DEA-C01 Data Operations and Support Practice Question
A data engineering team uses Amazon S3 to store raw data files. They have an AWS Glue ETL job that reads from an S3 bucket, transforms the data, and writes to a Redshift cluster. The job runs daily and has been failing intermittently with the error: 'An error occurred while calling o143.pyWriteDynamicFrame. S3 Access Denied'. The team has confirmed that the IAM role used by the Glue job has s3:GetObject and s3:PutObject permissions on the bucket and all objects. The Redshift cluster is in the same VPC and the Glue connection is configured correctly. What is the most likely cause of the failure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Glue job's IAM role lacks permission to write to the Glue temporary file bucket (aws-glue-*).
Glue jobs use a special S3 bucket for bookkeeping and temporary data. The job's IAM role must have s3:PutObject permission on the bucket used for temporary files, which is often 'aws-glue-*' for the same region. If this permission is missing, the job fails with access denied. Option A is wrong because the error is an S3 access issue, not a network timeout. Option B is wrong because the error is not related to schema mismatch. Option C is wrong because the error is an S3 access issue, not a Glue job timeout.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Redshift cluster is not publicly accessible and the Glue job does not have a VPC endpoint to Redshift.
Why it's wrong here
The error message is S3 access denied, not connection timeout; also the job has a connection to the VPC.
- ✗
The Glue job has exceeded the maximum execution time and is being killed by AWS.
Why it's wrong here
Timeout would produce a different error, not S3 access denied.
- ✗
The Glue job is using the wrong JDBC driver version for Redshift.
Why it's wrong here
JDBC driver mismatch would cause a different error, typically related to connection or syntax.
- ✓
The Glue job's IAM role lacks permission to write to the Glue temporary file bucket (aws-glue-*).
Why this is correct
Glue uses a temporary S3 bucket for staging; the role must have s3:PutObject on that bucket.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,711 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DEA-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A data engineer is setting up an AWS Glue job to process data from an Amazon S3 bucket. The job fails with an 'Access Denied' error. Which TWO IAM permissions are MOST likely missing from the Glue job's IAM role?
easy- ✓ A.s3:PutObject
- B.kms:Decrypt
- C.dynamodb:GetItem
- D.glue:StartJobRun
- ✓ E.s3:GetObject
Why A: Options A and E are correct. A Glue job requires s3:GetObject to read input data from S3 and s3:PutObject to write output data to S3. Option B (kms:Decrypt) is only needed if the S3 objects are encrypted with KMS. Option C (dynamodb:GetItem) is not relevant unless the job accesses DynamoDB. Option D (glue:StartJobRun) is not needed for the job's execution itself; it is used to start a job run.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.