Free AWS DEA-C01 practice questions

10 free AWS DEA-C01 practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 366 questions. Work through them, then open each answer to check your reasoning.

Get all 366 questions (US$39) · Download these 10 as a PDF

Question 1

A data engineer is configuring an AWS Glue job to read data from an Amazon S3 bucket. The data engineer has set up the necessary AWS Glue connection details and an associated IAM role. However, when the data engineer attempts to run the AWS Glue job, the data engineer receives an error message that indicates that there are problems with the Amazon S3 VPC gateway endpoint.

The data engineer must resolve the error and connect the AWS Glue job to the S3 bucket.

Which solution will meet this requirement?

  1. Update the AWS Glue security group to allow inbound traffic from the Amazon S3 VPC gateway endpoint.
  2. Configure an S3 bucket policy to explicitly grant the AWS Glue job permissions to access the S3 bucket.
  3. Review the AWS Glue job code to ensure that the AWS Glue connection details include a fully qualified domain name.
  4. Verify that the VPC's route table includes inbound and outbound routes for the Amazon S3 VPC gateway endpoint.
Show answer and explanation

Correct answer: D. Verify that the VPC's route table includes inbound and outbound routes for the Amazon S3 VPC gateway endpoint.

When an AWS Glue job runs in a VPC, its traffic can reach Amazon S3 only if the route table associated with the Glue subnets contains a route for the S3 prefix list that targets the gateway endpoint. If that route is missing, or the endpoint is not associated with the correct route table, the job fails with S3 VPC gateway endpoint errors. Checking and correcting the route table entries fixes the network path. This is a VPC routing problem, not a security group, bucket policy, or application code problem.

Why the other options are wrong

  • A. Gateway endpoints are not associated with security groups, so changing inbound rules does not restore the path to S3.
  • B. A bucket policy grants permissions but cannot fix a missing endpoint route that blocks connectivity.
  • C. Glue reaches S3 through the endpoint automatically; no fully qualified domain name setting is required here.

Question 2

A retail company has a customer data hub in an Amazon S3 bucket. Employees from many countries use the data hub to support company-wide analytics. A governance team must ensure that the company's data analysts can access data only for customers who are within the same country as the analysts.

Which solution will meet these requirements with the LEAST operational effort?

  1. Create a separate table for each country's customer data. Provide access to each analyst based on the country that the analyst serves.
  2. Register the S3 bucket as a data lake location in AWS Lake Formation. Use the Lake Formation row-level security features to enforce the company's access policies.
  3. Move the data to AWS Regions that are close to the countries where the customers are. Provide access to each analyst based on the country that the analyst serves.
  4. Load the data into Amazon Redshift. Create a view for each country. Create separate IAM roles for each country to provide access to data from each country. Assign the appropriate roles to the analysts.
Show answer and explanation

Correct answer: B. Register the S3 bucket as a data lake location in AWS Lake Formation. Use the Lake Formation row-level security features to enforce the company's access policies.

Lake Formation. Use the Lake Formation row-level security features to enforce the company's access policies. AWS Lake Formation provides built-in row-level security features that allow enforcement of access policies based on attributes like country. By registering the S3 bucket as a data lake location in Lake Formation and configuring row-level security, analysts can access the same table but only see rows relevant to their country. This requires minimal operational effort compared to creating separate tables, managing multiple regions, or building custom Redshift views and IAM roles.

Why the other options are wrong

  • A. Creating separate tables for each country is operationally intensive and does not scale well as countries are added.
  • C. Moving data to multiple regions introduces significant complexity, cost, and operational overhead for a data governance problem.
  • D. Using Amazon Redshift with separate views and IAM roles requires more manual management and operational effort than Lake Formation's built-in security features.

Question 3

A media company wants to improve a system that recommends media content to customer based on user behavior and preferences. To improve the recommendation system, the company needs to incorporate insights from third-party datasets into the company's existing analytics platform.

The company wants to minimize the effort and time required to incorporate third-party datasets.

Which solution will meet these requirements with the LEAST operational overhead?

  1. Use API calls to access and integrate third-party datasets from AWS Data Exchange.
  2. Use API calls to access and integrate third-party datasets from AWS DataSync.
  3. Use Amazon Kinesis Data Streams to access and integrate third-party datasets from AWS CodeCommit repositories.
  4. Use Amazon Kinesis Data Streams to access and integrate third-party datasets from Amazon Elastic Container Registry (Amazon ECR).
Show answer and explanation

Correct answer: A. Use API calls to access and integrate third-party datasets from AWS Data Exchange.

AWS Data Exchange is purpose-built for accessing and integrating third-party datasets with minimal effort. It provides pre-packaged datasets that can be accessed via API calls and easily integrated into existing analytics platforms. This is the most straightforward solution with the least operational overhead compared to alternatives.

Why the other options are wrong

  • B. AWS DataSync is designed for data transfer and synchronization between storage systems, not for accessing third-party datasets.
  • C. Amazon Kinesis Data Streams is a real-time streaming service, not a third-party dataset source; AWS CodeCommit is for version control.
  • D. Kinesis Data Streams is not designed for dataset integration; Amazon ECR is a container registry, not a third-party dataset source.

Question 4

A financial company wants to implement a data mesh. The data mesh must support centralized data governance, data analysis, and data access control. The company has decided to use AWS Glue for data catalogs and extract, transform, and load (ETL) operations.

Which combination of AWS services will implement a data mesh? (Choose two.)

  1. Use Amazon Aurora for data storage. Use an Amazon Redshift provisioned cluster for data analysis.
  2. Use Amazon S3 for data storage. Use Amazon Athena for data analysis.
  3. Use AWS Glue DataBrew for centralized data governance and access control.
  4. Use Amazon RDS for data storage. Use Amazon EMR for data analysis.
  5. Use AWS Lake Formation for centralized data governance and access control.
Show answer and explanation

Correct answer: B, E

B. Use Amazon S3 for data storage. Use Amazon Athena for data analysis. E. Use AWS Lake Formation for centralized data governance and access control. A data mesh implementation requires data storage, data analysis capabilities, and centralized governance with access control. Amazon S3 provides scalable data storage for the mesh, Amazon Athena enables serverless data analysis, and AWS Lake Formation provides centralized data governance and fine-grained access control. Together, these services support all requirements of a data mesh architecture.

Why the other options are wrong

  • A. Amazon Aurora is a relational database suitable for transactional workloads, not a data mesh storage pattern; Redshift requires cluster management overhead.
  • C. AWS Glue DataBrew is a data preparation tool, not a governance and access control solution.
  • D. Amazon RDS is a relational database not suited for data mesh scale; EMR requires more operational overhead than Athena.

Question 5

A data engineer maintains custom Python scripts that perform a data formatting process that many AWS Lambda functions use.

When the data engineer needs to modify the Python scripts, the data engineer must manually update all the Lambda functions.

The data engineer requires a less manual way to update the Lambda functions.

Which solution will meet this requirement?

  1. Store a pointer to the custom Python scripts in the execution context object in a shared Amazon S3 bucket.
  2. Package the custom Python scripts into Lambda layers. Apply the Lambda layers to the Lambda functions.
  3. Store a pointer to the custom Python scripts in environment variables in a shared Amazon S3 bucket.
  4. Assign the same alias to each Lambda function. Call reach Lambda function by specifying the function's alias. ✅Correct Answer: B, Package the custom Python scripts into Lambda layers. Apply the Lambda layers to the Lambda functions. Lambda layers let the engineer package the shared Python scripts once and attach them to every function that needs them. When the scripts change, he publishes a new layer version and points the functions at it, rather than editing and redeploying each function's code. The shared logic lives in one place, cutting maintenance effort.
Show answer and explanation

Answer and explanation for question 5

Question 6

A company created an extract, transform, and load (ETL) data pipeline in AWS Glue. A data engineer must crawl a table that is in Microsoft SQL Server. The data engineer needs to extract, transform, and load the output of the crawl to an Amazon S3 bucket. The data engineer also must orchestrate the data pipeline.

Which AWS service or feature will meet these requirements MOST cost-effectively?

  1. AWS Step Functions
  2. AWS Glue workflows
  3. AWS Glue Studio
  4. Amazon Managed Workflows for Apache Airflow (Amazon MWAA)
Show answer and explanation

Correct answer: B. AWS Glue workflows

AWS Glue workflows are purpose-built for orchestrating AWS Glue jobs including crawlers and ETL tasks. They provide native integration with Glue components, built-in error handling, and are the most cost-effective option for this specific use case. Workflows eliminate the need for external orchestration tools and are optimized for Glue-based pipelines.

Why the other options are wrong

  • A. AWS Step Functions is a general-purpose orchestration service with additional costs compared to Glue's native workflow capabilities.
  • C. AWS Glue Studio is a visual design tool for creating jobs, not an orchestration service.
  • D. Amazon MWAA is a managed Apache Airflow service that adds operational overhead and cost for a task that Glue workflows handle natively.

Question 7

A financial services company stores financial data in Amazon Redshift. A data engineer wants to run real-time queries on the financial data to support a web-based trading application. The data engineer wants to run the queries from within the trading application.

Which solution will meet these requirements with the LEAST operational overhead?

  1. Establish WebSocket connections to Amazon Redshift.
  2. Use the Amazon Redshift Data API.
  3. Set up Java Database Connectivity (JDBC) connections to Amazon Redshift.
  4. Store frequently accessed data in Amazon S3. Use Amazon S3 Select to run the queries.
Show answer and explanation

Correct answer: B. Use the Amazon Redshift Data API.

The Amazon Redshift Data API allows applications to execute SQL queries without managing connections or database drivers, making it ideal for web-based applications. It requires minimal setup, handles authentication through IAM, and supports asynchronous query execution. This approach minimizes operational overhead compared to managing persistent connections or alternative data retrieval methods.

Why the other options are wrong

  • A. WebSocket connections require custom implementation and management of persistent connections, adding operational complexity.
  • C. JDBC connections require managing driver versions, connection pools, and network connectivity, adding operational overhead.
  • D. Copying data to S3 and using S3 Select introduces latency and does not provide true real-time query capabilities on live Redshift data.

Question 8

A company uses Amazon Athena for one-time queries against data that is in Amazon S3. The company has several use cases. The company must implement permission controls to separate query processes and access to query history among users, teams, and applications that are in the same AWS account.

Which solution will meet these requirements?

  1. Create an S3 bucket for each use case. Create an S3 bucket policy that grants permissions to appropriate individual IAM users. Apply the S3 bucket policy to the S3 bucket.
  2. Create an Athena workgroup for each use case. Apply tags to the workgroup. Create an IAM policy that uses the tags to apply appropriate permissions to the workgroup.
  3. Create an IAM role for each use case. Assign appropriate permissions to the role for each use case. Associate the role with Athena.
  4. Create an AWS Glue Data Catalog resource policy that grants permissions to appropriate individual IAM users for each use case. Apply the resource policy to the specific tables that Athena uses.
Show answer and explanation

Correct answer: B. Create an Athena workgroup for each use case. Apply tags to the workgroup. Create an IAM policy that uses the tags to apply appropriate permissions to the workgroup.

Athena workgroups provide separation of query processes, query history, and cost tracking per workgroup. By creating a workgroup for each use case and applying IAM policies that use tags to control permissions, the company can enforce fine-grained access control while separating concerns among users, teams, and applications within the same account. This is the most direct and purpose-built solution.

Why the other options are wrong

  • A. Creating separate S3 buckets per use case is operationally complex and does not separate Athena query history or processes.
  • C. IAM roles alone do not provide the workgroup-level separation of query processes and query history that Athena workgroups offer.
  • D. AWS Glue Data Catalog resource policies control catalog access but do not provide Athena-specific controls for query history, processes, or cost separation.

Question 9

A data engineer needs to schedule a workflow that runs a set of AWS Glue jobs every day. The data engineer does not require the Glue jobs to run or finish at a specific time.

Which solution will run the Glue jobs in the MOST cost-effective way?

  1. Choose the FLEX execution class in the Glue job properties.
  2. Use the Spot Instance type in Glue job properties.
  3. Choose the STANDARD execution class in the Glue job properties.
  4. Choose the latest version in the GlueVersion field in the Glue job properties.
Show answer and explanation

Correct answer: A. Choose the FLEX execution class in the Glue job properties.

The FLEX execution class is designed for non-time-sensitive workloads and uses spare capacity at a lower cost than STANDARD. Since the data engineer does not require the jobs to run at a specific time, FLEX execution class is the most cost-effective option. It provides significant cost savings for flexible, intermittent workloads by utilizing idle cluster resources.

Why the other options are wrong

  • B. Spot Instances still incur compute costs and are not specifically designed for no-ime-sensitive Glue jobs.
  • C. STANDARD execution class is the default and more expensive option for tim-ensitive workloads.
  • D. Glue version selection does not directly impact cost-effectiveness for scheduling flexibility.

Question 10

A data engineer needs to create an AWS Lambda function that converts the format of data from .csv to Apache Parquet. The Lambda function must run only if a user uploads a .csv file to an Amazon S3 bucket.

Which solution will meet these requirements with the LEAST operational overhead?

  1. Create an S3 event notification that has an event type of s3:ObjectCreated:*. Use a filter rule to generate notifications only when the suffix includes .csv. Set the Amazon Resource Name (ARN) of the Lambda function as the destination for the event notification.
  2. Create an S3 event notification that has an event type of s3:ObjectTagging:* for objects that have a tag set to .csv. Set the Amazon Resource Name (ARN) of the Lambda function as the destination for the event notification.
  3. Create an S3 event notification that has an event type of s3:*. Use a filter rule to generate notifications only when the suffix includes .csv. Set the Amazon Resource Name (ARN) of the Lambda function as the destination for the event notification.
  4. Create an S3 event notification that has an event type of s3:ObjectCreated:*. Use a filter rule to generate notifications only when the suffix includes .csv. Set an Amazon Simple Notification Service (Amazon SNS) topic as the destination for the event notification. Subscribe the Lambda function to the SNS topic.
Show answer and explanation

Correct answer: A. Create an S3 event notification that has an event type of s3:ObjectCreated:*. Use a filter rule to generate notifications only when the suffix includes .csv. Set the Amazon Resource Name (ARN) of the Lambda function as the destination for the event notification.

Option A provides the most direct and operationally efficient solution by using S3 event notifications with object creation events filtered by .csv suffix, directly invoking the Lambda function. This requires no intermediate services and automatically triggers the Lambda function whenever a .csv file is uploaded. It is the simplest architecture with minimal overhead.

Why the other options are wrong

  • B. Using object tagging requires users to manually tag files, adding operational complexity and potential for human error.
  • C. The s3:* event type is overly broad and would trigger on all S3 events, not just uploads, wasting resources.
  • D. Adding SNS as an intermediary introduces unnecessary latency and operational overhead compared to direct Lambda invocation.

That was 10 of 366.

The full AWS DEA-C01 pack has all 366 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.

Get the full pack