Amazon DATA-ENGINEER-ASSOCIATE Online Practice Questions and Exam Preparation

Amazon DATA-ENGINEER-ASSOCIATE Online Questions & Answers

• Question 91:

  A company stores data in Amazon S3 and Amazon RDS. The company needs to apply technical controls to meet security requirements. The company must generate backups of the data and retain the backups for specified retention periods.

  The company must protect the backups from accidental or malicious deletion during the retention periods.

  Which solution will meet these requirements with the LEAST operational overhead?

  A. Create S3 buckets with versioning and MFA Delete enabled. Set a backup retention period and backup window for each RDS DB instance. Use the automated backup feature of Amazon RDS, and take additional snapshots as required.
  B. Create S3 buckets with versioning and Same-Region Replication enabled. Set a backup retention period and backup window for each RDS DB instance. Use the automated backup feature of Amazon RDS. Take additional snapshots as required.
  C. Create a backup plan in AWS Backup. Specify the backup schedule, set window and lifecycle values, and select a backup vault. Assign the Amazon S3 and Amazon RDS resources to the backup plan. Create a vault lock in compliance mode.
  D. Create S3 buckets with versioning and Cross-Region Replication enabled. Set a backup retention period and backup window for each RDS DB instance. Use Amazon RDS automated backups. Take additional snapshots as required.
  C. Create a backup plan in AWS Backup. Specify the backup schedule, set window and lifecycle values, and select a backup vault. Assign the Amazon S3 and Amazon RDS resources to the backup plan. Create a vault lock in compliance mode.

• Question 92:

  A data engineer notices that Amazon Athena queries are held in a queue before the queries run.

  How can the data engineer prevent the queries from queueing?

  A. Increase the query result limit.
  B. configure provisioned capacity for an existing workgroup.
  C. Use federated queries.
  D. Allow users who run the Athena queries to an existing workgroup.
  B. configure provisioned capacity for an existing workgroup.

• Question 93:

  An online retail company stores Application Load Balancer (ALB) access logs in an Amazon S3 bucket.

  The company wants to use Amazon Athena to query the logs to analyze traffic patterns.

  A data engineer creates an unpartitioned table in Athena. As the amount of the data gradually increases, the response time for queries also increases. The data engineer wants to improve the query performance in Athena.

  Which solution will meet these requirements with the LEAST operational effort?

  A. Create an AWS Glue job that determines the schema of all ALB access logs and writes the partition metadata to AWS Glue Data Catalog.
  B. Create an AWS Glue crawler that includes a classifier that determines the schema of all ALB access logs and writes the partition metadata to AWS Glue Data Catalog.
  C. Create an AWS Lambda function to transform all ALB access logs. Save the results to Amazon S3 in Apache Parquet format. Partition the metadata. Use Athena to query the transformed data.
  D. Use Apache Hive to create bucketed tables. Use an AWS Lambda function to transform all ALB access logs.
  B. Create an AWS Glue crawler that includes a classifier that determines the schema of all ALB access logs and writes the partition metadata to AWS Glue Data Catalog.

• Question 94:

  A company needs a solution that restricts access to Amazon S3 data and encrypts the data by using AWS managed keys. The solution must manage database credentials that an AWS Lambda function uses and must rotate the credentials automatically.

  Which solution will meet these requirements?

  A. Use S3 bucket policies to control access. Use server-side encryption with Amazon S3 managed keys (SSE-S3) to encrypt the data. Store the database credentials as Lambda environment variables.
  B. Use IAM policies to control access. Use server-side encryption with AWS KMS keys (SSE-KMS) to encrypt the data. Configure AWS Secrets Manager to store and automatically rotate the credentials by using a Lambda function.
  C. Use S3 ACLs to control access. Use server-side encryption with AWS KMS keys (SSE-KMS) to encrypt the data. Store the credentials in AWS Systems Manager Parameter Store and automatically rotate the credentials by using a Lambda function.
  D. Use IAM policies to control access. Use server-side encryption with Amazon S3 managed keys (SSE- S3) to encrypt the data. Store the credentials in AWS Systems Manager Parameter Store. Configure a scheduled Lambda function to rotate the credentials.
  B. Use IAM policies to control access. Use server-side encryption with AWS KMS keys (SSE-KMS) to encrypt the data. Configure AWS Secrets Manager to store and automatically rotate the credentials by using a Lambda function.

• Question 95:

  A data engineer manually moved all objects for an Athena table partition from prefix status=old to prefix status=current in Amazon S3. The old partition location is empty, but the old partition still appears in AWS Glue Data Catalog metadata.

  Which Athena action should the data engineer take to remove the stale metadata?

  A. Run ALTER TABLE DROP PARTITION for the old partition.
  B. Run MSCK REPAIR TABLE against the table.
  C. Run ALTER TABLE ADD PARTITION for the old partition.
  D. Run CREATE TABLE AS SELECT to recreate the table with the same schema.
  A. Run ALTER TABLE DROP PARTITION for the old partition.

  ---

  Explanation

  MSCK REPAIR TABLE adds Hive-compatible partitions that exist in S3 but are missing from the catalog; it does not remove partitions that were deleted or moved. ALTER TABLE DROP PARTITION removes the stale catalog partition. Adding the old partition would make the metadata problem worse. Recreating the table is unnecessary when only one partition entry is stale.

• Question 96:

  A company has a production AWS account that runs company workloads. The company's security team created a security AWS account to store and analyze security logs from the production AWS account. The security logs in the production AWS account are stored in Amazon CloudWatch Logs.

  The company needs to use Amazon Kinesis Data Streams to deliver the security logs to the security AWS account.

  Which solution will meet these requirements?

  A. Create a destination data stream in the production AWS account. In the security AWS account, create an IAM role that has cross-account permissions to Kinesis Data Streams in the production AWS account.
  B. Create a destination data stream in the security AWS account. Create an IAM role and a trust policy to grant CloudWatch Logs the permission to put data into the stream. Create a subscription filter in the security AWS account.
  C. Create a destination data stream in the production AWS account. In the production AWS account, create an IAM role that has cross-account permissions to Kinesis Data Streams in the security AWS account.
  D. Create a destination data stream in the security AWS account. Create an IAM role and a trust policy to grant CloudWatch Logs the permission to put data into the stream. Create a subscription filter in the production AWS account.
  D. Create a destination data stream in the security AWS account. Create an IAM role and a trust policy to grant CloudWatch Logs the permission to put data into the stream. Create a subscription filter in the production AWS account.

  ---

  Explanation

  Amazon Kinesis Data Streams is a service that enables you to collect, process, and analyze real-time streaming data. You can use Kinesis Data Streams to ingest data from various sources, such as Amazon CloudWatch Logs, and deliver it to different destinations, such as Amazon S3 or Amazon Redshift. To use Kinesis Data Streams to deliver the security logs from the production AWS account to the security AWS account, you need to create a destination data stream in the security AWS account. This data stream will receive the log data from the CloudWatch Logs service in the production AWS account. To enable this cross-account data delivery, you need to create an IAM role and a trust policy in the security AWS account. The IAM role defines the permissions that the CloudWatch Logs service needs to put data into the destination data stream. The trust policy allows the production AWS account to assume the IAM role.

  Finally, you need to create a subscription filter in the production AWS account. A subscription filter defines the pattern to match log events and the destination to send the matching events. In this case, the destination is the destination data stream in the security AWS account. This solution meets the requirements of using Kinesis Data Streams to deliver the security logs to the security AWS account. The other options are either not possible or not optimal. You cannot create a destination data stream in the production AWS account, as this would not deliver the data to the security AWS account. You cannot create a subscription filter in the security AWS account, as this would not capture the log events from the production AWS account.

• Question 97:

  A data engineer needs to schedule a workflow that runs a set of AWS Glue jobs every day. The data engineer does not require the Glue jobs to run or finish at a specific time.

  Which solution will run the Glue jobs in the MOST cost-effective way?

  A. Choose the FLEX execution class in the Glue job properties.
  B. Use the Spot Instance type in Glue job properties.
  C. Choose the STANDARD execution class in the Glue job properties.
  D. Choose the latest version in the GlueVersion field in the Glue job properties.
  A. Choose the FLEX execution class in the Glue job properties.

  ---

  Explanation

  The FLEX execution class allows you to run AWS Glue jobs on spare compute capacity instead of dedicated hardware. This can reduce the cost of running non-urgent or non-time sensitive data integration workloads, such as testing and one-time data loads. The FLEX execution class is available for AWS Glue 3.0 Spark jobs. The other options are not as cost-effective as FLEX, because they either use dedicated resources (STANDARD) or do not affect the cost at all (Spot Instance type and GlueVersion).

  References:

  Introducing AWS Glue Flex jobs: Cost savings on ETL workloads Serverless Data Integration ?AWS Glue Pricing

  AWS Certified Data Engineer - Associate DEA-C01 Complete Study Guide (Chapter 5, page 125)

• Question 98:

  A company wants to migrate an application and an on-premises Apache Kafka server to AWS. The application processes incremental updates that an on-premises Oracle database sends to the Kafka server.

  The company wants to use the replatform migration strategy instead of the refactor strategy.

  Which solution will meet these requirements with the LEAST management overhead?

  A. Amazon Kinesis Data Streams
  B. Amazon Managed Streaming for Apache Kafka (Amazon MSK) provisioned cluster
  C. Amazon Data Firehose
  D. Amazon Managed Streaming for Apache Kafka (Amazon MSK) Serverless
  D. Amazon Managed Streaming for Apache Kafka (Amazon MSK) Serverless

  ---

  Explanation

  Problem Analysis:

  The company needs to migrate both an application and an on-premises Apache Kafka server to AWS.

  Incremental updates from an on-premises Oracle database are processed by Kafka.

  The solution must follow a replatform migration strategy , prioritizing minimal changes and low management overhead .

  Key Considerations:

  Replatform Strategy: This approach keeps the application and architecture as close to the original as possible, reducing the need for refactoring.

  The solution must provide a managed Kafka service to minimize operational burden.

  Low overhead solutions like serverless services are preferred.

  Solution Analysis:

  Option A: Kinesis Data Streams Kinesis Data Streams is an AWS-native streaming service but is not a direct substitute for Kafka.

  This option would require significant application refactoring, which does not align with the replatform strategy.

  Option B: MSK Provisioned Cluster

  Managed Kafka service with fully configurable clusters.

  Provides the same Kafka APIs but requires cluster management (e.g., scaling, patching), increasing management overhead.

  Option C: Amazon Kinesis Data Firehose

  Kinesis Data Firehose is designed for data delivery rather than real-time streaming and processing.

  Not suitable for Kafka-based applications.

  Option D: MSK Serverless

  MSK Serverless eliminates the need for cluster management while maintaining compatibility with Kafka APIs.

  Automatically scales based on workload, reducing operational overhead.

  Ideal for replatform migrations, as it requires minimal changes to the application.

  Final Recommendation:

  Amazon MSK Serverlessis the best solution for migrating the Kafka server and application with minimal changes and the least management overhead.

  References:

  Amazon MSK Serverless Overview

  Comparison of Amazon MSK and Kinesis

• Question 99:

  A company needs to optimize storage for an Amazon S3 bucket. Objects older than 1 year must be accessible within 5 hours. All versions of the objects must be retained and immutable for 7 years. All versions of the objects must use the write-once-read-many (WORM) model.

  Which solution will meet these requirements?

  A. Configure S3 Versioning on the bucket and use the S3 Intelligent-Tiering storage class. Configure a lifecycle policy for the bucket to transition objects that are older than 1 year to S3 Glacier Flexible Retrieval. Configure the policy to delete objects that are older than 7 years.
  B. Configure S3 Object Lock on the bucket and use the S3 Intelligent-Tiering storage class. Configure a lifecycle policy for the bucket to transition objects that are older than 1 year to S3 Glacier Deep Archive. Configure the policy to delete objects that are older than 7 years.
  C. Configure S3 Object Lock on the bucket and use the S3 Intelligent-Tiering storage class. Configure a lifecycle policy for the bucket to transition objects that are older than 1 year to S3 Glacier Flexible Retrieval. Configure the policy to delete objects that are older than 7 years.
  D. Configure S3 Versioning on the bucket and use the S3 Intelligent-Tiering storage class. Configure a lifecycle policy for the bucket to transition objects that are older than 1 year to S3 Glacier Deep Archive. Configure the policy to deletes objects that are older than 7 years.
  C. Configure S3 Object Lock on the bucket and use the S3 Intelligent-Tiering storage class. Configure a lifecycle policy for the bucket to transition objects that are older than 1 year to S3 Glacier Flexible Retrieval. Configure the policy to delete objects that are older than 7 years.

• Question 100:

  A company stores customer data in an Amazon S3 bucket. Multiple teams in the company want to use the customer data for downstream analysis. The company needs to ensure that the teams do not have access to personally identifiable information (PII) about the customers.

  Which solution will meet this requirement with LEAST operational overhead?

  A. Use Amazon Macie to create and run a sensitive data discovery job to detect and remove PII.
  B. Use S3 Object Lambda to access the data, and use Amazon Comprehend to detect and remove PII.
  C. Use Amazon Kinesis Data Firehose and Amazon Comprehend to detect and remove PII.
  D. Use an AWS Glue DataBrew job to store the PII data in a second S3 bucket. Perform analysis on the data that remains in the original S3 bucket.
  B. Use S3 Object Lambda to access the data, and use Amazon Comprehend to detect and remove PII.