DEA-C01 Data Operations and Support Practice Test 17 — 15 Questions

Question 1

A data engineer is designing a data pipeline that ingests JSON files from an S3 bucket, transforms them using AWS Glue, and loads into Amazon Redshift. The data is updated daily, and the pipeline must handle late-arriving data from the previous day. Which approach minimizes reprocessing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Glue job bookmarks to process only new files based on S3 event notifications.. AWS Glue job bookmarks track previously processed files and process only new or changed files, which handles late-arriving data without reprocessing all data. Option B uses Amazon Kinesis Data Firehose to stream data to Redshift; this is designed for real-time streaming, not a batch pipeline with daily updates, and does not inherently handle late-arriving data without custom logic. Option C (S3 versioning) can manage multiple versions but does not provide incremental processing for late-arriving data; it would require custom logic to determine which version to process. Option D (scheduling a full reload) would reprocess all data daily, which is inefficient and does not handle late-arriving data efficiently.

Answer

Stream data using Amazon Kinesis Data Firehose to Redshift.

Answer

Enable S3 versioning and process only the latest version of each object.

Answer

Schedule a full reload of all data from S3 to Redshift each day.

Question 2

Refer to the exhibit. A data engineer sees this error log from an Amazon EC2 instance that is trying to access an S3 bucket in the us-west-2 region. The EC2 instance is in a VPC with a private subnet and no internet gateway. What is the MOST likely cause of this error?

Accepted Answer

The VPC does not have a VPC endpoint for S3.. The EC2 instance is in a private subnet without an internet gateway, so it cannot reach S3 over the internet. A VPC endpoint (Gateway or Interface) for S3 is required for private connectivity. The error log shows a connection timeout, which is consistent with the lack of a VPC endpoint. Option A is incorrect because the bucket's region is us-west-2 as specified, and the bucket exists (DNS resolves). Option C is incorrect because the error is a timeout, not a 404 (bucket not found). Option D is incorrect because the error is a connection timeout, not an access denied (403), so IAM permissions are not the issue.

Answer

The S3 bucket is in a different region than us-west-2.

Answer

The S3 bucket does not exist.

Answer

The IAM role attached to the EC2 instance does not have s3:GetObject permission.

Question 3

A data engineer needs to set up a cross-account access for an S3 bucket so that users in Account B can read objects. The bucket in Account A has a bucket policy that grants access. What additional step is required?

Accepted Answer

Create an IAM role in Account B and attach a policy that allows s3:GetObject for the bucket.. Cross-account S3 access requires both a bucket policy in the source account (Account A) that grants permissions to the target account or role, and an IAM role in the target account (Account B) with a policy allowing the necessary actions (e.g., s3:GetObject). This ensures that users in Account B can assume the role and access the bucket. Option A (enabling ACLs) is unnecessary and not recommended; ACLs are legacy and can be disabled. Option C (disabling Block Public Access) is not required because the bucket policy is not public; it only grants cross-account access to a specific role. Option D (lifecycle policy) is for object lifecycle management and does not provide access control.

Answer

Enable S3 object ACLs on the bucket.

Answer

Disable S3 Block Public Access settings on the bucket.

Answer

Set up an S3 Lifecycle policy to replicate objects to Account B.

Question 4

A company runs a production Amazon Redshift cluster. The data engineering team notices that queries are running slowly during peak hours. The cluster's CPU utilization is consistently above 80%. Which action should the engineer take to improve query performance?

Accepted Answer

Perform an elastic resize to add more nodes.. Performing an elastic resize allows adding nodes to the Redshift cluster, increasing CPU capacity and resolving the CPU bottleneck. Option A is incorrect: moving tables to Redshift Spectrum offloads queries to S3 but does not reduce CPU usage on the cluster for existing queries. Option B is incorrect: re-distributing tables might improve data distribution but does not directly address high CPU utilization. Option C is incorrect: concurrency scaling helps with many concurrent queries by adding transient capacity, but it does not reduce CPU usage on the main cluster; it may even increase it.

Answer

Move some tables to Amazon Redshift Spectrum.

Answer

Re-distribute the tables using a different distribution key.

Answer

Enable concurrency scaling.

Question 5

A company uses Amazon Kinesis Data Streams with a Lambda consumer. The Lambda function is failing with 'ProvisionedThroughputExceededException' when writing to a DynamoDB table. Which action should the data engineer take to resolve this without losing data?

Accepted Answer

Configure a dead-letter queue (DLQ) on the Lambda function and increase the DynamoDB write capacity.. The 'ProvisionedThroughputExceededException' occurs when the Lambda function exceeds the DynamoDB table's write capacity. To resolve this without data loss, the data engineer should both increase the DynamoDB write capacity to accommodate the throughput and configure a dead-letter queue (DLQ) on the Lambda function. The DLQ captures records that fail after all retries, preventing data loss. Option A (reducing shards) would lower the ingestion rate but may cause data loss and does not address the root cause. Option B (increasing read capacity) is irrelevant because the issue is with writes. Option D (disabling retries) would cause data loss because failed records would not be retried.

Answer

Reduce the number of Kinesis shards to lower the ingestion rate.

Answer

Increase the DynamoDB table's read capacity.

Answer

Disable retries on the Lambda function to avoid throttling.

Question 6

A data pipeline uses AWS DMS to replicate data from an on-premises Oracle database to Amazon S3 in Parquet format. The pipeline has been running successfully for months, but recently the DMS task status shows 'failed' with the error: 'The source database is running out of archive log space.' Which action should the engineer take to prevent this error?

Accepted Answer

Increase the amount of archive log space or reduce the log retention period on the source Oracle database.. The error 'source database is running out of archive log space' indicates that the Oracle database's archive log area is full. AWS DMS uses Change Data Capture (CDC) which reads from archive logs to replicate changes. Increasing archive log space or reducing log retention prevents this error. Option A is incorrect because distributing load across multiple S3 buckets does not address source log space. Option C is incorrect because DMS does not manage archiving; it only reads logs. Option D is incorrect because memory on the replication instance does not affect source archive log space.

Answer

Configure multiple target S3 buckets to distribute the load.

Answer

Enable automatic log archiving on the DMS replication instance.

Answer

Increase the memory allocation for the DMS replication instance.

Question 7

A data engineer needs to ensure that sensitive data stored in Amazon S3 is encrypted at rest. Which TWO options meet this requirement? (Choose TWO.)

Accepted Answer

Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS). Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS) allows you to enforce encryption at rest for S3 objects using a customer-managed or AWS-managed KMS key. This option meets the requirement because the encryption is applied server-side by S3 before the data is written to disk, and the data is decrypted automatically when accessed with appropriate permissions. SSE-KMS also provides an audit trail via AWS CloudTrail for every key usage.

Answer

Using a VPC to restrict network access

Answer

Enabling MFA Delete on the S3 bucket

Answer

Client-Side Encryption with SSL/TLS

Question 8

A data engineer is designing a disaster recovery strategy for an Amazon RDS for MySQL database with Multi-AZ deployment. Which THREE actions should the engineer take to meet a Recovery Point Objective (RPO) of 5 minutes and a Recovery Time Objective (RTO) of 15 minutes? (Choose THREE.)

Accepted Answer

Enable automated backups with a retention period of 7 days.. To achieve an RPO of 5 minutes and RTO of 15 minutes for an Amazon RDS for MySQL database with Multi-AZ deployment, the engineer should enable automated backups (A) for point-in-time recovery within minutes, create a cross-region read replica (B) for fast failover in another region, and enable Multi-AZ deployment (E) for automatic failover within the same region. Option C (Single-AZ) would not provide high availability, and option D (exporting snapshots to S3) is too slow for the required RTO.

Answer

Configure the DB instance to be Single-AZ for simplicity.

Answer

Export automated snapshots to an S3 bucket in a different region.

Question 9

A data engineer is troubleshooting a failed AWS Glue job that reads from an Amazon RDS for MySQL table. The error message indicates 'java.sql.SQLException: No suitable driver'. What is the most likely cause?

Accepted Answer

The MySQL JDBC driver JAR is not included in the Glue job's dependencies.. The MySQL JDBC driver must be included in the Glue job's dependent JARs or as a Python module. Option B is incorrect because the driver class name is correct; the driver JAR is missing. Option C is incorrect because the error is about driver, not connection. Option D is incorrect because subnet routing does not affect driver loading.

Answer

The Glue job is using the wrong JDBC driver class name.

Answer

The Glue job's VPC subnet does not have a route to the RDS instance.

Answer

The RDS instance is not publicly accessible.

Question 10

A company uses Amazon Kinesis Data Streams to ingest real-time clickstream data. A Lambda function processes each record. Recently, the Lambda function has been failing with 'ProvisionedThroughputExceededException' when writing results to a DynamoDB table. The data engineer has already increased the DynamoDB write capacity. What else can the engineer do to resolve the issue?

Accepted Answer

Increase the number of shards in the Kinesis stream.. Increasing the number of shards in the Kinesis stream increases the number of concurrent Lambda invocations, distributing the write load across more Lambda functions and reducing the number of writes per second to DynamoDB from each invocation. This helps mitigate ProvisionedThroughputExceededException. Option A is incorrect: increasing Lambda memory does not directly affect DynamoDB write throttling. Option B is incorrect: increasing DynamoDB read capacity does not help with write throttling. Option C is incorrect: decreasing the batch size to 1 reduces the number of records per invocation, but since each shard still invokes Lambda, it may increase the number of invocations and potentially increase the write frequency, worsening the throttling.

Answer

Increase the Lambda function memory.

Answer

Increase the DynamoDB read capacity units.

Answer

Decrease the Lambda batch size to 1.

Question 11

An IAM policy is attached to an IAM role used by an EC2 instance in the 10.0.0.0/8 VPC. The EC2 instance cannot read objects from the S3 bucket. What is the most likely cause?

Accepted Answer

The S3 bucket has a bucket policy that denies public access, and the IAM policy alone is insufficient.. The most likely cause is that the S3 bucket has a bucket policy that denies access or does not explicitly grant access to the IAM role. Even if the IAM policy attached to the role allows S3 actions, a bucket policy can override it with an explicit deny or by not granting access to the role. Option A is incorrect because the s3:GetObject operation does not require s3:ListBucket permission. Option C is incorrect because SSE-KMS is not mentioned and would require specific kms:Decrypt permission, but it is not the most likely cause. Option D is incorrect because the EC2 instance's private IP is within the 10.0.0.0/8 VPC range, and the public IP is irrelevant for in-VPC communication.

Answer

The policy does not grant s3:ListBucket permission.

Answer

The bucket is encrypted with SSE-KMS and the role does not have kms:Decrypt permission.

Answer

The EC2 instance's public IP is not in the 10.0.0.0/8 range.

Question 12

A data engineer needs to grant an IAM user read-only access to an S3 bucket named 'data-lake-bucket'. Which IAM policy statement should be attached to the user?

Accepted Answer

{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::data-lake-bucket/*"}. It grants read-only access by allowing only the s3:GetObject action, which permits downloading objects from the bucket. The resource ARN includes the wildcard /* to cover all objects within 'data-lake-bucket', ensuring the user can read but not list or modify data.

Answer

{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::data-lake-bucket"}

Answer

{"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::data-lake-bucket/*"}

Answer

{"Effect":"Allow","Action":"s3:*","Resource":"arn:aws:s3:::data-lake-bucket/*"}

Question 13

A data engineer runs the above AWS CLI command to investigate who uploaded a file to an S3 bucket. The output shows the event was recorded. Which additional step is needed to confirm the identity of the user?

Accepted Answer

No additional step is needed; the 'Username' field already identifies the IAM user.. The 'Username' field in the CloudTrail event log directly identifies the IAM user who made the API call. No additional step is needed to confirm the identity. Options B, C, and D are unnecessary as they provide supplementary information but do not directly identify the user when the Username is already present.

Answer

Use the 'MFA' field to check if multi-factor authentication was used.

Answer

View the 'accessKeyId' field in the CloudTrailEvent JSON.

Answer

Look up the 'sourceIPAddress' in the CloudTrailEvent.

Question 14

An AWS Glue job that performs data transformation on large Parquet files in Amazon S3 is taking a long time to complete. The job uses the default number of DPUs. Which change would most likely improve the job's performance?

Accepted Answer

Increase 'Max capacity' (number of DPUs) for the job.. Increasing the number of DPUs (Option A) adds more parallelism and memory, which directly improves the performance of the Glue job when processing large Parquet files. Option B (coalesce) reduces the number of output files but does not speed up the transformation itself. Option C (reduce partitions) may lead to data skew or out-of-memory errors. Option D (change to CSV) would make processing slower because CSV is less efficient than Parquet.

Answer

Use 'coalesce' to reduce the number of output files.

Answer

Reduce the number of partitions in the source data.

Answer

Change the input format from Parquet to CSV.

Question 15

A data engineer has this IAM policy attached to their user. They are trying to create an Amazon EMR cluster with a custom service role 'EMR_CustomRole'. What will happen?

Accepted Answer

The cluster creation will fail with an 'Access Denied' error for iam:PassRole.. The IAM policy allows iam:PassRole only for the specific role 'EMR_DefaultRole'. When creating an EMR cluster with a custom service role 'EMR_CustomRole', the user needs to pass that role, but the policy does not grant iam:PassRole for 'EMR_CustomRole'. Therefore, the cluster creation fails with an 'Access Denied' error for iam:PassRole. Other options are incorrect: A incorrectly attributes failure to elasticmapreduce:* being too broad; B incorrectly assumes success because elasticmapreduce:* is allowed, ignoring the PassRole requirement; D incorrectly states PassRole is not required.

Answer

The cluster creation will fail because elasticmapreduce:* is too broad.

Answer

The cluster creation will succeed because elasticmapreduce:* is allowed.

Answer

The cluster creation will succeed because PassRole is not required for EMR.