Troubleshooting practice questions

A data scientist is performing EDA on a dataset stored in Amazon S3 using Amazon Athena. The dataset is partitioned by date, and each partition contains CSV files. The data scientist notices that some queries return zero rows for partitions that should have data. Which THREE steps should the data scientist take to troubleshoot? (Choose 3.)

Trap 1: Convert the CSV files to Parquet format.

Format conversion is not a troubleshooting step for missing data.

Trap 2: Re-run the query with a LIMIT clause to force partition discovery.

LIMIT does not trigger partition discovery.

A
Verify that the CSV files exist in the S3 bucket for the specific partition.
Files may have been moved or deleted.
B
Run MSCK REPAIR TABLE to add new partitions to the Glue Data Catalog.
Partitions may not have been discovered by the crawler.
C
Convert the CSV files to Parquet format.
Why wrong: Format conversion is not a troubleshooting step for missing data.
D
Check the data types of the columns used in the query's WHERE clause.
Type mismatches can cause the filter to exclude all rows.
E
Re-run the query with a LIMIT clause to force partition discovery.
Why wrong: LIMIT does not trigger partition discovery.

Question 2hardmultiple choice

A data scientist is troubleshooting a failed SageMaker training job that uses a custom Docker image. The failure reason shows 'unrecognized arguments: --sagemaker_program'. What is the most likely cause?

Network Topology

Trap 1: The Docker image is tagged incorrectly and cannot be pulled

If the image could not be pulled, the failure reason would be different (e.g., 'CannotPullContainer').

Trap 2: The training job is in a different region than the ECR repository

Region mismatch would cause a different error, not an argument error.

Trap 3: The input mode is File mode, but the container expects Pipe mode

Input mode does not affect argument parsing.

A
The Docker image is tagged incorrectly and cannot be pulled
Why wrong: If the image could not be pulled, the failure reason would be different (e.g., 'CannotPullContainer').
B
The training job is in a different region than the ECR repository
Why wrong: Region mismatch would cause a different error, not an argument error.
C
The input mode is File mode, but the container expects Pipe mode
Why wrong: Input mode does not affect argument parsing.
D
The custom Docker image does not use the SageMaker training toolkit and thus does not accept SageMaker hyperparameters
Custom containers that are not toolkit-based ignore SageMaker hyperparameters, causing unrecognized argument errors if the entry point tries to parse them.

Question 3hardmultiple choice

A data engineer is troubleshooting an AWS Glue job that reads from and writes to the S3 bucket 'data-lake-bucket'. The job fails when trying to write to the 'sensitive/' prefix. The IAM policy attached to the Glue job's IAM role is shown in the exhibit. What is the MOST likely reason for the failure?

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject"
      ],
      "Resource": "arn:aws:s3:::data-lake-bucket/*"
    },
    {
      "Effect": "Deny",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::data-lake-bucket/sensitive/*"
    }
  ]
}

Trap 1: The IAM role does not have permission to read objects from the…

The policy allows s3:GetObject on all objects in the bucket.

Trap 2: The IAM policy does not specify the bucket resource correctly

The resource ARN is correctly specified for objects in the bucket.

Trap 3: The IAM policy lacks a required condition for encryption

There is no condition required; the deny is explicit.

A
The IAM role does not have permission to read objects from the bucket
Why wrong: The policy allows s3:GetObject on all objects in the bucket.
B
The IAM role has an explicit deny for s3:PutObject on the 'sensitive/' prefix
The Deny statement blocks write access to the sensitive prefix.
C
The IAM policy does not specify the bucket resource correctly
Why wrong: The resource ARN is correctly specified for objects in the bucket.
D
The IAM policy lacks a required condition for encryption
Why wrong: There is no condition required; the deny is explicit.

Question 4mediummultiple choice

A data scientist is troubleshooting access to an S3 bucket. The following IAM policy is attached to their role. What is the likely result when they try to list objects in the 'confidential' folder?

```json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::example-bucket"
    },
    {
      "Effect": "Deny",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::example-bucket/confidential/*",
      "Condition": {
        "StringNotEquals": {

"aws:SourceVpce": "vpce-12345678"

}
      }
    }
  ]
}

```

Exhibit

Refer to the exhibit.

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::my-bucket",
                "arn:aws:s3:::my-bucket/*"
            ]
        },
        {
            "Effect": "Deny",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::my-bucket/confidential/*",
            "Condition": {
                "StringNotEquals": {
                    "aws:sourceVpce": "vpce-12345678"
                }
            }
        }
    ]
}
```

Trap 1: Access is allowed because the Allow statement grants s3:ListBucket.

The Deny statement overrides the Allow for the confidential folder.

Trap 2: Access is denied unconditionally.

Denial is conditional on the source VPC endpoint.

Trap 3: Access is allowed only if the request uses HTTPS.

The condition is about VPC endpoint, not HTTPS.

A
Access is allowed because the Allow statement grants s3:ListBucket.
Why wrong: The Deny statement overrides the Allow for the confidential folder.
B
Access is denied unconditionally.
Why wrong: Denial is conditional on the source VPC endpoint.
C
Access is allowed only if the request uses HTTPS.
Why wrong: The condition is about VPC endpoint, not HTTPS.
D
Access is denied if the request does not originate from the specified VPC endpoint.
The condition requires the request to come from vpce-12345678 to allow access.

Question 5mediummultiple choice

A data scientist is analyzing application logs in JSON format. Based on the exhibit, which EDA insight is most valuable for troubleshooting?

Exhibit

Refer to the exhibit.

{
  "Logs": [
    {
      "timestamp": "2023-10-01T10:00:00Z",
      "level": "ERROR",
      "message": "NullPointerException: Cannot invoke method on null object"
    },
    {
      "timestamp": "2023-10-01T10:01:00Z",
      "level": "ERROR",
      "message": "NullPointerException: Cannot invoke method on null object"
    },
    {
      "timestamp": "2023-10-01T10:02:00Z",
      "level": "WARN",
      "message": "Connection timeout"
    },
    {
      "timestamp": "2023-10-01T10:03:00Z",
      "level": "ERROR",
      "message": "NullPointerException: Cannot invoke method on null object"
    }
  ]
}

Trap 1: All logs occurred at the same timestamp.

Timestamps are different.

Trap 2: There is a connection timeout issue.

Only one WARN log about timeout; less frequent.

Trap 3: Most logs are at WARN level.

Only one WARN; three are ERROR.

A
There is a recurring NullPointerException error.
Three out of four logs are the same error, indicating a pattern.
B
All logs occurred at the same timestamp.
Why wrong: Timestamps are different.
C
There is a connection timeout issue.
Why wrong: Only one WARN log about timeout; less frequent.
D
Most logs are at WARN level.
Why wrong: Only one WARN; three are ERROR.