DEA-C01 Data Operations and Support Practice Test 8 — 15 Questions

Question 1

A data engineer is troubleshooting a slow Amazon Redshift query. The EXPLAIN plan shows a 'Seq Scan' on a large table. What is the most likely cause?

Accepted Answer

The table does not have a proper sort key defined.. A 'Seq Scan' in the EXPLAIN plan indicates a full table scan, which typically occurs when the table does not have a proper sort key defined. Without a sort key, Redshift cannot use zone maps to skip blocks, resulting in a sequential scan. Option A (too many nodes) would not cause a Seq Scan; it might improve performance if properly distributed. Option B (concurrent queries) can cause slowdown but not specifically a Seq Scan. Option D (WLM queue misconfiguration) affects query queuing and concurrency, not the scan type.

Answer

The cluster has too many nodes.

Answer

There are too many concurrent queries.

Answer

The workload management (WLM) queue is misconfigured.

Question 2

Refer to the exhibit. A data engineer has an IAM policy attached to an IAM role used by an AWS Glue job. The Glue job reads from S3 bucket 'example-bucket' and writes to an S3 bucket 'output-bucket'. The job fails with an 'Access Denied' error when writing to 'output-bucket'. What is the MOST likely cause?

Accepted Answer

The policy does not allow s3:PutObject on 'output-bucket'.. The Glue job fails with 'Access Denied' when writing to 'output-bucket', indicating the IAM policy lacks the necessary s3:PutObject permission for that bucket. The policy must explicitly allow s3:PutObject on the 'output-bucket' ARN. Without this permission, the write operation is denied.

Answer

The policy does not allow s3:PutObject on any bucket.

Answer

The policy does not allow s3:GetObject on 'output-bucket'.

Answer

The policy has a condition that restricts s3:PutObject to 'example-bucket'.

Question 3

A data engineer is designing a data pipeline that ingests JSON files from an S3 bucket, transforms them using AWS Glue, and loads into Amazon Redshift. The data is updated daily, and the pipeline must handle late-arriving data from the previous day. Which approach minimizes reprocessing?

Accepted Answer

Use AWS Glue job bookmarks to process only new files based on S3 event notifications.. AWS Glue job bookmarks track previously processed files and process only new or changed files, which handles late-arriving data without reprocessing all data. Option B uses Amazon Kinesis Data Firehose to stream data to Redshift; this is designed for real-time streaming, not a batch pipeline with daily updates, and does not inherently handle late-arriving data without custom logic. Option C (S3 versioning) can manage multiple versions but does not provide incremental processing for late-arriving data; it would require custom logic to determine which version to process. Option D (scheduling a full reload) would reprocess all data daily, which is inefficient and does not handle late-arriving data efficiently.

Answer

Stream data using Amazon Kinesis Data Firehose to Redshift.

Answer

Enable S3 versioning and process only the latest version of each object.

Answer

Schedule a full reload of all data from S3 to Redshift each day.

Question 4

Refer to the exhibit. A data engineer sees this error log from an Amazon EC2 instance that is trying to access an S3 bucket in the us-west-2 region. The EC2 instance is in a VPC with a private subnet and no internet gateway. What is the MOST likely cause of this error?

Accepted Answer

The VPC does not have a VPC endpoint for S3.. An EC2 instance in a private subnet with no internet gateway cannot reach S3's public endpoint, so it needs a VPC endpoint (gateway endpoint for S3) to route traffic privately to S3. Without the endpoint, the instance has no route to S3 and the request fails, which is the most likely cause of the error.

Answer

The S3 bucket is in a different region than us-west-2.

Answer

The S3 bucket does not exist.

Answer

The IAM role attached to the EC2 instance does not have s3:GetObject permission.

Question 5

An Amazon CloudWatch alarm is configured to monitor the CPUUtilization of an EC2 instance. The alarm state is 'INSUFFICIENT_DATA'. What is the most likely cause?

Accepted Answer

The EC2 instance is not sending metric data to CloudWatch.. INSUFFICIENT_DATA means no data points are available, often due to no metrics being published. Option B (evaluation periods set too low) would not cause this state; it might affect alarm transitions but not insufficient data. Option C (threshold set too high) is irrelevant to data availability. Option D (no alarm actions configured) does not affect data collection or alarm state.

Answer

The evaluation periods are set too low.

Answer

The alarm threshold is set too high.

Answer

The alarm does not have any actions configured.

Question 6

A data engineer notices that an AWS Glue ETL job is failing with a 'MemoryError' when processing a large dataset. Which approach should the engineer take to resolve this issue?

Accepted Answer

Increase the number of DPUs for the job.. Increasing the number of DPUs allocates more memory and processing capacity, which can resolve memory errors. Option B is incorrect because changing from Parquet to JSON typically increases memory usage due to less efficient encoding. Option C is incorrect because reducing partitions may increase memory pressure per partition. Option D is incorrect because S3 Select can filter data before loading but does not directly address the memory limitation in Glue; increasing DPUs is the more direct solution.

Answer

Change the source file format from Parquet to JSON.

Answer

Reduce the number of partitions in the source data.

Answer

Use S3 Select to filter data before processing.

Question 7

A data engineer needs to set up a cross-account access for an S3 bucket so that users in Account B can read objects. The bucket in Account A has a bucket policy that grants access. What additional step is required?

Accepted Answer

Create an IAM role in Account B and attach a policy that allows s3:GetObject for the bucket.. Cross-account S3 access requires both a bucket policy in the source account (Account A) that grants permissions to the target account or role, and an IAM role in the target account (Account B) with a policy allowing the necessary actions (e.g., s3:GetObject). This ensures that users in Account B can assume the role and access the bucket. Option A (enabling ACLs) is unnecessary and not recommended; ACLs are legacy and can be disabled. Option C (disabling Block Public Access) is not required because the bucket policy is not public; it only grants cross-account access to a specific role. Option D (lifecycle policy) is for object lifecycle management and does not provide access control.

Answer

Enable S3 object ACLs on the bucket.

Answer

Disable S3 Block Public Access settings on the bucket.

Answer

Set up an S3 Lifecycle policy to replicate objects to Account B.

Question 8

A company runs a production Amazon Redshift cluster. The data engineering team notices that queries are running slowly during peak hours. The cluster's CPU utilization is consistently above 80%. Which action should the engineer take to improve query performance?

Accepted Answer

Perform an elastic resize to add more nodes.. The cluster's CPU utilization is consistently above 80% during peak hours, indicating the cluster lacks sufficient compute capacity to handle the query workload. An elastic resize adds nodes (and thus compute and memory) to the cluster, directly addressing the resource bottleneck. Elastic resize is the fastest Redshift resize method, typically completing in minutes by redistributing data slices across the new node count.

Answer

Move some tables to Amazon Redshift Spectrum.

Answer

Re-distribute the tables using a different distribution key.

Answer

Enable concurrency scaling.

Question 9

A data engineer is designing a disaster recovery strategy for an Amazon RDS for MySQL database with Multi-AZ deployment. Which THREE actions should the engineer take to meet a Recovery Point Objective (RPO) of 5 minutes and a Recovery Time Objective (RTO) of 15 minutes? (Choose THREE.)

Accepted Answer

Enable automated backups with a retention period of 7 days.. Option A is correct because automated backups on Amazon RDS provide point-in-time recovery (PITR) with transaction logs captured approximately every 5 minutes, which directly supports the 5-minute RPO; the 7-day retention ensures those backups remain available for restore. Option B is correct because a cross-region read replica continuously replicates data to another AWS region, giving a low-RPO copy of the database that can be promoted to a standalone primary in minutes, satisfying both the 5-minute RPO and 15-minute RTO for regional disasters. Option E is correct because Multi-AZ deployment maintains a synchronous standby in a second Availability Zone with automatic failover, typically completing in 60–120 seconds, which meets the 15-minute RTO for AZ-level failures. Option C is incorrect because Single-AZ removes the synchronous standby and automatic failover, increasing both RTO and risk, which contradicts the DR requirements. Option D is incorrect because exporting snapshots to S3 in another region is a manual, periodic process that cannot deliver a 5-minute RPO or a 15-minute RTO.

Answer

Configure the DB instance to be Single-AZ for simplicity.

Answer

Export automated snapshots to an S3 bucket in a different region.

Question 10

A data engineer is troubleshooting a failed AWS Glue job that reads from an S3 bucket and writes to an Amazon Redshift table. The error message indicates 'Access Denied'. Which TWO permissions are likely missing? (Choose TWO.)

Accepted Answer

s3:GetObject on the source S3 bucket. Options A and B are required for the Glue job to read from S3 and write to Redshift. Option C (kms:Decrypt) is only needed if the S3 bucket or Redshift cluster uses KMS encryption. Option D (ec2:DescribeInstances) is unrelated to the Glue job's read/write permissions. Option E (lambda:InvokeFunction) is not used in this S3-to-Redshift data transfer.

Answer

kms:Decrypt on a KMS key

Answer

ec2:DescribeInstances on the Redshift cluster

Answer

lambda:InvokeFunction on a Lambda function

Question 11

A company uses Amazon Kinesis Data Streams to ingest real-time clickstream data. A Lambda function processes each record. Recently, the Lambda function has been failing with 'ProvisionedThroughputExceededException' when writing results to a DynamoDB table. The data engineer has already increased the DynamoDB write capacity. What else can the engineer do to resolve the issue?

Accepted Answer

Increase the number of shards in the Kinesis stream.. Increasing the number of shards in the Kinesis stream directly addresses the root cause: the Lambda function's concurrency is tied to the number of shards. Each shard can invoke one Lambda instance per batch, so more shards allow more concurrent Lambda executions, which spreads the write load across DynamoDB partitions and reduces the chance of hitting per-partition throughput limits. Since the engineer already increased DynamoDB write capacity, the remaining bottleneck is the Kinesis shard count limiting parallelism. Option D is the correct answer.

Answer

Increase the Lambda function memory.

Answer

Increase the DynamoDB read capacity units.

Answer

Decrease the Lambda batch size to 1.

Question 12

An IAM policy is attached to an IAM role used by an EC2 instance in the 10.0.0.0/8 VPC. The EC2 instance cannot read objects from the S3 bucket. What is the most likely cause?

Accepted Answer

The S3 bucket has a bucket policy that denies public access, and the IAM policy alone is insufficient.. The most likely cause is that the S3 bucket policy explicitly denies access, which overrides any IAM policy attached to the EC2 instance role. In AWS, an explicit deny in a bucket policy takes precedence over an allow in an IAM policy. Therefore, even if the IAM role has s3:GetObject permission, the bucket policy denial blocks the read.

Answer

The policy does not grant s3:ListBucket permission.

Answer

The bucket is encrypted with SSE-KMS and the role does not have kms:Decrypt permission.

Answer

The EC2 instance's public IP is not in the 10.0.0.0/8 range.

Question 13

A data engineer needs to grant an IAM user read-only access to an S3 bucket named 'data-lake-bucket'. Which IAM policy statement should be attached to the user?

Accepted Answer

{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::data-lake-bucket/*"}. It grants read-only access by allowing only the s3:GetObject action, which permits downloading objects from the bucket. The resource ARN includes the wildcard /* to cover all objects within 'data-lake-bucket', ensuring the user can read but not list or modify data.

Answer

{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::data-lake-bucket"}

Answer

{"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::data-lake-bucket/*"}

Answer

{"Effect":"Allow","Action":"s3:*","Resource":"arn:aws:s3:::data-lake-bucket/*"}

Question 14

A data engineer runs the above AWS CLI command to investigate who uploaded a file to an S3 bucket. The output shows the event was recorded. Which additional step is needed to confirm the identity of the user?

Accepted Answer

No additional step is needed; the 'Username' field already identifies the IAM user.. The CloudTrail event's 'Username' field already identifies the IAM user who performed the S3 upload, so no additional lookup is required. The event record includes the user identity directly, making Option A correct.

Answer

Use the 'MFA' field to check if multi-factor authentication was used.

Answer

View the 'accessKeyId' field in the CloudTrailEvent JSON.

Answer

Look up the 'sourceIPAddress' in the CloudTrailEvent.

Question 15

A data engineer has this IAM policy attached to their user. They are trying to create an Amazon EMR cluster with a custom service role 'EMR_CustomRole'. What will happen?

Accepted Answer

The cluster creation will fail with an 'Access Denied' error for iam:PassRole.. Creating an EMR cluster with a custom service role requires the caller to have iam:PassRole permission for that specific role, in addition to elasticmapreduce:RunJobFlow. The policy shown grants elasticmapreduce:* but does not include iam:PassRole, so the request will be rejected with an Access Denied error specifically on the PassRole action. This is a classic privilege-escalation guard: AWS requires explicit PassRole authorization before a service can assume a role on your behalf.

Answer

The cluster creation will fail because elasticmapreduce:* is too broad.

Answer

The cluster creation will succeed because elasticmapreduce:* is allowed.

Answer

The cluster creation will succeed because PassRole is not required for EMR.