MLS-C01 Data Engineering Practice Test 5 — 15 Questions

Question 1

Refer to the exhibit. An IAM policy is attached to a data engineering role. The role is used by an AWS Glue ETL job that reads from 'raw/' and writes to 'processed/'. The job fails with an access denied error when trying to write to 'processed/'. What is the likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Deny statement on s3:DeleteObject prevents overwriting objects.. The Deny statement on s3:DeleteObject explicitly denies the permission required to overwrite an existing object in S3. When an AWS Glue job writes to 'processed/' and attempts to overwrite an existing object, S3 requires both s3:PutObject and s3:DeleteObject permissions (since overwrite involves delete then put). The Deny on DeleteObject causes the access denied error. Option B is incorrect because the role is presumed to be attached correctly per the scenario. Option C is incorrect because the policy allows both GetObject and PutObject on the same resource, as is typical. Option D is incorrect because the ARN for the 'processed' folder is correctly specified; the error is due to the Deny, not incorrect ARN.

Answer

The role is not correctly attached to the Glue job.

Answer

The policy does not allow both s3:GetObject and s3:PutObject on the same resource.

Answer

The policy specifies incorrect ARN for the 'processed' folder.

Question 2

Refer to the exhibit. A data engineer examines the output of 'aws glue get-job-run' for a failed job. The job run state is FAILED, but ErrorMessage is empty. The job ran for 3600 seconds (1 hour) before failing. What is the MOST likely cause of the failure?

Accepted Answer

The job ran out of memory due to insufficient DPU allocation.. The job ran for 3600 seconds (the default Glue job timeout) before failing with a FAILED state and an empty ErrorMessage. This pattern is characteristic of an out-of-memory (OOM) error in AWS Glue, which occurs when the allocated DPUs (Data Processing Units) are insufficient for the data volume or transformation complexity. Glue kills the job at the timeout boundary without a detailed error message because the JVM or Python process is killed by the OS (OOM killer), not by a Glue service exception.

Answer

The JDBC connection to the source database timed out.

Answer

The IAM role does not have sufficient permissions to access S3.

Answer

The Python script has a syntax error.

Question 3

Refer to the exhibit. A CloudFormation template creates an S3 bucket. The data engineering team stores daily log files in this bucket and queries them using Amazon Athena. After 30 days, queries on logs older than 30 days start failing with 'Access Denied' errors. What is the MOST likely reason?

Accepted Answer

The lifecycle rule transitions objects to GLACIER after 30 days, making them inaccessible to Athena.. Amazon Athena reads data directly from S3 and does not support querying objects stored in the GLACIER storage class because GLACIER objects are not retrievable in real time. The lifecycle rule transitions objects to GLACIER after 30 days, so when Athena attempts to read those older objects, it receives 'Access Denied' errors because the objects are no longer in a queryable storage class.

Answer

The bucket uses default encryption with SSE-S3, which Athena does not support.

Answer

The lifecycle rule deletes objects after 30 days.

Answer

The bucket policy denies access to objects older than 30 days.

Question 4

A data engineer needs to build a pipeline that ingests CSV files from an S3 bucket, validates the schema, and loads the data into an Amazon Redshift cluster. The pipeline must handle schema evolution gracefully by adding new columns as they appear in the source files. Which combination of AWS services and configurations would meet these requirements with minimal operational overhead?

Accepted Answer

Use AWS Glue to create a crawler and an ETL job that writes to Redshift, with 'resolveChoice' to handle new columns. AWS Glue provides a fully managed ETL service that can automatically detect schema changes via crawlers and handle new columns in CSV files using the 'resolveChoice' transformation. The Glue ETL job can write directly to Amazon Redshift with minimal operational overhead, as it manages schema evolution without requiring manual intervention or additional infrastructure.

Answer

Use AWS Glue to create a crawler that updates the schema, then use Redshift Spectrum to query the data directly from S3

Answer

Use Amazon Kinesis Data Firehose to ingest the files and load into Redshift, with a Lambda function to detect schema changes

Answer

Use Amazon Athena to create external tables with schema-on-read, and insert results into Redshift using INSERT INTO

Question 5

A machine learning team is preparing a dataset for model training. The data is stored in an Amazon S3 bucket with objects that are each approximately 100 MB in size. The team wants to use Amazon SageMaker for training. To optimize training performance, which data format and storage configuration should be used?

Accepted Answer

Store data as RecordIO-Protobuf files and use SageMaker Pipe input mode. RecordIO-Protobuf is the optimal format for SageMaker because it stores data in a binary, sharded structure that allows for efficient random access and parallel I/O. Pipe input mode streams data directly from S3 to the training algorithm, eliminating disk writes and reducing startup latency, which is critical for large datasets with 100 MB objects.

Answer

Store data as RecordIO-Protobuf files and use SageMaker File input mode

Answer

Store data as CSV files and use SageMaker Pipe input mode

Answer

Store data as CSV files and use SageMaker File input mode

Question 6

A company uses Amazon Kinesis Data Analytics for Apache Flink to process real-time clickstream data. The application uses event time and watermarks for windowed aggregations. The team notices that the output from tumbling windows is delayed, and many late records are being dropped. What is the MOST likely cause?

Accepted Answer

The allowed lateness is set too low, causing late records to be discarded. The described symptoms—delayed output and dropped late records—are classic indicators that the `allowedLateness` parameter is set too low. In Apache Flink, event-time processing relies on watermarks to determine when a window is complete; if `allowedLateness` is too short, any record arriving after the watermark passes the window's end time is discarded as late. The team's observation that many late records are being dropped directly points to this configuration issue.

Answer

The checkpointing interval is too long, causing state to be lost

Answer

The parallelism is too low, causing backpressure

Answer

The source is marking itself as idle, causing watermarks to stall

Question 7

A research lab stores large genomic datasets in Amazon S3 Glacier Deep Archive. They need to run a one-time analysis on a subset of 10 PB of data. The analysis will use an Amazon EMR cluster with Amazon S3 as the data source. What is the MOST cost-effective and performant way to make the data available for the EMR cluster?

Accepted Answer

Initiate a Bulk retrieval request and restore the data to S3 Standard for the duration of the analysis. Bulk retrieval is the most cost-effective retrieval tier for large, non-urgent data from S3 Glacier Deep Archive, completing within 48 hours. Restoring to S3 Standard provides direct, high-throughput access for the EMR cluster, and deleting the data after analysis avoids ongoing storage costs. This approach balances performance (EMR reads from S3 Standard) with minimal cost (Bulk retrieval is the cheapest retrieval option).

Answer

Restore the data to S3 Standard-IA and delete after the analysis

Answer

Configure the EMR cluster to read directly from Glacier Deep Archive using S3 Console

Answer

Initiate an Expedited retrieval request and use the temporary copy for the EMR cluster

Question 8

A company uses AWS Glue ETL jobs to transform data from Amazon RDS for MySQL to Amazon S3. The transformation includes aggregations and joins. The job runs daily and processes approximately 100 GB of data. Recently, the job started failing with memory errors on the worker nodes. Which approach would MOST effectively resolve the issue without changing the logic?

Accepted Answer

Increase the number of workers in the job configuration. Increasing the number of workers distributes the memory load across more nodes, which directly addresses memory errors in a Spark ETL job without altering the transformation logic. AWS Glue Spark jobs process data in memory across workers, and insufficient total memory causes out-of-memory errors when handling 100 GB of data with aggregations and joins.

Answer

Switch from a Spark ETL job to a Python shell job

Answer

Decrease the number of workers to reduce overhead

Answer

Change the worker type from G.2X to G.1X to increase memory per worker

Question 9

A data scientist needs to run a one-time training job on a 5 TB dataset stored in Amazon S3. The training algorithm requires random access to individual records. Which SageMaker input mode and data format combination would be MOST appropriate?

Accepted Answer

Use File mode with RecordIO-Protobuf format. File mode loads the entire 5 TB dataset onto the SageMaker instance's local SSD, providing low-latency random access to individual records, which is required by the training algorithm. RecordIO-Protobuf format is optimized for SageMaker's internal data pipeline, enabling efficient deserialization and batching during training. This combination ensures the algorithm can randomly access any record without the sequential streaming constraints of Pipe mode.

Answer

Use Pipe mode with Parquet format

Answer

Use Pipe mode with RecordIO-Protobuf format

Answer

Use Pipe mode with CSV format

Question 10

A company is building a data lake on Amazon S3 and wants to ensure that data is encrypted at rest using AWS KMS. Which TWO actions are required to achieve this? (Choose TWO.)

Accepted Answer

Configure the KMS key policy to allow the S3 service to use the key. Option B is correct because enabling default bucket encryption with SSE-KMS (PutBucketEncryption with the aws:kms or aws:kms:dsse algorithm) is what actually causes every object written to the bucket to be encrypted at rest with AWS KMS. Option A is correct because the KMS customer managed key's key policy must grant the S3 service principal (or the calling principals) kms:GenerateDataKey and kms:Decrypt permissions, otherwise S3 cannot use the key and uploads fail with AccessDenied. Option C is not required: a bucket policy denying unencrypted PutObject is an optional guardrail, not a prerequisite for KMS encryption at rest. Option D addresses encryption in transit (TLS/HTTPS), which is a separate control from encryption at rest with KMS. Option E describes client-side encryption, which bypasses SSE-KMS entirely and is not needed to meet the stated requirement.

Answer

Add a bucket policy that denies PutObject without encryption

Answer

Enable encryption in transit using HTTPS for all S3 API calls

Answer

Use client-side encryption on all data before uploading

Question 11

A company is using Amazon DynamoDB as a source for a machine learning pipeline. The data is exported nightly to Amazon S3 using DynamoDB Streams and an AWS Glue job. The Glue job reads the stream records, transforms them, and writes to S3 in Parquet format. The team notices that the Glue job is taking too long and consuming high DynamoDB read capacity. Which THREE actions would reduce the load on DynamoDB and improve performance? (Choose THREE.)

Accepted Answer

Use Amazon DynamoDB export to S3 (incremental) feature instead of Glue. Option A is correct because DynamoDB's native export to S3 feature (including incremental exports) reads from the table's underlying storage without consuming provisioned read capacity units, eliminating the RCU load that the Glue job currently places on the table. Option C is correct because using DynamoDB Streams with AWS Lambda lets the stream records be processed and written to S3 in near-real-time, removing the need for Glue to poll or scan the table and thus reducing read capacity consumption. Option E is correct because having Glue read from an S3 snapshot that was exported earlier means Glue performs its transformations against S3 objects rather than issuing reads against DynamoDB, so no DynamoDB read capacity is consumed by the Glue job. Option B is not appropriate because increasing write capacity units addresses write throughput, not the read capacity consumed by Glue reading the table. Option D is not appropriate because increasing read capacity units merely provisions more RCUs to absorb the existing Glue workload; it does not reduce the load on DynamoDB or improve the pipeline's efficiency.

Answer

Increase the DynamoDB write capacity units to handle the stream writes

Answer

Increase the DynamoDB read capacity units to handle Glue's workload

Question 12

An IAM policy is attached to a data engineering role that writes to an S3 bucket. The policy is shown in the exhibit. What is the effect of this policy?

Accepted Answer

The role must use SSE-KMS when writing objects; reading is allowed only if the object is encrypted with SSE-KMS. The IAM policy uses a `Condition` block with `s3:x-amz-server-side-encryption` set to `aws:kms`, which enforces that any `PutObject` request must include SSE-KMS encryption. The `Deny` effect on `s3:GetObject` when encryption is not `aws:kms` ensures that reading objects without SSE-KMS is blocked. This combination allows writing only with SSE-KMS and reading only of objects encrypted with SSE-KMS, making option D correct.

Answer

The role can write objects with any encryption, but reading is restricted to SSE-KMS only

Answer

The role can read and write any object without encryption restrictions

Answer

The role can only read objects; writing is always denied

Question 13

An ML engineer runs the AWS CLI command shown in the exhibit on a file in S3. The engineer wants to use this file in a SageMaker training job. What does the output reveal about the data?

Accepted Answer

The file is 5 GB and is stored as a CSV. The AWS CLI command `aws s3 ls s3://bucket/path/file.csv --summarize --human-readable` lists the object's size in human-readable format (e.g., 5 GB) and its last modified date. The output does not include ContentLength or version ID; however, the file extension `.csv` indicates the file is a CSV. This size and format information is sufficient to confirm the file is a 5 GB CSV, which can be used directly in a SageMaker training job. Options B (5 MB) is incorrect because the output shows 5 GB. Option C (Parquet) is incorrect because the extension is `.csv`. Option D (versioned) is incorrect because `aws s3 ls` without `--versions` does not show version ID.

Answer

The file is 5 MB and is stored as a CSV

Answer

The file is in Parquet format with two features and one label

Answer

The file is versioned and can be accessed by version ID

Question 14

A data engineer needs to move 10 TB of historical data from an on-premises Hadoop cluster to Amazon S3 for ML training. The data is currently stored in HDFS and is compressible. The network bandwidth between the on-premises data center and AWS is 1 Gbps. The team needs to minimize the time to transfer and also wants to avoid any downtime for the on-premises system. Which solution meets these requirements?

Accepted Answer

Install the AWS DataSync agent on-premises, configure a task to transfer data to S3 with compression enabled.. AWS DataSync is designed for large-scale data transfers from on-premises storage to AWS, and it can compress data in transit to reduce transfer time over a 1 Gbps link. It also operates as an agent-based solution that does not require downtime for the on-premises Hadoop cluster, as it reads data from HDFS without disrupting ongoing operations.

Answer

Set up an AWS Direct Connect connection and use rsync to copy data to S3.

Answer

Enable S3 Transfer Acceleration on the bucket and use the AWS CLI to copy data.

Answer

Use AWS Snowball Edge devices to export the data and ship them to AWS.

Question 15

A company uses Amazon Kinesis Data Streams for real-time clickstream analysis. The data is consumed by a Lambda function that enriches the records and stores them in Amazon S3. Recently, the Lambda function has been failing with throttling errors, and the consumer is falling behind. The team needs to increase the throughput of the consumer without changing the data format or the Lambda function code. What should the team do?

Accepted Answer

Increase the number of shards in the Kinesis data stream.. Kinesis Data Streams throughput is bounded by the number of shards: each shard provides 1 MB/s ingress and 2 MB/s egress, and Lambda event source mappings poll each shard with a single concurrent invocation per shard. Adding shards (resizing) increases both the stream's capacity and the number of parallel Lambda pollers, which directly raises consumer throughput without touching the data format or function code.

Answer

Add a second Kinesis data stream and send duplicate records to both.

Answer

Increase the batch size in the event source mapping for Lambda.

Answer

Increase the reserved concurrency of the Lambda function.