DEA-C01 Data Store Management Practice Test 7 — 15 Questions

Question 1

An IAM policy is attached to a user who tries to upload an object to the S3 bucket example-bucket using the AWS CLI without specifying the --server-side-encryption flag. What will happen?

Accepted Answer

The upload fails with an AccessDenied error.. The IAM policy denies s3:PutObject unless the request includes the `x-amz-server-side-encryption` header with a value of `AES256`. Since the user did not specify `--server-side-encryption` in the AWS CLI command, the request lacks this required header, causing S3 to evaluate the policy and return an AccessDenied error. The upload fails before any default encryption setting on the bucket is applied.

Answer

The upload succeeds and the object is encrypted with SSE-S3 by default.

Answer

The upload fails because the user does not have permission to use KMS.

Answer

The upload succeeds because the policy allows s3:PutObject.

Question 2

A data engineer is responsible for a data warehouse on Amazon Redshift that stores 5 TB of data. The engineer needs to load 50 GB of new data daily from Amazon S3 into Redshift. The current load process uses the COPY command and takes 2 hours, which is within the maintenance window. However, the engineer wants to optimize the load time and reduce the impact on concurrent queries. The engineer notices that the tables are not distributed evenly across the slices. The cluster has 4 nodes of dc2.large. Which approach will best improve load performance?

Accepted Answer

Change the distribution style of the tables to EVEN.. The COPY command distributes data across slices based on the table's distribution style. With dc2.large nodes, each node has 2 slices, so a 4-node cluster has 8 slices. If tables are not distributed evenly, some slices handle more data, causing bottlenecks. Changing the distribution style to EVEN forces rows to be spread uniformly across all slices, maximizing parallelism during the COPY load and reducing load time.

Answer

Increase the cluster size to 8 nodes.

Answer

Use GZIP compression on the S3 files.

Answer

Add sort keys to the tables based on the load timestamp.

Question 3

A company is using Amazon RDS for MySQL with Multi-AZ deployment. The database experiences intermittent slowdowns during peak hours. The company's DevOps team suspects that the primary instance is overwhelmed. Which action should the team take to distribute the read load without changing the application code?

Accepted Answer

Create a read replica and modify the connection string to point to the replica for read queries.. Creating a read replica and modifying the connection string to point to the replica for read queries (Option B) offloads read traffic from the primary RDS instance without requiring application code changes. This directly addresses the intermittent slowdowns during peak hours by distributing the read load, leveraging MySQL’s native replication to keep the replica synchronized. The key constraint is 'without changing the application code,' which is satisfied by simply updating the connection string in the application configuration.

Answer

Increase the instance size of the RDS instance.

Answer

Enable Multi-AZ on the existing instance.

Answer

Configure DynamoDB Accelerator (DAX) in front of the RDS instance.

Question 4

A data engineer is designing a data lake on Amazon S3. The data is ingested from multiple sources and stored in a partitioned structure under the 'landing' prefix. The engineer needs to ensure that only authorized applications can write to the 'landing' zone, while all AWS accounts in the organization can read the data. Which combination of S3 bucket policies and IAM policies should be used?

Accepted Answer

Create a bucket policy with a Deny for all principals except the authorized IAM roles on the 'landing' prefix. Add a separate statement allowing read access to the organization.. It uses a bucket policy with an explicit Deny on the 'landing' prefix for all principals except the authorized IAM roles, ensuring only those roles can write. A separate Allow statement grants read access to the entire organization (e.g., via the `aws:PrincipalOrgID` condition key), which satisfies the requirement that all AWS accounts in the organization can read the data. This approach leverages S3 bucket policies for cross-account access control without relying on ACLs or IAM policies alone.

Answer

Use bucket ACLs to grant write access to the authorized IAM roles and read access to all authenticated users.

Answer

Use S3 Object Ownership to enforce bucket owner enforced. Grant write access via IAM roles.

Answer

Create an IAM policy that allows s3:PutObject only for the 'landing' prefix and attach it to the authorized roles. Allow read access via an S3 Access Point.

Question 5

A company is migrating an on-premises PostgreSQL database to Amazon Aurora PostgreSQL. The database is 2 TB in size. The migration must have minimal downtime. Which approach should the data engineer use?

Accepted Answer

Use AWS Database Migration Service (DMS) with ongoing replication to minimize downtime.. AWS DMS with ongoing replication (change data capture) is the correct approach because it allows a full load of the 2 TB database followed by continuous replication of changes from the on-premises PostgreSQL source to the Aurora PostgreSQL target, minimizing downtime to a short cutover window. This is the only option that supports near-zero downtime migration for large databases by capturing ongoing transactions.

Answer

Use AWS Schema Conversion Tool (SCT) to convert the schema and then copy data using S3.

Answer

Create an Aurora read replica from the on-premises database using native replication.

Answer

Use pg_dump to export the database and pg_restore to import into Aurora.

Question 6

A data engineer is designing a data store for a real-time analytics application that requires sub-millisecond read and write latency. The data is key-value in nature and the workload is both read-heavy and write-heavy. Which AWS service is most suitable?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is the most suitable service because it is a fully managed NoSQL key-value and document database designed for single-digit millisecond latency at any scale, and with features like DynamoDB Accelerator (DAX) it can achieve sub-millisecond read latency. It supports both read-heavy and write-heavy workloads through its distributed architecture and auto-scaling capabilities, making it ideal for real-time analytics applications.

Answer

Amazon ElastiCache for Redis

Answer

Amazon RDS for MySQL

Answer

Amazon S3

Question 7

A company uses Amazon Redshift for its data warehouse. The data engineer notices that queries are running slower than expected. The system administrator reports that the cluster's disk space is 80% full. Which action should the engineer take to improve query performance?

Accepted Answer

Add more nodes to the cluster to increase storage and compute capacity.. When a Redshift cluster's disk space is 80% full, query performance degrades because Redshift relies on large sequential I/O operations, and high disk utilization forces more random I/O and increases the likelihood of spilling to disk. Adding nodes increases both storage capacity and compute resources, directly alleviating the I/O bottleneck and improving query throughput. This is the recommended scaling action when disk space exceeds 70-80% utilization.

Answer

Redesign the sort keys to optimize query performance.

Answer

Run the VACUUM command to reclaim space.

Answer

Enable concurrency scaling to handle more queries.

Question 8

A data engineer is setting up an Amazon S3 bucket for storing sensitive financial data. The compliance team requires that all data be encrypted at rest using a customer-managed AWS KMS key. Additionally, the bucket must block public access. Which combination of settings should the engineer configure?

Accepted Answer

Enable default encryption with AWS-KMS and a customer managed key. Enable block public access settings.. Enabling default encryption with AWS-KMS using a customer-managed key ensures that all objects uploaded to the S3 bucket are automatically encrypted at rest with the required key type. Additionally, enabling block public access settings prevents any public access to the bucket, satisfying the compliance team's requirements.

Answer

Use S3 Object Ownership to enforce bucket owner enforced. Enable block public access.

Answer

Use S3 Bucket Keys to reduce KMS costs. Enable block public access.

Answer

Create a bucket policy that denies PutObject without encryption. Enable block public access.

Question 9

A data engineer is designing a disaster recovery plan for an Amazon RDS for MySQL database. The database must be recoverable within 1 hour in a different AWS Region. Which TWO actions should the engineer take?

Accepted Answer

Create a cross-Region read replica.. Option A is correct because a cross-Region read replica continuously replicates data from the primary RDS for MySQL instance to a read replica in another Region, and it can be promoted to a standalone primary database, enabling recovery in a different Region within the 1-hour RPO/RTO target. Option C is correct because enabling automated backups with cross-Region copy ensures that automated snapshots and transaction logs are replicated to the target Region, allowing point-in-time restore of the database there if the primary Region fails. Option B is not correct because Multi-AZ deployment only provides high availability within a single Region by maintaining a synchronous standby in another Availability Zone, not cross-Region disaster recovery. Option D is not correct because manual snapshots copied to an S3 bucket in another Region are not directly restorable as RDS snapshots; RDS snapshot copies must be made as RDS snapshots in the target Region, not as S3 objects. Option E is not correct because EventBridge can schedule snapshot copy operations, but scheduling alone does not provide the cross-Region backup mechanism or the recovery capability required; it is an orchestration detail rather than a DR action.

Answer

Enable Multi-AZ deployment.

Answer

Take manual snapshots and copy them to an S3 bucket in the other Region.

Answer

Use Amazon EventBridge to schedule snapshot copies.

Question 10

A company uses Amazon DynamoDB to store session data for a web application. The application experiences throttling during peak hours. The data engineer needs to reduce throttling. Which THREE actions should the engineer take?

Accepted Answer

Use DynamoDB Accelerator (DAX) to cache read requests.. Option A is correct because DynamoDB Accelerator (DAX) is an in-memory cache for DynamoDB that serves eventually consistent reads with microsecond latency, offloading repeated read requests from the table and directly reducing read-based throttling during peak hours. Option C is correct because implementing exponential backoff (with jitter) in the application is the AWS-recommended retry strategy for ProvisionedThroughputExceededException and ThrottlingException, allowing retries to succeed as capacity frees up instead of hammering the table and worsening throttling. Option D is correct because a partition key with a random suffix (write sharding) spreads writes across many partitions, avoiding a hot partition that exceeds the per-partition throughput limit of 1,000 WCU / 3,000 RCU and causes throttling. Option B is not selected because simply raising provisioned read capacity units addresses only read throttling and does not mitigate write hot partitions or retry storms, and it is less cost-effective than the combined measures. Option E is not selected because DynamoDB auto scaling adjusts capacity reactively and cannot instantly absorb sudden spikes, nor does it fix hot partitions or unretried throttled requests.

Answer

Increase the provisioned read capacity units.

Answer

Enable auto scaling on the table.

Question 11

A company runs an e-commerce platform on AWS. The product catalog is stored in Amazon DynamoDB with a table that has a partition key of 'product_id' and a sort key of 'category'. The application frequently queries products by category and by product_id. Recently, the operations team noticed that read latency has increased significantly for queries that filter by category. The DynamoDB table has auto scaling enabled. The data engineer examines the CloudWatch metrics and sees that the ReadThrottleEvents metric is non-zero for the table, but the consumed read capacity is well below the provisioned limit. The table has a global secondary index (GSI) on the 'category' attribute. Which action is most likely to resolve the latency issue?

Accepted Answer

Redesign the GSI partition key to include a random suffix to distribute load across multiple partitions.. The issue is that the GSI on 'category' is experiencing hot partitions because 'category' has low cardinality, causing uneven data distribution. The non-zero ReadThrottleEvents on the GSI (not the main table) indicate throttling on the GSI's provisioned capacity, even though the main table's consumed read capacity is below its limit. Adding a random suffix to the GSI partition key distributes reads across multiple physical partitions, reducing hot spots and latency.

Answer

Switch the table to DynamoDB on-demand capacity mode.

Answer

Enable DynamoDB Accelerator (DAX) to cache read queries.

Answer

Increase the provisioned read capacity on the main table.

Question 12

A media company stores video metadata in Amazon RDS for PostgreSQL. The database is 500 GB and experiences high write traffic. The data engineer notices that the transaction log (WAL) is growing rapidly, causing storage issues. The company needs to retain backups for 30 days for compliance. The database is currently using automated backups with a retention period of 7 days. Which solution should the engineer implement to address the WAL growth while meeting compliance requirements?

Accepted Answer

Create manual snapshots daily and delete automated backups.. Creating manual snapshots daily and reducing or eliminating automated backups addresses WAL growth. Automated backups in RDS for PostgreSQL depend on WAL files to enable point-in-time recovery. By disabling automated backups or setting a very short retention period, RDS can purge WAL segments more aggressively, preventing accumulation. Manual snapshots can be retained for 30 days to meet compliance requirements without relying on WAL. Increasing backup retention (Option C) would worsen WAL storage, while streaming WAL to S3 (Option D) is not natively supported in RDS. Option B only adds storage without addressing the root cause.

Answer

Change the instance type to a larger one with more storage.

Answer

Increase the backup retention period to 30 days.

Answer

Configure the database to stream WAL files to Amazon S3.

Question 13

A startup uses Amazon S3 to store user-uploaded images. The images are accessed frequently for the first week after upload, but after that they are rarely accessed. The company wants to optimize storage costs without compromising availability. The data engineer must implement a lifecycle policy to transition objects to a more cost-effective storage class after 30 days. The objects must be retrievable within minutes. Which storage class should the engineer transition the objects to?

Accepted Answer

S3 Standard-Infrequent Access. S3 Standard-Infrequent Access (S3 Standard-IA) is the correct choice because it offers a per-GB storage cost lower than S3 Standard while maintaining high durability (99.999999999%) and availability (99.9%), with retrieval times in milliseconds. The lifecycle policy transitions objects after 30 days, aligning with the access pattern where images are rarely accessed after the first week, and the requirement for retrieval within minutes is satisfied by S3 Standard-IA's instant access.

Answer

S3 One Zone-Infrequent Access

Answer

S3 Standard

Answer

S3 Glacier Instant Retrieval

Question 14

A company is designing a data lake on Amazon S3. The data engineering team needs to implement a lifecycle policy to manage costs. Which TWO actions should be taken to reduce storage costs?

Accepted Answer

Transition objects to S3 Glacier Deep Archive after 90 days.. Option A is correct because transitioning objects to S3 Glacier Deep Archive after 90 days moves infrequently accessed data to the lowest-cost storage class (about $0.00099/GB-month), which is ideal for long-term archival data in a data lake and directly reduces storage costs. Option E is correct because incomplete multipart uploads leave orphaned parts in the bucket that are billed as storage but are never used; adding a lifecycle rule to abort and delete them after 7 days eliminates this hidden cost. Option B is not selected because S3 One Zone-IA only saves roughly 20% versus Standard and sacrifices multi-AZ durability, making it a weaker cost-optimization choice than the marked actions. Option C is not selected because S3 Intelligent-Tiering adds a per-object monitoring and automation charge and is best for unpredictable access patterns, not a deliberate lifecycle cost-reduction strategy. Option D is not selected because S3 Standard-IA is a modest cost reduction and is not one of the two actions the question expects for meaningful savings.

Answer

Transition objects to S3 One Zone-IA after 30 days.

Answer

Enable S3 Intelligent-Tiering.

Answer

Transition objects to S3 Standard-IA after 30 days.

Question 15

A data engineer is setting up Amazon S3 bucket policies for a data lake. The security team requires that all objects uploaded to the bucket be encrypted at rest using server-side encryption. Which TWO methods can enforce encryption at upload time?

Accepted Answer

Enable S3 default encryption on the bucket.. Option D is correct because enabling S3 default encryption (SSE-S3 or SSE-KMS) on the bucket causes Amazon S3 to automatically encrypt every object at rest when it is written, even if the uploader does not specify encryption headers, thereby enforcing encryption at upload time. Option E is correct because a bucket policy that denies s3:PutObject when the request lacks the x-amz-server-side-encryption header blocks any unencrypted PUT from succeeding, forcing clients to include server-side encryption headers and thus enforcing encryption at upload. Option A is not correct because S3 Transfer Acceleration only speeds up uploads by using AWS edge locations; it has no bearing on encryption at rest. Option B is not correct because AWS CloudTrail only logs and monitors API activity such as PutObject calls; it does not enforce or apply encryption. Option C is not correct because AWS KMS automatic key rotation rotates the backing key material on a schedule but does not require or enforce that uploaded objects be encrypted.

Answer

Enable S3 Transfer Acceleration.

Answer

Enable AWS CloudTrail to monitor uploads.

Answer

Enable AWS KMS automatic key rotation.