DEA-C01 Data Operations and Support Practice Test 7 — 15 Questions

Question 1

A data engineer is investigating a failed AWS Glue job. The engineer runs the CLI command shown in the exhibit to retrieve the latest log stream. The output shows storedBytes: 0. What does this indicate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Glue job failed before writing any log events to CloudWatch.. StoredBytes: 0 means no log events were stored, likely because the job failed before writing any logs or logging was not enabled. Option A is wrong because logs are not expired; they were never written. Option B is wrong because the stream exists. Option D is wrong because the command retrieved the latest stream.

Answer

The log stream is from a different Glue job.

Answer

The log stream is empty because the job is still running.

Answer

The log stream has been expired and deleted.

Question 2

A data engineer runs an AWS Glue ETL job that reads from an S3 bucket containing JSON files. The job fails with an error indicating that some records are malformed. The engineer wants to skip the malformed records and continue processing. Which approach should the engineer take?

Accepted Answer

Configure the Glue DynamicFrame to use the `withErrorThreshold` option to skip corrupt records.. AWS Glue DynamicFrames support error handling through the `withErrorThreshold` option (or the `errorThreshold` parameter in `getSource`), which allows the job to continue processing when a specified number of malformed records are encountered. When the threshold is set, Glue logs the bad records to an error collection rather than failing the entire job. This is the native, built-in mechanism for skipping corrupt records during ETL without pre-processing or format conversion.

Answer

Pre-process the JSON files to correct the malformed records before Glue reads them.

Answer

Convert the JSON files to Parquet format and use Glue to read Parquet.

Answer

Use AWS Glue Schema Registry to reject invalid records.

Question 3

A data engineering team notices that an AWS Glue ETL job fails intermittently with a 'ThrottlingException' error. The job reads from an Amazon S3 bucket and writes to an Amazon Redshift table. What is the MOST likely cause of this error?

Accepted Answer

The Redshift cluster's write throughput is exceeding its provisioned capacity.. The 'ThrottlingException' in this context is most likely caused by the Redshift cluster's write throughput exceeding its provisioned capacity. When Glue writes to Redshift, it uses JDBC connections and issues COPY or INSERT commands; if the cluster's WLM queues or concurrency limits are saturated, Redshift returns a throttling error. This is a common bottleneck when Glue jobs push large volumes of data into Redshift without adequate cluster sizing or workload management.

Answer

The S3 bucket's request rate is exceeding the bucket's performance limits.

Answer

The Glue job is exceeding the maximum number of concurrent runs allowed.

Answer

The Glue job's allocated memory is insufficient for the data volume.

Question 4

A company runs an Amazon DynamoDB table with on-demand capacity. A new reporting application performs frequent Scan operations on the table, causing occasional 'ProvisionedThroughputExceededException' errors. The operations team needs to resolve this with minimal cost. What should they do?

Accepted Answer

Create a global secondary index (GSI) on the attributes used in the reporting queries.. Creating a global secondary index (GSI) on the attributes used in the reporting queries allows the reporting application to use Query operations instead of expensive Scan operations. This reduces the read capacity consumption and avoids partition-level throttling, which is the cause of the 'ProvisionedThroughputExceededException' errors. On-demand tables have per-partition throughput limits, and frequent Scans can exceed those limits. Option A is incorrect because increasing the maximum read capacity via AWS Support is not applicable to on-demand tables; on-demand scaling is automatic but per-partition limits still apply. Option B is incorrect because switching to provisioned capacity would require careful capacity planning and would likely increase costs compared to using a GSI. Option C is incorrect because DAX can cache data and reduce read load, but it does not eliminate the inefficiency of Scan operations; the root cause is the Scan itself, which can be avoided by using a GSI to enable efficient queries.

Answer

Increase the table's maximum read capacity by requesting a limit increase from AWS Support.

Answer

Switch the table to provisioned capacity and increase the read capacity units.

Answer

Enable DynamoDB Accelerator (DAX) to cache the Scan results.

Question 5

A data engineer is troubleshooting a failed Amazon Kinesis Data Firehose delivery stream. The stream is configured to deliver data to an Amazon S3 bucket. The error log shows: 'The destination S3 bucket's bucket policy does not allow the firehose to put objects.' What is the MOST likely issue?

Accepted Answer

The S3 bucket policy does not include an Allow statement for the firehose to put objects.. The error states the bucket policy does not allow the firehose to put objects. The solution is to add an Allow statement in the bucket policy granting the firehose's IAM role permission to execute s3:PutObject. Option A is incorrect because the error is about bucket policy, not ACLs. Option B is incorrect because the error is already about permissions. Option D is incorrect because the issue is at the S3 bucket policy level, not IAM role trust policy.

Answer

The S3 bucket's ACL is configured to deny write access to the firehose.

Answer

The IAM role used by Firehose does not have the necessary permissions.

Answer

The IAM role's trust policy does not allow Firehose to assume the role.

Question 6

A company uses Amazon RDS for MySQL as a source for AWS DMS. The replication tasks are failing due to large transactions on the source. The team wants to reduce the impact of large transactions on DMS. Which THREE actions should the team take?

Accepted Answer

Increase the size of the source RDS instance and enable binary logging with ROW format.. Option B is correct because large transactions on the source RDS for MySQL instance can exhaust CPU, memory, and I/O resources; scaling up the instance provides more headroom, and binary logging in ROW format is required for DMS to capture changes efficiently at the row level, reducing the burden of reconstructing statements. Option C is correct because enabling BatchApply in the DMS task settings groups changes into batches and applies them transactionally on the target, which reduces the overhead and impact of replaying large transactions during change data capture. Option E is correct because tuning the DMS task with a larger memory limit and adjusting the transaction size (for example, via ChangeProcessingTuning parameters such as MemoryLimit and MinTransactionSize/MaxTransactionSize) allows DMS to buffer and process large transactions without failing or overloading resources. Option A is not correct because increasing parallel threads on the source does not reduce the impact of large transactions and may actually increase load on the source database. Option D is not correct because using 'full load only' would stop ongoing replication and does not address the impact of large transactions during CDC; it simply avoids the problem by not replicating changes.

Answer

Increase the number of parallel threads on the source.

Answer

Use the 'full load only' migration type.

Question 7

A data engineer is monitoring an Amazon Redshift cluster and notices that some queries are experiencing high disk usage and slow performance. The engineer wants to identify the queries that are causing the most disk spills to temporary files. Which system table should the engineer query to get this information?

Accepted Answer

SVL_QUERY_SUMMARY. SVL_QUERY_SUMMARY is the correct system table because it provides per-query summary statistics including rows, bytes, and — critically — disk-based spill metrics such as rows and bytes written to temporary files. It aggregates query execution metrics at the query level, making it the right place to identify which queries are spilling to disk and causing performance degradation.

Answer

SYS_QUERY_DETAIL

Answer

STL_SCAN

Answer

STV_TBL_PERM

Question 8

A company uses Amazon S3 to store sensitive data. The security team requires that all data in transit between on-premises applications and S3 be encrypted. The data engineer must implement a solution that meets this requirement without changing the applications. Which TWO solutions should the engineer consider? (Choose two.)

Accepted Answer

Use an S3 VPC Endpoint and enforce the use of HTTPS through bucket policies.. Option D is correct because an S3 gateway VPC endpoint (or interface endpoint) combined with a bucket policy that denies requests where aws:SecureTransport is false enforces HTTPS/TLS for data in transit to S3, and it requires no application changes since the endpoint is transparent to clients. Option E is correct because AWS Storage Gateway (File Gateway) presents S3 as an NFS/SMB file share and encrypts data in transit to AWS over HTTPS/TLS, so on-premises applications keep using standard file protocols while the traffic to S3 is encrypted. Option A is wrong because S3 Transfer Acceleration only speeds up uploads via AWS edge locations; it does not itself guarantee encryption in transit. Option B is wrong because default encryption applies server-side encryption at rest, not encryption of data in transit. Option C is wrong because SSE-S3 also provides encryption at rest only, leaving data in transit unprotected.

Answer

Enable S3 Transfer Acceleration on the bucket.

Answer

Enable default encryption on the S3 bucket.

Answer

Use server-side encryption with S3 managed keys (SSE-S3).

Question 9

A data engineer has attached the IAM policy shown in the exhibit to a role used by an AWS Glue ETL job. The job fails when trying to write to the S3 bucket 'example-bucket' with the error: 'Access Denied'. What is the MOST likely reason?

Accepted Answer

The S3 bucket policy denies the PutObject action for the role.. Even if the IAM policy allows s3:PutObject on the bucket, the S3 bucket policy can explicitly deny the action for the role, resulting in 'Access Denied'. The exhibit shows the IAM policy grants s3:PutObject, so the error must stem from the bucket policy. Option A is incorrect because the IAM policy does include the bucket ARN for write operations. Option B is incorrect because a trust policy failure would prevent role assumption and produce a different error, not an S3 access denied. Option D is incorrect because the IAM policy does grant s3:PutObject permission.

Answer

The IAM policy does not include the bucket ARN for write operations.

Answer

The IAM role's trust policy does not allow Glue to assume the role.

Answer

The IAM policy does not grant s3:PutObject permission.

Question 10

A company uses Amazon DynamoDB as the primary data store for a real-time application. The data engineer observes that some read requests are returning stale data, even though the application uses strongly consistent reads. The table has auto-scaling enabled with a maximum read capacity of 10,000 RCUs. The observed read traffic averages 8,000 RCUs but occasionally spikes to 12,000 RCUs. What is the most likely cause of the stale reads?

Accepted Answer

Read capacity auto-scaling cannot keep up with sudden traffic spikes, causing throttling and fallback to eventually consistent reads.. When read traffic spikes above the maximum auto-scaling limit of 10,000 RCUs (e.g., to 12,000 RCUs), the table cannot provision enough read capacity units quickly enough. This leads to throttling of requests. The AWS SDKs are designed to retry throttled requests, and under certain conditions, they may fall back to eventually consistent reads to reduce latency, which can return stale data. This explains why stale data appears even when the application explicitly requests strongly consistent reads. Option B is incorrect: write sharding does not inherently cause read-after-write inconsistencies; DynamoDB's strong consistency guarantees hold if capacity is sufficient. Option C is incorrect: DAX is a caching layer that provides eventual consistency by default; strongly consistent reads bypass DAX and go directly to the table, so DAX is not involved. Option D is incorrect: global tables replicate data asynchronously, but the statement says the application uses a single table; moreover, reading from a replica region would use eventually consistent reads only if configured, but the question states strongly consistent reads are used.

Answer

The application uses write sharding, causing read-after-write inconsistencies.

Answer

The application is using DynamoDB Accelerator (DAX) which caches data and may return stale values.

Answer

The table is part of a DynamoDB global table, and the application reads from a replica in a different region.

Question 11

A data engineer needs to implement a data pipeline that ingests data from an on-premises database using AWS DMS and loads it into Amazon S3 in Parquet format. The data should be encrypted at rest in S3 using a customer-managed KMS key. Which combination of actions should the engineer take? (Choose the correct course of action.)

Accepted Answer

Configure the DMS task to write to S3 in Parquet format, and specify the KMS key ID in the S3 endpoint settings.. The correct course of action is to configure the DMS task to write to S3 in Parquet format and specify the KMS key ID in the S3 endpoint settings. AWS DMS supports writing to Amazon S3 in Parquet format directly, and the S3 endpoint settings allow you to specify a customer-managed KMS key for encryption at rest. This meets both requirements: Parquet format and encryption with a customer-managed KMS key, without additional transformation steps.

Answer

Set up an EC2 instance to run a script that reads from the source and writes Parquet to S3 with KMS encryption.

Answer

Use DMS to write JSON to S3, then use an AWS Glue job to convert to Parquet and enable KMS encryption on the Glue job.

Answer

Configure the S3 bucket policy to require KMS encryption for all objects, and use DMS with default settings.

Question 12

A data engineer is troubleshooting an Amazon Redshift cluster that has experienced a node failure. The engineer needs to ensure that the cluster is highly available and can withstand a single node failure with minimal downtime. Which TWO actions should the engineer take?

Accepted Answer

Enable automated snapshots with cross-region copy.. Option A is correct because automated snapshots with cross-region copy provide a recovery mechanism that allows the cluster to be restored in another AWS Region if the primary Region or cluster suffers a failure, supporting high availability and minimizing downtime. Option E is correct because a multi-node cluster with RA3 node types distributes data and compute across multiple nodes, so the failure of a single node does not take down the entire cluster; Redshift automatically detects the failure and can recover the node, maintaining availability. Option B is not correct because concurrency scaling only adds transient compute capacity for read workloads and does not protect against node failure. Option C is not correct because a single-node cluster has no redundancy and cannot withstand a node failure. Option D is not correct because placing the cluster in a public subnet with an internet gateway affects network accessibility, not the cluster's ability to survive a node failure.

Answer

Enable concurrency scaling to handle increased read traffic.

Answer

Deploy the cluster as a single-node cluster for simplicity.

Answer

Place the cluster in a public subnet with an internet gateway.

Question 13

A data engineer notices that an Amazon S3 bucket policy is overly permissive. What is the best practice to restrict access while maintaining required permissions?

Accepted Answer

Write a new bucket policy that denies all actions.. The bucket policy is overly permissive, so writing a new bucket policy that denies all actions immediately restricts all access. While this may temporarily block required permissions, it is the most direct way to address the bucket policy issue; you can then refine the policy to allow only necessary actions. Option D does not change the bucket policy and thus does not resolve the problem. Option A makes permissions even more permissive. Option C is not a standard AWS feature.

Answer

Grant full S3 access using a new IAM policy.

Answer

Use an S3 blocklist to restrict access.

Answer

Attach the AWS managed policy AmazonS3ReadOnlyAccess to the IAM user.

Question 14

A company is using Amazon Kinesis Data Analytics (now part of Amazon Managed Service for Apache Flink) for streaming data processing. The application is experiencing high latency and the data engineer wants to improve performance. Which THREE actions should the engineer consider? (Choose three.)

Accepted Answer

Use a larger Kinesis data stream with more shards.. Options A, C, and D are correct. Increasing the number of shards in the Kinesis stream (A) increases the ingestion capacity, which can reduce bottlenecks and lower latency. Increasing Flink parallelism (C and D) allows more parallel processing of data, improving throughput and reducing latency. Option B is incorrect because decreasing the buffer time in Flink can lead to increased network overhead and may not improve overall performance; it can actually increase latency due to more frequent data transfers. Option E is incorrect because decreasing the checkpoint interval increases the frequency of state snapshots, adding overhead and potentially increasing latency rather than reducing it.

Answer

Decrease the buffer time in the Flink application to reduce latency.

Answer

Decrease the checkpoint interval to reduce state size.

Question 15

A company uses AWS Lake Formation to manage data lake permissions. A data engineer needs to grant a group of analysts SELECT permission on a set of tables in the 'analytics' database, but only for columns that are not classified as 'PII'. Which approach should the engineer use?

Accepted Answer

Use Lake Formation tag-based access control (LF-TBAC) to grant SELECT on columns without the 'PII' tag.. Lake Formation tag-based access control (LF-TBAC) allows you to define tags (e.g., PII) and grant permissions based on those tags. You can grant SELECT on columns that do not have the 'PII' tag, effectively excluding PII columns. This is the most scalable and granular approach for column-level security in Lake Formation.

Answer

Grant SELECT on the entire database and rely on analysts to avoid PII columns.

Answer

Create an IAM policy that denies access to PII columns.

Answer

Use an S3 bucket policy to restrict access to objects containing PII data.