DEA-C01 Data Operations and Support Practice Test 25 — 15 Questions

Question 1

A company uses AWS Kinesis Data Firehose to deliver streaming data to an Amazon S3 bucket. Recently, the delivery stream has been failing with the error 'S3 bucket does not exist'. The S3 bucket exists and the Firehose IAM role has s3:PutObject permissions. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The S3 bucket is in a different AWS Region than the Firehose stream.. The most likely cause is that the S3 bucket is in a different AWS Region than the Firehose stream. AWS Kinesis Data Firehose requires the destination S3 bucket to be in the same region as the delivery stream. If the bucket is in a different region, Firehose will fail with a 'S3 bucket does not exist' error even though the bucket exists. Option A is incorrect because a misspelled bucket name would cause a similar error, but the error message specifically says the bucket does not exist, which can also happen if the bucket is in a different region. Option B is incorrect because default encryption does not affect the bucket's existence; Firehose can write to encrypted buckets with the proper permissions. Option D is incorrect because s3:ListBucket permission is not required for Firehose to deliver data; s3:PutObject is sufficient.

Answer

The S3 bucket name is misspelled in the Firehose configuration.

Answer

The S3 bucket has default encryption enabled.

Answer

The IAM role does not have s3:ListBucket permission.

Question 2

A data engineer is monitoring an Amazon Kinesis Data Stream used to ingest clickstream data. The engineer notices that the stream's 'WriteProvisionedThroughputExceeded' metric is frequently above zero. Which TWO actions could help mitigate this issue? (Choose TWO.)

Accepted Answer

Increase the number of shards in the stream.. Options A and D are correct. Increasing the number of shards in the stream increases the write capacity, reducing the 'WriteProvisionedThroughputExceeded' metric. Implementing a random prefix for the partition key helps distribute data writes evenly across all shards, preventing hot shards. Option B is incorrect because reducing the data retention period does not affect write throughput; it only changes how long data is stored. Option C is incorrect because decreasing the number of shards would reduce write capacity, potentially worsening the issue. Option E is incorrect because enabling enhanced fan-out increases read capacity, not write capacity.

Answer

Reduce the data retention period to free up capacity.

Answer

Decrease the number of shards to reduce overhead.

Answer

Enable enhanced fan-out on the stream.

Question 3

A data engineer is troubleshooting an AWS Glue ETL job that fails with an 'Access Denied' error when trying to write to an S3 bucket. The IAM role used by the job has the policy shown in the exhibit. The bucket 'my-bucket' uses S3 default encryption with AWS KMS. What is the most likely missing permission?

Accepted Answer

kms:GenerateDataKey and kms:Decrypt. When an S3 bucket uses AWS KMS for default encryption, any write operation requires the IAM role to have kms:GenerateDataKey and kms:Decrypt permissions on the KMS key. The policy in the exhibit grants s3:PutObject but does not include any KMS actions, resulting in an 'Access Denied' error. Option A (s3:GetObjectVersion) is not needed for writing. Option B (glue:GetObject) is not a valid AWS action. Option C (s3:ListBucketMultipartUploads) is not required for a write operation. Option D (s3:PutObjectAcl) is unnecessary unless the job explicitly sets ACLs.

Answer

s3:GetObjectVersion

Answer

glue:GetObject

Answer

s3:ListBucketMultipartUploads

Answer

s3:PutObjectAcl

Question 4

A company runs a data pipeline that ingests streaming data from an IoT fleet into Amazon Kinesis Data Streams (KDS) with 50 shards. A Lambda function processes records from the stream and writes them to an Amazon DynamoDB table for real-time analytics. The Lambda function is configured with a batch size of 100 and a maximum batching window of 60 seconds. Recently, the company has been seeing an increasing number of 'WriteProvisionedThroughputExceededException' errors from DynamoDB, causing Lambda to retry and eventually send records to a dead-letter queue (DLQ). The DynamoDB table is provisioned with 5000 read capacity units (RCU) and 5000 write capacity units (WCU). The average item size is 1 KB. The KDS stream receives an average of 8000 records per second, each 2 KB in size. The Lambda function performs a simple transformation and writes each record individually to DynamoDB. The company wants to reduce the throttling errors without increasing the DynamoDB WCU provision. Which course of action is most likely to achieve this?

Accepted Answer

Increase the Lambda batch size to 500 and reduce the batching window to 30 seconds.. Increasing the Lambda batch size to 500 reduces the number of Lambda invocations per second from approximately 80 to 16, and reducing the batching window to 30 seconds helps spread writes more evenly across time. This lowers the concurrency of write operations to DynamoDB, which can reduce the frequency of 'WriteProvisionedThroughputExceededException' errors by staying within the provisioned 5000 WCU more consistently, even though the total write capacity required (16000 WCU) exceeds provisioned. Options A and B do not reduce the write load—batching writes (A) still consumes the same WCU, and increasing concurrency (B) worsens throttling. Option C is irrelevant as timeout does not affect write rate.

Answer

Modify the Lambda function to use DynamoDB BatchWriteItem to write records in batches of 25.

Answer

Increase the Lambda function's reserved concurrency to 1000.

Answer

Increase the Lambda function timeout to 5 minutes to allow more time for retries.

Question 5

A data engineer manages an Amazon Redshift cluster that hosts a 10 TB data warehouse. The cluster uses a single node of type dc2.large (160 GB SSD). The engineer notices that the cluster's disk space is 95% full, and queries are running slowly. The engineer runs the STV_PARTITIONS view and sees that many slices have high 'tossed' counts. The engineer also runs VACUUM and ANALYZE commands, but the disk space does not improve. The engineer suspects that the cluster needs more storage. However, the company wants to minimize cost. Which action should the engineer take to resolve the disk space issue most cost-effectively?

Accepted Answer

Replace the cluster with a single ds2.xlarge node.. The current cluster uses a single dc2.large node with only 160 GB SSD, which is nearly full. Replacing it with a single ds2.xlarge node provides 2 TB HDD storage, offering a significant capacity increase at a lower cost per GB compared to other options. Option A is wrong because switching to RA3 nodes introduces managed storage with higher costs and is unnecessary for this capacity need. Option C is wrong because scaling to a single dc2.8xlarge node provides 2.56 TB SSD but is more expensive than the ds2.xlarge option. Option D is wrong because adding another dc2.large node only doubles the storage to 320 GB, which may not be sufficient and still leaves the cluster with limited SSD capacity, while also increasing CPU and memory unnecessarily.

Answer

Switch to a ra3.xlplus node with managed storage.

Answer

Scale the cluster to a single dc2.8xlarge node.

Answer

Add another dc2.large node to the cluster to increase total storage.

Question 6

A company uses AWS Glue to run ETL jobs that process data from an Amazon RDS for MySQL database and load it into an Amazon S3 data lake. The Glue job runs daily and processes incremental data. Recently, the job has been taking longer than expected. The engineer checks the CloudWatch logs and sees that the job is spending most of its time on the 'Reading from JDBC' phase. The MySQL table has 10 million rows and is indexed on the primary key. The Glue job uses a 'job bookmark' to track processed data. The engineer wants to improve the performance of the read phase. Which action is most likely to help?

Accepted Answer

Modify the job to use a 'query' parameter that selects only the new or modified rows based on a timestamp column.. Modifying the job to use a 'query' parameter with a WHERE clause that filters on a timestamp column (the bookmark key) allows AWS Glue to read only the new or modified rows, reducing the amount of data transferred from the database and significantly improving read performance. Option A is wrong because increasing the JDBC 'fetchSize' parameter can improve throughput per connection but does not address the root cause of reading all 10 million rows; it may also cause memory issues if set too high. Option B is wrong because disabling job bookmarks and performing a full refresh would reprocess all data, making the job even slower and defeating the purpose of incremental processing. Option C is wrong because increasing the number of DPUs adds parallelism but does not reduce the volume of data read; the database can still become a bottleneck when reading the entire table.

Answer

Increase the JDBC 'fetchSize' parameter to 10000.

Answer

Disable job bookmark and perform a full refresh each time.

Answer

Increase the number of DPUs for the Glue job.

Question 7

A data engineering team is troubleshooting a failing AWS Glue ETL job that processes data from an S3 bucket. The job writes output to another S3 bucket. The job fails with an AccessDenied error when writing to the output bucket. The IAM role used by the job has the following policy attached: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:GetObject","s3:ListBucket"],"Resource":["arn:aws:s3:::input-bucket/*","arn:aws:s3:::input-bucket"]}]}. What is the most likely cause of the failure?

Accepted Answer

The IAM role does not have s3:PutObject permission on the output bucket.. The IAM policy only grants s3:GetObject and s3:ListBucket permissions on the input bucket, but the job also needs permission to write to the output bucket. The missing s3:PutObject permission on the output bucket causes the AccessDenied error. Therefore, Option C is correct. Option A is incorrect because there is no data size restriction. Option B is incorrect because the error is due to missing IAM permissions, not a bucket policy. Option D is incorrect because the role exists.

Answer

The ETL job is processing more than 10 TB of data.

Answer

The output bucket has a bucket policy that denies access to the IAM role.

Answer

The IAM role used by the job does not exist.

Question 8

A company uses Amazon Kinesis Data Streams to ingest real-time clickstream data. The data is consumed by an AWS Lambda function that processes records and stores results in Amazon DynamoDB. Recently, the Lambda function has been failing with ProvisionedThroughputExceededException errors. Which action should the data engineer take to resolve this issue?

Accepted Answer

Enable auto scaling on the DynamoDB table to handle increased write capacity.. Enabling DynamoDB auto scaling dynamically adjusts throughput to match demand. Option B is wrong because reducing the number of shards would lower the ingestion rate, which is not appropriate for handling high traffic. Option C is wrong because increasing the batch size in the Lambda event source mapping would process more records per invocation, but the underlying issue is DynamoDB throughput, not batch size. Option D is wrong because discarding records that cause throttling would lead to data loss.

Answer

Reduce the number of shards in the Kinesis stream to lower the ingestion rate.

Answer

Increase the batch size in the Lambda event source mapping to process more records per invocation.

Answer

Configure the Lambda function to discard records that cause throttling errors.

Question 9

A data pipeline uses AWS Glue to run ETL jobs that read from and write to an Amazon Redshift cluster. The pipeline recently started failing with the error 'ERROR: cannot execute INSERT in a read-only transaction'. The Glue job's IAM role has the necessary permissions. What could be the cause of this error?

Accepted Answer

The Glue job is using a transaction that was opened in read-only mode.. The error 'ERROR: cannot execute INSERT in a read-only transaction' occurs when attempting to write data within a transaction that was opened as read-only. In AWS Glue ETL jobs, if the Spark session is configured with `auto_commit=False` or if the job explicitly starts a read-only transaction (e.g., via `SET TRANSACTION READ ONLY`), any subsequent INSERT operation will fail. Option A correctly identifies this cause. Option B is incorrect because Redshift clusters do not enter a read-only mode during maintenance; instead, they are briefly unavailable. Option C is incorrect because Glue connections do not have a 'read-only' property; the connection string may set `defaultTransactionIsolation`, but not a read-only flag. Option D is incorrect because the IAM role has necessary permissions per the question stem, and insufficient permissions would produce a different error (e.g., permission denied).

Answer

The Redshift cluster is in read-only mode due to maintenance.

Answer

The Glue connection is configured with 'read-only' set to true.

Answer

The Glue job's IAM role does not have sufficient Redshift permissions.

Question 10

A data engineer is troubleshooting an AWS Glue ETL job that fails intermittently. The job is triggered by an AWS Lambda function that uses the IAM policy shown. The Lambda function invokes the Glue job, but sometimes the job does not start. Which action should the engineer take to ensure the job starts reliably?

Accepted Answer

Add the iam:PassRole permission for the IAM role used by the Glue job.. The Lambda function must have the `iam:PassRole` permission to pass the IAM role used by the AWS Glue job. Without this permission, the Glue job cannot assume the role required for execution, leading to intermittent failures when the job is invoked. Option A is incorrect because the resource `*` already allows starting the job, and the issue is not about resource restriction. Option B is incorrect because while S3 permissions may be necessary for the job's data access, they are not the cause of the job not starting. Option C is incorrect because batching job start requests does not address the underlying permission issue.

Answer

Replace the resource "*" in the Glue action with the specific Glue job ARN.

Answer

Add s3:GetObject and s3:PutObject permissions for the Glue job's output bucket.

Answer

Modify the Lambda function to batch multiple job start requests.

Question 11

A company uses Amazon S3 as a data lake. A data engineer needs to ensure that all objects uploaded to the 'incoming' prefix are automatically encrypted at rest using AWS KMS with a specific customer managed key. What is the simplest way to enforce this?

Accepted Answer

Use a bucket policy that denies PutObject requests without the required encryption header.. A bucket policy with a condition that denies PutObject requests unless the request includes the required encryption headers (x-amz-server-side-encryption: aws:kms and x-amz-server-side-encryption-aws-kms-key-id with the specific customer managed key ARN) enforces encryption at rest using that key. Option A (S3 Transfer Acceleration) only optimizes transfer speed, not encryption at rest. Option C (S3 Inventory) reports on encryption status but does not enforce it. Option D (default encryption with SSE-S3) uses S3-managed keys, not a customer managed KMS key, so it does not meet the requirement.

Answer

Enable S3 Transfer Acceleration to force encryption in transit.

Answer

Configure S3 Inventory to report on encryption status and alert on non-compliance.

Answer

Enable default encryption on the bucket with SSE-S3.

Question 12

A company uses Amazon Kinesis Data Firehose to deliver streaming log data to an Amazon S3 bucket. The delivery stream uses dynamic partitioning with a custom prefix. Recently, the delivery stream has been failing with the error 'InvalidArgumentException: The number of partitions exceeds the limit'. What is the likely cause?

Accepted Answer

The incoming data contains more distinct partition key values than the allowed limit.. The error 'InvalidArgumentException: The number of partitions exceeds the limit' occurs when Kinesis Data Firehose dynamic partitioning receives more distinct partition key values than the allowed limit (default 500 distinct values per stream). Option A correctly identifies this cause. Option B is wrong because S3 bucket policy restrictions would cause AccessDenied errors, not partition limit errors. Option C is wrong because buffer size and interval affect file size and delivery frequency, not partition count. Option D is wrong because throughput limits cause ProvisionedThroughputExceededException, not partition limit errors.

Answer

The S3 bucket has a bucket policy that restricts the number of prefixes.

Answer

The buffer size and interval are set too low, causing many small files.

Answer

The data volume exceeds the maximum throughput of the delivery stream.

Question 13

A data engineer needs to monitor the performance of an Amazon Redshift cluster. Which Amazon CloudWatch metric should the engineer monitor to detect disk space issues?

Accepted Answer

PercentageDiskSpace. Option C. PercentageDiskSpace is a direct CloudWatch metric that tracks the percentage of disk space used on the Redshift cluster, making it ideal for detecting disk space issues. ReadIOPS and WriteIOPS measure I/O operations per second and are not indicators of disk space usage. NetworkThroughput measures network traffic, and CPUUtilization measures compute usage; neither relates to disk space.

Answer

ReadIOPS

Answer

WriteIOPS

Answer

NetworkThroughput

Answer

CPUUtilization

Question 14

A company is using AWS Glue Data Catalog to store metadata about datasets in S3. The data engineer wants to implement a data governance solution that tracks lineage and versioning of datasets. Which TWO AWS services can be used together to achieve this?

Accepted Answer

AWS Lake Formation. The correct answers are B (AWS Lake Formation) and C (AWS Glue Data Catalog). AWS Lake Formation provides data lineage tracking and versioning capabilities for datasets in the data lake. AWS Glue Data Catalog serves as the central metadata repository and integrates with Lake Formation to enable governance features like lineage. Option A (AWS Data Pipeline) is a data orchestration service, not a governance tool. Option D (AWS CloudTrail) logs API calls but does not track data lineage or versioning. Option E (Amazon S3) is object storage and does not provide lineage or versioning by itself.

Answer

AWS Data Pipeline

Answer

AWS CloudTrail

Answer

Amazon S3

Question 15

A data engineer is designing a disaster recovery plan for an Amazon RDS for PostgreSQL database. The database is 500 GB and has a multi-AZ deployment. The recovery point objective (RPO) is 5 minutes, and the recovery time objective (RTO) is 2 hours. Which THREE actions should the engineer take to meet these objectives?

Accepted Answer

Enable Multi-AZ deployment for automatic failover.. Multi-AZ deployment provides automatic failover to a standby in another Availability Zone, meeting the RTO of 2 hours. Option B is correct because automated backups enable point-in-time recovery within the retention period, supporting the RPO of 5 minutes (default backup retention is 1 day, which is sufficient). Option E is correct because a cross-region read replica can be promoted to a standalone database in another region for faster disaster recovery if the primary region fails. Option C is wrong because manual snapshots exported to S3 are for long-term archival and not fast enough for a 2-hour RTO. Option D is wrong because disabling automated backups would prevent point-in-time recovery and violate the RPO of 5 minutes.

Answer

Take daily manual snapshots and export them to Amazon S3.

Answer

Disable automatic backups to reduce storage costs.