DEA-C01 Data Store Management — Timed 10 Questions

Question 1

A data engineer attaches the above IAM policy to an IAM user. The user tries to download an object from my-bucket using the AWS CLI without specifying SSE headers. The object is stored with SSE-S3. Will the download succeed?

10 minute time limit — choose an answer to begin.

Accepted Answer

Yes, because the policy allows s3:GetObject on the bucket.. For SSE-S3 objects, no additional encryption headers are required on GET requests because S3 handles decryption transparently for authorized users. The IAM policy grants s3:GetObject, so the download succeeds.

Answer

No, because the object is encrypted and the user does not have decrypt permission.

Answer

No, because the request does not include the required encryption header.

Answer

Yes, because the object is encrypted with SSE-S3, which uses AES256.

Question 2

A data engineer is designing a data lake on Amazon S3. The data includes customer PII that must be encrypted at rest. The company also requires that the encryption keys be rotated automatically every year. Which encryption solution should the engineer use?

Accepted Answer

SSE-KMS with automatic key rotation enabled. SSE-KMS with automatic key rotation enabled meets both requirements: it encrypts data at rest in S3 and allows the company to automatically rotate the customer master key (CMK) every year. AWS KMS supports automatic annual rotation for symmetric CMKs, which satisfies the compliance need without manual intervention.

Answer

SSE-S3

Answer

SSE-C

Answer

Client-side encryption with AWS KMS

Question 3

A company is using Amazon Redshift for a data warehouse. The data engineer needs to improve query performance for a table that is frequently joined with other tables on a specific column. Which THREE actions would help improve join performance? (Choose THREE.)

Accepted Answer

Set the distribution style to KEY on the join column. Setting the distribution style to KEY on the join column (option A) ensures that rows with the same join key value are co-located on the same compute node, enabling collocated joins and avoiding costly redistribution. Applying a SORTKEY on the join column (option B) allows Redshift to use merge joins efficiently and reduce the data scanned. Using DISTSTYLE ALL (option D) replicates the entire table to every node, which can eliminate the need to redistribute data for joins when the table is small or a dimension table. Options A and C are essentially the same action (DISTKEY is the same as distribution style KEY), so they are not distinct; thus the correct set is A, B, and D.

Answer

Use DISTKEY on the join column to co-locate data

Answer

Change the column data type to a fixed-length CHAR

Question 4

A data engineering team is designing a data lake on Amazon S3. They need to store raw data in its original format and transformed data in Parquet. The data is accessed by multiple analytics services, including Amazon Athena and Amazon Redshift Spectrum. Compliance requirements mandate that all data be encrypted at rest with AWS KMS and that the encryption keys be rotated every 90 days. Which S3 bucket configuration meets these requirements?

Accepted Answer

Use SSE-KMS with a customer-managed KMS key that has automatic key rotation enabled.. SSE-KMS with a customer-managed KMS key allows you to implement custom key rotation, such as every 90 days, by creating new keys and updating the bucket policy or key alias. AWS KMS automatic key rotation for customer-managed keys occurs yearly, not every 90 days, but you can achieve a 90-day rotation schedule manually or through automation (e.g., AWS Lambda). SSE-C requires manual key management and does not integrate with AWS services like Amazon Athena. SSE-S3 does not support configurable rotation, and the default encryption option (C) does not meet compliance if rotation is required.

Answer

Use SSE-C with client-managed keys and rotate them manually.

Answer

Use a bucket policy to enforce encryption and rely on default S3 encryption.

Answer

Use SSE-S3 with default encryption enabled.

Question 5

A data engineer is troubleshooting an AWS Glue ETL job that reads from an S3 bucket and writes to a DynamoDB table. The job fails with an AccessDeniedException. The IAM role attached to the Glue job has the policy shown in the exhibit. Which TWO additional permissions are required to resolve the issue?

Accepted Answer

kms:Decrypt. The AccessDeniedException indicates missing permissions on the resources used by the Glue job. For reading from an S3 bucket, the job requires s3:ListBucket permission to list objects (if the job uses a prefix or crawls the bucket) and s3:GetObject to read individual objects. For writing to a DynamoDB table, it requires dynamodb:PutItem (not listed). However, among the given options, the two additional permissions that are commonly missing and directly related to the failure are s3:ListBucket (D) for S3 access and kms:Decrypt (A) if either the S3 bucket or the DynamoDB table uses AWS KMS encryption. Note: The job's role already likely has some DynamoDB write permissions (like PutItem) as part of the base policy, but if the DynamoDB table uses KMS, kms:Decrypt is also necessary for the write operation.

Answer

dynamodb:DescribeTable

Answer

iam:PassRole

Answer

glue:GetJobRun

Question 6

A company stores sensitive customer data in Amazon S3. The security team requires that all data be encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). Which S3 bucket policy condition will enforce this requirement?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. The condition `s3:x-amz-server-side-encryption-aws-kms-key-id` enforces that objects uploaded to S3 must use a specific AWS KMS key for server-side encryption (SSE-KMS). This satisfies the security team's requirement that all data be encrypted at rest using SSE-KMS with AWS KMS managed keys, as it explicitly checks for the presence and value of the KMS key ID in the request. Option C, `s3:x-amz-server-side-encryption`, can also enforce SSE-KMS if the condition value is set to 'aws:kms', but it does not require a specific KMS key ID, which the question's phrasing 'AWS KMS managed keys' implies is needed.

Answer

s3:x-amz-server-side-encryption-customer-algorithm

Answer

s3:x-amz-server-side-encryption

Answer

s3:x-amz-server-side-encryption-aws-kms-key-id or s3:x-amz-server-side-encryption

Question 7

An IAM role 'DataLakeRole' has the above S3 bucket policy attached to an S3 bucket. The role is assumed by an AWS Glue job. The Glue job is failing with 'Access Denied' errors when trying to list objects in the bucket. Which action should be added to the policy to fix the issue?

Accepted Answer

Add s3:ListBucket action for the bucket ARN (arn:aws:s3:::my-data-lake).. The Glue job is failing with 'Access Denied' when trying to list objects, which requires the s3:ListBucket permission on the bucket itself (not on objects). Option B correctly adds s3:ListBucket for the bucket ARN (arn:aws:s3:::my-data-lake), which grants permission to list the contents of the bucket. Without this action, even if other permissions exist, the ListObjectsV2 API call used by AWS Glue to enumerate objects will be denied.

Answer

Add s3:ListObjects action for the bucket ARN.

Answer

Add s3:GetObjectVersion action for the object ARN.

Answer

Add s3:ListBucket action for the object ARN (arn:aws:s3:::my-data-lake/*).

Question 8

A data engineer needs to store JSON documents that are frequently updated and require ACID transactions. Which AWS database service is most appropriate?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is the correct choice because it supports ACID transactions via the `TransactWriteItems` and `TransactGetItems` APIs, enabling atomic, consistent, isolated, and durable operations on JSON documents. It also provides single-digit millisecond latency for frequently updated data, making it ideal for high-throughput, transactional workloads. DynamoDB's flexible schema natively handles JSON documents, and its auto-scaling capabilities ensure performance under varying load.

Answer

Amazon Neptune

Answer

Amazon DocumentDB

Answer

Amazon S3

Question 9

A company uses Amazon DynamoDB for a gaming leaderboard. The table has a partition key of 'GameId' and a sort key of 'Score'. The application needs to query the top 10 scores for a given game. Which DynamoDB feature should be used for optimal performance?

Accepted Answer

Use a Query operation on the base table with ScanIndexForward set to false.. The base table already has 'GameId' as partition key and 'Score' as sort key. A Query operation on the base table with ScanIndexForward set to false retrieves items in descending order by Score, so the first 10 items are the top scores. This is efficient without additional cost or complexity. Option D is unnecessary and incurs extra storage cost.

Answer

Enable DynamoDB Streams and use a Lambda function to compute the leaderboard.

Answer

Use DynamoDB Accelerator (DAX) to cache the results of a Scan operation.

Answer

Create a Global Secondary Index with the same partition key and sort key, then query with ScanIndexForward false.

Question 10

Which TWO actions can help improve the read performance of an Amazon DynamoDB table that is experiencing throttling? (Choose two.)

Accepted Answer

Increase the provisioned read capacity units (RCUs) for the table.. Increasing the provisioned read capacity units (RCUs) directly raises the number of read operations per second the table can handle, alleviating throttling caused by exceeding the current RCU limit. Option C is correct because eventually consistent reads consume half the RCUs of strongly consistent reads, effectively doubling the read throughput for the same provisioned capacity, which can reduce throttling. Option D is not a direct solution for throttling; while a global secondary index (GSI) can improve query performance with a different partition key, it does not increase the base table's read capacity and may require additional provisioning.

Answer

Enable DynamoDB Accelerator (DAX) for write-heavy workloads.

Answer

Add a global secondary index (GSI) with a different partition key.

Answer

Enable auto-scaling with a lower minimum capacity.