MLS-C01 Data Engineering Practice Test 11 — 15 Questions

Question 1

A research lab stores large genomic datasets in Amazon S3 Glacier Deep Archive. They need to run a one-time analysis on a subset of 10 PB of data. The analysis will use an Amazon EMR cluster with Amazon S3 as the data source. What is the MOST cost-effective and performant way to make the data available for the EMR cluster?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Initiate a Bulk retrieval request and restore the data to S3 Standard for the duration of the analysis. Bulk retrieval is the most cost-effective retrieval tier for large, non-urgent data from S3 Glacier Deep Archive, completing within 48 hours. Restoring to S3 Standard provides direct, high-throughput access for the EMR cluster, and deleting the data after analysis avoids ongoing storage costs. This approach balances performance (EMR reads from S3 Standard) with minimal cost (Bulk retrieval is the cheapest retrieval option).

Answer

Restore the data to S3 Standard-IA and delete after the analysis

Answer

Configure the EMR cluster to read directly from Glacier Deep Archive using S3 Console

Answer

Initiate an Expedited retrieval request and use the temporary copy for the EMR cluster

Question 2

An ML engineer is using Amazon SageMaker to train a model on a dataset that contains personal identifiable information (PII). The data must be encrypted at rest and in transit. The company uses AWS KMS for key management. How should the engineer configure the SageMaker training job to meet these encryption requirements?

Accepted Answer

Specify a KMS key for the training job's VolumeKmsKeyId and enable inter-container traffic encryption. It addresses both encryption at rest and in transit for the SageMaker training job. Specifying a KMS key via VolumeKmsKeyId encrypts the ML storage volume (EBS) used by the training instances at rest, while enabling inter-container traffic encryption ensures data exchanged between distributed training containers is encrypted in transit using TLS. This combination meets the PII encryption requirements using AWS KMS.

Answer

Enable S3 Server-Side Encryption (SSE-S3) on the input data bucket

Answer

Use a custom Docker image with built-in encryption and disable inter-container traffic encryption for performance

Answer

Use a VPC with an S3 VPC Endpoint and enable SSL for the endpoint

Question 3

A company uses AWS Glue ETL jobs to transform data from Amazon RDS for MySQL to Amazon S3. The transformation includes aggregations and joins. The job runs daily and processes approximately 100 GB of data. Recently, the job started failing with memory errors on the worker nodes. Which approach would MOST effectively resolve the issue without changing the logic?

Accepted Answer

Increase the number of workers in the job configuration. Increasing the number of workers distributes the memory load across more nodes, which directly addresses memory errors in a Spark ETL job without altering the transformation logic. AWS Glue Spark jobs process data in memory across workers, and insufficient total memory causes out-of-memory errors when handling 100 GB of data with aggregations and joins.

Answer

Switch from a Spark ETL job to a Python shell job

Answer

Decrease the number of workers to reduce overhead

Answer

Change the worker type from G.2X to G.1X to increase memory per worker

Question 4

A data scientist needs to run a one-time training job on a 5 TB dataset stored in Amazon S3. The training algorithm requires random access to individual records. Which SageMaker input mode and data format combination would be MOST appropriate?

Accepted Answer

Use File mode with RecordIO-Protobuf format. File mode loads the entire 5 TB dataset onto the SageMaker instance's local SSD, providing low-latency random access to individual records, which is required by the training algorithm. RecordIO-Protobuf format is optimized for SageMaker's internal data pipeline, enabling efficient deserialization and batching during training. This combination ensures the algorithm can randomly access any record without the sequential streaming constraints of Pipe mode.

Answer

Use Pipe mode with Parquet format

Answer

Use Pipe mode with RecordIO-Protobuf format

Answer

Use Pipe mode with CSV format

Question 5

A team is building a data pipeline using Amazon Kinesis Data Firehose to deliver real-time clickstream data to an Amazon S3 bucket. The data must be partitioned by year, month, day, and hour. Which configuration should the team use to achieve this?

Accepted Answer

Enable dynamic partitioning in Firehose and configure the partition keys as YYYY/MM/dd/HH. Amazon Kinesis Data Firehose supports dynamic partitioning, which allows you to automatically partition incoming data in S3 based on keys like YYYY/MM/dd/HH. By enabling this feature and configuring the partition keys to match the desired year, month, day, and hour format, Firehose will write data directly into the corresponding S3 prefix structure without requiring additional processing.

Answer

Configure an S3 lifecycle rule to move data into partition folders after delivery

Answer

Use an AWS Lambda function to write data to S3 with the desired partition structure

Answer

Use Amazon Athena partition projection to dynamically create partitions

Question 6

A company is building a data lake on Amazon S3 and wants to ensure that data is encrypted at rest using AWS KMS. Which TWO actions are required to achieve this? (Choose TWO.)

Accepted Answer

Configure the KMS key policy to allow the S3 service to use the key. AWS KMS uses key policies to control access to the KMS key. For S3 to use a KMS key for server-side encryption (SSE-KMS), the key policy must grant the S3 service principal (or the bucket owner's account) the necessary permissions, such as kms:Encrypt and kms:Decrypt. Without this policy, S3 cannot access the key to encrypt or decrypt objects at rest. Option B is correct because enabling default encryption on the S3 bucket with SSE-KMS ensures that all objects uploaded to the bucket are automatically encrypted using the specified KMS key, meeting the requirement for encryption at rest.

Answer

Add a bucket policy that denies PutObject without encryption

Answer

Enable encryption in transit using HTTPS for all S3 API calls

Answer

Use client-side encryption on all data before uploading

Question 7

A company is using Amazon DynamoDB as a source for a machine learning pipeline. The data is exported nightly to Amazon S3 using DynamoDB Streams and an AWS Glue job. The Glue job reads the stream records, transforms them, and writes to S3 in Parquet format. The team notices that the Glue job is taking too long and consuming high DynamoDB read capacity. Which THREE actions would reduce the load on DynamoDB and improve performance? (Choose THREE.)

Accepted Answer

Use Amazon DynamoDB export to S3 (incremental) feature instead of Glue. DynamoDB's native export to S3 (incremental) feature directly exports data to S3 without consuming read capacity units (RCUs) or requiring a separate compute service like AWS Glue. This eliminates the bottleneck of Glue reading from DynamoDB Streams, which consumes RCUs and adds latency, thereby reducing load on DynamoDB and improving overall performance.

Answer

Increase the DynamoDB write capacity units to handle the stream writes

Answer

Increase the DynamoDB read capacity units to handle Glue's workload

Question 8

A data engineer is designing a data pipeline that uses Amazon Kinesis Data Streams to ingest sensor data. The data must be processed in real-time, and the results must be stored in Amazon DynamoDB. Which TWO AWS services can be used together to achieve this? (Choose TWO.)

Accepted Answer

Amazon Kinesis Data Analytics. Amazon Kinesis Data Analytics (B) can process streaming data from Kinesis Data Streams in real-time using SQL or Apache Flink, and AWS Lambda (E) can be used as a consumer to write the processed results to DynamoDB. This combination provides a fully managed, serverless pipeline for real-time ingestion, processing, and storage.

Answer

Amazon Athena

Answer

AWS Glue

Answer

Amazon S3

Question 9

An IAM policy is attached to a data engineering role that writes to an S3 bucket. The policy is shown in the exhibit. What is the effect of this policy?

Accepted Answer

The role must use SSE-KMS when writing objects; reading is allowed only if the object is encrypted with SSE-KMS. The IAM policy uses a `Condition` block with `s3:x-amz-server-side-encryption` set to `aws:kms`, which enforces that any `PutObject` request must include SSE-KMS encryption. The `Deny` effect on `s3:GetObject` when encryption is not `aws:kms` ensures that reading objects without SSE-KMS is blocked. This combination allows writing only with SSE-KMS and reading only of objects encrypted with SSE-KMS, making option D correct.

Answer

The role can write objects with any encryption, but reading is restricted to SSE-KMS only

Answer

The role can read and write any object without encryption restrictions

Answer

The role can only read objects; writing is always denied

Question 10

An AWS Glue job is failing with an error that it cannot access an S3 bucket. The IAM role attached to the Glue job is shown in the exhibit. What is the MOST likely cause of the failure?

Accepted Answer

The S3 bucket has a bucket policy that denies access to this role. Even if the IAM role has S3 permissions, an S3 bucket policy that explicitly denies access to that role will override any allow. AWS evaluates all policies (identity-based and resource-based) and a deny in any policy results in a final deny decision. The error indicates the Glue job cannot access the bucket, which is consistent with a bucket-level deny.

Answer

The role lacks S3 permissions

Answer

The role does not have permission to call S3 APIs

Answer

The trust policy does not allow Glue to assume the role

Question 11

A data engineer needs to process streaming data from an IoT fleet and store the results in Amazon S3 for analysis. The solution must be serverless and handle data that arrives at irregular intervals. Which AWS service should be used to ingest the data?

Accepted Answer

AWS IoT Core. AWS IoT Core is the correct choice because it is a fully managed, serverless service designed specifically to ingest data from IoT devices at scale, handling irregular and high-frequency message arrivals via MQTT, HTTP, or LoRaWAN protocols. It can directly route data to Amazon S3 using IoT Rules, making it ideal for this streaming IoT fleet scenario without requiring any server management.

Answer

Amazon S3

Answer

Amazon Simple Queue Service (SQS)

Answer

Amazon Kinesis Data Streams

Question 12

A machine learning team is building a real-time inference pipeline using Amazon SageMaker. The input data is located in an S3 bucket, and the team needs to transform the data before inference using a custom Python script. The transformation should run on a serverless infrastructure and must be triggered automatically when new data arrives in S3. Which combination of services should the team use?

Accepted Answer

Use AWS Lambda functions triggered by S3 events to run the transformation, then invoke a SageMaker endpoint.. AWS Lambda functions can be triggered directly by S3 events (e.g., ObjectCreated) to run a custom Python transformation script on the incoming data, and then invoke a SageMaker endpoint for real-time inference. This combination meets the serverless infrastructure requirement and provides automatic, event-driven processing without managing any servers.

Answer

Use AWS Glue jobs triggered by S3 events.

Answer

Use Amazon SageMaker Processing jobs triggered by S3 events.

Answer

Use Amazon Kinesis Data Firehose to transform data and deliver to SageMaker.

Question 13

A data engineer needs to move 10 TB of historical data from an on-premises Hadoop cluster to Amazon S3 for ML training. The data is currently stored in HDFS and is compressible. The network bandwidth between the on-premises data center and AWS is 1 Gbps. The team needs to minimize the time to transfer and also wants to avoid any downtime for the on-premises system. Which solution meets these requirements?

Accepted Answer

Install the AWS DataSync agent on-premises, configure a task to transfer data to S3 with compression enabled.. AWS DataSync is designed for large-scale data transfers from on-premises storage to AWS, and it can compress data in transit to reduce transfer time over a 1 Gbps link. It also operates as an agent-based solution that does not require downtime for the on-premises Hadoop cluster, as it reads data from HDFS without disrupting ongoing operations.

Answer

Set up an AWS Direct Connect connection and use rsync to copy data to S3.

Answer

Enable S3 Transfer Acceleration on the bucket and use the AWS CLI to copy data.

Answer

Use AWS Snowball Edge devices to export the data and ship them to AWS.

Question 14

A company uses Amazon Kinesis Data Streams for real-time clickstream analysis. The data is consumed by a Lambda function that enriches the records and stores them in Amazon S3. Recently, the Lambda function has been failing with throttling errors, and the consumer is falling behind. The team needs to increase the throughput of the consumer without changing the data format or the Lambda function code. What should the team do?

Accepted Answer

Increase the number of shards in the Kinesis data stream.. Increase the number of shards in the Kinesis data stream. Each shard supports a fixed number of read transactions per second and a maximum data read rate. Increasing the number of shards increases the parallelism of the stream, allowing the Lambda function to process records from multiple shards concurrently, thus increasing throughput. Option A is incorrect because adding a second stream would require duplicating data and does not address the throttling on the existing stream. Option B is incorrect because increasing the batch size may reduce the number of Lambda invocations but does not increase the parallelism of the stream; the bottleneck is the shard count. Option D is incorrect because increasing reserved concurrency does not overcome the limitation that each shard can only trigger one Lambda invocation at a time; the main constraint is the number of shards.

Answer

Add a second Kinesis data stream and send duplicate records to both.

Answer

Increase the batch size in the event source mapping for Lambda.

Answer

Increase the reserved concurrency of the Lambda function.

Question 15

A financial services company is building a fraud detection model that requires joining real-time transaction data with a reference dataset of known fraudulent accounts stored in Amazon DynamoDB. The solution must minimize latency and be highly available. The reference dataset is updated frequently (every few minutes). Which architecture should the team use?

Accepted Answer

Use Amazon Kinesis Data Analytics to process the stream and join with a DynamoDB table.. Amazon Kinesis Data Analytics (now managed Apache Flink) can directly reference a DynamoDB table as a reference source via the Flink Table API or SQL JOINs, enabling low-latency, stateful stream enrichment without external query overhead. This architecture minimizes latency by performing the join in-memory within the streaming application, and it supports high availability through Kinesis Data Analytics' automatic checkpointing and failover.

Answer

Use Amazon Athena to query the DynamoDB table and join with streaming data.

Answer

Use AWS Glue streaming ETL to read from Kinesis and join with DynamoDB.

Answer

Use Amazon SageMaker to host a model that queries DynamoDB for each inference.