DEA-C01 Hard Questions — 25 Difficult Questions

Question 1

A company is using Amazon S3 to store sensitive customer data. The security team requires that all data be encrypted in transit and at rest. Additionally, they want to prevent any accidental public access. Which combination of actions should the data engineer take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable default encryption with SSE-S3, enforce HTTPS only via bucket policy, and enable S3 Block Public Access.. Enabling default encryption with SSE-S3 ensures data is encrypted at rest automatically, enforcing HTTPS only via bucket policy ensures encryption in transit by rejecting HTTP requests, and enabling S3 Block Public Access prevents any accidental public exposure regardless of bucket policies or ACLs. This combination satisfies all security requirements: encryption in transit, encryption at rest, and prevention of public access.

Answer

Enable default encryption with SSE-KMS, allow both HTTP and HTTPS, and set bucket ACLs to private.

Answer

Use client-side encryption, enforce HTTPS via bucket policy, and enable S3 Block Public Access.

Answer

Enable default encryption with SSE-S3, allow HTTP and HTTPS, and use bucket ACLs to block public access.

Question 2

A company is using AWS DMS to replicate data from an on-premises Oracle database to Amazon RDS for MySQL. The replication is working, but the target table has a different schema. Which DMS feature should be used to transform the source schema to match the target?

Accepted Answer

Use DMS transformation rules. AWS DMS transformation rules allow you to modify the schema, table, or column names and data types during the migration process. This feature is specifically designed to handle schema transformations within the DMS task itself, enabling you to map the source Oracle schema to the target MySQL schema without external tools or services.

Answer

Use AWS Schema Conversion Tool (SCT)

Answer

Use AWS Glue ETL jobs

Answer

Use AWS Lambda triggers

Question 3

A data engineer is designing a streaming pipeline that ingests data from an Amazon Kinesis Data Stream (with 5 shards) into Amazon S3. The data must be transformed using a complex stateful operation that cannot be done in a Lambda function (limited to 15 minutes). The engineer needs a solution that can maintain state across multiple records. Which service should be used?

Accepted Answer

Amazon Kinesis Data Analytics for Apache Flink. Amazon Kinesis Data Analytics for Apache Flink is the correct choice because it supports stateful stream processing with exactly-once semantics, can maintain state across multiple records, and has no 15-minute execution limit like AWS Lambda. It natively integrates with Kinesis Data Streams and can sink transformed data to S3, meeting all requirements for complex stateful operations.

Answer

Amazon EMR running Spark Structured Streaming

Answer

Amazon Kinesis Data Firehose with Lambda transformation

Answer

AWS Glue streaming ETL job

Question 4

A company is migrating an on-premises Hadoop cluster to AWS. The data is stored in HDFS and needs to be accessible by both Amazon EMR and Amazon Redshift Spectrum. Which storage solution is most cost-effective and scalable?

Accepted Answer

Amazon Simple Storage Service (S3). Amazon S3 is the most cost-effective and scalable storage solution for this use case because it provides native integration with both Amazon EMR (via S3A connector or EMRFS) and Amazon Redshift Spectrum (via external tables). Unlike HDFS, S3 decouples compute from storage, allowing you to pay only for the data stored and the compute resources used, with virtually unlimited scalability and 99.999999999% durability.

Answer

Amazon FSx for HDFS

Answer

Amazon Elastic Block Store (EBS)

Answer

Amazon Elastic File System (EFS)

Question 5

Which THREE factors should a data engineer consider when choosing between Amazon S3 and Amazon DynamoDB for storing time-series data? (Choose three.)

Accepted Answer

Required query complexity (simple key lookups vs. range scans). Option A is correct because the required query complexity directly drives the choice: DynamoDB excels at simple primary-key lookups and, with sort keys, efficient range scans on a single partition key, whereas S3 (especially with Athena or S3 Select) is better suited to broader analytical scans and aggregations over large datasets. Option B is correct because latency requirements differ fundamentally: DynamoDB provides single-digit millisecond, predictable latency at any scale, while S3 GET requests typically return in tens to hundreds of milliseconds and are not designed for low-latency transactional reads. Option D is correct because data access patterns determine the fit: DynamoDB is optimized for high-volume random reads/writes keyed by partition and sort key, while S3 is optimized for sequential throughput of large objects and is a poor fit for frequent small random updates. Option C is not a primary differentiator here, since both services offer low-cost storage tiers and per-GB pricing alone rarely decides the architecture compared to access and query characteristics. Option E is also not decisive, because both S3 and DynamoDB scale to virtually unlimited volumes; total data volume matters for cost and partitioning strategy but does not by itself dictate which service to choose.

Answer

Cost per GB of storage

Answer

Total data volume

Question 6

A data engineer is troubleshooting an issue where an Amazon Redshift query returns an error: 'ERROR:  permission denied for relation table_name'. The user has been granted SELECT on the table. What is the most likely cause?

Accepted Answer

The user does not have USAGE permission on the schema.. In Amazon Redshift, to access a table, a user must have USAGE permission on the schema containing the table, in addition to SELECT or other table-level permissions. Without USAGE on the schema, the user receives a 'permission denied for relation' error even if SELECT is granted. Option D is correct. Option A (session timeout) would cause a different error or disconnection. Option B (no CONNECT permission) would prevent connecting to the database. Option C (wrong schema) would result in a 'schema not found' error, not a permission denied error.

Answer

The user's session has timed out.

Answer

The user does not have CONNECT permission on the database.

Answer

The table is in a different schema than expected.

Question 7

A company has an Amazon RDS for MySQL database that is experiencing performance issues due to a large number of read requests. The application is read-heavy and can tolerate eventually consistent reads. Which action will reduce the load on the primary database with the least operational overhead?

Accepted Answer

Create a read replica in the same region. Creating a read replica in the same region offloads read traffic from the primary RDS instance to a read-only copy, which directly addresses the read-heavy workload. Since the application can tolerate eventually consistent reads, the slight replication lag is acceptable, and this solution requires minimal operational overhead—just a few clicks in the AWS console or a single API call—without any application code changes.

Answer

Use Amazon ElastiCache for caching

Answer

Enable Multi-AZ deployment

Answer

Increase the instance size of the primary DB

Question 8

Which THREE of the following are benefits of using Amazon DynamoDB Accelerator (DAX)? (Choose three.)

Accepted Answer

Offloads read traffic from the DynamoDB table.. DAX acts as a read-through cache that offloads read traffic from the DynamoDB table, reducing the number of read requests that hit the underlying table and thus lowering the consumed read capacity units (RCUs). This allows the table to handle more concurrent reads without scaling up provisioned capacity.

Answer

Improves write throughput by batching writes.

Answer

Supports write-through caching to improve write performance.

Question 9

Refer to the exhibit. A data engineer has attached this bucket policy to an S3 bucket named data-lake-bucket. The engineer wants to allow only GET requests from the corporate network (10.0.0.0/16) over HTTPS. However, users report that they cannot access objects even when connected to the corporate network. What is the issue?

Accepted Answer

The Deny statement blocks all requests that are not using HTTPS, including those from the corporate network.. The Deny statement with `aws:SecureTransport` set to `false` blocks all HTTP requests. Since the Allow statement only permits GET requests from the corporate network (10.0.0.0/16) but does not require HTTPS, any request from that network that uses HTTP is denied by the explicit Deny. The Deny statement overrides the Allow, so even legitimate corporate users are blocked if they use HTTP.

Answer

The Deny statement should include a condition on the source IP.

Answer

The Allow statement should include a condition for SecureTransport.

Answer

The Allow statement should specify s3:GetObject instead of s3:GetObject.

Question 10

Which THREE factors should a data engineer consider when choosing between Amazon RDS and Amazon DynamoDB for a new application? (Choose THREE.)

Accepted Answer

Requirement for ACID transactions across multiple tables.. Amazon RDS (with engines like PostgreSQL or MySQL) supports ACID transactions across multiple tables, ensuring atomicity, consistency, isolation, and durability for complex operations. DynamoDB, while supporting transactions, is limited to a single AWS account and region, and its transactional API has constraints on item sizes and throughput, making RDS the better choice for multi-table ACID compliance.

Answer

Ability to encrypt data at rest.

Answer

Support for multi-region disaster recovery.

Question 11

A company is migrating a legacy data warehouse to Amazon Redshift. They need to choose a distribution style to minimize data movement during joins. Which THREE factors should they consider?

Accepted Answer

The size of the table (number of rows).. Option A is correct because table size (number of rows) is a primary driver of distribution style choice: small tables are typically assigned ALL distribution so they can be broadcast to every node, eliminating data movement during joins, while large tables need KEY or EVEN distribution. Option B is correct because the whole purpose of choosing a distribution style is to co-locate matching rows on the same slice; if a table is frequently joined on a specific column, distributing both tables on that join key keeps the join local and avoids network redistribution. Option D is correct because fact and dimension tables play different roles in a star schema: large fact tables are usually distributed on their most common join key (or EVEN), while smaller dimension tables are often set to ALL so they are replicated to every node and can be joined without movement. Option C is not a factor because the number of columns does not affect how rows are distributed across slices; it only affects storage width and I/O, not join data movement. Option E is not a factor because Redshift supports distribution keys of various data types, and the data type itself does not determine whether a join requires redistribution — what matters is whether the joined columns match and are used as distribution keys.

Answer

The number of columns in the table.

Answer

The data type of the distribution key column.

Question 12

Refer to the exhibit. A data engineer is troubleshooting an IAM policy attached to a user. The user reports that they cannot upload objects to the S3 bucket 'data-lake-bucket' unless they explicitly specify the 'x-amz-server-side-encryption' header with value 'AES256'. The engineer wants to modify the policy to allow uploads without requiring encryption headers, but still enforce encryption on the bucket itself. Which change should the engineer make?

Accepted Answer

Remove the entire Deny statement.. Removing the Deny statement eliminates the explicit denial that blocks uploads without the 'x-amz-server-side-encryption' header set to 'AES256'. The Allow statement already grants s3:PutObject, and by removing the Deny, users can upload without specifying encryption headers. The bucket's default encryption setting (e.g., AES256) will then automatically encrypt objects at rest, enforcing encryption without requiring the header in the request.

Answer

Remove the Condition block from the Allow statement.

Answer

Change the Condition in the Allow statement to use aws:kms instead of AES256.

Answer

Set the bucket's default encryption to AES256 and keep the policy unchanged.

Question 13

A company is running a production Amazon Aurora PostgreSQL database. The database experiences high write latency during peak hours. The data engineer suspects that the issue is due to a large number of small transactions. Which action would MOST effectively reduce write latency?

Accepted Answer

Increase the instance size and use Provisioned IOPS storage. Increasing the instance size and using Provisioned IOPS storage directly addresses high write latency by providing more CPU and memory resources to handle transaction processing, while Provisioned IOPS ensures consistent, low-latency I/O for write operations. This is the most effective action because small transactions create high I/O demand, and scaling up the instance with dedicated IOPS reduces contention and write queue depth.

Answer

Enable parallel query for the database

Answer

Enable Aurora Auto Scaling for read replicas

Answer

Enable Performance Insights to identify the bottleneck

Question 14

A company uses Amazon Kinesis Data Streams to ingest real-time clickstream data. A Lambda function processes each record. Recently, the Lambda function has been failing with 'ProvisionedThroughputExceededException' when writing results to a DynamoDB table. The data engineer has already increased the DynamoDB write capacity. What else can the engineer do to resolve the issue?

Accepted Answer

Increase the number of shards in the Kinesis stream.. Increasing the number of shards in the Kinesis stream directly addresses the root cause: the Lambda function's concurrency is tied to the number of shards. Each shard can invoke one Lambda instance per batch, so more shards allow more concurrent Lambda executions, which spreads the write load across DynamoDB partitions and reduces the chance of hitting per-partition throughput limits. Since the engineer already increased DynamoDB write capacity, the remaining bottleneck is the Kinesis shard count limiting parallelism. Option D is the correct answer.

Answer

Increase the Lambda function memory.

Answer

Increase the DynamoDB read capacity units.

Answer

Decrease the Lambda batch size to 1.

Question 15

A company runs an Amazon RDS for PostgreSQL database. To meet disaster recovery requirements, they set up a cross-Region read replica. The replica has been lagging by several minutes. Which action is MOST effective to reduce the replica lag?

Accepted Answer

Increase the instance size (memory and CPU) of the replica.. Increasing the instance size (memory and CPU) of the cross-Region read replica is the most effective action because replica lag in Amazon RDS for PostgreSQL is often caused by the replica being unable to keep up with the volume of write-ahead log (WAL) data arriving from the primary. A larger replica instance provides more compute and memory resources to apply WAL changes faster, reducing the replay lag. This directly addresses the bottleneck at the replica side without impacting the primary database.

Answer

Enable Multi-AZ on the primary database.

Answer

Increase the instance size of the primary database.

Answer

Decrease the instance size of the replica to reduce cost.

Question 16

A company runs a time-series forecasting model that writes results to an S3 bucket every 5 minutes. A downstream ETL job reads this data, but sometimes fails because it encounters incomplete files (zero bytes). What is the MOST reliable way to ensure the ETL job only processes complete files?

Accepted Answer

Use S3 Event Notifications to trigger a Lambda function that checks file size and then moves the file to a 'ready' prefix.. S3 Event Notifications can trigger a Lambda function upon object creation, which can check the file size (e.g., > zero bytes) and then copy the file to a 'ready' prefix, ensuring the ETL job only processes complete files. Option A is wrong because an S3 Lifecycle policy can delete small files but does not prevent the ETL from reading incomplete files. Option B is wrong because S3 Copy does not verify completeness. Option C is wrong because S3 Select still reads the file even if it is incomplete; it doesn't guarantee completeness.

Answer

Set an S3 Lifecycle policy to delete files smaller than 1 MB.

Answer

Use S3 Copy to move files to a 'processed' folder after the ETL job reads them.

Answer

Configure S3 Select to query the files and only return rows if the file is complete.

Question 17

A CloudFormation template includes this IAM policy for a cross-account S3 upload use case. What is the purpose of the condition?

Accepted Answer

To ensure that uploaded objects grant full control to the bucket owner.. The condition in the IAM policy uses the `s3:x-amz-acl` key with a value of `bucket-owner-full-control`. This ensures that any object uploaded to the S3 bucket explicitly grants the bucket owner full control over the object, overriding the default behavior where the uploading account retains ownership. This is critical in cross-account uploads to prevent the uploading account from retaining exclusive access to the objects.

Answer

To enforce server-side encryption with KMS.

Answer

To limit the size of objects that can be uploaded.

Answer

To restrict uploads to only a specific AWS account.

Question 18

A data engineer is troubleshooting an access denied error when an AWS Lambda function tries to decrypt an object encrypted with the KMS key 'abc123'. The Lambda function's execution role has the above policy attached. What is the likely cause of the error?

Accepted Answer

The KMS key policy does not grant the Lambda role decrypt permission. The error occurs because KMS requires both the IAM policy and the key policy to grant the necessary permissions. While the IAM policy attached to the Lambda execution role includes kms:Decrypt, the KMS key policy for 'abc123' does not explicitly grant the Lambda role permission to call kms:Decrypt. Since KMS key policies act as a resource-based policy, they must allow the principal (the Lambda role) to perform the action; otherwise, the request is denied even if the IAM policy allows it.

Answer

The Deny statement blocks all decrypt requests

Answer

The Lambda function does not have permission to call kms:GenerateDataKey

Answer

The IAM policy does not include kms:Decrypt permission

Question 19

A data engineer is building a data ingestion pipeline using AWS Glue. The source is an Amazon DynamoDB table, and the target is an Amazon S3 data lake in Parquet format. The pipeline must handle large volumes and ensure exactly-once processing. Which THREE features should the engineer use together to achieve this? (Choose THREE.)

Accepted Answer

Configure the Glue job to convert data to Parquet format.. Converting data to Parquet format is a core requirement for an S3 data lake, as Parquet offers columnar storage, compression, and efficient querying via services like Amazon Athena and Amazon Redshift Spectrum. AWS Glue natively supports Parquet as an output format, enabling the engineer to specify it in the job's output schema or transformation logic.

Answer

Use Amazon Kinesis Data Streams to capture DynamoDB Streams changes.

Answer

Use Amazon S3 Object Lambda to transform data on the fly.

Question 20

A company runs an AWS Glue ETL job that reads data from Amazon S3, transforms it, and writes back to S3 in a different partition structure. The job uses the 'spark.sql.shuffle.partitions' option set to 200. After the job completes, the output has many small files. The data engineer wants to minimize the number of output files while maintaining job performance. Which action should the engineer take?

Accepted Answer

Use 'coalesce(n)' with n based on target file size (e.g., 128 MB) before writing.. 'coalesce(n)' reduces the number of partitions without triggering a full shuffle, allowing you to control the number of output files based on a target file size (e.g., 128 MB). This minimizes small files while preserving job performance, as coalesce is a narrow transformation that avoids the overhead of a shuffle. In contrast, 'repartition(n)' would cause a full shuffle, degrading performance.

Answer

Enable S3 multipart upload for the Glue job.

Answer

Increase the 'spark.sql.shuffle.partitions' to 500.

Answer

Reduce the 'spark.sql.shuffle.partitions' to 50.