Amazon DAS-C01 Online Practice Questions and Exam Preparation

Amazon DAS-C01 Online Questions & Answers

• Question 181:

  A company uses Amazon Redshift as its data warehouse. A new table includes some columns that contain sensitive data and some columns that contain non-sensitive data. The data in the table eventually will be referenced by several existing queries that run many times each day.

  A data analytics specialist must ensure that only members of the company's auditing team can read the columns that contain sensitive data. All other users must have read-only access to the columns that contain non-sensitive data.

  Which solution will meet these requirements with the LEAST operational overhead?

  A. Grant the auditing team permission to read from the table. Load the columns that contain non-sensitive data into a second table. Grant the appropriate users read-only permissions to the second table.
  B. Grant all users read-only permissions to the columns that contain non-sensitive data. Use the GRANT SELECT command to allow the auditing team to access the columns that contain sensitive data.
  C. Grant all users read-only permissions to the columns that contain non-sensitive data. Attach an IAM policy to the auditing team with an explicit. Allow action that grants access to the columns that contain sensitive data.
  D. Grant the auditing team permission to read from the table. Create a view of the table that includes the columns that contain non-sensitive data. Grant the appropriate users read-only permissions to that view.
  B. Grant all users read-only permissions to the columns that contain non-sensitive data. Use the GRANT SELECT command to allow the auditing team to access the columns that contain sensitive data.

  ---

  Explanation/Reference:

  B - GRANT defines access privileges for a user or user group. https://docs.aws.amazon.com/redshift/latest/dg/r_GRANT.html

• Question 182:

  A data analyst is using AWS Glue to organize, cleanse, validate, and format a 200 GB dataset. The data analyst triggered the job to run with the Standard worker type. After 3 hours, the AWS Glue job status is still RUNNING. Logs from the job run show no error codes. The data analyst wants to improve the job execution time without overprovisioning.

  Which actions should the data analyst take?

  A. Enable job bookmarks in AWS Glue to estimate the number of data processing units (DPUs). Based on the profiled metrics, increase the value of the executor-cores job parameter.
  B. Enable job metrics in AWS Glue to estimate the number of data processing units (DPUs). Based on the profiled metrics, increase the value of the maximum capacity job parameter.
  C. Enable job metrics in AWS Glue to estimate the number of data processing units (DPUs). Based on the profiled metrics, increase the value of the spark.yarn.executor.memoryOverhead job parameter.
  D. Enable job bookmarks in AWS Glue to estimate the number of data processing units (DPUs). Based on the profiled metrics, increase the value of the num-executors job parameter.
  B. Enable job metrics in AWS Glue to estimate the number of data processing units (DPUs). Based on the profiled metrics, increase the value of the maximum capacity job parameter.

  ---

  Explanation/Reference:

  Reference: https://docs.aws.amazon.com/glue/latest/dg/monitor-debug-capacity.html

• Question 183:

  A company is planning to do a proof of concept for a machine learning (ML) project using Amazon SageMaker with a subset of existing on-premises data hosted in the company's 3 TB data warehouse. For part of the project, AWS Direct Connect is established and tested. To prepare the data for ML, data analysts are performing data curation. The data analysts want to perform multiple step, including mapping, dropping null fields, resolving choice, and splitting fields. The company needs the fastest solution to curate the data for this project.

  Which solution meets these requirements?

  A. Ingest data into Amazon S3 using AWS DataSync and use Apache Spark scrips to curate the data in an Amazon EMR cluster. Store the curated data in Amazon S3 for ML processing.
  B. Create custom ETL jobs on-premises to curate the data. Use AWS DMS to ingest data into Amazon S3 for ML processing.
  C. Ingest data into Amazon S3 using AWS DMS. Use AWS Glue to perform data curation and store the data in Amazon S3 for ML processing.
  D. Take a full backup of the data store and ship the backup files using AWS Snowball. Upload Snowball data into Amazon S3 and schedule data curation jobs using AWS Batch to prepare the data for ML.
  C. Ingest data into Amazon S3 using AWS DMS. Use AWS Glue to perform data curation and store the data in Amazon S3 for ML processing.

  ---

  Explanation/Reference:

  S3 is a valid target for DMS https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.S3.html

• Question 184:

  A company needs a solution to control data access for the company's Amazon S3 data lake. The company expects the number of data sources in the data lake and the number of users that access the data to increase rapidly. All the data in the data lake is cataloged in an AWS Glue Data Catalog. Users access the data by using Amazon Athena and Amazon QuickSight.

  A data analytics specialist must implement a solution that controls which users can ingest new data into the data lake. The solution also must restrict access to data at the column level and must provide audit capabilities.

  Which solution will meet these requirements?

  A. Use IAM resource-based policies to allow access to required S3 prefixes only. Use AWS CloudTrail for audit logs.
  B. Use AWS Lake Formation access controls for the data in the data lake. Use AWS CloudTrail for audit logs.
  C. Use IAM identity-based policies to allow access to authorized users only. Use Amazon CloudWatch for audit logs.
  D. Use Athena federated queries to access the data in the data lake. Use S3 server access logs for audit logs.
  D. Use Athena federated queries to access the data in the data lake. Use S3 server access logs for audit logs.

  ---

  Explanation/Reference:

• Question 185:

  A data analyst is designing an Amazon QuickSight dashboard using centralized sales data that resides in Amazon Redshift. The dashboard must be restricted so that a salesperson in Sydney, Australia, can see only the Australia view and that a salesperson in New York can see only United States (US) data.

  What should the data analyst do to ensure the appropriate data security is in place?

  A. Place the data sources for Australia and the US into separate SPICE capacity pools.
  B. Set up an Amazon Redshift VPC security group for Australia and the US.
  C. Deploy QuickSight Enterprise edition to implement row-level security (RLS) to the sales table.
  D. Deploy QuickSight Enterprise edition and set up different VPC security groups for Australia and the US.
  C. Deploy QuickSight Enterprise edition to implement row-level security (RLS) to the sales table.

  ---

  Explanation/Reference:

  Correct answer is C as QuickSight Enterprise edition provides row-level security (RLS) which can be configured for the sales table to restrict access. To do this, you create a query or file that has one column named UserName, GroupName, or both. Or you can create a query or file that has one column named UserARN, GroupARN, or both. You can think of this as adding a rule for that user or group. Then you can add one column to the query or file for each field that you want to grant or restrict access to. For each user or group name that you add, you add the values for each field. You can use NULL (no value) to mean all values. https://docs.aws.amazon.com/quicksight/latest/user/restrict-access-to-a-data-set-using-row-level-security.html

• Question 186:

  A banking company is currently using Amazon Redshift for sensitive data. An audit found that the current cluster is unencrypted. Compliance requires that a database with sensitive data must be encrypted using a hardware security module (HSM) with customer managed keys.

  Which modifications are required in the cluster to ensure compliance?

  A. Create a new HSM-encrypted Amazon Redshift cluster and migrate the data to the new cluster.
  B. Modify the DB parameter group with the appropriate encryption settings and then restart the cluster.
  C. Enable HSM encryption in Amazon Redshift using the command line.
  D. Modify the Amazon Redshift cluster from the console and enable encryption using the HSM option.
  A. Create a new HSM-encrypted Amazon Redshift cluster and migrate the data to the new cluster.

  ---

  Explanation/Reference:

  When you modify your cluster to enable AWS KMS encryption, Amazon Redshift automatically migrates your data to a new encrypted cluster. Reference: https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-db-encryption.html

• Question 187:

  Once a month, a company receives a 100 MB .csv file compressed with gzip. The file contains 50,000 property listing records and is stored in Amazon S3 Glacier. The company needs its data analyst to query a subset of the data for a specific vendor.

  What is the most cost-effective solution?

  A. Load the data into Amazon S3 and query it with Amazon S3 Select.
  B. Query the data from Amazon S3 Glacier directly with Amazon Glacier Select.
  C. Load the data to Amazon S3 and query it with Amazon Athena.
  D. Load the data to Amazon S3 and query it with Amazon Redshift Spectrum.
  A. Load the data into Amazon S3 and query it with Amazon S3 Select.

  ---

  Explanation/Reference:

  Correct answer is A as AWS S3 Select enables querying S3 data on selected fields. As S3 Glacier Select does not support uncompressed data, it needs to be restored to S3.

  With Amazon S3 Select, you can use simple structured query language (SQL) statements to filter the contents of an Amazon S3 object and retrieve just the subset of data that you need. By using Amazon S3 Select to filter this data, you can

  reduce the amount of data that Amazon S3 transfers, which reduces the cost and latency to retrieve this data.

  Amazon S3 Select works on objects stored in CSV, JSON, or Apache Parquet format. It also works with objects that are compressed with GZIP or BZIP2 (for CSV and JSON objects only), and server-side encrypted objects. You can specify

  the format of the results as either CSV or JSON, and you can determine how the records in the result are delimited.

  Option B is wrong as Archive objects that are queried by S3 Glacier Select must be formatted as uncompressed comma-separated values (CSV).

  Options C and D are wrong as Athena and Redshift would add additional cost.

• Question 188:

  A data architect at a large financial institution is building a data platform on AWS with the intent of implementing fraud detection by identifying duplicate customer accounts. The fraud detection algorithm will run in a batch mode to identify when a newly created account matches one for a user that was previously fraudulent.

  Which approach MOST cost-effectively meets these requirements?

  A. Build a custom deduplication script by using Apache Spark on an Amazon EMR cluster. Use PySpark to compare the data frames that represent the new customers and the fraudulent customer set to identify matches.
  B. Load the data to an Amazon Redshift cluster. Use custom SQL to build deduplication logic.
  C. Load the data to Amazon S3 to form the basis of a data lake. Use Amazon Athena to build a deduplication script.
  D. Load the data to Amazon S3. Use the AWS Glue FindMatches transform to implement deduplication logic.
  D. Load the data to Amazon S3. Use the AWS Glue FindMatches transform to implement deduplication logic.

  ---

  Explanation/Reference:

• Question 189:

  A bank operates in a regulated environment. The compliance requirements for the country in which the bank operates say that customer data for each state should only be accessible by the bank's employees located in the same state. Bank

  employees in one state should NOT be able to access data for customers who have provided a home address in a different state.

  The bank's marketing team has hired a data analyst to gather insights from customer data for a new campaign being launched in certain states. Currently, data linking each customer account to its home state is stored in a tabular .csv file

  within a single Amazon S3 folder in a private S3 bucket. The total size of the S3 folder is 2 GB uncompressed. Due to the country's compliance requirements, the marketing team is not able to access this folder.

  The data analyst is responsible for ensuring that the marketing team gets one-time access to customer data for their campaign analytics project, while being subject to all the compliance requirements and controls. Which solution should the data analyst implement to meet the desired requirements with the LEAST amount of setup effort?

  A. Re-arrange data in Amazon S3 to store customer data about each state in a different S3 folder within the same bucket. Set up S3 bucket policies to provide marketing employees with appropriate data access under compliance controls. Delete the bucket policies after the project.
  B. Load tabular data from Amazon S3 to an Amazon EMR cluster using s3DistCp. Implement a custom Hadoop-based row-level security solution on the Hadoop Distributed File System (HDFS) to provide marketing employees with appropriate data access under compliance controls. Terminate the EMR cluster after the project.
  C. Load tabular data from Amazon S3 to Amazon Redshift with the COPY command. Use the built-in row-level security feature in Amazon Redshift to provide marketing employees with appropriate data access under compliance controls. Delete the Amazon Redshift tables after the project.
  D. Load tabular data from Amazon S3 to Amazon QuickSight Enterprise edition by directly importing it as a data source. Use the built-in row-level security feature in Amazon QuickSight to provide marketing employees with appropriate data access under compliance controls. Delete Amazon QuickSight data sources after the project is complete.
  D. Load tabular data from Amazon S3 to Amazon QuickSight Enterprise edition by directly importing it as a data source. Use the built-in row-level security feature in Amazon QuickSight to provide marketing employees with appropriate data access under compliance controls. Delete Amazon QuickSight data sources after the project is complete.

  ---

  Explanation/Reference:

  Correct answer is D as using QuickSight with its built-in-row-level security features allows the data analyst to provide limited one-time access while maintaining data compliance requirements and controls and a minimal amount of setup.

  In the Enterprise edition of Amazon QuickSight, you can restrict access to a dataset by configuring row-level security (RLS) on it. You can do this before or after you have shared the dataset. Only the people whom you shared with can see

  any of the data. By adding row-level security, you can further control their access.

  Option A is wrong as it would take some amount of setup to repartition the data in S3.

  Options B and C are wrong as using EMR and Redshift would need set up and provisioning effort.

• Question 190:

  A company stores transaction data in an Amazon Aurora PostgreSQL DB cluster. Some of the data is sensitive. A data analytics specialist must implement a solution to classify the data in the database and create a report. Which combination of steps will meet this requirement with the LEAST development effort? (Choose two.)

  A. Create an Amazon S3 bucket. Export an Aurora DB cluster snapshot to the bucket.
  B. Create an Amazon S3 bucket. Create an AWS Lambda function to run Amazon Athena federated queries on the database and to store the output as S3 objects in Apache Parquet format.
  C. Create an Amazon S3 bucket. Create an AWS Lambda function to run Amazon Athena federated queries on the database and to store the output as S3 objects in CSV format.
  D. Create an AWS Lambda function to analyze the bucket contents and create a report.
  E. Create an Amazon Macie job to analyze the bucket contents and create a report.
  A. Create an Amazon S3 bucket. Export an Aurora DB cluster snapshot to the bucket.
  E. Create an Amazon Macie job to analyze the bucket contents and create a report.

  ---

  Explanation/Reference: