DEA-C01 Data Operations and Support Practice Test 23 — 15 Questions

Question 1

A company runs a daily batch processing job on Amazon EMR that reads data from Amazon S3 and writes results back to S3. The job takes longer than expected. The engineer wants to monitor the job's resource utilization. Which AWS service should be used to collect and visualize metrics such as CPU and memory usage of the EMR cluster's nodes?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon CloudWatch with the CloudWatch Agent installed on the EMR nodes.. Amazon CloudWatch with the CloudWatch Agent installed on EMR nodes can collect CPU, memory, and other system-level metrics, which can be visualized in CloudWatch dashboards. Option A is incorrect because AWS Config records configuration changes, not resource utilization. Option B is incorrect because Amazon Athena is a query service for data in S3, not a monitoring service. Option D is incorrect because AWS CloudTrail logs API calls, not performance metrics.

Answer

AWS Config to record configuration changes in the EMR cluster.

Answer

Amazon Athena to query EMR job logs stored in S3.

Answer

AWS CloudTrail to log API calls made by the EMR job.

Question 2

A company uses Amazon Kinesis Data Streams to ingest clickstream data. The data is consumed by an AWS Lambda function that processes each record and writes to an Amazon DynamoDB table. Recently, the Lambda function has been failing with 'ProvisionedThroughputExceededException' from DynamoDB. The Lambda function uses the AWS SDK to batch write items in batches of 25. The DynamoDB table has on-demand capacity mode. The stream has 10 shards, and the Lambda function is configured with a batch size of 100 and 5 concurrent invocations per shard. What step should the team take to resolve the issue?

Accepted Answer

Reduce the Lambda batch size to 25 and implement exponential backoff with jitter in the Lambda code.. The issue is DynamoDB throttling due to high write traffic from Lambda. The DynamoDB table is on-demand, which can throttle if bursts exceed sustained limits. Reducing the Lambda batch size from 100 to 25 decreases the number of records processed per invocation, lowering the instantaneous write rate. Implementing exponential backoff with jitter in the Lambda code allows retries on throttled requests, making the system more resilient. Option A is not required because on-demand mode automatically scales, and switching to provisioned can be costly. Option C is incorrect because increasing shards would increase parallelism and worsen throttling. Option D is incorrect because increasing concurrency would also increase write pressure on DynamoDB.

Answer

Switch the DynamoDB table from on-demand to provisioned capacity with a high write capacity unit (WCU) value.

Answer

Increase the number of Kinesis shards to 20 to reduce the load per shard.

Answer

Increase the Lambda function's reserved concurrency to allow more parallel executions.

Question 3

A data engineer is designing a data pipeline that processes sensitive personal data. The data is ingested via Amazon Kinesis Data Firehose and stored in Amazon S3. The pipeline must ensure that the data is encrypted at rest and in transit. The engineer also needs to audit access to the data. Which combination of services meets these requirements?

Accepted Answer

S3 server-side encryption (SSE-S3) for at-rest encryption, HTTPS for in-transit encryption, and AWS CloudTrail for auditing.. S3 server-side encryption (SSE-S3) encrypts data at rest in S3. HTTPS (TLS) encrypts data in transit between the data source and Kinesis Data Firehose, and between Firehose and S3. AWS CloudTrail logs S3 API calls (e.g., GetObject, PutObject) for auditing data access. Option A is incorrect because Kinesis Data Analytics does not provide encryption in transit; it processes data but does not handle encryption. Option B is incorrect because CloudWatch Logs is for monitoring and storing logs, not for auditing data access; CloudTrail is the appropriate service for auditing. Option D is incorrect because client-side encryption requires manual key management and does not use AWS-managed encryption; AWS Config tracks configuration changes, not data access.

Answer

AWS KMS for encryption at rest, Kinesis Data Analytics for in-transit encryption, and AWS CloudTrail for auditing.

Answer

AWS KMS for encryption at rest, Amazon CloudWatch Logs for auditing, and TLS for in-transit encryption.

Answer

S3 client-side encryption, AWS Config for auditing, and TLS for in-transit encryption.

Question 4

A data analyst needs to query a large Amazon S3 bucket containing CSV files using Amazon Athena. The bucket has millions of small files (less than 1 MB each). The analyst reports that queries are very slow and often time out. The data is partitioned by date and the partition columns are defined in the table. What is the most effective way to improve query performance?

Accepted Answer

Run a compaction job to consolidate small files into fewer larger files (e.g., 128 MB each).. Many small files (under 1 MB) cause high overhead because each file requires a separate read operation and metadata call. Consolidating them into fewer larger files (e.g., 128 MB each) reduces the number of read operations and improves I/O efficiency, directly addressing the root cause of slowdowns and timeouts. Option A (converting to Parquet) improves storage efficiency and query performance but does not reduce the file count; it is a beneficial addition but not the most effective standalone fix for the small file problem. Option C (adding more partitions) would increase overhead by creating even more directories/files to scan. Option D (S3 Select) applies within individual files and does not mitigate overhead from file quantity.

Answer

Convert the files to Apache Parquet format using an AWS Glue ETL job.

Answer

Add more partitions by including hour and minute as partition keys.

Answer

Use S3 Select to push down filtering to S3 before Athena processes the data.

Question 5

An Amazon RDS for PostgreSQL instance is experiencing high CPU utilization and slow query performance. The data engineer suspects that a specific query is causing the problem. The engineer wants to identify the query and analyze its execution plan. Which steps should the engineer take?

Accepted Answer

Enable pg_stat_statements in the PostgreSQL parameter group and query the pg_stat_statements view.. Enabling pg_stat_statements in the PostgreSQL parameter group and querying the pg_stat_statements view provides detailed query execution statistics (e.g., total execution time, calls, rows) and helps identify high‑load queries. The execution plan can then be obtained by running EXPLAIN on the identified query. Option A is incorrect because CloudWatch Logs captures logs but does not provide real‑time query performance details. Option C is incorrect because Enhanced Monitoring shows OS‑level metrics (CPU, memory), not query‑level plans or statistics. Option D is incorrect because RDS Performance Insights identifies top queries by wait events and load but does not directly expose the execution plan; the execution plan is best obtained via EXPLAIN on the specific query identified from pg_stat_statements.

Answer

Enable CloudWatch Logs for the RDS instance and search for slow query logs.

Answer

Enable Enhanced Monitoring and analyze the CPU metrics.

Answer

Use RDS Performance Insights to identify the top queries.

Question 6

A company uses AWS Glue DataBrew to clean and prepare data for machine learning. The source data is in an S3 bucket with server-side encryption using AWS KMS (SSE-KMS). The DataBrew project is set up with an IAM role that has permissions to read from the S3 bucket and use the KMS key. When the DataBrew job runs, it fails with an error indicating that it cannot access the data. The IAM role has the following policy: { 'Version': '2012-10-17', 'Statement': [ { 'Effect': 'Allow', 'Action': ['s3:GetObject', 's3:ListBucket'], 'Resource': ['arn:aws:s3:::my-bucket', 'arn:aws:s3:::my-bucket/*'] }, { 'Effect': 'Allow', 'Action': 'kms:Decrypt', 'Resource': 'arn:aws:kms:us-east-1:123456789012:key/my-key' } ] }. What is the most likely cause of the failure?

Accepted Answer

The IAM role is missing s3:PutObject permission on the DataBrew output bucket.. The IAM role has permissions to read from the source S3 bucket (s3:GetObject, s3:ListBucket) and to decrypt using the KMS key (kms:Decrypt). However, DataBrew needs to write intermediate results to a separate output S3 bucket. The error indicates that the job cannot access data, which in the context of DataBrew often means it cannot write to the output bucket. Therefore, the role is missing s3:PutObject permission on the output bucket. Option B is incorrect because the role already has s3:ListBucket on the source bucket. Option C is incorrect because the S3 bucket being in a different region would not cause an access denied error if the role has proper cross-region permissions; DataBrew can access buckets in any region. Option D is incorrect because kms:Decrypt is sufficient for reading encrypted objects; kms:GenerateDataKey is needed for writing.

Answer

The IAM role is missing s3:ListBucket permission on the source bucket.

Answer

The S3 bucket is in a different region than the DataBrew project.

Answer

The IAM role is missing kms:GenerateDataKey permission for the KMS key.

Question 7

A company is using AWS Glue to catalog data stored in Amazon S3. The data is partitioned by year, month, and day. A data analyst reports that new partitions are not automatically discovered by the Glue crawler. The crawler runs on a schedule every hour. What is the MOST likely reason for the missing partitions?

Accepted Answer

The IAM role used by the crawler does not have permission to list the S3 bucket.. The IAM role used by the crawler must have permissions to list the S3 bucket and read its objects. Without s3:ListBucket permission, the crawler cannot discover new partitions in the bucket, even if it runs on schedule. Option B is incorrect because the crawler does not need a Hive metastore connection to discover partitions in S3; it can update the Glue Data Catalog directly. Option C is incorrect because the partition limit is 1,000,000 (not 100,000) per table, and the scenario does not indicate that limit is reached. Option D is incorrect because running the crawler every hour is a reasonable frequency; if permissions are correct, it should discover new partitions at that interval.

Answer

The Glue Data Catalog is not configured to use a Hive metastore.

Answer

The number of partitions exceeds the Glue catalog limit of 100,000.

Answer

The crawler schedule is set to run too frequently.

Question 8

A financial services company runs a critical data pipeline using AWS Step Functions to orchestrate multiple AWS Lambda functions and AWS Glue jobs. The pipeline processes transaction data and must complete within 15 minutes to meet a service-level agreement (SLA). Recently, the pipeline has been failing intermittently with a 'StateMachineExecutionLimitExceeded' error. The Step Functions state machine is configured with a Standard type. The company has a single state machine that runs on demand. The error occurs when multiple requests are submitted simultaneously. What should the team do to prevent this error?

Accepted Answer

Request a service quota increase for concurrent executions of Standard Workflows.. The 'StateMachineExecutionLimitExceeded' error indicates that the account-level limit for concurrent Standard Workflow executions has been reached. The default limit is 1,000 concurrent executions per account per region. To handle simultaneous submissions, requesting a service quota increase is the appropriate action. Option A (increasing timeout) does not affect concurrent execution limits. Option B (switching to Express Workflow) is not ideal because Express Workflows have a maximum duration of 5 minutes, which cannot meet the 15-minute SLA, and the error is not about throughput but about concurrency limits. Option D (increasing Lambda reserved concurrency) is unrelated to Step Functions execution limits.

Answer

Increase the state machine execution timeout to 30 minutes.

Answer

Switch the state machine type to Express Workflow to handle higher throughput.

Answer

Increase the Lambda function reserved concurrency to 100.

Question 9

A data engineer is tasked with reducing costs for an Amazon Redshift cluster. The cluster is used for both ETL workloads and BI reporting. The engineer observes that the cluster is over-provisioned during off-peak hours. Which action would be MOST effective in reducing costs while maintaining performance during peak hours?

Accepted Answer

Enable concurrency scaling to automatically add cluster capacity during peak hours.. Concurrency scaling adds additional capacity on demand and is cost-effective for variable workloads. Option A is incorrect because RA3 nodes with managed storage are more about storage scaling and may not directly reduce costs for variable workloads as effectively. Option C is incorrect because Reserved Instances require upfront payment and are best for steady-state, not variable workloads. Option D is incorrect because reducing node count may impact performance during peak hours.

Answer

Switch to RA3 node types for managed storage.

Answer

Purchase Reserved Instances for the cluster.

Answer

Reduce the number of nodes in the cluster.

Question 10

A data engineer is troubleshooting an Amazon Redshift cluster that is running slowly. The cluster has 4 dc2.large nodes. The engineer runs a query that scans a large table and notices that the query uses only a single slice instead of all slices. The table is distributed with DISTSTYLE ALL. What is the most likely reason for the query using only one slice?

Accepted Answer

The table uses DISTSTYLE ALL, which stores the entire table on a single slice per node.. DISTSTYLE ALL replicates the entire table to every node, but within each node, the data is stored on a single slice. For dc2.large nodes, which have 2 slices per node, this means that a full table scan will only use one slice per node, not all available slices. This leads to underutilization and slow query performance. Option A is incorrect because the leader node does not execute data queries; it only coordinates them. Queries are executed on compute nodes. Option C is incorrect because WLM queue slots control concurrency, not the number of slices used by a single query. Option D is incorrect because sort keys affect data ordering and compression, not slice distribution.

Answer

The query is running on the leader node instead of the compute nodes.

Answer

The workload management (WLM) queue is configured with a single query slot.

Answer

The table does not have a sort key defined.

Question 11

A company uses Amazon DynamoDB as a data store for a real-time dashboard application. The application performs point lookups and range queries on a table that has a partition key and sort key. The table uses on-demand capacity mode. Recently, the application's response time has increased, and CloudWatch metrics show high 'ThrottledRequests' for the table. The application uses the AWS SDK with default retry settings. The data access pattern is read-heavy with occasional spikes. What is the most effective way to reduce throttling?

Accepted Answer

Implement exponential backoff with jitter in the application code.. DynamoDB on-demand mode can throttle requests when traffic exceeds the table's previous peak by more than double. Implementing exponential backoff with jitter in the application code allows retries to spread out and succeed without overwhelming the table. Option A is incorrect because switching to provisioned capacity requires accurate capacity planning and may still throttle during unexpected spikes. Option B is incorrect because DAX caches frequently read items, reducing read load, but it does not directly address throttling caused by exceeding the table's throughput limits; it also adds cost and complexity. Option C is incorrect because increasing read capacity units applies only to provisioned capacity mode, not on-demand.

Answer

Switch the table to provisioned capacity and set the read capacity units to a high value.

Answer

Enable DynamoDB Accelerator (DAX) to cache frequently read items.

Answer

Increase the read capacity units to a higher value.

Question 12

A company uses Amazon S3 to store log files from multiple applications. The logs are encrypted with AWS KMS (SSE-KMS). A data engineer needs to grant a new IAM user read-only access to the logs. The engineer attaches an S3 bucket policy that allows s3:GetObject and a KMS key policy that allows kms:Decrypt. However, the user still receives an 'Access Denied' error when trying to download an object. What is the MOST likely missing permission?

Accepted Answer

The user's IAM policy does not include kms:Decrypt permission.. To use SSE-KMS, the user needs kms:Decrypt, but also the IAM policy must allow kms:Decrypt, not just the key policy. The key policy alone is not sufficient if the IAM user's policy denies or does not allow the action. Option A is incorrect because s3:ListBucket is for listing, not downloading. Option B is incorrect because s3:GetObjectVersion is for versioned buckets. Option D is incorrect because kms:GenerateDataKey is for encryption, not decryption.

Answer

The user does not have s3:ListBucket permission on the bucket.

Answer

The user does not have s3:GetObjectVersion permission.

Answer

The user does not have kms:GenerateDataKey permission.

Question 13

A company runs a data lake on Amazon S3 with AWS Lake Formation for access control. The data lake contains sensitive customer information. A data scientist needs to query the data using Amazon Athena. The data scientist has been granted SELECT permission on the database and tables via Lake Formation. However, when the data scientist runs a query in Athena, they receive an error: 'Access denied. Please check your permissions.' The IAM role used by Athena has the following permissions: s3:GetObject, s3:ListBucket, and lakeformation:GetDataAccess. The Lake Formation admin has verified that the data scientist is a member of a Lake Formation data lake location and has been granted 'Describe' and 'Select' permissions on the table. What is the most likely reason for the access denied error?

Accepted Answer

The S3 bucket policy does not grant the Athena IAM role access to the S3 location.. The access denied error occurs because the IAM role used by Athena lacks the necessary S3 permissions, even though Lake Formation has granted SELECT and DESCRIBE permissions. Lake Formation handles permissions at the metadata level, but the actual data access still requires S3 bucket policy or IAM policy to allow s3:GetObject and s3:ListBucket for the specific S3 location. If the bucket policy does not grant the Athena IAM role access to the S3 location, the request will be denied. Option B correctly identifies this issue. Option A is incorrect because Lake Formation tag-based access control is not required for this scenario; the data scientist already has direct table permissions. Option C is incorrect because lakeformation:GetEffectivePermissions is not needed; the role already has lakeformation:GetDataAccess. Option D is incorrect because Athena uses the IAM role assigned to the workgroup, not the data scientist's individual IAM user.

Answer

The data scientist is not assigned to the correct Lake Formation tag.

Answer

The Athena IAM role is missing lakeformation:GetEffectivePermissions permission.

Answer

The data scientist's IAM user lacks the necessary S3 permissions.

Question 14

A data engineer is designing a disaster recovery plan for an Amazon RDS for MySQL database. The database must have a Recovery Point Objective (RPO) of less than 5 minutes and a Recovery Time Objective (RTO) of less than 30 minutes. Which TWO actions should the engineer take to meet these requirements?

Accepted Answer

Enable automated backups with a 1-day retention period and point-in-time recovery.. Options A and B are correct. Multi-AZ deployment (B) provides automatic failover to a standby in a different Availability Zone, meeting the RTO of less than 30 minutes. Automated backups with point-in-time recovery (A) allow recovery to any point within the retention period, enabling an RPO of less than 5 minutes. Option C is wrong because automated backups have a minimum retention of 1 day; you cannot set a 5-minute retention. Option D is wrong because a cross-Region read replica requires manual promotion and does not provide automatic failover, resulting in higher RTO. Option E is wrong because a single-AZ instance without Multi-AZ does not provide automatic failover, leading to RTO exceeding 30 minutes.

Answer

Enable automated backups with a 5-minute retention period.

Answer

Create a cross-Region read replica.

Answer

Use a single-AZ instance with a standby in another Region.

Question 15

A company uses Amazon S3 to store log files from multiple applications. The logs are written in JSON format. A data engineer wants to use Amazon Athena to query these logs. The logs are stored in a bucket with the following structure: 's3://logs/app1/date=2021-01-01/'. The engineer creates an Athena table with partitions. However, when querying, Athena returns zero results for partitions that exist. The engineer has run MSCK REPAIR TABLE to add partitions. What is the most likely cause of the issue?

Accepted Answer

The partition key name in the table definition does not match the S3 folder naming convention.. The most likely cause is that the partition key name in the Athena table definition does not match the S3 folder naming convention. When using MSCK REPAIR TABLE, Athena relies on the partition folder structure (e.g., 'date=2021-01-01') to automatically add partitions. If the table's partition key is named differently (e.g., 'dt' instead of 'date'), MSCK REPAIR will not recognize the folders and will not register the partitions, resulting in zero results. Option A is incorrect because MSCK REPAIR does not fail silently; it either adds partitions or reports none if the structure doesn't match. Option C is incorrect because Athena fully supports JSON format. Option D is incorrect because the bucket location does not affect partition registration; data can be queried in any bucket as long as the table points to it.

Answer

The MSCK REPAIR TABLE command failed silently.

Answer

The log files are in JSON format and Athena does not support JSON.

Answer

The log files need to be copied to a different bucket in the same region.