DEA-C01 Data Store Management Practice Test 3 — 15 Questions

Question 1

A company uses Amazon S3 to store sensitive customer data. The security team requires that all objects uploaded to a specific bucket be encrypted at rest using AWS KMS with a customer managed key. Which bucket policy statement should be applied to enforce this requirement?

Accepted Answer

Deny s3:PutObject unless s3:x-amz-server-side-encryption-aws-kms-key-id equals the specific KMS key ARN. Option C is correct because the security team requires encryption at rest using AWS KMS with a customer managed key. The bucket policy must deny any s3:PutObject request that does not include the s3:x-amz-server-side-encryption-aws-kms-key-id condition key set to the specific KMS key ARN. This ensures that only objects encrypted with the designated customer managed key are allowed, enforcing the encryption requirement at the bucket policy level.

Answer

Deny s3:PutObject unless s3:x-amz-server-side-encryption is present

Answer

Allow s3:PutObject only if s3:x-amz-server-side-encryption is present

Answer

Deny s3:PutObject unless s3:x-amz-server-side-encryption equals AES256

Question 2

A data engineer is designing a data lake on Amazon S3. The data is ingested from multiple sources and needs to be partitioned by year, month, day, and event type for efficient querying with Amazon Athena. Which S3 key prefix structure is most appropriate?

Accepted Answer

s3://bucket/event_type=events/year=2024/month=01/day=01/data.parquet. Option C uses Hive-style partitioning (event_type=events/year=2024/month=01/day=01), which Athena and other query engines natively support. This structure allows Athena to perform partition pruning, reading only the relevant directories based on WHERE clause filters, significantly reducing data scanned and improving query performance.

Answer

s3://bucket/events/2024-01-01/event_type=data.parquet

Answer

s3://bucket/2024/01/01/event_type/events/data.parquet

Answer

s3://bucket/event_type=events/year=2024/month=01/day=01/data.parquet

Question 3

A company runs an Amazon RDS for MySQL database. The database experiences high write latency during peak hours. The data engineer notices that the WriteIOPS metric is consistently at the provisioned limit. Which action would most effectively reduce write latency without increasing costs?

Accepted Answer

Migrate to Amazon Aurora MySQL with appropriate instance size. Migrating to Amazon Aurora MySQL with an appropriate instance size reduces write latency because Aurora’s distributed storage architecture provides up to 20 times the write throughput of standard MySQL on RDS, without requiring additional IOPS provisioning. Aurora automatically scales storage I/O and uses a 6-replica quorum-based write model, which eliminates the bottleneck of hitting a fixed IOPS limit while keeping costs comparable to or lower than provisioned IOPS on RDS.

Answer

Enable Multi-AZ deployment

Answer

Increase the provisioned IOPS on the existing RDS instance

Answer

Add a read replica to offload read traffic

Question 4

A data engineer needs to store semi-structured JSON data from IoT devices. The data is written once, read rarely, but must be queryable using SQL. The storage cost must be minimized. Which storage solution should the engineer choose?

Accepted Answer

Store JSON files in Amazon S3 and use Amazon Athena for queries. Amazon S3 provides the lowest-cost storage for data that is written once and rarely read, while Amazon Athena enables serverless SQL querying directly on JSON files stored in S3. This combination minimizes storage costs because S3 charges only for the data stored and retrieval, with no minimum fees or provisioning required, and Athena charges only for the data scanned per query. The workload's write-once, read-rarely pattern aligns perfectly with S3's durability and lifecycle policies, making it the most cost-effective choice.

Answer

Store JSON in Amazon Redshift as SUPER data type

Answer

Store JSON in an Amazon RDS for MySQL table

Answer

Store JSON documents in Amazon DynamoDB and use PartiQL for queries

Question 5

A company uses Amazon DynamoDB as the primary data store for a web application. The application experiences occasional throttling on write requests. The data engineer needs to implement a solution that handles throttling gracefully without losing data. Which approach should the engineer use?

Accepted Answer

Implement exponential backoff in the application's write retry logic. Option C is correct because implementing exponential backoff in the application's write retry logic is the standard AWS-recommended approach for handling DynamoDB throttling (ProvisionedThroughputExceededException). Exponential backoff gradually increases the wait time between retries, reducing the retry rate and allowing the throttling condition to subside, while ensuring no write data is lost as long as the retries eventually succeed. This approach is lightweight, requires no additional AWS services, and aligns with best practices for building resilient applications against DynamoDB throttling.

Answer

Increase the provisioned write capacity to a higher value

Answer

Use an Amazon SQS queue to buffer write requests before sending to DynamoDB

Answer

Enable DynamoDB Accelerator (DAX) to cache writes

Question 6

A financial services company stores transaction data in Amazon RDS for PostgreSQL. The company requires that all changes to the database be logged for audit purposes, including before and after images of updated rows. Which feature should the data engineer enable?

Accepted Answer

Set up logical replication using pglogical or native publication/subscription. Option C is correct because logical replication, using either pglogical or native PostgreSQL publication/subscription, captures row-level changes (INSERT, UPDATE, DELETE) and can include both the old and new values of updated rows. This meets the audit requirement for before-and-after images, as logical replication decodes the write-ahead log (WAL) to produce a change stream that includes full row snapshots.

Answer

Enable automated backups and export logs to Amazon S3

Answer

Enable Enhanced Monitoring and publish logs to CloudWatch Logs

Answer

Enable Multi-AZ deployment and read replicas

Question 7

A data engineer is configuring Amazon S3 Lifecycle policies to transition objects between storage classes. The data is accessed frequently for the first 30 days, then rarely for the next 90 days, after which it must be archived. The engineer wants to minimize costs while ensuring immediate retrieval for the first 30 days. Which lifecycle policy should the engineer implement?

Accepted Answer

Transition to Standard-IA after 30 days, then to Glacier Deep Archive after 120 days. Option D is correct because it transitions objects from S3 Standard (immediate retrieval, frequent access) to S3 Standard-IA (lower cost for infrequent access, immediate retrieval) after 30 days, then to S3 Glacier Deep Archive (lowest-cost archival storage) after 120 days. This matches the access pattern: frequent for 30 days, rare for 90 days, then archived, while minimizing cost and maintaining immediate retrieval for the first 30 days.

Answer

Transition to Glacier Flexible Retrieval after 30 days, then delete after 120 days

Answer

Transition to One Zone-IA after 30 days, then to Glacier Deep Archive after 120 days

Answer

Transition to Glacier Deep Archive after 30 days, then delete after 120 days

Question 8

A data engineer needs to store a large number of small files (each a few KB) from IoT sensors. The data is written once and never modified. The primary requirement is high write throughput and low latency for writes. Which storage solution is most suitable?

Accepted Answer

Amazon DynamoDB with on-demand capacity. Amazon DynamoDB with on-demand capacity is the most suitable because it is a NoSQL key-value and document database designed for single-digit millisecond latency at any scale. It supports high write throughput by automatically distributing data across multiple partitions, and on-demand capacity eliminates the need for provisioning, allowing it to absorb unpredictable write spikes from many IoT sensors without throttling.

Answer

Amazon RDS for MySQL with InnoDB

Answer

Amazon S3 with standard storage class

Answer

Amazon Elastic Block Store (EBS) volumes

Question 9

A company uses Amazon Redshift for analytics. A data engineer notices that queries are slow due to high disk usage on the compute nodes. The engineer needs to reclaim disk space without interrupting ongoing queries. Which action should the engineer take?

Accepted Answer

Run VACUUM DELETE to reclaim space from deleted rows. Option C is correct because VACUUM DELETE specifically reclaims disk space from deleted rows without requiring an exclusive table lock, allowing ongoing queries to continue. In Amazon Redshift, deleted rows consume disk space until reclaimed, and VACUUM DELETE operates in the background to free that space while maintaining query concurrency.

Answer

Use the COPY command to reload data

Answer

Run VACUUM FULL on all tables

Answer

Resize the cluster to a larger instance type

Question 10

A data engineer is designing a data lake on Amazon S3. The data lake must support both batch and streaming ingestion. Which TWO AWS services can ingest data directly into S3? (Choose TWO.)

Accepted Answer

AWS Glue. AWS Glue is correct because it can ingest data directly into S3 via AWS Glue crawlers and ETL jobs, which read from various sources and write the processed data to S3. Amazon Kinesis Data Firehose is correct because it is a fully managed service that can capture, transform, and load streaming data directly into S3 without requiring custom code.

Answer

Amazon RDS

Answer

Amazon EMR

Answer

Amazon DynamoDB

Question 11

A company is migrating an on-premises Apache Hadoop cluster to Amazon EMR. The data is stored in HDFS and must be moved to Amazon S3. Which THREE considerations are important when designing the migration? (Choose THREE.)

Accepted Answer

EMR can read data directly from S3 using EMRFS. Option C is correct because Amazon EMR uses the EMR File System (EMRFS) to directly read and write data stored in Amazon S3, treating S3 as a scalable, durable data lake without needing to first copy data into HDFS. This allows EMR clusters to process data directly from S3, enabling decoupled compute and storage.

Answer

S3 supports POSIX file system semantics

Answer

HDFS can be directly mounted as an S3 bucket

Question 12

A data engineer is setting up Amazon S3 bucket policies for a data lake. Which TWO statements are true regarding S3 bucket policies? (Choose TWO.)

Accepted Answer

Bucket policies can grant access to accounts in other AWS Organizations. Option A is correct because S3 bucket policies can grant cross-account access to principals in other AWS accounts, including those in different AWS Organizations, by specifying the target account ID or organization ID in the Principal element. This enables centralized data lake access management across organizational boundaries without requiring IAM roles or resource-based policies in each account.

Answer

Bucket policies are the only way to control access to S3

Answer

Bucket policies can be applied to individual objects

Answer

The Principal element in a bucket policy is optional

Question 13

A data engineer applies the above IAM policy to a user. The user attempts to upload an object to the bucket 'my-data-lake' without specifying server-side encryption. What will happen?

Accepted Answer

The upload fails because the condition requires encryption. The IAM policy includes a condition that requires the `s3:x-amz-server-side-encryption` header to be present with a value of `AES256`. When the user attempts to upload an object without specifying server-side encryption, the condition is not satisfied, so the `s3:PutObject` permission is denied. This causes the upload to fail, regardless of any bucket default encryption settings or bucket policies.

Answer

The upload fails only if the bucket has a default encryption setting

Answer

The upload succeeds if the bucket policy allows unencrypted uploads

Answer

The upload succeeds because the policy allows s3:PutObject

Question 14

A data engineer runs the above CLI command to describe the DynamoDB table 'Orders'. The table has a partition key 'OrderID' and sort key 'CustomerID'. Which query operation is most efficient for retrieving all orders for a specific customer?

Accepted Answer

Create a Global Secondary Index on CustomerID and query the index. Option D is correct because a Global Secondary Index (GSI) on CustomerID allows you to query efficiently using CustomerID as the partition key, avoiding a full table scan. Since the base table's primary key is (OrderID, CustomerID), you cannot directly query by CustomerID alone; a GSI provides an alternative access pattern optimized for this query.

Answer

Query the table using CustomerID as the partition key

Answer

Scan the table and filter by CustomerID

Answer

Use GetItem with CustomerID as the key

Question 15

A data engineer is troubleshooting an access denied error when an AWS Lambda function tries to decrypt an object encrypted with the KMS key 'abc123'. The Lambda function's execution role has the above policy attached. What is the likely cause of the error?

Accepted Answer

The KMS key policy does not grant the Lambda role decrypt permission. The error occurs because KMS requires both the IAM policy and the key policy to grant the necessary permissions. While the IAM policy attached to the Lambda execution role includes kms:Decrypt, the KMS key policy for 'abc123' does not explicitly grant the Lambda role permission to call kms:Decrypt. Since KMS key policies act as a resource-based policy, they must allow the principal (the Lambda role) to perform the action; otherwise, the request is denied even if the IAM policy allows it.

Answer

The Deny statement blocks all decrypt requests

Answer

The Lambda function does not have permission to call kms:GenerateDataKey

Answer

The IAM policy does not include kms:Decrypt permission