Amazon DEA-C01 Exam Questions Instant Access

Question 1

A company stores sales data in an Amazon RDS for MySQL database. The company needs to start a reporting process between 6:00 A.M. and 6:10 A.M. every Monday. The reporting process must generate a CSV file and store the file in an Amazon S3 bucket.

Which combination of steps will meet these requirements with the LEAST operational overhead? (Select TWO.)

ACreate an Amazon EventBridge rule to run every Monday at 6:00 A.M.

BCreate an Amazon EventBridge Scheduler to run every Monday at 6:00 A.M.

CCreate and invoke an AWS Batch job that runs a script in an Amazon Elastic Container Service (Amazon ECS) container. Configure the script to generate the report and to save it to the S3 bucket.

DCreate and invoke an AWS Glue ETL job to generate the report and to save it to the S3 bucket.

ECreate and invoke an Amazon EMR Serverless job to generate the report and to save it to the S3 bucket.

Answer : B, D

The Amazon EventBridge Scheduler offers a simple, serverless cron-based execution mechanism. It can trigger an AWS Glue ETL job that extracts data from Amazon RDS, formats it as CSV, and writes it to Amazon S3 --- all without manual orchestration or servers.

''For scheduled data extraction and transformation, use AWS Glue jobs triggered by EventBridge Scheduler for fully managed, low-maintenance workflows.''

-- Ace the AWS Certified Data Engineer - Associate Certification - version 2 - apple.pdf

Glue natively integrates with RDS and S3, avoiding the need to manage Batch or EMR infrastructure.

Question 2

A media company uploads large video files to Amazon S3 for processing. After processing, the company needs to keep the original files for 90 days in case the files require reprocessing. After 90 days, the company can delete the files to reduce storage costs. The company stores the processed videos in a different S3 bucket.

Which S3 Lifecycle configuration will meet these requirements for the original files MOST cost-effectively?

AStore the files in S3 Standard for 90 days. Transition the files to S3 Glacier Flexible Retrieval for long-term storage. Then expire the files.

BStore the files in S3 Standard for 90 days. Enable versioning. Enable Object Lock on the files for 90 days. Then expire the files.

CStore the files in S3 Standard for 90 days. Implement S3 Lifecycle management to expire the files.

DStore the files in S3 Intelligent-Tiering for 90 days. Enable versioning. Add S3 Lifecycle management to expire the files.

Answer : C

Option C is correct because the company only needs to keep the original files for 90 days and then delete them. AWS states that S3 Lifecycle can be used to delete expired objects automatically, which directly matches this requirement. There is no need to transition the objects to another storage class because the files are not needed beyond day 90. Adding a transition step would add complexity and, in this case, would not improve cost-effectiveness.

Option A is not optimal because S3 Glacier Flexible Retrieval has a 90-day minimum storage duration and is intended for longer-term archival. Transitioning objects right before deleting them is unnecessary overhead and can add minimum-duration charges. Option B is incorrect because Object Lock is for retention and write-once-read-many protection, not for normal temporary retention with lowest cost. Option D is also less cost-effective because S3 Intelligent-Tiering is useful when access patterns are uncertain, but here the retention period and deletion timing are already known. The simplest and cheapest solution is to keep the originals in S3 Standard for the required 90 days and then expire them with Lifecycle.

Question 3

A company has a data warehouse in Amazon Redshift. The Amazon Redshift provisioned cluster is created in a VPC. The company is developing a new application in AWS Lambda that needs to access the data from Amazon Redshift. The company security policy states that AWS services can access the Amazon Redshift cluster only from the AWS network. Traffic between Lambda and the Amazon Redshift Data API must remain in the AWS network.

Which solution will meet these requirements?

AUse the Data API in the Lambda function to access the data. Set up an Amazon VPC endpoint for the Data API.

BUse the Data API in the Lambda function to access the data. Set up an Amazon VPC endpoint for the Lambda function.

CConnect to the Amazon Redshift cluster from the Lambda function by using an Amazon Redshift ODBC driver. Set up an Amazon VPC endpoint for the Lambda function.

DConnect to the Amazon Redshift cluster from the Lambda function by using an Amazon Redshift JDBC driver. Set up an Amazon VPC endpoint for the Lambda function.

Answer : A

The correct answer is A because the requirement specifically says that traffic between Lambda and the Amazon Redshift Data API must remain on the AWS network. AWS documentation states that you can call the Redshift Data API with Amazon VPC endpoints and that this keeps traffic between applications in the VPC and the Data API in the AWS network without public IP addresses. The Data API also removes the need to manage database drivers, persistent connections, and network configuration from Lambda. Creating a VPC endpoint for Lambda is not how Lambda privately reaches Redshift Data API. ODBC and JDBC drivers introduce connection management and do not address the stated Data API traffic requirement. Therefore, Data API plus the Redshift Data API VPC endpoint is correct.

Question 4

A company stores time-series data that is collected from streaming services in an Amazon S3 bucket. The company must ensure that only workloads that are deployed within the company's VPC can access the data.

Which solution will meet this requirement?

ACreate an S3 bucket policy that uses a condition to allow access only to traffic that originates from the company's VPC.

BApply a security group to the S3 bucket that allows connections only from the company's VPC CIDR block.

CDefine an IAM policy that denies access to all users unless the request originates from within the company's VPC.

DUse a network ACL on the VPC subnets to allow only specific resources to access the S3 bucket.

Answer : A

The best practice to restrict Amazon S3 access to specific VPCs is to use a bucket policy with a StringEquals or StringLike condition on aws:SourceVpc. This ensures only requests from a specified VPC are allowed.

IAM policies (option C) control who can access the resource but are not suitable alone to restrict by VPC.

Security Groups and NACLs (options B and D) do not apply to Amazon S3 because it is a global service and not VPC-bound.

''You can restrict access to your S3 bucket so that only requests coming from a specific VPC endpoint are allowed.''

Source: AWS Documentation -- Amazon S3 Bucket Policies for VPC Endpoints

Question 5

A company has an application that is deployed on AWS. The application uses Amazon Simple Notification Service (Amazon SNS) with multiple topics. The company's security team needs to be able to audit all Publish and PublishBatch API actions for all the SNS topics. The company's application team and security team must also be able to query the audit data. The company has already established an event data store in AWS CloudTrail Lake to collect all events.

Which solution will meet these requirements with the LEAST operational overhead?

AEnable management events for the SNS topics. Create a table in AWS Glue Data Catalog. Query the data by using Amazon Athena.

BEnable management events for the SNS topics. Use CloudTrail Lake to query the audit data.

CEnable data events for the SNS topics. Use CloudTrail Lake to query the audit data.

DEnable data events for the SNS topics. Create a table in AWS Glue Data Catalog. Query the data by using Amazon Athena.

Answer : C

The correct answer is C because SNS Publish and PublishBatch operations are data-plane operations, not ordinary management events. AWS CloudTrail documentation specifically lists Amazon SNS Publish and PublishBatch API operations on topics as supported data events. Because the company already has a CloudTrail Lake event data store, the lowest-operational-overhead approach is to enable the relevant SNS data events and query them directly in CloudTrail Lake. Creating Glue Data Catalog tables and querying with Athena adds unnecessary cataloging and query infrastructure. Management events would not satisfy the requirement to audit the requested SNS publishing actions. Therefore, the precise configuration is SNS data events plus CloudTrail Lake querying.

Question 6

A company runs multiple applications on AWS. The company configured each application to output logs. The company wants to query and visualize the application logs in near real time.

Which solution will meet these requirements?

AConfigure the applications to output logs to Amazon CloudWatch Logs log groups. Create an Amazon S3 bucket. Create an AWS Lambda function that runs on a schedule to export the required log groups to the S3 bucket. Use Amazon Athena to query the log data in the S3 bucket.

BCreate an Amazon OpenSearch Service domain. Configure the applications to output logs to Amazon CloudWatch Logs log groups. Create an OpenSearch Service subscription filter for each log group to stream the data to OpenSearch. Create the required queries and dashboards in OpenSearch Service to analyze and visualize the data.

CConfigure the applications to output logs to Amazon CloudWatch Logs log groups. Use CloudWatch log anomaly detection to query and visualize the log data.

DUpdate the application code to send the log data to Amazon QuickSight by using Super-fast, Parallel, In-memory Calculation Engine (SPICE). Create the required analyses and dashboards in QuickSight.

Answer : B

The optimal solution for near-real-time querying and visualization of logs is to integrate Amazon CloudWatch Logs with Amazon OpenSearch Service using subscription filters, which stream the logs directly into OpenSearch for querying and dashboarding:

''Use OpenSearch Service with CloudWatch Logs and create a subscription filter to stream log data in near real time into OpenSearch. Then use OpenSearch dashboards for visualization.''

-- Ace the AWS Certified Data Engineer - Associate Certification - version 2 - apple.pdf

This approach offers low latency and avoids batch exports, unlike the scheduled Athena + S3 pattern.

Question 7

A company has a data pipeline that uses an Amazon RDS instance, AWS Glue jobs, and an Amazon S3 bucket. The RDS instance and AWS Glue jobs run in a private subnet of a VPC and in the same security group.

A use' made a change to the security group that prevents the AWS Glue jobs from connecting to the RDS instance. After the change, the security group contains a single rule that allows inbound SSH traffic from a specific IP address.

The company must resolve the connectivity issue.

Which solution will meet this requirement?

AAdd an inbound rule that allows all TCP traffic on all TCP ports. Set the security group as the source.

BAdd an inbound rule that allows all TCP traffic on all UDP ports. Set the private IP address of the RDS instance as the source.

CAdd an inbound rule that allows all TCP traffic on all TCP ports. Set the DNS name of the RDS instance as the source.

DReplace the source of the existing SSH rule with the private IP address of the RDS instance. Create an outbound rule with the same source, destination, and protocol as the inbound SSH rule.

Answer : A

Amazon AWS Certified Data Engineer - Associate DEA-C01 Exam Questions