer

Use a bucket policy to deny PutObject requests that do not include the x-amz-server-side-encryption header.. Option D is correct because a bucket policy that denies PutObject requests lacking the `x-amz-server-side-encryption` header enforces encryption at the time of upload, ensuring that any object written without explicit encryption headers is rejected. Option E is correct because enabling default encryption on the S3 bucket automatically applies server-side encryption (SSE-S3 or SSE-KMS) to any object uploaded without specifying encryption headers, providing a fallback that covers all objects. Together, these actions ensure that every object stored in the bucket is encrypted at rest, either by explicit client request or by default bucket settings.

Answer

Enable S3 Versioning on the bucket.

Answer

Enable MFA Delete on the bucket.

Answer

Configure S3 Access Points with network policies.

Question 14

A retail company stores customer transaction data in an Amazon S3 bucket. The data is encrypted using server-side encryption with AWS KMS (SSE-KMS). The company uses an IAM role to allow an Amazon Athena query service to read the data. The data engineer creates a new Athena workgroup and attempts to run a query on the S3 bucket. The query fails with an access denied error. The IAM role has permissions to decrypt the KMS key and read from the bucket. The engineer checks the S3 bucket policy and finds that it does not explicitly allow access. What is the most likely cause of the failure?

Accepted Answer

The S3 bucket policy does not grant the required permissions to the Athena service principal.. Option D is correct because although the IAM role has permissions, the S3 bucket policy might explicitly deny access or not grant access to the Athena service. Option A is wrong because the IAM role has encryption permissions. Option B is wrong because cross-account access is not mentioned; the role is in the same account. Option C is wrong because Athena can query encrypted data with proper permissions.

Answer

The S3 bucket is in a different AWS account than the Athena workgroup.

Answer

The IAM role does not have permission to use the KMS key for encryption operations.

Answer

Athena does not support querying data encrypted with SSE-KMS.

Question 15

A data engineer needs to ingest log files from multiple EC2 instances into Amazon S3. The logs are written to local disk on each instance. The engineer wants a simple agent-based solution that can collect, compress, and upload logs to S3 with minimal configuration. The solution must support incremental uploads (only new log lines) and handle log rotation. What should the engineer use?

Accepted Answer

Install and configure Amazon Kinesis Agent for Amazon CloudWatch to send logs to CloudWatch Logs, then use a subscription filter to export logs to S3.. Option C is correct: Amazon Kinesis Agent for Amazon CloudWatch can tail log files, compress, and send to CloudWatch Logs, which can then be exported to S3. Option A (AWS DataSync) is for bulk transfers, not streaming. Option B (AWS CLI) is manual. Option D (S3 sync) is not real-time.

Answer

Use AWS CLI cp command with --recursive in a cron job to copy logs to S3 every minute.

Answer

Install AWS DataSync agent on each EC2 instance to sync logs to S3 daily.

Answer

Use an S3 sync command from the AWS CLI scheduled every hour.

Question 16

A social media company ingests user activity data from multiple sources into Amazon S3. The data is in JSON format and includes fields: user_id, activity_type, timestamp, and metadata. The company wants to transform this data into a columnar format (Parquet) partitioned by date and activity_type for efficient querying with Amazon Athena. The pipeline must handle data that arrives up to 3 days late. Currently, a daily AWS Glue ETL job scans the entire S3 bucket for new files, transforms them, and writes to a separate output bucket. The job is taking longer as data volume grows, and the team wants to reduce processing time and cost. What should the engineer do?

Accepted Answer

Set up S3 event notifications to invoke an AWS Lambda function that triggers a Glue job for each new object, passing the object key so the job processes only that file.. Option B is correct: Using S3 event notifications to trigger a Lambda function that starts a Glue job for each new file allows incremental processing, reducing scan time. Option A (increase capacity) does not address the root cause. Option C (EMR) adds complexity. Option D (partition projection) does not help with transformation.

Answer

Increase the number of DPUs for the Glue job to process data faster.

Answer

Use AWS Glue partition projection and schema inference to reduce scan time.

Answer

Replace AWS Glue with Amazon EMR and use Spark to process data in parallel.

Question 17

A data engineer is responsible for ingesting daily CSV files from an external partner into an Amazon S3 bucket. The partner uploads files to an AWS Transfer Family (SFTP) endpoint. Once a file is uploaded, an AWS Lambda function triggers an AWS Glue ETL job to transform the data and load it into an Amazon RDS database. Recently, some files have failed to trigger the Glue job because the Lambda function timed out while waiting for the Glue job to complete. The engineer needs to ensure that all files are processed reliably without manual intervention. What should the data engineer do?

Accepted Answer

Modify the Lambda function to send a message to an Amazon SQS queue after uploading, and create a separate Lambda function that reads from the queue and triggers the Glue job asynchronously.. Option A is correct because decoupling the Lambda function from the Glue job by using SQS allows the Lambda function to submit the job and exit, while a second Lambda function monitors completion. Option B is wrong because increasing Lambda timeout still ties it to job duration. Option C is wrong because the issue is not concurrency. Option D is wrong because increasing S3 events does not address the timeout.

Answer

Increase the Lambda function timeout to 15 minutes to accommodate longer Glue jobs.

Answer

Increase the Lambda function's reserved concurrency to allow multiple invocations.

Answer

Configure S3 event notifications to trigger the Glue job directly without Lambda.

Question 18

A company runs a data pipeline that ingests clickstream data from a web application into Amazon Kinesis Data Streams. A Lambda function processes records from the stream and writes them to an Amazon S3 bucket in JSON format. The pipeline has been running smoothly, but for the past hour, the Lambda function has been failing with 'Rate exceeded' errors, and the Kinesis stream shows elevated 'IteratorAgeMilliseconds' metrics. The Lambda function has a reserved concurrency of 100, and the Kinesis stream has 10 shards. The average record size is 5 KB, and the data rate is approximately 15 MB per second. Which combination of actions should a data engineer take to resolve the issue and prevent recurrence? (Choose TWO.)

Accepted Answer

Increase the Lambda function's reserved concurrency to 200.. The 'Rate exceeded' errors indicate that the Lambda function's concurrency is insufficient to keep up with the incoming data rate from Kinesis. With 10 shards and a 15 MB/s data rate, each shard processes ~1.5 MB/s, and with 5 KB records, that's ~300 records per second per shard. Increasing reserved concurrency to 200 allows more parallel invocations to handle the load, reducing the iterator age.

Answer

Decrease the Lambda function's batch size from 100 to 50.

Answer

Enable S3 multipart upload for the Lambda function.

Answer

Replace the Lambda function with Amazon Kinesis Data Firehose to write directly to S3.

Question 19

A financial services company needs to share sensitive customer data with a third-party analytics firm. The data resides in an S3 bucket encrypted with an AWS KMS customer managed key. The third party has their own AWS account. Which combination of steps is required to securely share the data? (Choose TWO.)

Accepted Answer

Update the KMS key policy to include the third-party account as a principal with kms:Decrypt permission. Options A and D are correct. Option A: The S3 bucket policy must grant cross-account access. Option D: The KMS key policy must grant decrypt permission to the third-party account. Option B is wrong because the third party does not need access to the KMS key management. Option C is wrong because the third party should not have cross-account access to the S3 bucket without appropriate permissions. Option E is wrong because sharing the KMS key directly is not secure.

Answer

Share the KMS key material with the third party

Answer

Create an IAM role in the third-party account that can be assumed by the data owner

Answer

Grant the third-party account access to the KMS key management

Question 20

A financial services company is ingesting trade data from multiple exchanges via Amazon Kinesis Data Streams. Each shard receives data from multiple exchanges, and a consumer application (using KCL) processes the data. The company needs to ensure that trades from the same exchange are processed in order. However, the current implementation distributes records to shards using a random partition key, causing trades from the same exchange to be spread across shards and processed out of order. The team must enforce ordering per exchange without significantly reducing throughput. What should the team do?

Accepted Answer

Use the exchange ID as the partition key when putting records into the stream.. Option C is correct because using the exchange ID as the partition key ensures all trades from the same exchange go to the same shard, preserving order. Option A is wrong because increasing shard count would further spread data and break ordering. Option B is wrong because using a single shard would preserve order but reduce throughput due to shard limits. Option D is wrong because implementing a custom sequencer is complex and unnecessary.

Answer

Implement a custom sequence number in the application to reorder after processing.

Answer

Use a single shard for all data to guarantee order.

Answer

Increase the number of shards to 10 per exchange.