AWS DAS-C01 Free Practice Questions — Page 3

Q: An analytics software as a service (SaaS) provider wants to offer its customers business intelligence (BI) reporting capabilities that are self-service. The provider is using Amazon QuickSight to build these reports. The data for the reports resides in a multi-tenant database, but each customer should only be able to access their own data.The provider wants to give customers two user role options: Read-only users for individuals who only need to view dashboards. Power users for individuals who are allowed to create and share new dashboards with other users.Which QuickSught feature allows the provider to meet these requirements?

C. Isolated namespaces. Why C is correct: Isolated namespaces in QuickSight enable multi-tenant architectures by isolating assets (dashboards, datasets) between different customer groups while maintaining separate permission structures. Each namespace can have its own users and groups, with namespace-level isolation ensuring customers only access their own data. This is specifically designed for SaaS providers serving multiple customers from shared infrastructure. Why others are wrong: A Embedded dashboards are for embedding QuickSight into external applications but don't inherently solve multi-tenant data isolation B Table calculations are for computed fields, not access control or multi-tenancy D SPICE is QuickSight's in-memory calculation engine for performance, not related to multi-tenant access control

Q: A company is sending historical datasets to Amazon S3 for storage. A data engineer at the company wants to make these datasets available for analysis using Amazon Athena. The engineer also wants to encrypt the Athena query results in an S3 results location by using AWS solutions for encryption. The requirements for encrypting the query results are as follows: Use custom keys for encryption of the primary dataset query results. Use generic encryption for all other query results. Provide an audit trail for the primary dataset queries that shows when the keys were used and by whom.Which solution meets these requirements?

C. Why C is correct: SSE-KMS with customer managed keys (CMKs) provides custom encryption keys for the primary dataset and includes comprehensive audit trails through AWS CloudTrail. CloudTrail logs every use of KMS keys including which principal used them and when, satisfying the audit requirement. SSE-S3 provides generic encryption for other datasets with AWS-managed keys. This combination meets all three requirements: custom keys, generic encryption, and audit trails. Why others are wrong: A SSE-S3 uses AWS-managed keys, not custom keys, and doesn't provide detailed audit trails B SSE-C requires the client to provide encryption keys with each request and doesn't provide audit trails through CloudTrail D client-side encryption adds complexity and isn't native to Athena's encryption options; S3 client-side encryption also doesn't integrate with CloudTrail for key usage auditing

Question 1

An analytics software as a service (SaaS) provider wants to offer its customers business intelligence (BI) reporting capabilities that are self-service. The provider is using Amazon QuickSight to build these reports. The data for the reports resides in a multi-tenant database, but each customer should only be able to access their own data.The provider wants to give customers two user role options: Read-only users for individuals who only need to view dashboards. Power users for individuals who are allowed to create and share new dashboards with other users.Which QuickSught feature allows the provider to meet these requirements?

Answer

Show Answer & Explanation

Correct Answer: C. Isolated namespaces

Why C is correct: Isolated namespaces in QuickSight enable multi-tenant architectures by isolating assets (dashboards, datasets) between different customer groups while maintaining separate permission structures. Each namespace can have its own users and groups, with namespace-level isolation ensuring customers only access their own data. This is specifically designed for SaaS providers serving multiple customers from shared infrastructure. Why others are wrong: A Embedded dashboards are for embedding QuickSight into external applications but don't inherently solve multi-tenant data isolation B Table calculations are for computed fields, not access control or multi-tenancy D SPICE is QuickSight's in-memory calculation engine for performance, not related to multi-tenant access control

Question 2

A company is sending historical datasets to Amazon S3 for storage. A data engineer at the company wants to make these datasets available for analysis using Amazon Athena. The engineer also wants to encrypt the Athena query results in an S3 results location by using AWS solutions for encryption. The requirements for encrypting the query results are as follows: Use custom keys for encryption of the primary dataset query results. Use generic encryption for all other query results. Provide an audit trail for the primary dataset queries that shows when the keys were used and by whom.Which solution meets these requirements?

Answer

Show Answer & Explanation

Correct Answer: C

Why C is correct: SSE-KMS with customer managed keys (CMKs) provides custom encryption keys for the primary dataset and includes comprehensive audit trails through AWS CloudTrail. CloudTrail logs every use of KMS keys including which principal used them and when, satisfying the audit requirement. SSE-S3 provides generic encryption for other datasets with AWS-managed keys. This combination meets all three requirements: custom keys, generic encryption, and audit trails. Why others are wrong: A SSE-S3 uses AWS-managed keys, not custom keys, and doesn't provide detailed audit trails B SSE-C requires the client to provide encryption keys with each request and doesn't provide audit trails through CloudTrail D client-side encryption adds complexity and isn't native to Athena's encryption options; S3 client-side encryption also doesn't integrate with CloudTrail for key usage auditing

Question 3

A company is providing analytics services to its sales and marketing departments. The departments can access the data only through their business intelligence (BI) tools, which run queries on Amazon Redshift using an Amazon Redshift internal user to connect. Each department is assigned a user in the Amazon Redshift database with the permissions needed for that department. The marketing data analysts must be granted direct access to the advertising table, which is stored in Apache Parquet format in the marketing S3 bucket of the company data lake. The company data lake is managed by AWS Lake Formation. Finally, access must be limited to the three promotion columns in the table. Which combination of steps will meet these requirements? (Choose three.)

Answer

Show Answer & Explanation

Correct Answers: B; D. Create an external schema in Amazon Redshift by using the Amazon Redshift Spectrum IAM role. Grant usage to the marketing Amazon Redshift user.; E. Grant permissions in Lake Formation to allow the Amazon Redshift Spectrum role to access the three promotion columns of the advertising table.

Why B is correct: Amazon Redshift Spectrum requires an IAM role with permissions for Lake Formation to access Lake Formation-managed data. This role must be attached to the Redshift cluster to enable Spectrum queries against Lake Formation catalogs. Why D is correct: Creating an external schema in Redshift using the Spectrum IAM role establishes the connection to the Lake Formation catalog. Granting USAGE permission on this schema to the marketing Redshift user allows them to query tables within that schema. Why E is correct: Lake Formation permissions are required to control fine-grained access (column-level) to the advertising table. The Redshift Spectrum IAM role must be granted Lake Formation permissions on the specific three promotion columns to enforce this access control at query time. Why others are wrong: A Redshift permissions alone aren't sufficient; Lake Formation manages the underlying data access C S3 bucket permissions aren't sufficient when using Lake Formation; Lake Formation controls data access F the IAM group isn't directly querying; the Redshift Spectrum role needs the permissions

Question 4

A data engineer is using AWS Glue ETL jobs to process data at frequent intervals. The processed data is then copied into Amazon S3. The ETL jobs run every 15 minutes. The AWS Glue Data Catalog partitions need to be updated automatically after the completion of each job.Which solution will meet these requirements MOST cost-effectively?

Answer

Show Answer & Explanation

Correct Answer: D. Use the AWS Glue Data Catalog to manage the data catalog. Update the AWS Glue ETL code to include the enableUpdateCatalog and partitionKeys arguments

Why D is correct: The enableUpdateCatalog and partitionKeys arguments in AWS Glue ETL jobs enable automatic catalog updates during job execution without requiring separate crawlers. This is the most cost-effective solution because it eliminates crawler costs and reduces latency - partitions are updated immediately as data is written, rather than waiting for a crawler to run. For jobs running every 15 minutes, this prevents crawler costs from accumulating quickly. Why others are wrong: A running crawlers after each ETL job (96 times per day) incurs significant crawler costs and adds latency B AWS Glue Studio doesn't have a special built-in feature for catalog updates that's more cost-effective than enableUpdateCatalog C Apache Hive metastore adds operational overhead of managing a separate metastore instead of using managed AWS Glue Data Catalog

Question 5

A company hosts an on-premises PostgreSQL database that contains historical data. An internal legacy application uses the database for read-only activities. The company’s business team wants to move the data to a data lake in Amazon S3 as soon as possible and enrich the data for analytics.The company has set up an AWS Direct Connect connection between its VPC and its on-premises network. A data analytics specialist must design a solution that achieves the business team’s goals with the least operational overhead.Which solution meets these requirements?

Answer

Show Answer & Explanation

Correct Answer: D. Configure an AWS Glue crawler to use a JDBC connection to catalog the data in the on-premises database. Use an AWS Glue job to enrich the data and save the result to Amazon S3 in Apache Parquet format. Use Amazon Athena to query the data.

Why D is correct: This solution uses AWS Glue crawler with JDBC connection over Direct Connect to catalog the on-premises PostgreSQL database without requiring data migration first, minimizing operational overhead. AWS Glue jobs can directly read from the on-premises database via JDBC, enrich the data, and write optimized Parquet files to S3 - all managed by AWS. Athena provides serverless SQL querying with no infrastructure management. This achieves the goal with the least operational overhead by using fully managed AWS services. Why others are wrong: A requires developing and maintaining custom batch upload processes, adding operational overhead B requires provisioning and managing an RDS instance and Data Pipeline, adding unnecessary operational complexity C uses Redshift cluster instead of Athena, requiring cluster management and adding costs for this use case

AWS DAS-C01 Free Practice Questions — Page 3

Ready for the Full DAS-C01 Experience?

Recommended Next Certifications