DEA-C01 Data Store Management — 20 Questions

Question 1

A data engineer attaches the above IAM policy to an IAM user. The user tries to download an object from my-bucket using the AWS CLI without specifying SSE headers. The object is stored with SSE-S3. Will the download succeed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Yes, because the policy allows s3:GetObject on the bucket.. For SSE-S3 objects, no additional encryption headers are required on GET requests because S3 handles decryption transparently for authorized users. The IAM policy grants s3:GetObject, so the download succeeds.

Answer

No, because the object is encrypted and the user does not have decrypt permission.

Answer

No, because the request does not include the required encryption header.

Answer

Yes, because the object is encrypted with SSE-S3, which uses AES256.

Question 2

A data engineer is designing a data lake on Amazon S3. The data includes customer PII that must be encrypted at rest. The company also requires that the encryption keys be rotated automatically every year. Which encryption solution should the engineer use?

Accepted Answer

SSE-KMS with automatic key rotation enabled. SSE-KMS with automatic key rotation enabled meets both requirements: it encrypts data at rest in S3 and allows the company to automatically rotate the customer master key (CMK) every year. AWS KMS supports automatic annual rotation for symmetric CMKs, which satisfies the compliance need without manual intervention.

Answer

SSE-S3

Answer

SSE-C

Answer

Client-side encryption with AWS KMS

Question 3

A company is using Amazon Redshift for a data warehouse. The data engineer needs to improve query performance for a table that is frequently joined with other tables on a specific column. Which THREE actions would help improve join performance? (Choose THREE.)

Accepted Answer

Set the distribution style to KEY on the join column. Setting the distribution style to KEY on the join column (option A) ensures that rows with the same join key value are co-located on the same compute node, enabling collocated joins and avoiding costly redistribution. Applying a SORTKEY on the join column (option B) allows Redshift to use merge joins efficiently and reduce the data scanned. Using DISTSTYLE ALL (option D) replicates the entire table to every node, which can eliminate the need to redistribute data for joins when the table is small or a dimension table. Options A and C are essentially the same action (DISTKEY is the same as distribution style KEY), so they are not distinct; thus the correct set is A, B, and D.

Answer

Use DISTKEY on the join column to co-locate data

Answer

Change the column data type to a fixed-length CHAR

Question 4

A data engineering team is designing a data lake on Amazon S3. They need to store raw data in its original format and transformed data in Parquet. The data is accessed by multiple analytics services, including Amazon Athena and Amazon Redshift Spectrum. Compliance requirements mandate that all data be encrypted at rest with AWS KMS and that the encryption keys be rotated every 90 days. Which S3 bucket configuration meets these requirements?

Accepted Answer

Use SSE-KMS with a customer-managed KMS key that has automatic key rotation enabled.. SSE-KMS with a customer-managed KMS key allows you to implement custom key rotation, such as every 90 days, by creating new keys and updating the bucket policy or key alias. AWS KMS automatic key rotation for customer-managed keys occurs yearly, not every 90 days, but you can achieve a 90-day rotation schedule manually or through automation (e.g., AWS Lambda). SSE-C requires manual key management and does not integrate with AWS services like Amazon Athena. SSE-S3 does not support configurable rotation, and the default encryption option (C) does not meet compliance if rotation is required.

Answer

Use SSE-C with client-managed keys and rotate them manually.

Answer

Use a bucket policy to enforce encryption and rely on default S3 encryption.

Answer

Use SSE-S3 with default encryption enabled.

Question 5

A data engineer is troubleshooting an AWS Glue ETL job that reads from an S3 bucket and writes to a DynamoDB table. The job fails with an AccessDeniedException. The IAM role attached to the Glue job has the policy shown in the exhibit. Which TWO additional permissions are required to resolve the issue?

Accepted Answer

kms:Decrypt. The AccessDeniedException indicates missing permissions on the resources used by the Glue job. For reading from an S3 bucket, the job requires s3:ListBucket permission to list objects (if the job uses a prefix or crawls the bucket) and s3:GetObject to read individual objects. For writing to a DynamoDB table, it requires dynamodb:PutItem (not listed). However, among the given options, the two additional permissions that are commonly missing and directly related to the failure are s3:ListBucket (D) for S3 access and kms:Decrypt (A) if either the S3 bucket or the DynamoDB table uses AWS KMS encryption. Note: The job's role already likely has some DynamoDB write permissions (like PutItem) as part of the base policy, but if the DynamoDB table uses KMS, kms:Decrypt is also necessary for the write operation.

Answer

dynamodb:DescribeTable

Answer

iam:PassRole

Answer

glue:GetJobRun

Question 6

A company stores sensitive customer data in Amazon S3. The security team requires that all data be encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). Which S3 bucket policy condition will enforce this requirement?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. The condition `s3:x-amz-server-side-encryption-aws-kms-key-id` enforces that objects uploaded to S3 must use a specific AWS KMS key for server-side encryption (SSE-KMS). This satisfies the security team's requirement that all data be encrypted at rest using SSE-KMS with AWS KMS managed keys, as it explicitly checks for the presence and value of the KMS key ID in the request. Option C, `s3:x-amz-server-side-encryption`, can also enforce SSE-KMS if the condition value is set to 'aws:kms', but it does not require a specific KMS key ID, which the question's phrasing 'AWS KMS managed keys' implies is needed.

Answer

s3:x-amz-server-side-encryption-customer-algorithm

Answer

s3:x-amz-server-side-encryption

Answer

s3:x-amz-server-side-encryption-aws-kms-key-id or s3:x-amz-server-side-encryption

Question 7

An IAM role 'DataLakeRole' has the above S3 bucket policy attached to an S3 bucket. The role is assumed by an AWS Glue job. The Glue job is failing with 'Access Denied' errors when trying to list objects in the bucket. Which action should be added to the policy to fix the issue?

Accepted Answer

Add s3:ListBucket action for the bucket ARN (arn:aws:s3:::my-data-lake).. The Glue job is failing with 'Access Denied' when trying to list objects, which requires the s3:ListBucket permission on the bucket itself (not on objects). Option B correctly adds s3:ListBucket for the bucket ARN (arn:aws:s3:::my-data-lake), which grants permission to list the contents of the bucket. Without this action, even if other permissions exist, the ListObjectsV2 API call used by AWS Glue to enumerate objects will be denied.

Answer

Add s3:ListObjects action for the bucket ARN.

Answer

Add s3:GetObjectVersion action for the object ARN.

Answer

Add s3:ListBucket action for the object ARN (arn:aws:s3:::my-data-lake/*).

Question 8

A data engineer needs to store JSON documents that are frequently updated and require ACID transactions. Which AWS database service is most appropriate?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is the correct choice because it supports ACID transactions via the `TransactWriteItems` and `TransactGetItems` APIs, enabling atomic, consistent, isolated, and durable operations on JSON documents. It also provides single-digit millisecond latency for frequently updated data, making it ideal for high-throughput, transactional workloads. DynamoDB's flexible schema natively handles JSON documents, and its auto-scaling capabilities ensure performance under varying load.

Answer

Amazon Neptune

Answer

Amazon DocumentDB

Answer

Amazon S3

Question 9

A company uses Amazon DynamoDB for a gaming leaderboard. The table has a partition key of 'GameId' and a sort key of 'Score'. The application needs to query the top 10 scores for a given game. Which DynamoDB feature should be used for optimal performance?

Accepted Answer

Use a Query operation on the base table with ScanIndexForward set to false.. The base table already has 'GameId' as partition key and 'Score' as sort key. A Query operation on the base table with ScanIndexForward set to false retrieves items in descending order by Score, so the first 10 items are the top scores. This is efficient without additional cost or complexity. Option D is unnecessary and incurs extra storage cost.

Answer

Enable DynamoDB Streams and use a Lambda function to compute the leaderboard.

Answer

Use DynamoDB Accelerator (DAX) to cache the results of a Scan operation.

Answer

Create a Global Secondary Index with the same partition key and sort key, then query with ScanIndexForward false.

Question 10

Which TWO actions can help improve the read performance of an Amazon DynamoDB table that is experiencing throttling? (Choose two.)

Accepted Answer

Increase the provisioned read capacity units (RCUs) for the table.. Increasing the provisioned read capacity units (RCUs) directly raises the number of read operations per second the table can handle, alleviating throttling caused by exceeding the current RCU limit. Option C is correct because eventually consistent reads consume half the RCUs of strongly consistent reads, effectively doubling the read throughput for the same provisioned capacity, which can reduce throttling. Option D is not a direct solution for throttling; while a global secondary index (GSI) can improve query performance with a different partition key, it does not increase the base table's read capacity and may require additional provisioning.

Answer

Enable DynamoDB Accelerator (DAX) for write-heavy workloads.

Answer

Add a global secondary index (GSI) with a different partition key.

Answer

Enable auto-scaling with a lower minimum capacity.

Question 11

A data engineer needs to migrate an on-premises MongoDB database to AWS. The migration must have minimal downtime and support automatic scaling. Which TWO AWS services should the engineer use for the target data store? (Choose TWO.)

Accepted Answer

Amazon DocumentDB (with MongoDB compatibility). Amazon DocumentDB (with MongoDB compatibility) is correct because it is a native AWS document database service that is wire-protocol compatible with MongoDB, allowing you to migrate your MongoDB workloads with minimal application changes. It supports automatic scaling of storage (up to 64 TB) and compute resources, and its fully managed architecture helps achieve minimal downtime during migration using tools like AWS DMS or native MongoDB replication. Amazon DynamoDB is also correct because it is a fully managed NoSQL database service that provides automatic scaling of throughput and storage, and can serve as a target for MongoDB migrations using AWS DMS or custom scripts, offering high availability and low-latency performance. Both services support minimal downtime and automatic scaling, meeting the requirements.

Answer

Amazon Redshift

Answer

Amazon RDS for MySQL

Answer

Amazon S3

Question 12

A data engineer is designing a data lake on Amazon S3 for a healthcare organization that must comply with HIPAA regulations. The data includes protected health information (PHI) and must be encrypted at rest. The organization requires that all encryption keys be managed by AWS and rotated automatically every year. Additionally, the data must be replicated to another AWS Region for disaster recovery. Which combination of S3 features should the engineer use to meet these requirements?

Accepted Answer

Use SSE-S3 with S3 Cross-Region Replication (CRR).. SSE-S3 provides server-side encryption with Amazon S3-managed keys, satisfying the requirement for AWS-managed keys with automatic annual rotation (SSE-S3 keys are rotated at least annually). S3 Cross-Region Replication (CRR) meets the disaster recovery requirement by automatically replicating objects to a different AWS Region. SSE-S3 encryption is applied at rest in both the source and destination buckets, and CRR works seamlessly with SSE-S3 without additional configuration for key management.

Answer

Use SSE-S3 with S3 Same-Region Replication (SRR).

Answer

Use SSE-KMS with S3 Cross-Region Replication (CRR).

Answer

Use SSE-C with S3 Cross-Region Replication (CRR).

Question 13

A company uses Amazon DynamoDB as a key-value store for a high-traffic application. The table has a provisioned read capacity of 10,000 RCUs and write capacity of 5,000 WCUs. The application experiences occasional throttling during peak hours. Which TWO actions can reduce throttling without changing the application code? (Choose TWO.)

Accepted Answer

Enable DynamoDB Auto Scaling for both read and write capacity.. DynamoDB Auto Scaling automatically adjusts the provisioned read and write capacity based on actual traffic patterns, which helps absorb peak-hour spikes without manual intervention. This reduces throttling by ensuring sufficient capacity during high-demand periods without requiring code changes.

Answer

Switch to on-demand capacity mode for the table.

Answer

Change the read consistency model from eventually consistent to strongly consistent.

Answer

Use DynamoDB Global Tables to distribute the workload across regions.

Question 14

A company is migrating a MySQL database to Amazon RDS for MySQL. The database is 2 TB in size and the company can only afford minimal downtime. The migration must be secure and use AWS DMS. Which TWO configuration steps are required? (Choose TWO.)

Accepted Answer

Create a source endpoint pointing to the on-premises MySQL database.. The two required configuration steps for a DMS migration are creating a source endpoint (A) and a target endpoint (B). The source endpoint connects to the on-premises MySQL database, and the target endpoint connects to the Amazon RDS for MySQL instance. Option C (SSL/TLS) is optional, not required. Option D (VPC peering) is not necessary because DMS can use other connectivity methods. Option E (creating a replication instance) is a prerequisite for migration tasks but is not among the two endpoint configuration steps asked in the question.

Answer

Configure SSL/TLS encryption for the DMS endpoints.

Answer

Set up VPC peering between the on-premises network and the Amazon VPC.

Answer

Create a DMS replication instance.

Question 15

A company has an Amazon RDS for MySQL DB instance with read replicas. The primary DB instance fails. What is the correct procedure to promote a read replica to become the new primary?

Accepted Answer

Manually promote the read replica to a standalone DB instance.. When an Amazon RDS for MySQL primary DB instance fails, read replicas do not automatically become the new primary. The correct procedure is to manually promote the read replica using the AWS Management Console, CLI, or API, which converts it into a standalone DB instance. After promotion, you must update your application endpoints to point to the new primary, as RDS does not handle this automatically.

Answer

Modify the read replica to be a Multi-AZ deployment and failover will occur.

Answer

RDS automatically fails over to the read replica within 5 minutes.

Answer

Delete the primary and the read replica will automatically become the primary.

Question 16

A data engineering team uses Amazon Redshift for analytics. They notice that queries on a large fact table are slow. The table is distributed using DISTSTYLE ALL. Which design change would most likely improve query performance?

Accepted Answer

Change DISTSTYLE to KEY on a column used in frequent joins.. DISTSTYLE ALL copies the entire table to every node, which is inefficient for large fact tables because it wastes storage and network bandwidth during data loading and query execution. Changing to DISTSTYLE KEY on a column used in frequent joins collocates related rows on the same slice, reducing the need to broadcast or redistribute data across the network during joins, which directly improves query performance.

Answer

Change DISTSTYLE to EVEN to distribute rows evenly across slices.

Answer

Increase the number of nodes in the Redshift cluster.

Answer

Change the table to use a SORTKEY on the most frequently filtered column.

Question 17

A company uses Amazon DynamoDB for a gaming application. They need to store player session data that expires after 24 hours. Which DynamoDB feature should they use to automatically delete expired items?

Accepted Answer

Time to Live (TTL). DynamoDB Time to Live (TTL) is the correct feature because it allows you to define a per-item timestamp attribute (e.g., `expireAt`) that DynamoDB automatically deletes once that timestamp is reached. This is ideal for expiring session data after 24 hours without requiring custom code or scheduled jobs to scan and delete items, reducing cost and operational overhead.

Answer

DynamoDB auto scaling

Answer

DynamoDB Streams

Answer

Point-in-time recovery

Question 18

Which TWO actions should a data engineer take to encrypt data at rest in an Amazon S3 bucket? (Select TWO.)

Accepted Answer

Configure the bucket to use SSE-KMS.. SSE-KMS (Server-Side Encryption with AWS Key Management Service) encrypts data at rest in S3 by using a KMS key to manage encryption keys. This provides envelope encryption, where a CMK generates a data key that encrypts the object, and the data key is then encrypted by the CMK. Option D is correct because enabling default encryption on an S3 bucket using SSE-S3 (AES-256) ensures that all objects uploaded without explicit encryption headers are automatically encrypted at rest by S3's managed key.

Answer

Enable S3 Transfer Acceleration on the bucket.

Answer

Use client-side encryption before uploading objects to S3.

Answer

Attach a bucket policy that denies unencrypted PUT requests.

Question 19

A data engineer is designing a data lake on Amazon S3. The data must be immutable and support high-throughput streaming ingestion. Which THREE features should the engineer consider? (Select THREE.)

Accepted Answer

S3 Lifecycle policies to transition data to Amazon S3 Glacier. S3 Object Lock in governance mode (Option D) is correct because it enforces immutability by preventing objects from being deleted or overwritten for a specified retention period, which is essential for a data lake requiring immutable data. S3 Multipart Upload API (Option C) is correct because it enables high-throughput streaming ingestion by allowing large objects to be uploaded in parallel parts, improving throughput and resilience. S3 Lifecycle policies to transition data to Amazon S3 Glacier (Option B) is correct because it supports cost-effective storage management for immutable data that is rarely accessed, aligning with the data lake's lifecycle needs.

Answer

S3 Transfer Acceleration

Answer

S3 Cross-Region Replication (CRR)

Question 20

An e-commerce application uses Amazon ElastiCache for Redis to cache product catalog data. The cache currently uses lazy loading. The team wants to ensure that frequently accessed product data is always fresh. Which caching strategy should they implement?

Accepted Answer

Write-through caching. Write-through caching ensures that data is written to the cache simultaneously with the database, guaranteeing that frequently accessed product data is always fresh. This strategy eliminates stale reads by synchronously updating the cache on every write, which directly addresses the requirement for freshness without relying on expiration or lazy population.

Answer

Set a TTL of 5 minutes for all cached items

Answer

Use database read replicas to serve data

Answer

Lazy loading with TTL