Free DEA-C01 Practice Test

AWS Certificate Manager (ACM) provisions public or private SSL/TLS certificates, automatically renews them, and deploys renewed certificates to ACM-integrated endpoints (ALB, NLB, CloudFront, API Gateway) without scripting or host-level operations, providing the lowest operational overhead.

A. Self-managed certificates require manual issuance, distribution, and rotation on every EC2 instance, increasing operational burden.
C. Secrets Manager rotates text-based secrets; it cannot issue or automatically renew X.509 SSL/TLS certificates.
D. ECS Service Connect offers service discovery and connectivity for containers; it does not manage SSL/TLS certificates.

1. AWS Certificate Manager User Guide – “About ACM” & “Managed Renewal” (docs.aws.amazon.com/acm/latest/userguide/acm-overview.html).

2. AWS Certificate Manager FAQs – “ACM automatically renews certificates” (https://aws.amazon.com/certificate-manager/faqs/).

3. AWS Secrets Manager User Guide – “Secrets managed are passwords and API keys, not certificates” (docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html).

4. Amazon ECS Service Connect – “Service Connect simplifies communication; certificate management not included” (docs.aws.amazon.com/AmazonECS/latest/developerguide/service-connect.html).

5. AWS Security Best Practices – “Use ACM to reduce certificate-handling overhead” (AWS Whitepaper V1, p.18).

The most efficient way to build a data catalog from S3 and RDS with minimal effort is by using an AWS Glue crawler. A crawler can connect to various data stores, automatically infer schemas, and populate the AWS Glue Data Catalog. To specifically identify the storage format (e.g., Parquet, CSV, JSON), the crawler uses classifiers. AWS Glue provides built-in classifiers for common formats and allows for custom classifiers for more complex or non-standard data formats. This automated discovery and classification process is the core purpose of Glue crawlers and requires the least manual intervention.

A. Requiring data stewards to manually inspect and update the catalog contradicts the "LEAST effort" requirement, as this is a manual process.
C. Amazon Macie is a data security service for discovering sensitive data, not a tool for building a general-purpose data catalog with storage format metadata.
D. Writing custom scripts to scan data and assign classifications is a high-effort, manual approach that AWS Glue crawlers are designed to replace.

1. AWS Glue Developer Guide. (2023). Cataloging tables with a crawler. AWS Documentation. Retrieved from https://docs.aws.amazon.com/glue/latest/dg/add-crawler.html

2. AWS Glue Developer Guide. (2023). Working with classifiers in AWS Glue. AWS Documentation. Retrieved from https://docs.aws.amazon.com/glue/latest/dg/classifiers.html (Section: "Built-in classifiers in AWS Glue")

For a robust monitoring system on EKS with minimal development, the best approach is to use standard, well-integrated tools. OpenTelemetry is the industry standard for collecting traces, and FluentBit is a lightweight, standard log collector for Kubernetes. This combination covers data collection (A). For analysis, Amazon OpenSearch Service is designed to ingest, search, and visualize both logs and traces, providing built-in capabilities to correlate them through features like Trace Analytics. This covers the correlation and analysis requirement (D).

B. Amazon Kinesis is a data streaming service, not a specialized tool for collecting application traces in a standardized format like OpenTelemetry.
C. Amazon MSK is a managed Apache Kafka service used for streaming data pipelines, not for collecting application traces.
E. AWS Glue is an ETL service used for data preparation and loading, not for real-time log and trace correlation and analysis.

1. AWS Prescriptive Guidance. (2023). Implement observability for an Amazon EKS cluster. AWS Documentation. Retrieved from https://docs.aws.amazon.com/prescriptive-guidance/latest/implementing-observability-eks/collection.html. (This guide discusses using FluentBit for logs and OpenTelemetry for traces).

2. Amazon OpenSearch Service Developer Guide. (2023). Trace Analytics. AWS Documentation. Retrieved from https://docs.aws.amazon.com/opensearch-service/latest/developerguide/trace-analytics.html. (This section describes how OpenSearch can be used to analyze trace data from OpenTelemetry).

3. AWS Blogs. (2022). Setting up the OpenTelemetry Collector for AWS X-Ray in Amazon EKS. Retrieved from https://aws.amazon.com/blogs/containers/setting-up-the-opentelemetry-collector-for-aws-x-ray-in-amazon-eks/. (Demonstrates the use of OpenTelemetry in EKS).

S3 Object Lock provides two retention modes: governance and compliance. To meet the requirement that no user, including the root user, can delete or modify the data, compliance mode is necessary. Compliance mode ensures that a protected object version cannot be overwritten or deleted by any user for the duration of the retention period. Setting a default retention period of 7 years on the bucket ensures all new objects automatically inherit this WORM (Write-Once-Read-Many) protection, fulfilling the strict immutability requirement.

A. Governance mode allows users with special permissions (s3:BypassGovernanceRetention) to alter retention settings or delete objects, which violates the requirement.
C. A legal hold prevents deletion but does not have a fixed retention period; it must be explicitly removed and is not time-based.
D. This option is incomplete; it specifies setting a retention period but omits the crucial retention mode (compliance) needed to prevent deletion by the root user.

1. Amazon S3 User Guide. (2023). S3 Object Lock retention modes. AWS Documentation. Retrieved from https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html#object-lock-retention-modes

2. Amazon S3 User Guide. (2023). Using S3 Object Lock. AWS Documentation. Retrieved from https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-managing.html (Section: "Default retention settings")

The Apache Spark web UI that AWS Glue exposes for every job run shows the DAG, stages, and task-level counters (records processed, bytes read/written, shuffle metrics, etc.). These detailed stage metrics are not forwarded to CloudWatch or CloudTrail, and Run Insights surfaces only summarized troubleshooting information. Therefore the data engineer must open the Spark UI for the failed job run to inspect stage-by-stage performance and errors.

B. CloudWatch publishes only high-level Glue job metrics (Succeeded, Failed, DPUUsed) and does not include per-stage Spark counters.
C. CloudTrail records control-plane API calls, not data-plane Spark execution metrics.
D. Run Insights highlights anomalous steps but does not expose the full set of Spark stage statistics.

1. AWS Glue Developer Guide

“Monitoring AWS Glue Using the Apache Spark UI”

¶2-4 (docs.aws.amazon.com/glue/latest/dg/monitor-spark-ui.html).

2. AWS Glue Developer Guide

“Glue job metrics published to Amazon CloudWatch”

¶1 (monitoring-overview.html).

3. AWS Glue Developer Guide

“AWS Glue Job Run Insights”

¶3-4 (job-run-insights.html).

4. AWS CloudTrail User Guide

“Logging AWS Glue API Calls with AWS CloudTrail”

Scope section (docs.aws.amazon.com)

The most precise and correct method to create a new Amazon Athena table from a query result is by using a CREATE TABLE AS SELECT (CTAS) statement. The statement in Option A correctly uses the CREATE TABLE tablename AS syntax, followed by a SELECT query that filters the citiesworld table for records where the country column is 'US'. This single operation creates the new table citiesus and populates it with the specified subset of data, storing the new data files in Amazon S3.

1. Amazon Athena Developer Guide

"CREATE TABLE AS": This official documentation explicitly defines the CTAS query syntax and its purpose. It states

"A CREATE TABLE AS SELECT (CTAS) query creates a new table in Athena from the results of a SELECT statement from another query." The provided syntax is CREATE TABLE newtable AS SELECT ...

which directly matches Option A.

Source: AWS Documentation

Amazon Athena

SQL reference

Data definition language

CREATE TABLE AS.

2. Amazon Athena Developer Guide

"Examples of CTAS queries": This page provides practical examples that reinforce the correct syntax. An example shows CREATE TABLE ctascsvexample AS SELECT key

CAST(vin AS VARCHAR) AS vin FROM "mydatabase"."mytable"

confirming the CREATE TABLE ... AS SELECT ... structure.

Source: AWS Documentation

Amazon Athena

User Guide

Working with query results

CTAS and INSERT INTO

Examples of CTAS queries.

3. Amazon Athena Developer Guide

"CREATE TABLE": This document details the syntax for creating tables

including the CREATE TABLE ... LIKE variant. It shows that LIKE is used to copy metadata only

not data

and its syntax does not include a WHERE clause for data filtering

confirming why Option C is incorrect.

Source: AWS Documentation

Amazon Athena

SQL reference

Data definition language

CREATE TABLE.

AWS Step Functions natively integrates with Amazon EventBridge, emitting events for every execution and state transition (e.g., SUCCEEDED, FAILED). This is the most direct and efficient way to monitor the entire pipeline. By creating an EventBridge rule that filters for specific status changes from the target state machine, you can trigger an action, such as publishing a message to an Amazon SNS topic. This provides real-time, centralized notifications for the entire workflow's status without requiring custom code within the pipeline's individual steps.

A. This method is indirect, adds unnecessary components (S3), and only provides a notification when the entire state machine finishes, not for individual step failures in real time.
B. Requiring each Lambda function to write notifications is decentralized, hard to maintain, and does not provide a holistic view of the Step Functions orchestrator itself.
C. AWS CloudTrail is designed for auditing API activity and has inherent latency. It is not the appropriate service for real-time operational monitoring and alerting on state machine status.

1. AWS Step Functions Developer Guide. (2023). Monitoring with Amazon EventBridge. This guide explicitly details the process: "You can create an Amazon EventBridge rule that triggers when a state machine execution changes status... For example, you can create a rule that sends a notification to an Amazon SNS topic when an execution fails." AWS. Retrieved from https://docs.aws.amazon.com/step-functions/latest/dg/cw-events.html

2. Amazon EventBridge User Guide. (2023). Events from AWS services. This document lists AWS Step Functions as a native event source for EventBridge, confirming the direct integration. AWS. Retrieved from https://docs.aws.amazon.com/eventbridge/latest/userguide/events-service-events.html

Amazon S3 Storage Lens is the ideal solution for gathering information about storage usage patterns with the least operational effort. It provides a single-pane-of-glass dashboard with organization-wide visibility into object storage. Crucially, its default dashboard includes pre-aggregated metrics for "Incomplete multipart upload bytes" and "Noncurrent version bytes." This allows the company to immediately see the required information across all buckets without any configuration, scripting, or report processing. This turnkey visibility makes it the most operationally efficient option for this specific use case.

A. Using the AWS CLI would require writing, executing, and maintaining scripts to list objects and uploads for every bucket, which is a significant operational effort.
B. S3 Inventory reports can provide the raw data, but this requires configuring the reports, waiting for generation, and then querying large output files, which is more effort than viewing a dashboard.
D. AWS usage reports are for billing and provide high-level metrics (e.g., total storage in GB-months). They lack the granular detail needed to identify incomplete multipart uploads or outdated versions.

1. AWS Documentation. (2023). Assessing your storage activity and usage with Amazon S3 Storage Lens. Amazon S3 User Guide. Retrieved from https://docs.aws.amazon.com/AmazonS3/latest/userguide/storagelens.html (See the "Overview" section).

2. AWS Documentation. (2023). Using the S3 Storage Lens default dashboard. Amazon S3 User Guide. Retrieved from https://docs.aws.amazon.com/AmazonS3/latest/userguide/storagelensdefaultdashboard.html (This page describes the out-of-the-box experience).

3. AWS Documentation. (2023). S3 Storage Lens metrics glossary. Amazon S3 User Guide. Retrieved from https://docs.aws.amazon.com/AmazonS3/latest/userguide/storagelensmetricsglossary.html (This glossary confirms the availability of "Incomplete multipart upload (IMPU) bytes" and "Noncurrent version bytes" metrics).

The goal is the most operationally efficient way to perform a daily incremental load from a source with a monotonically increasing column. AWS Glue job bookmarks are designed for this exact scenario. By specifying the column with increasing values as the bookmark key, Glue automatically tracks the last value processed. On subsequent runs, the job processes only new rows with a key value greater than the last one, eliminating the need for custom tracking logic or inefficient daily full reloads.

A. AWS DMS with CDC is for continuous replication, which is overly complex for a once-daily batch load. It is not the most operationally efficient choice here.
C. Performing a full load with AWS DMS every day is inefficient, as it re-transfers all data instead of just the daily increment.
D. Performing a full load with AWS Glue every day is similarly inefficient and costly compared to an incremental load using job bookmarks.

1. AWS Glue Developer Guide. (2023). Tracking Processed Data Using Job Bookmarks. AWS Documentation. "AWS Glue tracks data that has already been processed during a previous run of an ETL job by persisting state information from the job run. This persisted state information is called a job bookmark... Job bookmarks help AWS Glue maintain state information and prevent the reprocessing of old data."

2. AWS Glue Developer Guide. (2023). Job bookmark keys. AWS Documentation. "For JDBC sources with monotonically increasing and unique values in a column, you can have AWS Glue bookmark the rows that have been processed."

RootDiskUsed signals that the EBS storage attached to the brokers is nearing capacity. Amazon MSK supports increasing broker storage and enabling automatic volume expansion; doing so relieves the pressure without changing instance type or ZooKeeper nodes.

B. ZooKeeper metadata is tiny; its storage is not tracked by the RootDiskUsed metric on brokers.
C. Larger instances add CPU/RAM but do not increase attached storage, so RootDiskUsed remains high.
D. Target-Volume-in-GiB is a per-topic retention setting, not a storage-expansion mechanism for broker disks.

1. Amazon MSK Developer Guide – “Expanding storage” (“Increase the EBS storage attached to each broker or enable automatic storage scaling”) (https://docs.aws.amazon.com/msk/latest/developerguide/volume-expansion.html).

2. Amazon MSK Metrics – “RootDiskUsed” description (tracks broker EBS utilization) (https://docs.aws.amazon.com/msk/latest/developerguide/monitoring.html#broker-metrics).