DEA-C01 Data Operations and Support Practice Test 11 — 15 Questions

Question 1

A data engineer is troubleshooting a Kinesis Data Analytics application that processes streaming data. The application is falling behind, and the metric 'MillisBehindLatest' is consistently above 60000. The source Kinesis stream has 10 shards, and the application uses a Flink application with default parallelism. What is the MOST likely cause of the lag?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Flink application parallelism is set to 1.. The Flink application's parallelism is set to 1, meaning it can only process data with a single task, severely limiting throughput. With 10 shards, the application could scale up to 10 parallel tasks to match the shard count. The high MillisBehindLatest indicates the application cannot keep up with the incoming data rate, and the default parallelism of 1 is the most likely bottleneck.

Answer

The sink (destination) is throttling writes.

Answer

The Kinesis stream has too few shards.

Answer

The retention period of the Kinesis stream is too short.

Question 2

Refer to the exhibit. An IAM policy is attached to an IAM user. The user is trying to upload an object to 's3://data-lake-bucket/confidential/report.pdf' using the AWS CLI. The upload fails with an AccessDenied error. What is the reason for the failure?

Accepted Answer

An explicit Deny statement overrides the Allow statement for the 'confidential/' prefix.. The upload fails because an explicit Deny statement in the attached IAM policy overrides the Allow statement for the 'confidential/' prefix. In AWS IAM, an explicit Deny always takes precedence over any Allow, regardless of the order or specificity of the statements. Since the user is trying to upload to 'confidential/report.pdf', the Deny on that prefix blocks the action even if a broader Allow exists.

Answer

The policy does not include 's3:PutObject' action.

Answer

The resource ARN in the Allow statement does not cover the specific object.

Answer

The user does not have permission to access the bucket at all.

Question 3

A data engineer is monitoring an Amazon Kinesis Data Streams application that processes real-time events. The application uses a Kinesis Client Library (KCL) consumer. The engineer notices that the consumer is lagging behind the producer, and the lag is increasing over time. The stream has 10 shards. Which action will MOST effectively reduce the lag?

Accepted Answer

Increase the number of shards in the Kinesis data stream.. Kinesis Data Streams throughput scales with the number of shards — each shard supports up to 1 MB/s or 1,000 records/s ingest and 2 MB/s egress. If a KCL consumer is lagging and the lag is growing, the stream's total capacity is insufficient for the producer's rate, so increasing shards (which can be done via UpdateShardCount or resharding) adds parallel processing capacity. More shards allow more KCL workers to process concurrently, directly reducing the consumer lag.

Answer

Use multiple KCL workers per shard to increase processing capacity.

Answer

Decrease the number of records per shard per second.

Answer

Decrease the number of shards in the Kinesis data stream.

Question 4

A company uses Amazon EMR to run Spark jobs on a transient cluster. The jobs are submitted via a step in the cluster. The cluster is configured to auto-terminate after the last step completes. However, the cluster is not terminating even though the step shows as 'COMPLETED'. What could be the cause?

Accepted Answer

The step's 'ActionOnFailure' parameter is set to 'CONTINUE' and 'KeepClusterAliveOnFailure' is true.. In Amazon EMR, the step-level parameter `KeepClusterAliveOnFailure` (or `KeepJobFlowAliveWhenNoSteps` for the cluster) can prevent auto-termination. When `ActionOnFailure` is set to `CONTINUE` and `KeepClusterAliveOnFailure` is `true`, the cluster remains running even after the last step completes, overriding the transient cluster's auto-terminate setting. Option A is incorrect because root device size does not affect termination. Option B is incorrect because the step status 'COMPLETED' indicates success, not a bug. Option C is incorrect because the cluster is explicitly configured as transient and auto-terminating, not long-running.

Answer

The cluster's root device size is too large.

Answer

The step failed with an error, but the status shows 'COMPLETED' due to a reporting bug.

Answer

The cluster is configured as a long-running cluster.

Question 5

A data engineer is troubleshooting a slow-running Amazon Redshift query. The query joins several large tables and performs aggregations. The engineer runs EXPLAIN and sees a 'DS_DIST_ALL' step. Which TWO actions will MOST likely improve query performance? (Choose TWO.)

Accepted Answer

Change the distribution style of the tables to DISTSTYLE KEY on the join columns.. Option C is correct because a DS_DIST_ALL step in EXPLAIN indicates that Redshift is broadcasting the entire table to every node (DISTSTYLE ALL) to perform the join, which is expensive for large tables; switching to DISTSTYLE KEY on the join columns co-locates matching rows on the same node slice, eliminating the broadcast and enabling efficient collocated joins. Option E is correct because defining SORTKEYs on columns used in the query's predicates and join filters allows Redshift to use zone maps and block-level metadata to skip irrelevant data blocks, dramatically reducing I/O for the large-table scans and aggregations in this query. Option A is not the best fix because VACUUM only reclaims space and re-sorts rows to restore sort order; it does not change distribution strategy and would not resolve a DS_DIST_ALL broadcast caused by DISTSTYLE ALL. Option B is irrelevant because CNAME is a DNS alias record concept, not a Redshift command, and renaming tables has no effect on query execution plans. Option D is not the most likely improvement because adding nodes increases cost and capacity but does not address the underlying broadcast distribution problem, so the DS_DIST_ALL step would persist.

Answer

Run the VACUUM command on all tables.

Answer

Use the CNAME command to rename the tables.

Answer

Increase the number of nodes in the Redshift cluster.

Question 6

A company uses Amazon S3 to store data for analytics. The data engineer needs to ensure that the S3 bucket is protected against accidental deletion of objects. Which THREE actions should the engineer take? (Choose THREE.)

Accepted Answer

Create an S3 bucket policy that explicitly denies the s3:DeleteObject action.. Option B is correct because an S3 bucket policy that explicitly denies s3:DeleteObject (and typically s3:DeleteObjectVersion) prevents any principal, including the bucket owner, from deleting objects, providing a strong guardrail against accidental deletion. Option D is correct because enabling versioning keeps prior versions of objects, so even if an object is deleted or overwritten, the previous version can be restored, which directly protects against accidental deletion. Option E is correct because MFA Delete requires multi-factor authentication to permanently delete object versions or change the versioning state, adding an additional safeguard against accidental or unauthorized deletion. Option A is not correct because server access logging only records requests for auditing and does not prevent deletion. Option C is not correct because transitioning objects to Glacier changes storage class for cost/archival purposes and does not protect against deletion.

Answer

Enable server access logging for the S3 bucket.

Answer

Configure a lifecycle policy to transition objects to Glacier.

Question 7

A data engineer creates an IAM policy as shown in the exhibit. The engineer then attaches this policy to an IAM role used by an application that uploads objects to the S3 bucket 'my-bucket'. When the application uploads an object without specifying server-side encryption, what happens?

Accepted Answer

The upload fails with a 403 Access Denied error.. The IAM policy includes a condition that requires the `s3:x-amz-server-side-encryption` header to be present and set to `AES256`. If the application uploads an object without specifying server-side encryption, this condition is not met, so the request is denied with a 403 Access Denied error. Options A, C, and D are incorrect because the upload fails and the object is not stored at all.

Answer

The object is uploaded with SSE-S3 encryption by default.

Answer

The object is uploaded without encryption.

Answer

The object is uploaded with SSE-C encryption.

Question 8

A data engineer runs an AWS Glue ETL job that transforms data in Amazon S3. The job fails with the error shown in the exhibit. Which action will MOST likely fix the issue?

Accepted Answer

Change the worker type from G.1X to G.2X.. The error indicates an out-of-memory error in the Spark executor. This occurs when the executor memory is insufficient for the data being processed. Option D, changing the worker type from G.1X to G.2X, doubles the memory per worker (from 4 GB to 8 GB for Spark executors), addressing the memory issue directly. Option A is incorrect because decreasing the number of workers reduces the total memory and parallelism, worsening the problem. Option B is incorrect because the error is not related to IAM permissions; an IAM policy for S3 write access would resolve a different error (e.g., AccessDenied). Option C is incorrect because increasing the number of workers from 2 to 4 adds more executors but does not increase memory per executor, and the error is likely due to insufficient per-executor memory.

Answer

Decrease the number of workers from 2 to 1.

Answer

Add an IAM policy that grants the Glue job permission to write to S3.

Answer

Increase the number of workers from 2 to 4.

Question 9

A company runs a data pipeline that ingests user activity logs from an API gateway into an Amazon Kinesis Data Firehose delivery stream. The Firehose stream writes data to an S3 bucket. The data is then processed by a scheduled AWS Glue job that runs every hour. Recently, the company noticed that the data in S3 is incomplete: some logs from the API are missing. The Glue job processes all files in the S3 bucket. The Firehose stream has a buffer size of 5 MB and a buffer interval of 60 seconds. The API sends data at a rate of approximately 2 MB per minute. What should the company do to reduce data loss?

Accepted Answer

Configure a Dead Letter Queue (DLQ) for the Firehose stream.. Firehose buffers records up to the buffer size (5 MB) or buffer interval (60 s), whichever comes first. At 2 MB/min, only ~2 MB accumulates per 60 s, so the interval triggers delivery — but if the delivery to S3 fails (permissions, throttling, transient errors), Firehose retries and eventually drops the batch. A DLQ (S3 bucket) captures failed records so they can be reprocessed, directly reducing data loss. Buffer tuning only affects latency, not failed deliveries.

Answer

Decrease the buffer interval to 30 seconds.

Answer

Increase the Firehose buffer size to 10 MB.

Answer

Enable data transformation with AWS Lambda to compress data.

Question 10

A data engineer notices that an AWS Glue ETL job is failing intermittently with the error 'Connection refused'. The job reads from Amazon RDS for MySQL and writes to Amazon S3. What is the MOST likely cause?

Accepted Answer

The security group for the RDS instance is not allowing inbound traffic from the Glue job's subnet.. The 'Connection refused' error indicates a network connectivity issue between the AWS Glue ETL job and Amazon RDS for MySQL. The most likely cause is that the security group for the RDS instance is not configured to allow inbound traffic on the MySQL port (3306) from the subnet or security group used by the Glue job. Option A (max connections) would result in a 'too many connections' error, not 'connection refused'. Option C (DPU limits) would cause resource-related errors, not a connection refusal. Option D (IAM permissions) would lead to an access denied error when writing to S3, not a connection error. Therefore, option B is correct.

Answer

The RDS instance has reached its maximum number of connections.

Answer

The Glue job is using too many DPUs and hitting resource limits.

Answer

The IAM role associated with the Glue job lacks permissions to write to the S3 bucket.

Question 11

A data engineer is managing an Amazon RDS for PostgreSQL instance that serves as a source for change data capture (CDC) using AWS DMS. The DMS task is a full load followed by ongoing replication. The full load completed successfully, but the ongoing replication is failing with the error 'Value too long for character type'. The engineer has verified that the target database schema matches the source. The source table has a VARCHAR(256) column, and the target has VARCHAR(256) as well. However, some source rows contain values longer than 256 characters. What should the engineer do to resolve the issue?

Accepted Answer

Alter the target table column to a larger data type, such as VARCHAR(512).. The error indicates that source data exceeds the column length. The source column definition may not enforce the length, or the data was inserted bypassing constraints. The engineer should alter the target column to a larger size, such as VARCHAR(512), to accommodate the actual data. Option A is wrong because truncating data may cause data loss. Option B is wrong because renaming would cause mapping issues. Option C is wrong because the error is not about character set; using CLOB may not be compatible with the CDC process and would change the data type.

Answer

Modify the DMS task to truncate data that exceeds the column length.

Answer

Rename the target column to match a different source column.

Answer

Change the target column to a CLOB data type.

Question 12

An Amazon RDS for PostgreSQL instance is experiencing high CPU utilization and slow query performance. The data engineer suspects that a specific query is causing the problem. The engineer wants to identify the query and analyze its execution plan. Which steps should the engineer take?

Accepted Answer

Enable pg_stat_statements in the PostgreSQL parameter group and query the pg_stat_statements view.. Enabling pg_stat_statements in the PostgreSQL parameter group and querying the pg_stat_statements view gives normalized query statistics including total execution time, calls, rows, and shared buffer usage — exactly what's needed to identify the offending query. From there, the engineer can run EXPLAIN (ANALYZE, BUFFERS) on the identified query to inspect its execution plan.

Answer

Enable CloudWatch Logs for the RDS instance and search for slow query logs.

Answer

Enable Enhanced Monitoring and analyze the CPU metrics.

Answer

Use RDS Performance Insights to identify the top queries.

Question 13

A company uses AWS Glue DataBrew to clean and prepare data for machine learning. The source data is in an S3 bucket with server-side encryption using AWS KMS (SSE-KMS). The DataBrew project is set up with an IAM role that has permissions to read from the S3 bucket and use the KMS key. When the DataBrew job runs, it fails with an error indicating that it cannot access the data. The IAM role has the following policy: { 'Version': '2012-10-17', 'Statement': [ { 'Effect': 'Allow', 'Action': ['s3:GetObject', 's3:ListBucket'], 'Resource': ['arn:aws:s3:::my-bucket', 'arn:aws:s3:::my-bucket/*'] }, { 'Effect': 'Allow', 'Action': 'kms:Decrypt', 'Resource': 'arn:aws:kms:us-east-1:123456789012:key/my-key' } ] }. What is the most likely cause of the failure?

Accepted Answer

The IAM role is missing s3:PutObject permission on the DataBrew output bucket.. The IAM role has permissions to read from the source S3 bucket (s3:GetObject, s3:ListBucket) and to decrypt using the KMS key (kms:Decrypt). However, DataBrew needs to write intermediate results to a separate output S3 bucket. The error indicates that the job cannot access data, which in the context of DataBrew often means it cannot write to the output bucket. Therefore, the role is missing s3:PutObject permission on the output bucket. Option B is incorrect because the role already has s3:ListBucket on the source bucket. Option C is incorrect because the S3 bucket being in a different region would not cause an access denied error if the role has proper cross-region permissions; DataBrew can access buckets in any region. Option D is incorrect because kms:Decrypt is sufficient for reading encrypted objects; kms:GenerateDataKey is needed for writing.

Answer

The IAM role is missing s3:ListBucket permission on the source bucket.

Answer

The S3 bucket is in a different region than the DataBrew project.

Answer

The IAM role is missing kms:GenerateDataKey permission for the KMS key.

Question 14

A financial services company runs a critical data pipeline using AWS Step Functions to orchestrate multiple AWS Lambda functions and AWS Glue jobs. The pipeline processes transaction data and must complete within 15 minutes to meet a service-level agreement (SLA). Recently, the pipeline has been failing intermittently with a 'StateMachineExecutionLimitExceeded' error. The Step Functions state machine is configured with a Standard type. The company has a single state machine that runs on demand. The error occurs when multiple requests are submitted simultaneously. What should the team do to prevent this error?

Accepted Answer

Request a service quota increase for concurrent executions of Standard Workflows.. The error 'StateMachineExecutionLimitExceeded' occurs when the number of concurrent executions exceeds the quota for Standard Workflows. The solution is to request a service quota increase for concurrent executions. This directly addresses the limit. Increasing timeout or switching to Express Workflow may not be appropriate because Express Workflows have different execution semantics and may not support all features needed.

Answer

Increase the state machine execution timeout to 30 minutes.

Answer

Switch the state machine type to Express Workflow to handle higher throughput.

Answer

Increase the Lambda function reserved concurrency to 100.

Question 15

A data engineer is tasked with reducing costs for an Amazon Redshift cluster. The cluster is used for both ETL workloads and BI reporting. The engineer observes that the cluster is over-provisioned during off-peak hours. Which action would be MOST effective in reducing costs while maintaining performance during peak hours?

Accepted Answer

Enable concurrency scaling to automatically add cluster capacity during peak hours.. Concurrency scaling automatically adds transient cluster capacity to handle concurrent queries during peak periods, and you only pay for the extra capacity when it's used. This allows the cluster to remain appropriately sized for baseline workloads while seamlessly scaling during peak hours, reducing costs during off-peak when the cluster is over-provisioned. It maintains performance during peak hours without manual intervention.

Answer

Switch to RA3 node types for managed storage.

Answer

Purchase Reserved Instances for the cluster.

Answer

Reduce the number of nodes in the cluster.