Courseiva

AWS Certified Data Engineer Associate DEA-C01 (DEA-C01) — Questions 1–75

1711 questions total · 23pages · All types, answers revealed

Take a mock examExam hub

Page 1 of 23

Page 2
1
MCQmedium

A company uses AWS DMS to migrate an on-premises Oracle database to Amazon Aurora PostgreSQL. The migration is ongoing with continuous replication. The data engineer notices that the target Aurora database has a higher lag than expected. Which action would most likely reduce the lag?

A.Increase the size of the S3 bucket used for staging
B.Increase the number of parallel tasks in the DMS task settings
C.Enable Batch Optimized Apply on the DMS task
D.Disable validation of data on the target
AnswerB

More parallel tasks improve apply throughput.

Why this answer

Increasing the number of parallel tasks in a DMS task improves throughput, allowing data to be loaded faster to the target and reducing replication lag. Option A is incorrect because the S3 bucket size does not affect DMS replication performance. Option C is incorrect: while Batch Optimized Apply can reduce apply overhead on certain targets like PostgreSQL, increasing parallel tasks is a more direct and effective way to address lag.

Option D is incorrect because disabling validation reduces data integrity checks and may provide only minor lag reduction, but it is not the recommended primary action.

Full explanation →
2
Multi-Selectmedium

A data engineer needs to securely store database credentials used by an AWS Glue ETL job. Which THREE steps should the engineer take?

Select 3 answers
A.Hardcode the credentials in the Glue job script.
B.Store the credentials in AWS Secrets Manager.
C.Grant the Glue job's IAM role permission to read the secret.
D.Configure the Glue job to use the Secrets Manager connector to retrieve credentials.
E.Use AWS Systems Manager Parameter Store with a SecureString parameter.
AnswersB, C, D

Secrets Manager provides secure storage and rotation.

Why this answer

Options B, C, and D are correct. AWS Secrets Manager securely stores credentials with automatic rotation. The Glue job's IAM role must have permission to read the secret (C), and the job uses the Secrets Manager connector to retrieve credentials (D).

Option A is incorrect because hardcoding credentials is insecure and violates best practices. Option E is incorrect because while Parameter Store can store secrets, Secrets Manager is the recommended service for managing database credentials due to its built-in rotation and tighter integration with Glue.

Full explanation →
3
MCQhard

Refer to the exhibit. A data engineer is troubleshooting a permissions issue. The IAM role 'DataEngineerRole' is used by an AWS Glue job that needs to read data from an S3 bucket encrypted with a customer managed KMS key. The above key policy is attached to the KMS key. The Glue job fails with an AccessDenied error when trying to read the data. What is the MOST likely cause?

A.The key policy requires requests to originate from a VPC endpoint, but the Glue job is not using one.
B.The key policy denies requests that are not using HTTPS, but the Glue job is using HTTPS.
C.The key policy condition 'kms:ViaService' restricts KMS actions to only when they are made through S3, but AWS Glue calls KMS directly, not via S3.
D.The Glue job is running in a different AWS region than the S3 bucket.
AnswerC

Glue does not use S3 to make KMS calls; it calls KMS directly, so the condition fails.

Why this answer

The key policy includes a condition `kms:ViaService` that restricts KMS actions to only when they are made through the S3 service. However, AWS Glue does not call KMS via S3; it calls KMS directly to decrypt the S3 object's data key. Because the Glue job's KMS request does not originate from the S3 service, the condition fails, resulting in an AccessDenied error.

Exam trap

AWS often tests the nuance that `kms:ViaService` only applies when the KMS API call is made through the specified service's endpoint, not when a service like Glue calls KMS directly to decrypt an S3 object's key.

How to eliminate wrong answers

Option A is wrong because the key policy does not contain any VPC endpoint condition; the condition shown is `kms:ViaService`, not `aws:SourceVpce`. Option B is wrong because the key policy does not include an HTTPS condition, and even if it did, AWS Glue uses HTTPS by default, so this would not cause an AccessDenied error. Option D is wrong because cross-region access to an S3 bucket is allowed as long as the KMS key is in the same region as the bucket; the error is not region-related.

Full explanation →
4
MCQeasy

A data engineer needs to capture change data capture (CDC) events from an Amazon RDS for PostgreSQL database and stream them to Amazon S3 in near real-time. Which AWS service should be used?

A.Amazon S3 Transfer Acceleration
B.Amazon Athena
C.AWS Database Migration Service (AWS DMS)
D.Amazon Kinesis Data Streams
AnswerC

DMS supports ongoing replication (CDC) from databases to S3.

Why this answer

AWS DMS supports continuous replication from PostgreSQL source databases using logical replication slots to capture CDC events in near real-time. It can directly stream these changes to Amazon S3 as a target, making it the correct choice for this use case.

Exam trap

The trap here is that candidates may confuse Kinesis Data Streams as a direct CDC solution, but it requires a separate CDC tool or custom application to capture PostgreSQL changes, whereas AWS DMS natively supports this integration.

How to eliminate wrong answers

Option A is wrong because Amazon S3 Transfer Acceleration is a feature that speeds up uploads to S3 over long distances using edge locations, but it does not capture or stream CDC events from a database. Option B is wrong because Amazon Athena is an interactive query service for analyzing data in S3 using SQL, not a tool for capturing or streaming database changes. Option D is wrong because Amazon Kinesis Data Streams is a real-time streaming service that can ingest data, but it cannot directly capture CDC events from an RDS for PostgreSQL database without additional configuration or a separate CDC connector.

Full explanation →
5
MCQhard

A company uses AWS Database Migration Service (DMS) to continuously replicate data from an on-premises Oracle database to Amazon S3 in Parquet format. The replication is used for near-real-time analytics. Recently, the DMS task started failing with an error indicating insufficient memory. The source database is large (2 TB). What should a data engineer do to resolve this issue while minimizing changes to the existing architecture?

A.Change the target format to JSON to reduce memory usage.
B.Split the DMS task into multiple smaller tasks.
C.Use Change Data Capture (CDC) only, without full load.
D.Increase the DMS replication instance size.
AnswerD

Provides more memory.

Why this answer

The error indicates the DMS replication instance is running out of memory during continuous replication of a 2 TB Oracle database to S3 in Parquet format. Increasing the replication instance size (Option D) directly addresses the memory constraint by providing more RAM and processing capacity, which is necessary for handling large volumes of Change Data Capture (CDC) data and Parquet conversion overhead. This solution requires minimal architectural changes, as it only involves modifying the instance class in the DMS task settings.

Exam trap

The trap here is that candidates may think splitting tasks or changing formats reduces memory usage, but the root cause is insufficient instance resources, and AWS DMS tasks require adequate instance sizing for large-scale CDC workloads.

How to eliminate wrong answers

Option A is wrong because changing the target format to JSON would not reduce memory usage; JSON is typically larger than Parquet and would increase memory consumption during serialization, not decrease it. Option B is wrong because splitting the DMS task into multiple smaller tasks would increase complexity and overhead, potentially causing additional memory pressure from multiple connections and task management, and does not directly resolve the insufficient memory error. Option C is wrong because using CDC only without full load ignores the fact that the task is already failing during continuous replication (CDC phase), and the full load may have already completed; disabling full load does not address the memory issue in CDC processing.

Full explanation →
6
MCQmedium

Refer to the exhibit. This log snippet is from a failed AWS Glue job. The job processes a large dataset in memory. What is the MOST likely cause of the OutOfMemoryError?

A.The Glue job is running with insufficient DPUs or worker type.
B.The input data is in an unsupported file format.
C.The job is attempting to join two tables with mismatched keys.
D.The job has too many partitions.
AnswerA

Insufficient resources cause out-of-memory.

Why this answer

An OutOfMemoryError in AWS Glue typically occurs when the allocated DPUs or worker type are insufficient for the in-memory processing of a large dataset. Option B is incorrect because unsupported file formats cause parsing errors, not memory errors. Option C is incorrect because mismatched keys in a join cause data skew or incorrect results, but not directly an OutOfMemoryError.

Option D is incorrect because too many partitions usually lead to small file overhead, not heap space exhaustion.

Full explanation →
7
MCQmedium

A company has a large volume of CSV files in S3 that need to be transformed into Parquet using AWS Glue. The files are partitioned by date. The engineer wants to minimize costs by processing only new files each day. Which approach should be used?

A.Use S3 partition discovery to automatically read new partitions.
B.Schedule the Glue job to run daily and process all files.
C.Enable job bookmarks in the Glue job.
D.Use S3 Event Notifications to trigger the Glue job on each new file.
AnswerC

Bookmarks track processed data and skip already processed files.

Why this answer

Using a Job Bookmark in Glue tracks processed data and skips already processed files, processing only new ones. Option A is wrong because it would reprocess all files. Option B is wrong because partitioning alone does not prevent reprocessing.

Option D is wrong because an SQS event can trigger a job, but without bookmarks, it may still reprocess.

Full explanation →
8
MCQeasy

A data engineering team needs to ingest real-time streaming data from thousands of IoT devices and transform the data before storing it in Amazon S3. Which AWS service is most suitable for performing the transformation step in near real-time?

A.AWS Lambda
B.Amazon Kinesis Data Analytics
C.Amazon Kinesis Data Firehose
D.Amazon S3
AnswerA

Lambda can process Kinesis stream records and transform them.

Why this answer

AWS Lambda can run code in response to Kinesis Data Streams events and perform transformations before writing to S3. Option B is incorrect because Kinesis Data Analytics is for running SQL/Java on streams, not simple transforms. Option C is incorrect because Kinesis Data Firehose is for loading data to destinations with optional simple transformations via Lambda.

Option D is incorrect because Amazon S3 is storage, not a transformation service.

Full explanation →
9
MCQeasy

A data engineer needs to ingest streaming data from thousands of IoT devices into Amazon S3 in near real-time. The data must be processed with minimal latency and stored in a columnar format for analytics. Which service should the engineer use to ingest the data?

A.Amazon Kinesis Data Analytics
B.Amazon Simple Queue Service (SQS)
C.Amazon Kinesis Data Streams with a Lambda consumer
D.Amazon Kinesis Data Firehose
AnswerD

Directly loads streaming data to S3 with transformation and columnar format support.

Why this answer

Amazon Kinesis Data Firehose is the correct choice because it is designed to ingest streaming data and deliver it directly to Amazon S3 with near-real-time latency (typically 60 seconds or more, depending on buffer settings). It automatically converts data to columnar formats like Parquet or ORC, which is essential for analytics, and requires no custom code for the delivery pipeline, minimizing operational overhead.

Exam trap

The trap here is that candidates often confuse Kinesis Data Streams (which requires a consumer like Lambda to write to S3) with Kinesis Data Firehose (which is a fully managed delivery service), leading them to choose Option C because they think they need a Lambda consumer for processing, but Firehose handles the entire ingestion pipeline without custom code.

How to eliminate wrong answers

Option A is wrong because Amazon Kinesis Data Analytics is for running real-time SQL or Apache Flink analytics on streaming data, not for ingesting and storing raw data into S3. Option B is wrong because Amazon SQS is a message queue service for decoupling application components, not designed for high-throughput streaming ingestion or direct delivery to S3 with format conversion. Option C is wrong because while Kinesis Data Streams with a Lambda consumer can ingest data and write to S3, it requires custom code in the Lambda function for batching, format conversion, and error handling, adding latency and complexity compared to Firehose's managed delivery.

Full explanation →
10
MCQmedium

A data engineer needs to ingest data from an on-premises Oracle database to Amazon S3 daily. The data volume is 500 GB per day, and the network bandwidth is 200 Mbps. The requirement is to minimize the impact on the source database and ensure data integrity. Which combination of AWS services should be used?

A.AWS Database Migration Service (DMS) with S3 as target
B.AWS Glue ETL jobs with JDBC connection
C.Amazon Kinesis Data Firehose with Oracle as source
D.AWS Data Pipeline with SQLActivity
AnswerA

AWS DMS minimizes source impact by using change data capture and supports S3 as a target.

Why this answer

AWS DMS with S3 as target is correct because it supports continuous change data capture (CDC) from Oracle, minimizing impact on the source database by reading redo logs instead of querying tables directly. It can handle 500 GB/day over 200 Mbps (which yields ~2.16 TB/day theoretical max) and ensures data integrity via transactional consistency and validation checksums. DMS also automatically partitions large datasets and can resume from failures, making it ideal for daily bulk loads.

Exam trap

The trap here is that candidates assume AWS Glue or Data Pipeline are suitable for database ingestion, but they lack the CDC and low-impact features of DMS, which is specifically designed for minimal source database load during large-scale migrations or replication.

How to eliminate wrong answers

Option B is wrong because AWS Glue ETL jobs with JDBC connection would pull data via full table scans, placing significant load on the Oracle database and lacking native CDC capabilities, which violates the requirement to minimize source impact. Option C is wrong because Amazon Kinesis Data Firehose cannot use Oracle as a direct source; it ingests from streaming sources like Kinesis Data Streams, not relational databases via JDBC. Option D is wrong because AWS Data Pipeline with SQLActivity uses a polling-based approach that repeatedly queries the source, causing unnecessary overhead, and does not support CDC or optimized large-volume transfers like DMS.

Full explanation →
11
MCQmedium

A company uses Amazon Kinesis Data Firehose to deliver streaming data to Amazon S3. The data is in JSON format and needs to be converted to Parquet. However, the conversion is failing. What is the most likely cause?

A.The data transformation Lambda function is not converting to Parquet
B.The schema is not defined in the AWS Glue Data Catalog
C.The data size exceeds the 1 MB limit per record
D.The delivery stream is configured to use Kinesis Data Streams as source
AnswerB

Parquet conversion requires a schema; without it, Firehose cannot convert.

Why this answer

Kinesis Data Firehose requires a schema to convert to Parquet. This schema can be provided by a Glue Data Catalog table. If the schema is not defined, the conversion fails.

Data size is not an issue for conversion. Kinesis Data Streams is not involved here. Lambda transformation can convert to Parquet but is not required.

Full explanation →
12
MCQeasy

A company is running a production database on Amazon RDS for PostgreSQL. The database experiences high read traffic from multiple application servers. Which data store management strategy would reduce the load on the primary database instance?

A.Enable DynamoDB Accelerator (DAX) for the database.
B.Enable Multi-AZ deployment for automatic failover.
C.Create an RDS Read Replica in the same region.
D.Use Amazon ElastiCache to cache query results.
AnswerC

Read Replicas allow offloading read queries, reducing load on the primary.

Why this answer

Creating an RDS Read Replica in the same region offloads read-heavy traffic from the primary PostgreSQL instance by providing a separate, read-only copy of the database. Application servers can direct SELECT queries to the Read Replica, reducing the primary instance's CPU and I/O load without affecting write performance. This is the most direct and cost-effective strategy for scaling read capacity in Amazon RDS for PostgreSQL.

Exam trap

The trap here is that candidates often confuse Multi-AZ (which is for failover, not read scaling) with Read Replicas, or they assume ElastiCache is the only caching option, overlooking that RDS Read Replicas are a managed, database-level solution for read offloading without application code changes.

How to eliminate wrong answers

Option A is wrong because DynamoDB Accelerator (DAX) is an in-memory cache for Amazon DynamoDB, a NoSQL database, and cannot be used to cache or offload queries from Amazon RDS for PostgreSQL. Option B is wrong because Multi-AZ deployment provides high availability and automatic failover by maintaining a standby replica in another Availability Zone, but it does not serve read traffic or reduce load on the primary instance. Option D is wrong because while ElastiCache can cache query results to reduce read load, it requires application-level changes to implement caching logic and does not provide a full database replica; the question asks for a data store management strategy, and a Read Replica is a more native and simpler solution for offloading read traffic from RDS.

Full explanation →
13
MCQmedium

A company uses Amazon Kinesis Data Firehose to deliver streaming data to an Amazon S3 bucket. The data is JSON and each record is about 2 KB. The delivery stream is configured to buffer incoming data to 5 MB or 60 seconds, whichever comes first. The data engineering team notices that the S3 bucket contains many small files (average 2 MB), which makes subsequent processing inefficient. They need to reduce the number of small files without increasing the latency beyond 5 minutes. Which solution should they implement?

A.Enable compression (GZIP) on the delivery stream.
B.Increase the buffer size to 50 MB and the buffer interval to 300 seconds.
C.Use a Lambda function to merge small files after delivery.
D.Decrease the buffer size to 1 MB and the buffer interval to 60 seconds.
AnswerB

Larger buffer creates larger files within latency limit.

Why this answer

Increasing the buffer size to 50 MB and the buffer interval to 300 seconds directly addresses the root cause: the current 5 MB buffer size triggers a flush too frequently, producing many 2 MB files. By raising the buffer size to 50 MB, each flush will contain more data, resulting in larger S3 objects (up to ~50 MB uncompressed), while the 300-second interval ensures latency stays within the 5-minute requirement. This reduces the number of small files without requiring additional services or post-processing.

Exam trap

The trap here is that candidates often assume compression (Option A) reduces file count, but compression only reduces file size, not the number of files; the real issue is the flush frequency controlled by buffer size and interval.

How to eliminate wrong answers

Option A is wrong because enabling GZIP compression reduces the storage size of each file but does not change the buffer size or flush behavior; the delivery stream will still flush at 5 MB or 60 seconds, producing the same number of small files (just compressed). Option C is wrong because using a Lambda function to merge small files after delivery adds complexity, cost, and latency (Lambda invocation delays, S3 event processing), and does not address the root cause of premature flushes; it also violates the goal of not increasing latency beyond 5 minutes due to the merging overhead. Option D is wrong because decreasing the buffer size to 1 MB and keeping the buffer interval at 60 seconds would make the problem worse, producing even smaller files (average ~1 MB) and more frequent flushes, increasing the number of small files.

Full explanation →
14
Multi-Selecthard

A company uses Amazon DynamoDB for a gaming application that requires single-digit millisecond read and write latencies. The application experiences throttling on the 'GameScores' table during peak hours. The table has a partition key of 'game_id' and a sort key of 'player_id'. The data engineer needs to improve performance without changing the table's provisioned capacity. Which THREE actions should the engineer take? (Choose THREE.)

Select 3 answers
A.Enable DynamoDB adaptive capacity to allow more throughput per partition.
B.Enable DynamoDB auto scaling to adjust capacity based on traffic patterns.
C.Add a Global Secondary Index (GSI) on a different partition key to offload reads.
D.Implement DynamoDB Accelerator (DAX) for caching frequent reads.
E.Increase the read capacity units (RCUs) to twice the peak observed value.
AnswersB, C, D

Auto scaling prevents throttling by adjusting capacity automatically.

Why this answer

DynamoDB auto scaling automatically adjusts the provisioned read and write capacity based on actual traffic patterns, preventing throttling during peak hours without manual intervention. This allows the table to handle bursts while maintaining single-digit millisecond latencies, as long as the traffic stays within the auto scaling limits.

Exam trap

The trap here is that candidates may confuse adaptive capacity with auto scaling, or think that increasing provisioned capacity is the only solution, but the question explicitly prohibits changing provisioned capacity, making options that alter RCUs or WCUs incorrect.

Full explanation →
15
Multi-Selecteasy

Which TWO features of Amazon S3 help protect data from accidental deletion or modification? (Choose two.)

Select 2 answers
A.Lifecycle policies
B.Default encryption
C.S3 MFA Delete
D.S3 Object Versioning
E.Cross-Region Replication
AnswersC, D

MFA Delete requires additional authentication for deletions.

Why this answer

C is correct because S3 MFA Delete requires multi-factor authentication for permanent deletion of objects or suspension of versioning, adding a critical layer of protection against accidental or malicious deletions. D is correct because S3 Object Versioning preserves every version of an object, allowing recovery from accidental overwrites or deletions by restoring a previous version.

Exam trap

The trap here is that candidates often confuse data protection features (like encryption or replication) with deletion prevention, mistakenly selecting Lifecycle policies or Cross-Region Replication because they think 'protection' includes backup or security, when the question specifically asks about preventing accidental deletion or modification.

Full explanation →
16
MCQeasy

A data engineer is monitoring an Amazon Redshift cluster and notices that the disk space usage is increasing rapidly. The engineer wants to reclaim space from deleted rows. Which command should the engineer run?

A.VACUUM
B.ANALYZE
C.UNLOAD
D.COPY
AnswerA

VACUUM reclaims space from deleted rows.

Why this answer

The VACUUM command in Amazon Redshift reclaims disk space from deleted rows and reorganizes the data to improve query performance. Option B is wrong because ANALYZE updates statistics for the query optimizer, not reclaims space. Option C is wrong because UNLOAD exports data from the cluster to Amazon S3.

Option D is wrong because COPY loads data from files into the cluster.

Full explanation →
17
MCQmedium

A company uses AWS Glue to process sensitive customer data stored in S3. The data engineer must ensure that the Glue ETL jobs do not write any data to S3 buckets that lack encryption. Which approach meets this requirement?

A.Use AWS CloudTrail to monitor and alert on unencrypted writes
B.Attach an S3 bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header
C.Enable S3 default encryption on the bucket
D.Configure an IAM role for Glue with a policy that denies s3:PutObject without encryption
AnswerB

S3 bucket policies can enforce encryption on uploads.

Why this answer

An S3 bucket policy with a condition key such as s3:x-amz-server-side-encryption can deny s3:PutObject requests that do not specify encryption, thereby preventing unencrypted writes. Option A is incorrect because AWS CloudTrail is an auditing service that logs API calls but does not actively prevent writes. Option C is incorrect because while S3 default encryption automatically encrypts objects at rest, it does not enforce that write requests include encryption headers; the bucket policy approach ensures encryption is explicitly requested.

Option D is incorrect because an IAM role policy can also enforce encryption, but a bucket policy is more comprehensive as it applies to all principals accessing the bucket, including the Glue service role.

Full explanation →
18
MCQmedium

A company uses AWS KMS to encrypt data in Amazon S3. The security team requires that all encryption keys be rotated automatically every year. Which key type should the company use?

A.Use a customer managed key with automatic rotation enabled
B.Use the default S3 managed encryption key (SSE-S3)
C.Use an AWS managed key (aws/s3)
D.Use a customer managed key with manual rotation
AnswerA

Correct: Customer managed keys with automatic rotation enabled rotate automatically every year, meeting the requirement while maintaining customer control.

Why this answer

AWS KMS allows customer managed keys to have automatic rotation enabled, which rotates the key material annually. This satisfies the security team's requirement for automatic yearly rotation while keeping customer control over the key. Option D (manual rotation) does not meet the automatic rotation requirement.

AWS managed keys (C) also rotate automatically but are not customer managed, and SSE-S3 (B) is not a KMS key type.

Exam trap

Candidates may incorrectly think that only AWS managed keys support automatic rotation, overlooking that customer managed keys also offer automatic rotation. They might also confuse manual rotation as acceptable despite the explicit 'automatic' requirement.

Full explanation →
19
Multi-Selectmedium

A data engineer is setting up a Redshift cluster and needs to ensure high availability. Which TWO actions should be taken?

Select 2 answers
A.Enable concurrency scaling.
B.Configure cross-region snapshot copy.
C.Enable automatic replication across Availability Zones.
D.Use a single-node cluster to reduce complexity.
E.Deploy a multi-node cluster with at least two compute nodes.
AnswersB, E

Cross-region snapshot copy provides disaster recovery by replicating snapshots to another region, ensuring data availability in case of a regional outage. This is a correct action for high availability.

Why this answer

For high availability in Amazon Redshift, you need to protect against data loss and downtime. Option B (configure cross-region snapshot copy) ensures that snapshots are replicated to another region, providing disaster recovery and high availability in case of a regional outage. Option E (deploy a multi-node cluster with at least two compute nodes) provides node-level redundancy; if one node fails, the workload can be redistributed.

Option C (enable automatic replication across Availability Zones) is not a feature of Amazon Redshift; Redshift does not support automatic cross-AZ replication for compute nodes. Option A (concurrency scaling) improves query concurrency, not availability. Option D (single-node cluster) offers no redundancy.

Exam trap

Candidates often assume that cross-AZ replication is available for Redshift, but it is not. The correct HA measures are cross-region snapshot copy and multi-node clusters.

Full explanation →
20
Multi-Selecthard

A company is ingesting Apache logs from multiple web servers into AWS. The logs are sent via Amazon CloudWatch Logs to a subscription filter that delivers to a Lambda function. The Lambda function parses the logs and writes to Amazon S3. However, there is a significant backlog. Which THREE actions can reduce the backlog?

Select 3 answers
A.Route the CloudWatch Logs subscription to an Amazon SQS queue first
B.Increase the Lambda function memory allocation
C.Increase the Lambda function reserved concurrency
D.Change the Lambda function runtime from Python to Node.js
E.Increase the Lambda function maximum concurrency (unreserved account concurrency)
AnswersB, C, E

More memory also increases CPU, speeding up processing.

Why this answer

Increasing the Lambda function's memory allocation also increases its CPU allocation, allowing the function to process each log event faster. This reduces the per-invocation processing time, enabling the function to handle more log data per unit time and thus reduce the backlog.

Exam trap

The trap here is that candidates may confuse 'reserved concurrency' with 'maximum concurrency' or think that adding an SQS queue always improves throughput, when in fact it can add latency and does not address the root cause of slow per-invocation processing.

Full explanation →
21
Multi-Selectmedium

A company is designing a disaster recovery strategy for an Amazon RDS for SQL Server database. The database must be recoverable in another AWS region within 15 minutes of a regional outage. Which TWO actions should the data engineer take?

Select 2 answers
A.Enable Multi-AZ deployment on the primary instance.
B.Configure automated backups to copy to the recovery region.
C.Configure automated cross-region snapshots to be copied to the recovery region.
D.Create a cross-region read replica in the desired recovery region.
AnswersC, D

Cross-region snapshot copy allows restoring in another region.

Why this answer

Cross-region snapshots for Amazon RDS are automatically copied to a destination AWS region, enabling you to restore the database in the recovery region from the most recent snapshot. This meets the 15-minute recovery time objective (RTO) when combined with a pre-provisioned DB instance, as the snapshot copy is asynchronous but can be scheduled to occur frequently (e.g., every 5 minutes for SQL Server).

Exam trap

The trap here is that candidates confuse Multi-AZ (regional high availability) with cross-region disaster recovery, or they assume automated backups can be copied across regions, but AWS does not support automatic cross-region backup copying for RDS.

Full explanation →
22
MCQhard

A company runs an Amazon DynamoDB table with on-demand capacity. A new reporting application performs frequent Scan operations on the table, causing occasional 'ProvisionedThroughputExceededException' errors. The operations team needs to resolve this with minimal cost. What should they do?

A.Increase the table's maximum read capacity by requesting a limit increase from AWS Support.
B.Switch the table to provisioned capacity and increase the read capacity units.
C.Enable DynamoDB Accelerator (DAX) to cache the Scan results.
D.Create a global secondary index (GSI) on the attributes used in the reporting queries.
AnswerD

GSI enables efficient queries, reducing Scans and avoiding partition-level throttling.

Why this answer

Creating a global secondary index (GSI) on the attributes used in the reporting queries allows the reporting application to use Query operations instead of expensive Scan operations. This reduces the read capacity consumption and avoids partition-level throttling, which is the cause of the 'ProvisionedThroughputExceededException' errors. On-demand tables have per-partition throughput limits, and frequent Scans can exceed those limits.

Option A is incorrect because increasing the maximum read capacity via AWS Support is not applicable to on-demand tables; on-demand scaling is automatic but per-partition limits still apply. Option B is incorrect because switching to provisioned capacity would require careful capacity planning and would likely increase costs compared to using a GSI. Option C is incorrect because DAX can cache data and reduce read load, but it does not eliminate the inefficiency of Scan operations; the root cause is the Scan itself, which can be avoided by using a GSI to enable efficient queries.

Full explanation →
23
MCQhard

A data engineer notices that an S3 bucket policy allows access to a user from another AWS account, but the access is being denied. What could be the reason?

A.The bucket policy does not include KMS permissions
B.The other account's IAM user does not have permissions to access the bucket
C.S3 does not support cross-account access
D.The bucket is in a different region
AnswerB

Cross-account access requires IAM permissions in the other account.

Why this answer

For cross-account S3 access to succeed, both the bucket policy (resource-based policy) and the IAM user policy (identity-based policy) in the other account must grant the necessary permissions. Option B is correct because even if the bucket policy allows access from the other account, the IAM user in that account must have an explicit IAM policy that permits the S3 action (e.g., s3:GetObject) on the bucket. Without this, the request is denied by the other account's own IAM evaluation.

Exam trap

The trap here is that candidates assume a bucket policy alone is sufficient for cross-account access, forgetting that the requesting account's IAM user must also have explicit permissions, which is a classic AWS cross-account authorization nuance.

How to eliminate wrong answers

Option A is wrong because KMS permissions are only required if the bucket uses SSE-KMS encryption; the question does not mention encryption, and a missing KMS permission would cause a different error (e.g., AccessDenied with KMS key context). Option C is wrong because S3 fully supports cross-account access via bucket policies and ACLs, as documented in the AWS S3 User Guide. Option D is wrong because S3 is a global service and cross-region access is allowed; region does not inherently block cross-account access.

Full explanation →
24
MCQmedium

A company is using Amazon Redshift for its data warehouse. A data engineer notices that COPY commands from S3 are failing intermittently with 'S3ServiceException: Access Denied'. The IAM role used by Redshift has the correct permissions. What is the MOST likely cause?

A.The IAM role is not attached to the Redshift cluster.
B.The S3 bucket uses SSE-KMS encryption and the role lacks kms:Decrypt.
C.The IAM role name contains a typo in the COPY command.
D.The S3 bucket policy denies access to the Redshift cluster's IP addresses.
AnswerD

Bucket policies can override IAM permissions and cause Access Denied.

Why this answer

S3 bucket policies may deny access even if the role allows it. Option A is wrong because the role is already attached. Option B is wrong because encryption would cause different errors.

Option C is wrong because if the role exists, it should work; the issue is likely external.

Full explanation →
25
MCQeasy

A data engineering team is ingesting streaming data from IoT devices into Amazon Kinesis Data Streams. The data must be transformed in real-time and then loaded into an Amazon S3 bucket for long-term storage. Which AWS service should be used to perform the transformation and delivery to S3 with minimal operational overhead?

A.Amazon Kinesis Data Firehose
B.AWS Glue
C.Amazon EMR
D.Amazon Kinesis Data Analytics
AnswerA

Kinesis Data Firehose can subscribe to a Kinesis Data Stream, transform data, and automatically deliver to S3.

Why this answer

Amazon Kinesis Data Firehose is the correct choice because it is a fully managed service designed to automatically load streaming data into Amazon S3, Redshift, Elasticsearch, and Splunk. It can invoke an AWS Lambda function for real-time data transformation before delivery, eliminating the need to manage any infrastructure or write custom code for the delivery pipeline. This directly meets the requirement of minimal operational overhead for transformation and S3 delivery.

Exam trap

The trap here is that candidates often confuse Amazon Kinesis Data Analytics (which processes streams but does not deliver to S3) with Kinesis Data Firehose, or they overcomplicate the solution by selecting EMR or Glue for what is fundamentally a simple streaming ingestion and transformation task.

How to eliminate wrong answers

Option B (AWS Glue) is wrong because AWS Glue is a serverless ETL service primarily used for batch processing and cataloging data in data lakes, not for real-time streaming ingestion or continuous delivery to S3. Option C (Amazon EMR) is wrong because Amazon EMR is a cluster-based platform for running big data frameworks like Apache Spark and Hadoop, which requires provisioning and managing clusters, leading to higher operational overhead than a fully managed service. Option D (Amazon Kinesis Data Analytics) is wrong because it is designed for real-time analytics on streaming data using SQL or Apache Flink, but it does not natively deliver transformed data to S3; it would require additional services to handle the output.

Full explanation →
26
MCQhard

A company has a multi-account AWS environment with a centralized data lake in the Security account. Data producers in other accounts use AWS Glue to write data to S3 buckets in the Security account. The Security account uses AWS Lake Formation to manage permissions. The data engineer is setting up cross-account access so that users in the Producer account can query the data using Athena in their own account. The engineer has registered the S3 buckets and Data Catalog tables in Lake Formation. The IAM roles in the Producer account have the necessary permissions. However, when a user in the Producer account tries to query the table, they get an AccessDenied error. The error message indicates that the principal is not authorized to perform lakeformation:GetTable on the resource. What is the most likely cause?

A.The Glue Data Catalog resource policy is missing a statement to allow cross-account access.
B.The S3 bucket policy does not allow the Producer account's IAM role to read the data.
C.The KMS key policy does not allow the Producer account's IAM role to decrypt objects.
D.The Lake Formation permissions in the Security account do not include a grant to the Producer account's IAM role.
AnswerD

Lake Formation must grant cross-account access to the external IAM role.

Why this answer

Lake Formation requires explicit cross-account grants to the producer account's IAM role for the Data Catalog tables. Even if the S3 buckets and Data Catalog tables are registered, the producer account's role must be granted SELECT and DESCRIBE permissions on the table in Lake Formation. Option A is incorrect because a Glue Data Catalog resource policy is not required when Lake Formation is used for cross-account access; Lake Formation handles the authorization.

Option B is incorrect because the S3 bucket policy must allow the producer account's role, but the error specifically mentions lakeformation:GetTable, not S3 access. Option C is incorrect because the KMS key policy is not relevant to the lakeformation:GetTable error.

Full explanation →
27
MCQeasy

A company wants to audit all data access events in their S3 buckets, including who accessed objects and from which IP address. Which AWS service should be used to capture these events?

A.AWS CloudTrail with data events enabled
B.Amazon CloudWatch Logs
C.AWS Config
D.Amazon S3 Server Access Logs
AnswerA

CloudTrail can log S3 object-level operations and capture user identity and source IP.

Why this answer

AWS CloudTrail can log S3 API calls such as GetObject, PutObject, and ListObjects when data events are enabled, capturing details like who accessed an object and from which IP address. Option D is incorrect because S3 Server Access Logs provide object-level logs but do not include IAM user or role details. Option B is incorrect because Amazon CloudWatch Logs can store and monitor logs but does not capture S3 data events directly.

Option C is incorrect because AWS Config records resource configuration changes, not data access events.

Full explanation →
28
MCQhard

A company uses Amazon Athena to query data in an S3 bucket. A data engineer notices that a query fails with the error: 'HIVE_CANNOT_OPEN_SPLIT: Error opening Hive split s3://bucket/path/file.parquet (Path does not exist)'. However, the file exists in S3. What is the most likely cause?

A.The file was uploaded using S3 multipart upload and is incomplete.
B.The table's metadata in the Glue Data Catalog is outdated.
C.The S3 bucket has a bucket policy that denies access to the Athena principal.
D.Another process deleted the file after Athena listed the files but before reading.
AnswerD

Eventual consistency for deletions can cause this.

Why this answer

The error 'Path does not exist' occurs when Athena has already listed the files in the table's location and then tries to read a specific file that was deleted after the listing. This is a race condition caused by concurrent operations. Option A is incorrect because an incomplete multipart upload would not cause a path-not-found error; the file would simply not be visible or be incomplete.

Option B is incorrect because outdated Glue metadata would cause schema mismatches or table not found errors, not a missing file path. Option C is incorrect because a bucket policy denying access would result in an Access Denied error, not 'Path does not exist'.

Full explanation →
29
MCQeasy

A data engineer needs to transform JSON data from Amazon S3 into Parquet format using AWS Glue. The data contains nested fields. Which Glue feature should the engineer use to define the schema and handle the nested structure?

A.Use the 'FindMatches' transform to identify duplicates.
B.Use the 'DropFields' transform to remove nested fields.
C.Use the 'Relationalize' transform in a Glue ETL script.
D.Use the 'Spigot' transform to write sample data.
AnswerC

Relationalize flattens nested JSON into relational tables.

Why this answer

The 'Relationalize' transform in AWS Glue is specifically designed to convert nested JSON data into flat tables by extracting and flattening nested fields into separate relational tables. This allows handling complex nested structures effectively. Option A is incorrect because 'FindMatches' is used for deduplication, not for handling nested data.

Option B is incorrect because 'DropFields' is used to remove fields from a dataset, not to transform nested structures. Option D is incorrect because 'Spigot' is used for writing sample data for testing or debugging, not for schema definition or handling nesting.

Full explanation →
30
Multi-Selectmedium

A data engineer is troubleshooting a slow Amazon Redshift query. The query plan shows a large number of 'DS_DIST_ALL_INNER' and 'DS_BCAST_INNER' operations. Which TWO actions would likely improve query performance?

Select 2 answers
A.Set DISTSTYLE to ALL for both tables.
B.Change the distribution style of large tables to KEY on the join column.
C.Increase the number of slices by resizing the cluster.
D.Define SORTKEYs on the join columns.
E.Drop and recreate the tables with the same DDL.
AnswersB, C

KEY distribution collocates data on the same slice, reducing redistribution.

Why this answer

Using DISTSTYLE KEY on the join column for large tables colocates data with the same key on the same slice, reducing the need for data redistribution operations like DS_DIST_ALL_INNER and DS_BCAST_INNER. Option C is correct because increasing the number of slices by resizing the cluster distributes data across more compute nodes, allowing more parallelism and reducing the relative impact of data redistribution. Option A is incorrect because setting DISTSTYLE to ALL on both tables would broadcast each table to all nodes, increasing data movement and likely worsening performance.

Option D is incorrect because SORTKEYs optimize range-restricted scans and sorting, not join data movement. Option E is incorrect because dropping and recreating tables with the same DDL does not change distribution or sort strategies, so it does not address the root cause of excessive redistribution.

Full explanation →
31
MCQhard

A company runs a data pipeline that ingests streaming data via Amazon Kinesis Data Streams, processes it with an AWS Lambda function, and stores results in Amazon DynamoDB. The Lambda function sometimes fails due to 'ProvisionedThroughputExceededException' on the DynamoDB table. Which combination of steps should a data engineer take to resolve this issue?

A.Enable DynamoDB auto scaling and configure a dead-letter queue for the Lambda function.
B.Increase the Lambda function timeout and enable batch windows.
C.Increase the number of Kinesis shards to reduce Lambda invocations.
D.Increase Lambda reserved concurrency and disable retries.
AnswerA

Auto scaling adjusts throughput; DLQ captures failed records for reprocessing.

Why this answer

Enabling DynamoDB auto scaling allows the table to adjust its provisioned throughput based on actual traffic patterns, which helps prevent 'ProvisionedThroughputExceededException' when the Lambda function writes to DynamoDB. Additionally, configuring a dead-letter queue (DLQ) for the Lambda function ensures that records that fail due to throttling are captured and can be reprocessed later, preventing data loss. Option B is incorrect because increasing the Lambda function timeout does not address DynamoDB throughput limits.

Option C is incorrect because increasing the number of Kinesis shards may increase the rate of Lambda invocations, potentially worsening the throttling issue. Option D is incorrect because increasing Lambda reserved concurrency could allow more concurrent invocations, which may exacerbate throughput exceedance, and disabling retries would cause data loss.

Full explanation →
32
Multi-Selectmedium

Which TWO of the following are benefits of using Amazon DynamoDB Accelerator (DAX)? (Choose TWO.)

Select 2 answers
A.Improves write throughput
B.Provides microsecond read latency
C.Offloads read traffic from the DynamoDB table
D.Provides data durability across Availability Zones
E.Reduces storage costs
AnswersB, C

DAX caches reads in memory for low latency.

Why this answer

Amazon DynamoDB Accelerator (DAX) is an in-memory cache that sits between your application and DynamoDB, providing microsecond response times for read-heavy workloads. It achieves this by caching frequently accessed data in memory, reducing the latency from single-digit milliseconds to microseconds for eventually consistent reads.

Exam trap

The trap here is that candidates often confuse DAX's read acceleration with write performance improvements, or assume that a cache provides durability guarantees similar to the underlying database.

Full explanation →
33
Multi-Selectmedium

A data engineer is designing a data storage solution for IoT sensor data that is ingested at high velocity. The data is time-series and needs to be queried by time range. Which TWO AWS services are suitable for this use case? (Choose TWO)

Select 2 answers
A.Amazon RDS
B.Amazon Redshift
C.Amazon Timestream
D.Amazon DynamoDB
E.Amazon S3
AnswersC, D

Timestream is a time-series database built for IoT and operational applications.

Why this answer

Amazon Timestream is a purpose-built time-series database that automatically scales to handle high-velocity IoT sensor data, with built-in time-based partitioning and query optimization for time-range queries. It supports SQL-like queries with time-series functions (e.g., `BETWEEN`, `DATE_BIN`) and separates storage into a memory store for recent data and a magnetic store for historical data, enabling efficient querying by time range.

Exam trap

The trap here is that candidates often choose Amazon RDS or Redshift because they are familiar with SQL-based querying, overlooking that Timestream and DynamoDB are purpose-built for high-velocity time-series ingestion and time-range queries, while RDS and Redshift incur performance and cost penalties for such workloads.

Full explanation →
34
Multi-Selecteasy

Which TWO AWS services can be used to transform data in an Amazon S3 data lake before loading into Amazon Redshift? (Choose 2.)

Select 2 answers
A.AWS Lambda
B.Amazon Athena
C.Amazon EMR
D.AWS Glue
E.Amazon Redshift Spectrum
AnswersD, E

Glue can transform data in S3 and load into Redshift.

Why this answer

AWS Glue (Option D) is correct because it provides a fully managed ETL service that can crawl, catalog, and transform data in Amazon S3 data lakes. With AWS Glue, you can create ETL jobs using a serverless Spark environment to transform raw data into optimized formats (e.g., Parquet) and load it into Amazon Redshift via JDBC connections, making it ideal for preparing data before ingestion.

Exam trap

The trap here is that candidates confuse Amazon Athena's querying capability with ETL functionality, or assume AWS Lambda can handle large-scale data transformations, when in fact AWS Glue is the correct managed ETL service for transforming data in S3 before loading into Redshift.

Full explanation →
35
MCQmedium

A data engineer needs to grant cross-account access to an S3 bucket. The engineer wants to use a role in the source account and assume that role from the target account. Which permissions are required?

A.Role in source account with trust policy allowing target account, and bucket policy granting access to the role
B.Bucket policy in source account allowing the target account's root user
C.Role in target account with trust policy allowing source account
D.IAM policy in target account allowing s3:GetObject on the bucket
AnswerA

This is the correct cross-account access pattern using role assumption.

Why this answer

Cross-account access via role assumption requires the source account to have an IAM role with a trust policy that explicitly allows the target account's AWS account ID to assume it. The bucket policy must then grant the necessary S3 actions (e.g., s3:GetObject) to that role's ARN, enabling the target account's assumed role session to access the bucket. This two-step mechanism—trust policy for authentication and bucket policy for authorization—is the standard AWS pattern for secure cross-account S3 access.

Exam trap

The trap here is that candidates often confuse the direction of the trust policy—thinking the role must be in the target account—or incorrectly assume that a bucket policy alone (without a role) is sufficient for cross-account access, missing the requirement for the target account to authenticate via role assumption.

How to eliminate wrong answers

Option B is wrong because granting access to the target account's root user in the bucket policy is overly permissive and violates the principle of least privilege; it also does not involve a role, so the target account would need to use its root user credentials directly, which is insecure and not the requested role-based approach. Option C is wrong because a role in the target account with a trust policy allowing the source account would enable the source account to assume a role in the target account, which is the reverse of the required direction—here, the target account needs to assume a role in the source account. Option D is wrong because an IAM policy in the target account alone cannot grant access to a resource in the source account; S3 bucket policies are resource-based policies that must explicitly allow the principal (the role ARN) to access the bucket, and a target account IAM policy only controls permissions within the target account.

Full explanation →
36
MCQeasy

A company is using Amazon S3 as a data lake. Data is ingested hourly from multiple sources. The data engineer needs to ensure that once an object is written to S3, it cannot be overwritten or deleted for 30 days. Which S3 feature should be used?

A.Use S3 Lifecycle policies to transition objects to Glacier after 30 days.
B.Enable S3 Versioning and MFA Delete.
C.Configure a bucket policy that denies s3:DeleteObject for all principals.
D.Enable S3 Object Lock with a retention period of 30 days.
AnswerD

Object Lock enforces write-once-read-many (WORM) protection.

Why this answer

S3 Object Lock with a retention period of 30 days enforces a write-once-read-many (WORM) policy that prevents objects from being overwritten or deleted during the retention period. This meets the requirement exactly, as it applies to both new and existing objects when enabled on a versioning-enabled bucket.

Exam trap

The trap here is that candidates confuse S3 Versioning with MFA Delete (which only protects version deletions, not overwrites) as a sufficient solution, overlooking that Object Lock is the only feature that enforces a time-based immutability lock against both overwrites and deletions.

How to eliminate wrong answers

Option A is wrong because S3 Lifecycle policies only automate storage class transitions (e.g., to Glacier) after a specified period; they do not prevent overwrites or deletions during that time. Option B is wrong because S3 Versioning with MFA Delete protects against accidental deletion of object versions but does not prevent overwrites of the current version (it creates a new version instead). Option C is wrong because a bucket policy denying s3:DeleteObject for all principals can be overridden by explicit allow policies or root account actions, and it does not prevent overwrites (which are PUT operations), nor does it enforce a time-based retention lock.

Full explanation →
37
MCQeasy

A company needs to audit all API calls made in their AWS account, including actions performed by the root user. Which AWS service should be used?

A.VPC Flow Logs
B.AWS CloudTrail
C.Amazon CloudWatch Logs
D.AWS Config
AnswerB

AWS CloudTrail is the service designed to record all API calls for auditing and governance.

Why this answer

AWS CloudTrail records all API calls made in an AWS account, including root user actions, for auditing and compliance. Option A is incorrect because VPC Flow Logs capture network traffic metadata, not API calls. Option C is incorrect because Amazon CloudWatch Logs stores log data but does not natively capture API calls; it can ingest logs from other sources.

Option D is incorrect because AWS Config tracks configuration changes to AWS resources, not API calls.

Full explanation →
38
MCQmedium

A data engineer needs to ingest data from an on-premises Apache Kafka cluster into Amazon S3. The data volume is about 10 TB per day. The engineer wants to set up a managed Kafka connector. Which AWS service should they use?

A.AWS Database Migration Service
B.AWS Lambda with Kafka trigger
C.Amazon MSK Connect
D.Amazon Kinesis Data Streams
AnswerC

MSK Connect runs Kafka Connect workers, including S3 sink connectors.

Why this answer

Amazon MSK Connect is a managed Kafka connector service that integrates with Amazon MSK or self-managed Apache Kafka clusters to stream data into Amazon S3 using Kafka Connect. It handles the 10 TB/day volume efficiently with auto-scaling and checkpointing, making it the correct choice for a managed connector setup.

Exam trap

The trap here is that candidates confuse Amazon MSK Connect with Amazon Kinesis Data Streams, thinking both are streaming services, but MSK Connect is specifically a managed Kafka connector service for Kafka-to-S3 ingestion, while Kinesis is a separate streaming platform.

How to eliminate wrong answers

Option A is wrong because AWS Database Migration Service (DMS) is designed for database migrations and continuous replication, not for ingesting data from Kafka into S3. Option B is wrong because AWS Lambda with Kafka trigger is event-driven and not suitable for high-volume, continuous streaming of 10 TB/day due to concurrency limits and lack of managed checkpointing for large-scale Kafka ingestion. Option D is wrong because Amazon Kinesis Data Streams is a separate streaming service, not a managed Kafka connector; it cannot directly connect to an on-premises Kafka cluster as a connector.

Full explanation →
39
MCQhard

A company is building a data lake on S3 and needs to ingest data from on-premises Oracle database. The data is 5 TB and changes incrementally. The ingestion must capture changes in near real-time (less than 1 minute latency) and be cost-effective. Which approach should be used?

A.Use AWS Database Migration Service (DMS) with ongoing replication to S3
B.Use Amazon Kinesis Data Firehose with an Oracle JDBC connector
C.Use AWS Glue to perform a full table export daily
D.Use AWS DataSync to sync the Oracle data files to S3
AnswerA

DMS supports CDC and can replicate changes to S3 with low latency.

Why this answer

AWS DMS with ongoing replication captures incremental changes from Oracle using its native change data capture (CDC) mechanism, such as Oracle LogMiner or binary logs, and streams them to S3 in near real-time with latency under 1 minute. This approach is cost-effective because DMS charges only for the compute resources used during replication, and S3 storage is inexpensive, making it ideal for a 5 TB dataset with continuous changes.

Exam trap

The trap here is that candidates often confuse Kinesis Data Firehose's ability to accept data from custom sources with native JDBC support, leading them to choose Option B, but Firehose lacks built-in CDC connectors for relational databases like Oracle.

How to eliminate wrong answers

Option B is wrong because Amazon Kinesis Data Firehose does not natively support a JDBC connector for Oracle; it ingests data from sources like Kinesis Data Streams, AWS IoT, or custom HTTP endpoints, and using a JDBC connector would require custom code and add complexity without guaranteeing sub-minute latency for CDC. Option C is wrong because AWS Glue performing a full table export daily cannot meet the near real-time requirement of less than 1 minute latency; it is a batch-oriented service designed for periodic ETL jobs, not continuous change capture. Option D is wrong because AWS DataSync is designed for one-time or scheduled bulk data transfers of files or objects, not for capturing incremental database changes from Oracle; it syncs data at the file level, not the row-level CDC needed for a database.

Full explanation →
40
MCQmedium

A data engineer is managing an Amazon Redshift cluster used for analytics. The cluster has a single node of type dc2.large. The engineer notices that queries are slowing down as data volume grows. The cluster's disk space is at 70% usage. The engineer needs to improve query performance and accommodate future growth. The budget allows for moderate cost increase. Which action should the engineer take?

A.Add another dc2.large node to the cluster.
B.Resize the cluster to a single ds2.xlarge node.
C.Migrate the cluster to a single ra3.xlplus node with managed storage.
D.Enable concurrency scaling and maintain the current cluster.
AnswerA

Adding nodes increases both compute and storage capacity for better performance.

Why this answer

The dc2.large node is a dense compute node with limited storage. Adding another dc2.large node (option A) increases both compute capacity and storage, which directly addresses the slowdown and provides room for growth at a moderate cost. Option B (resizing to a single ds2.xlarge node) increases storage but may not improve compute performance proportionally, as ds2 nodes are dense storage.

Option C (single ra3.xlplus with managed storage) separates compute and storage but still has a single compute endpoint, and the cost is higher. Option D (concurrency scaling) adds cost without resolving the single-node bottleneck. Therefore, option A is the best choice.

Full explanation →
41
MCQmedium

A data engineer is troubleshooting a nightly ETL job that extracts data from an Amazon RDS MySQL instance and loads it into an Amazon S3 bucket in Parquet format. The job runs on an Amazon EMR cluster and has been failing with the error 'Access Denied' when writing to S3. The IAM role attached to the EMR cluster has permissions for S3 PutObject. What is the MOST likely cause?

A.The S3 bucket uses SSE-KMS encryption and the EMR role lacks kms:GenerateDataKey permission.
B.The S3 bucket has a Lifecycle rule that expires objects too quickly.
C.The EMR cluster was terminated before the write operation completed.
D.The S3 bucket policy denies access to the EMR cluster's IAM role.
AnswerD

S3 bucket policies can explicitly deny access, overriding IAM allow.

Why this answer

S3 bucket policies can override IAM permissions; if the bucket policy denies access from the EMR cluster, the write will fail even with IAM allow. Option A is wrong because KMS permissions are needed only if the bucket uses SSE-KMS, which is not indicated. Option B is wrong because S3 Lifecycle rules do not affect write permissions.

Option C is wrong because EMR cluster termination would cause a different error.

Full explanation →
42
MCQmedium

A company ingests JSON logs into Amazon S3 using Kinesis Data Firehose. The logs contain a timestamp field, but the delivery to S3 is delayed by up to 15 minutes during peak hours. The business requires near-real-time availability (under 2 minutes). Which configuration change should the data engineer make?

A.Increase the number of shards in the Kinesis Data Firehose stream
B.Increase the buffer size to 128 MB
C.Decrease the buffer interval to 60 seconds
D.Enable buffering hints in the Firehose delivery stream
AnswerC

Shorter buffer interval reduces delivery latency.

Why this answer

Decreasing the buffer interval to 60 seconds forces Kinesis Data Firehose to deliver data to S3 more frequently, reducing the maximum delivery latency to under 2 minutes. The default buffer interval is 300 seconds (5 minutes), and by lowering it to 60 seconds, you ensure that data is flushed to S3 within one minute of ingestion, meeting the near-real-time requirement even during peak hours when buffering might otherwise delay delivery.

Exam trap

The trap here is that candidates confuse Kinesis Data Firehose with Kinesis Data Streams and incorrectly think that increasing shards (a Data Streams concept) will reduce latency, when in fact Firehose's latency is controlled solely by buffer size and buffer interval parameters.

How to eliminate wrong answers

Option A is wrong because increasing the number of shards applies to Kinesis Data Streams, not to Kinesis Data Firehose, which uses a delivery stream abstraction and does not have shards; shard management is irrelevant to Firehose's buffering behavior. Option B is wrong because increasing the buffer size to 128 MB would actually increase the amount of data held before delivery, potentially worsening latency rather than reducing it, as Firehose waits to fill the buffer before flushing. Option D is wrong because 'buffering hints' is not a valid configuration in Kinesis Data Firehose; the correct parameters are buffer size and buffer interval, and enabling hints does not exist as a feature.

Full explanation →
43
MCQmedium

A data engineer notices that an Amazon Redshift cluster is experiencing slow query performance. The engineer suspects that tables are not properly sorted. Which diagnostic query should the engineer run to identify unsorted rows?

A.SELECT * FROM SVV_TABLE_INFO ORDER BY unsorted DESC;
B.SELECT * FROM PG_CATALOG;
C.SELECT * FROM STV_TBL_PERM;
D.SELECT * FROM STL_LOAD_ERRORS;
AnswerA

SVV_TABLE_INFO shows unsorted rows for each table.

Why this answer

The `SVV_TABLE_INFO` system view in Amazon Redshift provides metadata about each table, including the `unsorted` column which shows the percentage of unsorted rows. By ordering by `unsorted DESC`, the engineer can quickly identify tables with the highest proportion of unsorted data, which directly impacts query performance due to inefficient zone maps and scan pruning.

Exam trap

The trap here is that candidates may confuse `SVV_TABLE_INFO` with `STV_TBL_PERM` (which shows block counts) or `STL_LOAD_ERRORS` (which is for load debugging), missing that only `SVV_TABLE_INFO` exposes the `unsorted` column specifically designed for sort health analysis.

How to eliminate wrong answers

Option B is wrong because `PG_CATALOG` is a system schema containing PostgreSQL catalog tables (e.g., `pg_class`, `pg_attribute`), not a diagnostic view for unsorted rows; it lacks the `unsorted` metric. Option C is wrong because `STV_TBL_PERM` provides block-level storage information (e.g., number of blocks per slice) but does not include a column for unsorted row percentage. Option D is wrong because `STL_LOAD_ERRORS` logs errors from COPY and INSERT operations, such as data type mismatches or malformed CSV rows, and has no relevance to sort key efficiency.

Full explanation →
44
MCQeasy

A company uses Amazon DynamoDB for a gaming application. They need to store player session data that expires after 24 hours. Which DynamoDB feature should they use to automatically delete expired items?

A.Time to Live (TTL)
B.DynamoDB auto scaling
C.DynamoDB Streams
D.Point-in-time recovery
AnswerA

TTL automatically deletes expired items based on a timestamp attribute.

Why this answer

DynamoDB Time to Live (TTL) is the correct feature because it allows you to define a per-item timestamp attribute (e.g., `expireAt`) that DynamoDB automatically deletes once that timestamp is reached. This is ideal for expiring session data after 24 hours without requiring custom code or scheduled jobs to scan and delete items, reducing cost and operational overhead.

Exam trap

The trap here is that candidates may confuse TTL with DynamoDB Streams, thinking streams can automatically delete items, but streams only notify of changes and require separate logic to perform deletions.

How to eliminate wrong answers

Option B (DynamoDB auto scaling) is wrong because it manages throughput capacity (read/write units) based on traffic, not item expiration or deletion. Option C (DynamoDB Streams) is wrong because it captures item-level changes (inserts, updates, deletes) in near real-time for downstream processing, but does not automatically delete items. Option D (Point-in-time recovery) is wrong because it provides continuous backups to restore a table to any point within the last 35 days, but does not handle automatic deletion of expired data.

Full explanation →
45
Multi-Selecteasy

A data engineer needs to ingest data from a SaaS application that sends webhooks in JSON format. The data must be stored in S3 for batch analysis. Which AWS services can receive the webhooks and store the data in S3 with minimal custom code? (Choose TWO.)

Select 2 answers
A.AWS Lambda with S3 SDK
B.AWS Glue with a Python shell job
C.Amazon Kinesis Data Streams
D.Amazon API Gateway with S3 integration
E.Amazon API Gateway with Kinesis Data Firehose integration
AnswersD, E

API Gateway can directly write to S3.

Why this answer

Amazon API Gateway with S3 integration (Option D) allows you to create a REST API that directly writes incoming webhook payloads to an S3 bucket without any custom code, using a proxy integration with an AWS service. This minimizes custom code because the integration handles the mapping and storage automatically.

Exam trap

The trap here is that candidates often assume Lambda is the only serverless option for webhook ingestion, overlooking API Gateway's direct S3 integration, or they mistakenly think Kinesis Data Streams can directly receive HTTP requests without a custom producer.

Full explanation →
46
MCQhard

A company is using Amazon Redshift for data warehousing. The data engineer notices that the STL_ALERT_EVENT_LOG table shows many 'missing statistics' alerts. What is the best course of action to address this issue?

A.Increase the WLM concurrency slots.
B.Run VACUUM on the tables.
C.Enable compression on the tables.
D.Run ANALYZE on the tables.
AnswerD

ANALYZE updates table statistics, resolving missing statistics alerts.

Why this answer

The STL_ALERT_EVENT_LOG table records alerts about query performance issues, including 'missing statistics' alerts. This indicates that the query optimizer lacks up-to-date table statistics, leading to suboptimal query plans. Running the ANALYZE command updates table statistics, enabling the optimizer to generate efficient execution plans.

Therefore, option D is the correct course of action.

Exam trap

The trap here is that candidates often confuse VACUUM (which reorganizes data) with ANALYZE (which updates statistics), assuming both are needed for query performance, but only ANALYZE directly resolves 'missing statistics' alerts.

How to eliminate wrong answers

Option A is wrong because increasing WLM concurrency slots does not address missing statistics; it only allows more queries to run simultaneously, which could worsen performance if statistics are outdated. Option B is wrong because VACUUM reclaims disk space and sorts rows but does not update table statistics; it is used for managing data storage, not query optimization. Option C is wrong because enabling compression reduces storage and I/O but does not provide the optimizer with the statistical metadata needed for efficient query planning.

Full explanation →
47
Multi-Selecthard

A data engineer is designing a data transformation pipeline using AWS Glue. The source data is in Amazon S3 in Parquet format, and the transformed output must be written to another S3 bucket in Parquet format partitioned by year, month, day. The pipeline should handle incremental updates efficiently. Which three features should the engineer use? (Choose THREE.)

Select 3 answers
A.AWS Glue job bookmarks to track processed data
B.Use AWS Glue JobWatch for monitoring job progress
C.Use DynamicFrames instead of Spark DataFrames for schema handling
D.Enable partition pruning in the Glue job
E.Use Spark SQL for transformations
AnswersA, C, D

Enables incremental processing.

Why this answer

AWS Glue job bookmarks track processed data by recording the state of previously processed files and partitions, enabling incremental processing of new or changed data in subsequent runs. This is essential for efficiently handling incremental updates without reprocessing the entire dataset.

Exam trap

The trap here is that candidates may confuse general-purpose tools like Spark SQL or monitoring concepts with the specific AWS Glue features designed for incremental processing and partitioning, leading them to select options that are technically possible but not the three required features.

Full explanation →
48
MCQmedium

A company is using Amazon RDS for MySQL and needs to reduce read latency for a global user base. Which AWS feature should be implemented?

A.Multi-AZ deployment
B.Aurora Auto Scaling
C.Read Replicas
D.Cross-Region Replication
AnswerC

Read Replicas allow offloading read queries to reduce latency.

Why this answer

Amazon RDS Read Replicas allow you to offload read traffic from the primary DB instance to one or more read-only copies, which can be placed in different AWS Regions to reduce read latency for a global user base. Unlike Multi-AZ, which is designed for high availability, Read Replicas directly address read performance and latency by distributing read queries closer to users. Cross-Region Replication for RDS MySQL is achieved through Read Replicas, making option C the correct choice for reducing read latency globally.

Exam trap

The trap here is that candidates often confuse Multi-AZ (high availability) with Read Replicas (read scaling), or they assume Cross-Region Replication is a separate feature when it is actually implemented via Read Replicas in RDS MySQL.

How to eliminate wrong answers

Option A is wrong because Multi-AZ deployment provides high availability and automatic failover by maintaining a standby replica in a different Availability Zone, but it does not offload read traffic or reduce read latency for a global user base. Option B is wrong because Aurora Auto Scaling automatically adjusts the number of Aurora Replicas based on workload, but it is a feature of Amazon Aurora, not Amazon RDS for MySQL, and the question specifies RDS for MySQL. Option D is wrong because Cross-Region Replication is not a standalone feature for RDS MySQL; it is implemented using Read Replicas in a different region, so it is a subset of the correct answer, not a separate feature.

Full explanation →
49
MCQhard

A company stores sensitive data in S3 and uses VPC Endpoints to restrict access. They want to ensure that data can only be accessed from their VPC. What configuration is required?

A.Configure VPC Flow Logs to monitor access
B.Add a bucket policy condition aws:SourceVpce
C.Enable S3 Block Public Access
D.Associate a security group with the S3 bucket
AnswerB

This condition restricts access to requests originating from the specified VPC endpoint.

Why this answer

To restrict S3 bucket access to a specific VPC, use a bucket policy with the aws:SourceVpce condition key to specify the VPC endpoint ID. Option A (VPC Flow Logs) logs traffic but does not restrict access. Option B is correct.

Option C (S3 Block Public Access) prevents public access but does not limit access to a specific VPC. Option D (security groups) are used for EC2 instances, not S3 buckets.

Full explanation →
50
MCQmedium

A company stores sensitive customer data in an Amazon S3 bucket. The security team requires that all data be encrypted at rest using a key that is automatically rotated every year. Which encryption solution should the data engineer use?

A.SSE-S3
B.SSE-KMS with a customer managed key
C.SSE-C
D.Client-side encryption
AnswerB

KMS can automatically rotate customer managed keys annually.

Why this answer

SSE-KMS with a customer managed key is correct because it allows you to use an AWS KMS key that you control, enabling automatic annual key rotation via the KMS key rotation feature. This satisfies the security team's requirement for encryption at rest with a key that is automatically rotated every year, while maintaining control over the key lifecycle.

Exam trap

The trap here is that candidates often confuse SSE-S3's automatic rotation (which is managed by AWS and not customer-controlled) with the requirement for a customer-managed key, leading them to incorrectly select SSE-S3 thinking it meets the automatic rotation need.

How to eliminate wrong answers

Option A is wrong because SSE-S3 uses Amazon S3-managed keys that are automatically rotated by AWS, but you cannot control the rotation schedule or manage the key yourself, failing the requirement for a customer-controlled key. Option C is wrong because SSE-C requires you to manage and provide your own encryption keys, and AWS does not support automatic rotation of SSE-C keys; you must rotate them manually. Option D is wrong because client-side encryption encrypts data before it is sent to S3, and key rotation is entirely your responsibility, not managed by AWS, so it does not meet the automatic rotation requirement.

Full explanation →
51
Multi-Selecteasy

A company uses AWS Glue to catalog and transform data in Amazon S3. The Glue ETL jobs are failing intermittently with 'ThrottlingException' errors. Which THREE actions can help mitigate this issue? (Select THREE.)

Select 3 answers
A.Implement exponential backoff and retry in the Glue job code.
B.Increase the number of DPUs for the Glue job.
C.Request a service quota increase for the Glue API.
D.Enable job bookmarking to avoid reprocessing old data.
E.Switch from PySpark to Spark SQL.
AnswersA, C, D

Exponential backoff retries throttled requests, reducing failure impact.

Why this answer

Options A, C, and D are correct. Implementing exponential backoff and retry (A) handles transient ThrottlingException errors by pacing retries. Requesting a service quota increase for the Glue API (C) raises the maximum allowed requests per second.

Enabling job bookmarking (D) reduces the amount of data reprocessed, thereby lowering the number of API calls made to Glue. Option B (increasing DPUs) improves job performance but does not directly address API throttling. Option E (switching to Spark SQL) does not change the underlying API call frequency.

Full explanation →
52
MCQmedium

A company uses AWS Glue crawlers to populate the Data Catalog from data in Amazon S3. The crawler fails to update the schema when new columns are added to the CSV files. What is the most likely cause?

A.The S3 bucket has versioning enabled.
B.The crawler is configured to only crawl new partitions.
C.The IAM role for the crawler lacks permissions to read the new columns.
D.The crawler uses a custom classifier that defines a fixed schema.
AnswerD

Custom classifiers can override schema inference.

Why this answer

When a crawler uses a custom classifier that defines a fixed schema, it will not recognize new columns added to the CSV files because the custom classifier overrides the schema inference. Option A is incorrect because S3 bucket versioning does not affect crawler schema updates. Option B is incorrect because the crawler configuration to crawl new partitions does not prevent schema updates; it only affects which partitions are crawled.

Option C is incorrect because the IAM role would cause permissions errors, not a failure to update schema due to new columns.

Full explanation →
53
MCQmedium

A company runs a multi-AZ Amazon RDS for PostgreSQL instance. They need to run a one-time analytical query that will take several hours and consume significant I/O. The query should not impact the primary workload. What should the data engineer do?

A.Create a read replica of the RDS instance and run the query on the replica.
B.Run the query directly on the primary instance during off-peak hours.
C.Increase the instance size to handle the load.
D.Enable Multi-AZ and run the query on the standby instance.
AnswerA

Read replica offloads read traffic from the primary.

Why this answer

Creating a read replica of the RDS for PostgreSQL instance allows the analytical query to run on a separate database engine without affecting the primary workload. Read replicas in Amazon RDS use asynchronous replication from the source instance, so the replica can handle heavy I/O and long-running queries independently. This ensures the primary instance remains available for the production workload without performance degradation.

Exam trap

The trap here is that candidates often confuse the Multi-AZ standby instance with a read replica, assuming the standby can be used for queries, but in Amazon RDS, the standby is only for high availability and is not accessible for read operations.

How to eliminate wrong answers

Option B is wrong because running the query directly on the primary instance, even during off-peak hours, still consumes significant I/O and CPU resources on that instance, which can impact the primary workload and potentially cause performance issues or increased latency. Option C is wrong because increasing the instance size only adds more resources to the same single instance; the analytical query would still compete with the primary workload for I/O and memory, and scaling up does not isolate the workload. Option D is wrong because the standby instance in a Multi-AZ deployment is not directly accessible for read or write operations; it is a synchronous replica used only for automatic failover, and Amazon RDS does not allow connecting to the standby for queries.

Full explanation →
54
MCQeasy

A data engineer is tasked with ingesting on-premises database snapshots (full load) into Amazon S3 on a daily basis. The database is PostgreSQL and the snapshot size is 50 GB. The network link is 1 Gbps. Which approach is the MOST time-efficient and cost-effective?

A.Use AWS Database Migration Service (DMS) with S3 as target.
B.Use AWS Snowball Edge to transfer the snapshot.
C.Use AWS CLI to copy the snapshot file directly to S3.
D.Write a Lambda function to run pg_dump and upload to S3.
AnswerA

DMS can perform full loads from on-premises PostgreSQL to S3 in a managed and scalable way.

Why this answer

AWS Database Migration Service (DMS) is a managed service that efficiently performs full loads from on-premises PostgreSQL to Amazon S3, handling schema conversion and data transfer automatically. For a 50 GB snapshot over a 1 Gbps link, the transfer takes approximately 7 minutes, making Snowball (Option B) overkill and more expensive. Option C (AWS CLI) would require manual steps and is less efficient for database snapshots.

Option D (Lambda + pg_dump) adds unnecessary complexity and potential performance issues. Therefore, DMS is the most time-efficient and cost-effective approach.

Full explanation →
55
MCQhard

A data engineer is designing a multi-region disaster recovery plan for an Amazon DynamoDB table. The table stores critical user profile data and must have a Recovery Point Objective (RPO) of less than 1 minute and a Recovery Time Objective (RTO) of less than 5 minutes. Which solution meets these requirements?

A.Configure DynamoDB Streams and a Lambda function to replicate data to another region.
B.Use DynamoDB on-demand backup and restore to another region.
C.Use DynamoDB global tables to replicate data to another region.
D.Enable point-in-time recovery (PITR) and restore to another region.
AnswerC

Global tables provide near-real-time replication and fast failover.

Why this answer

DynamoDB global tables provide active-active multi-region replication with sub-second latency, ensuring that data written in one region is automatically replicated to other regions within seconds. This meets the RPO of less than 1 minute and RTO of less than 5 minutes because the table is already available in the secondary region for immediate reads and writes, with no manual restore or failover steps required.

Exam trap

The trap here is that candidates confuse point-in-time recovery (PITR) or on-demand backups with multi-region replication, not realizing that restore operations are manual and time-consuming, whereas global tables provide automatic, near-real-time replication.

How to eliminate wrong answers

Option A is wrong because DynamoDB Streams with a Lambda function introduces asynchronous replication that can have variable latency and potential data loss if the Lambda fails or is throttled, making it unreliable for a sub-1-minute RPO. Option B is wrong because on-demand backup and restore is a manual process that takes minutes to hours to complete, far exceeding the 5-minute RTO and 1-minute RPO. Option D is wrong because point-in-time recovery (PITR) only allows restoring to a point within the last 35 days in the same region, and restoring to another region requires exporting and re-importing data, which cannot achieve sub-5-minute RTO.

Full explanation →
56
Multi-Selecteasy

A data engineer is building a data ingestion pipeline that uses AWS Lambda to process records from Amazon Kinesis Data Streams. The Lambda function writes the processed data to Amazon DynamoDB. Which TWO factors affect the maximum number of concurrent Lambda executions for this stream? (Choose TWO.)

Select 2 answers
A.DynamoDB table's read capacity units
B.Lambda function's memory allocation
C.Kinesis stream name
D.Batch size configured for the Lambda event source mapping
E.Number of shards in the Kinesis stream
AnswersD, E

Batch size determines how many records are sent per invocation, affecting concurrency.

Why this answer

Correct options: D and E. The maximum number of concurrent Lambda executions for processing a Kinesis stream is determined by the number of shards in the stream, because each shard can have at most one concurrent Lambda invocation processing records from that shard. The batch size configured for the Lambda event source mapping also affects concurrency: a smaller batch size can lead to more invocations per shard over time, as each shard processes batches sequentially.

Options A (DynamoDB read capacity units) and B (Lambda memory allocation) do not directly limit concurrency from the stream. Option C (stream name) is just an identifier and has no effect on concurrency.

Full explanation →
57
MCQeasy

A data engineer needs to transform JSON data from an S3 bucket using AWS Glue. The JSON contains nested arrays and objects. Which Glue transform is best suited for flattening nested structures?

A.Unnest
B.ResolveChoice
C.Relationalize
D.Map
AnswerC

Relationalize flattens nested structures into separate DynamicFrames.

Why this answer

The Relationalize transform is specifically designed to flatten nested JSON structures (arrays and objects) into a set of related tables, making it ideal for this use case. It automatically handles complex nesting by creating separate DataFrames for each nested level and linking them via foreign keys, which is exactly what is needed when ingesting JSON with nested arrays and objects into a relational format.

Exam trap

The trap here is that candidates often confuse the generic Spark SQL function `explode` (or the concept of 'unnesting') with a named AWS Glue transform, leading them to select 'Unnest' even though it does not exist as a Glue transform and would require manual handling of multiple nesting levels.

How to eliminate wrong answers

Option A (Unnest) is wrong because AWS Glue does not have a built-in transform named 'Unnest'; this is a Spark SQL function (e.g., `explode`) but not a named Glue transform, and it would require manual handling of multiple nesting levels. Option B (ResolveChoice) is wrong because it is used to resolve schema ambiguities (e.g., when a column has mixed types like string and int) and does not flatten nested structures. Option D (Map) is wrong because it applies a function to each record in a DynamicFrame for row-wise transformations, but it does not inherently flatten nested arrays or objects—you would need to write custom logic to handle the nesting.

Full explanation →
58
MCQmedium

A data engineer runs the describe-table command shown in the exhibit. The application frequently queries by CustomerID alone. Currently, these queries result in full table scans. Which action should the engineer take to improve query performance?

A.Change the sort key to OrderID
B.Create a local secondary index on CustomerID
C.Increase the read capacity units to 500
D.Create a global secondary index on CustomerID
AnswerD

A GSI allows efficient queries on CustomerID.

Why this answer

The `describe-table` output shows CustomerID is the partition key, but the application frequently queries by CustomerID alone, which currently causes full table scans because there is no index supporting that query pattern. Creating a global secondary index (GSI) on CustomerID allows efficient querying by CustomerID without scanning the entire table, as the GSI provides a separate data structure with its own read/write capacity that can be queried directly.

Exam trap

AWS often tests the misconception that increasing capacity (RCUs/WCUs) can fix query performance issues, but the trap here is that throughput and indexing are separate concerns — full table scans are a design problem, not a capacity problem.

How to eliminate wrong answers

Option A is wrong because changing the sort key to OrderID would not help queries by CustomerID alone, as the sort key is used for sorting within a partition, not for filtering by a different attribute. Option B is wrong because DynamoDB does not support local secondary indexes (LSIs) on the partition key; LSIs can only be created on a different sort key within the same partition key, and CustomerID is already the partition key, so an LSI on CustomerID is invalid. Option C is wrong because increasing read capacity units only increases throughput, not query efficiency; full table scans still occur regardless of capacity, and the issue is the lack of an index, not insufficient capacity.

Full explanation →
59
Multi-Selecthard

A company uses AWS KMS to encrypt data in multiple services. They want to ensure that only specific IAM roles can decrypt data using a particular KMS key. Which TWO steps are necessary?

Select 2 answers
A.Attach an IAM policy to each role with kms:Decrypt permission
B.Enable IAM policies in the key policy
C.Enable automatic key rotation
D.Ensure the key policy allows kms:GenerateDataKey for the roles
E.Add a statement to the KMS key policy allowing kms:Decrypt for the IAM roles
AnswersA, E

Correct. The IAM policy attached to the role must include kms:Decrypt to allow the role to decrypt using the key.

Why this answer

To allow specific IAM roles to decrypt data using a KMS key, two steps are required. First, each role must have an IAM policy that grants the kms:Decrypt permission (A). Second, the KMS key policy must include a statement that allows the IAM roles to perform kms:Decrypt (E).

The permission kms:GenerateDataKey (D) is not needed for decryption-only access; it is used for generating data keys during encryption. Options B (enabling IAM policies in key policy) and C (automatic key rotation) are unrelated to access control for decryption.

Full explanation →
60
Multi-Selecthard

A company runs a production Amazon RDS for PostgreSQL database. The database is experiencing performance degradation due to a high number of concurrent read queries. The data engineer needs to improve read performance without significantly increasing costs. Which TWO actions should the engineer take? (Choose TWO.)

Select 2 answers
A.Create one or more read replicas in the same region.
B.Enable Multi-AZ deployment for automatic failover.
C.Increase the allocated storage size to improve IOPS.
D.Enable Performance Insights to identify slow queries.
E.Delete unnecessary indexes to reduce write overhead.
AnswersA, D

Read replicas handle read traffic, reducing load on the primary.

Why this answer

Creating one or more read replicas in the same region offloads read traffic from the primary DB instance, directly addressing the high number of concurrent read queries. Read replicas are asynchronous copies that can serve SELECT traffic, improving read throughput without increasing the cost of the primary instance. This is a cost-effective scaling strategy because you pay only for the replica instances and can choose smaller instance sizes if read workloads are bursty.

Exam trap

The trap here is that candidates often confuse Multi-AZ with read replicas, assuming the standby can serve reads, or they think increasing storage automatically improves IOPS and read performance without considering cost or the actual bottleneck.

Full explanation →
61
MCQhard

A data engineer is setting up an Amazon S3 bucket for storing sensitive financial data. The compliance team requires that all data be encrypted at rest using a customer-managed AWS KMS key. Additionally, the bucket must block public access. Which combination of settings should the engineer configure?

A.Enable default encryption with AWS-KMS and a customer managed key. Enable block public access settings.
B.Use S3 Object Ownership to enforce bucket owner enforced. Enable block public access.
C.Use S3 Bucket Keys to reduce KMS costs. Enable block public access.
D.Create a bucket policy that denies PutObject without encryption. Enable block public access.
AnswerA

This ensures all objects are encrypted with the specified KMS key and public access is blocked.

Why this answer

Enabling default encryption with AWS-KMS using a customer-managed key ensures that all objects uploaded to the S3 bucket are automatically encrypted at rest with the required key type. Additionally, enabling block public access settings prevents any public access to the bucket, satisfying the compliance team's requirements.

Exam trap

The trap here is that candidates may think a bucket policy denying unencrypted uploads is sufficient, but it does not enforce the use of a customer-managed KMS key, nor does it automatically encrypt objects that lack encryption headers.

How to eliminate wrong answers

Option B is wrong because S3 Object Ownership with bucket owner enforced controls object ownership and ACLs, but does not enforce encryption at rest with a customer-managed KMS key. Option C is wrong because S3 Bucket Keys reduce KMS request costs by using a bucket-level key, but they do not enforce encryption with a customer-managed key or block public access. Option D is wrong because a bucket policy that denies PutObject without encryption can enforce encryption, but it does not guarantee that the encryption uses a customer-managed KMS key; it could allow SSE-S3 or SSE-KMS with an AWS-managed key, and it does not configure default encryption.

Full explanation →
62
MCQmedium

A data engineer is troubleshooting an issue where an AWS Glue ETL job fails when trying to read data from an S3 bucket encrypted with SSE-KMS. The job has an IAM role that includes `kms:Decrypt` permission. What is the most likely reason for the failure?

A.The IAM role does not have s3:GetObject permission
B.The KMS key policy does not allow the Glue job to use the key
C.The S3 bucket is in a different AWS region than the Glue job
D.The Glue job is not configured to use the KMS key for decryption
AnswerB

Correct. The most likely cause is that the KMS key policy does not grant the Glue job's IAM role permission to use the key. Even with kms:Decrypt in the role, the key policy must allow it.

Why this answer

The most likely reason for the failure, even with kms:Decrypt permission in the IAM role, is that the KMS key policy explicitly denies the Glue job's IAM role access to the key. AWS Glue ETL jobs can read SSE-KMS encrypted S3 objects without additional configuration; the job's IAM role must be allowed by the key policy. Option A is incorrect because the IAM role likely has s3:GetObject permission.

Option C is incorrect because cross-region S3 access is permitted with proper permissions. Option D is incorrect because Glue does not require explicit KMS key configuration for reading; the key is identified in the S3 object metadata, and the job's IAM role is trusted to use the key based on key policy.

Exam trap

Candidates often assume that kms:Decrypt on the IAM role is sufficient, but the KMS key policy is an additional layer that can deny access even when the role has the permission.

Full explanation →
63
MCQmedium

A company has an Amazon RDS for PostgreSQL DB instance with a large table that is frequently updated. The data engineer needs to reduce storage costs by archiving old records that are no longer accessed. The archived records must be retained for 7 years due to compliance requirements. Which solution is MOST cost-effective?

A.Use RDS native backup and restore to keep a separate backup.
B.Export old records using pg_dump and store in S3 Glacier Deep Archive.
C.Enable storage autoscaling on the RDS instance.
D.Move old records to a separate table in the same RDS instance.
AnswerB

This offloads old data to low-cost archival storage.

Why this answer

Exporting old records via pg_dump and storing them in S3 Glacier Deep Archive provides the lowest-cost storage for data that must be retained for 7 years but is never accessed. S3 Glacier Deep Archive offers retrieval times of 12–48 hours at a storage cost of approximately $0.00099/GB/month, far cheaper than any RDS storage tier. This approach removes the archived data from the RDS instance, reducing provisioned storage costs while meeting compliance requirements.

Exam trap

The trap here is that candidates confuse 'archiving' with 'backup' or 'storage autoscaling,' failing to recognize that only moving data out of the RDS instance to a low-cost storage class like S3 Glacier Deep Archive actually reduces ongoing storage costs.

How to eliminate wrong answers

Option A is wrong because RDS native backup and restore creates full or snapshot backups of the entire DB instance, not just the old records, and storing these backups for 7 years would incur high costs for redundant data and storage fees. Option C is wrong because enabling storage autoscaling only increases storage capacity when thresholds are reached, which does not reduce costs or archive old records—it merely prevents out-of-space errors. Option D is wrong because moving old records to a separate table in the same RDS instance does not reduce storage costs; the data still occupies the same provisioned storage, and the table remains part of the instance's billed capacity.

Full explanation →
64
MCQmedium

A gaming company ingests player event data from mobile games into Amazon Kinesis Data Streams. Each event is a small JSON payload (<1 KB). The data must be delivered to Amazon S3 for analytics, and the company wants to minimize storage costs by aggregating events into larger files (e.g., 100 MB per file). The current setup uses Kinesis Data Firehose with a buffer size of 10 MB and a buffer interval of 60 seconds, but the resulting files are very small (average 5 MB) because the data volume is low. The engineer needs to ensure that files are at least 100 MB to reduce the number of S3 objects and lower costs. What should the engineer do?

A.Use an AWS Glue streaming ETL job with a 100 MB file size threshold to write to S3.
B.Use an AWS Lambda function to buffer events in memory and write to S3 when buffer reaches 100 MB.
C.Increase the buffer size in Kinesis Data Firehose to 100 MB and increase the buffer interval to 300 seconds.
D.Use Amazon EMR with Spark Streaming to aggregate and write larger files to S3.
AnswerC

This allows Firehose to accumulate data until the buffer size or interval is reached, producing larger files.

Why this answer

Increase the buffer size in Kinesis Data Firehose to 100 MB and increase the buffer interval to 300 seconds. This allows more data to accumulate before writing to S3, resulting in larger files (≥100 MB) and reducing the number of S3 objects, thus lowering storage costs. Option B (Lambda) would require custom buffering logic and may encounter timeouts or memory limits.

Option A (Glue streaming ETL) adds latency and cost without directly controlling file size. Option D (EMR Spark Streaming) is overkill for this simple aggregation need.

Full explanation →
65
MCQeasy

Refer to the exhibit. A data engineer runs this CLI command to check an object's metadata. The engineer wants to verify if the object is eligible for lifecycle transition to S3 Glacier based on its age. What additional information is needed?

A.The current date
B.The ETag value
C.The metadata archive flag
D.The ContentLength value
AnswerA

The object age is based on LastModified and current date.

Why this answer

The CLI command output provides the last modified date of the object. To determine if the object is eligible for lifecycle transition to S3 Glacier based on its age, the engineer needs the current date to compute the object's age. The age is calculated as the difference between the current date and the last modified date.

Option A is correct because without the current date, the engineer cannot verify the age condition. Option B (ETag) is used for integrity checking and not for age calculations. Option C (metadata archive flag) is not relevant; the archive flag indicates storage class but not age.

Option D (ContentLength) is the object size and does not affect lifecycle age eligibility.

Full explanation →
66
MCQeasy

A company wants to use AWS Lake Formation to manage permissions on a data lake. What is the primary benefit of using Lake Formation for data security?

A.Automatically encrypts data at rest and in transit.
B.Replaces IAM for all data access policies.
C.Provides a unified view of data across all AWS regions.
D.Centralized fine-grained access control to data in S3, Redshift, and RDS.
AnswerD

Lake Formation provides column and row-level security.

Why this answer

AWS Lake Formation centralizes fine-grained access control for data lakes, allowing administrators to define column-level, row-level, and cell-level permissions on data stored in Amazon S3, and also extend those policies to Amazon Redshift and Amazon RDS via integrated resource links. This eliminates the need to manage separate IAM policies for each service, providing a single point of governance for data security across the data lake ecosystem.

Exam trap

The trap here is that candidates often assume Lake Formation replaces IAM entirely or handles encryption, but the exam tests the understanding that Lake Formation is a complementary governance layer for fine-grained access control, not a replacement for IAM or encryption services.

How to eliminate wrong answers

Option A is wrong because Lake Formation does not automatically encrypt data at rest or in transit; encryption is handled by the underlying services (e.g., S3 SSE, KMS, TLS) and must be configured separately. Option B is wrong because Lake Formation does not replace IAM; it works alongside IAM, with IAM still controlling authentication and service-level permissions while Lake Formation manages fine-grained data permissions. Option C is wrong because Lake Formation does not provide a unified view of data across all AWS regions; it operates within a single region and does not aggregate metadata or permissions globally.

Full explanation →
67
Multi-Selecteasy

A financial services company is ingesting real-time stock trade data into Amazon Kinesis Data Streams. The data is then processed by a Kinesis Data Analytics application for fraud detection. The company must ensure that the data is processed in the correct order for each stock symbol. Which TWO configuration steps should be taken? (Choose two.)

Select 2 answers
A.Use a random partition key to distribute the load evenly.
B.Increase the number of shards to reduce latency.
C.Use the stock symbol as the partition key when putting records into the stream.
D.Use AWS Lambda with DynamoDB Streams instead of Kinesis Data Analytics.
E.Configure the Kinesis Client Library (KCL) to process records in the order they arrive in each shard.
AnswersC, E

Partition key determines shard assignment; same symbol goes to same shard, preserving order.

Why this answer

To ensure data is processed in the correct order for each stock symbol, the partition key must group all records for the same symbol into the same shard. Using the stock symbol as the partition key (C) guarantees that all trades for a given symbol go to the same shard, preserving order within that shard. Additionally, the Kinesis Client Library (KCL) processes records within a shard in the order they arrive (E), so enabling this ensures ordered processing.

Options A and B are incorrect: a random partition key (A) would distribute records across shards, breaking order; increasing shards (B) does not affect ordering. Option D is wrong because DynamoDB Streams is for change data capture, not for real-time streaming order.

Full explanation →
68
MCQhard

A company runs a streaming application on Amazon EC2 instances that writes data to an Amazon DynamoDB table (us-east-1). The data is later consumed by a reporting job that runs every hour. Recently, the reporting job has been failing with ProvisionedThroughputExceededException errors during peak hours. The DynamoDB table uses provisioned capacity with 1000 read capacity units (RCU) and 500 write capacity units (WCU). The reporting job performs scans and reads using eventually consistent reads. The application's write traffic is steady, but the reporting job's reads spike at the top of the hour. The data engineer needs to resolve the throughput exceptions without affecting the application's writes. Which solution should the data engineer implement?

A.Create a global secondary index (GSI) with enough RCU for the reporting job and have the job query the index instead of scanning the table.
B.Increase the table's RCU to 2000.
C.Create a read replica of the DynamoDB table in a different region.
D.Switch the table to on-demand capacity mode.
AnswerA

Correct. Adding a GSI with its own RCU allows the reporting job to read from the index without consuming the table's RCU, avoiding throttling and not affecting writes.

Why this answer

The reporting job is failing due to ProvisionedThroughputExceededException because it performs full table scans, consuming read capacity from the table's provisioned RCU. Since the write traffic is steady and must not be affected, increasing the table's RCU (Option B) is not ideal because it would also allow more reads, potentially impacting writes if capacity is shared. Switching to on-demand (Option D) would eliminate throttling but could significantly increase costs and does not provide dedicated read capacity for the reporting job.

A read replica (Option C) is not a native DynamoDB feature. Creating a global secondary index (GSI) with its own provisioned read capacity dedicated for the reporting job (Option A) offloads the read traffic from the main table, preventing interference with writes. The job can query the GSI with eventually consistent reads, effectively using the allocated RCU on the GSI without affecting the table's capacity.

Exam trap

The main trap is thinking that simply increasing the table's RCU or switching to on-demand is the best solution, without considering the impact on write performance or cost. A GSI with dedicated capacity isolates read workloads.

Full explanation →
69
MCQmedium

A company uses Amazon DynamoDB as a data store for a real-time dashboard application. The application performs point lookups and range queries on a table that has a partition key and sort key. The table uses on-demand capacity mode. Recently, the application's response time has increased, and CloudWatch metrics show high 'ThrottledRequests' for the table. The application uses the AWS SDK with default retry settings. The data access pattern is read-heavy with occasional spikes. What is the most effective way to reduce throttling?

A.Switch the table to provisioned capacity and set the read capacity units to a high value.
B.Enable DynamoDB Accelerator (DAX) to cache frequently read items.
C.Increase the read capacity units to a higher value.
D.Implement exponential backoff with jitter in the application code.
AnswerD

Retries with backoff reduce the rate of requests during throttling, allowing the table to recover.

Why this answer

DynamoDB on-demand mode can throttle requests when traffic exceeds the table's previous peak by more than double. Implementing exponential backoff with jitter in the application code allows retries to spread out and succeed without overwhelming the table. Option A is incorrect because switching to provisioned capacity requires accurate capacity planning and may still throttle during unexpected spikes.

Option B is incorrect because DAX caches frequently read items, reducing read load, but it does not directly address throttling caused by exceeding the table's throughput limits; it also adds cost and complexity. Option C is incorrect because increasing read capacity units applies only to provisioned capacity mode, not on-demand.

Full explanation →
70
MCQhard

A data pipeline uses AWS Glue to read from an Amazon S3 bucket containing millions of small CSV files (each < 1 MB). The ETL job is slow. Which optimization would most improve performance?

A.Write the ETL script using PySpark instead of Scala
B.Increase the number of Glue workers
C.Use the G.1X worker type for more memory
D.Use S3 file grouping to combine small files
AnswerD

Grouping small files reduces the number of partitions and improves Spark performance.

Why this answer

Using Amazon S3 file grouping or converting to columnar format like Parquet reduces the number of files and improves read performance. Increasing workers helps, but file consolidation is more impactful. Using G.1X worker type may help, but grouping files is key.

Using Spark SQL directly does not address the small files problem.

Full explanation →
71
MCQeasy

A company needs to ingest data from an on-premises Hadoop cluster into Amazon S3 for archival and analysis. The total data volume is 50 TB. The migration must be completed within one week. The on-premises network has a 1 Gbps connection to AWS. Which AWS service should be used?

A.AWS Transfer Family
B.AWS Snowball Edge
C.AWS Glue
D.AWS DataSync
AnswerB

Snowball can physically ship data for large transfers.

Why this answer

AWS Snowball Edge is the correct choice because it is designed for large-scale data transfers (50 TB) over slow or unreliable networks. With a 1 Gbps connection, transferring 50 TB would take approximately 5 days under ideal conditions, but real-world factors (e.g., network congestion, protocol overhead) make it risky to complete within one week. Snowball Edge physically ships the data, bypassing network constraints entirely.

Exam trap

The trap here is that candidates assume a 1 Gbps connection is fast enough for 50 TB in a week, ignoring real-world throughput limitations (e.g., TCP overhead, competing traffic) and the need for a guaranteed completion window, which makes Snowball Edge the safer choice.

How to eliminate wrong answers

Option A is wrong because AWS Transfer Family is used for managed file transfers over SFTP/FTPS/FTP, not for bulk data migration from Hadoop clusters; it would still be limited by the 1 Gbps network and would not complete 50 TB within a week. Option C is wrong because AWS Glue is a serverless ETL service for data preparation and cataloging, not a data transfer or migration tool; it cannot move 50 TB from on-premises to S3. Option D is wrong because AWS DataSync is optimized for online data transfer over the network, but with a 1 Gbps link, transferring 50 TB would take approximately 5 days under perfect conditions, leaving no margin for error or real-world overhead, making it unreliable for a one-week deadline.

Full explanation →
72
Multi-Selecthard

A data engineer is implementing a CDC (Change Data Capture) pipeline from a relational database to Amazon S3 using AWS Database Migration Service (DMS). Which TWO configurations are required for continuous replication?

Select 2 answers
A.Define transformation rules in the DMS task.
B.Enable binary logging on the source database.
C.Configure a VPC endpoint for DMS.
D.Enable 'Full load' and 'Ongoing replication' in the task.
E.Pre-create the target table in S3.
AnswersB, D

Binary logs are needed to capture changes for CDC.

Why this answer

For continuous CDC replication with AWS DMS, two key configurations are required: enabling binary logging on the source database (option B) and selecting both 'Full load' and 'Ongoing replication' in the DMS task (option D). Binary logging (e.g., binlog for MySQL) captures ongoing changes, while enabling both full load and ongoing replication ensures that the initial data load is completed before continuous change capture begins. Option A (transformation rules) is optional, not required.

Option C (VPC endpoint) is not necessary because DMS can connect to the source database over the internet, VPN, or VPC peering without a VPC endpoint. Option E (pre-creating the target table in S3) is not needed because DMS can create the target table automatically or you can let DMS handle the schema.

Full explanation →
73
MCQmedium

Refer to the exhibit. A Glue ETL job failed. What is the most likely cause?

A.Some source files have a different schema than others.
B.The job bookmarks are misconfigured.
C.The source data has inconsistent partitioning.
D.The job ran out of memory due to insufficient DPUs.
AnswerA

Directly matches the error.

Why this answer

The error 'Cannot merge incompatible schemas' indicates that some source files have a different schema than others, preventing the Glue ETL job from merging them. Option D is wrong because insufficient DPUs cause memory or performance errors, not schema conflicts. Option B is wrong because partition pruning is about filtering data, not schema mismatches.

Option C is wrong because job bookmarks track processed files to avoid reprocessing, not schema issues.

Full explanation →
74
MCQeasy

A data engineer needs to ensure that an Amazon Redshift cluster encrypts all data at rest. Which setting must be enabled when creating the cluster?

A.Enable automated snapshots
B.Enable encryption
C.Enable SSL/TLS
D.Enable VPC
AnswerB

Redshift supports encryption at rest.

Why this answer

Amazon Redshift encryption at rest is enabled during cluster creation by selecting the encryption option. Option A is incorrect because enabling automated snapshots is for backup and recovery, not encryption. Option C is incorrect because SSL/TLS ensures encryption in transit, not at rest.

Option D is incorrect because VPC is for network isolation, not encryption.

Full explanation →
75
MCQhard

A company is designing a data ingestion pipeline for real-time analytics. The source is a relational database, and the target is Amazon Redshift. The pipeline must handle schema changes in the source database automatically. Which combination of services should be used?

A.Amazon S3 and Amazon Athena
B.AWS DMS and AWS Glue
C.AWS Glue and Amazon Redshift COPY
D.Amazon Kinesis Data Streams and AWS Lambda
AnswerB

DMS captures changes, Glue can detect and apply schema changes.

Why this answer

AWS DMS (Database Migration Service) can capture ongoing changes from a relational database source using Change Data Capture (CDC) and replicate them to Amazon Redshift. AWS Glue can be used to handle schema evolution by crawling the source and updating the target schema, ensuring the pipeline adapts to schema changes automatically. Together, they provide a real-time ingestion pipeline with schema flexibility.

Exam trap

The trap here is that candidates often choose Kinesis and Lambda (Option D) because they associate 'real-time' with streaming, but they overlook that DMS is the native AWS service for CDC from relational databases, and Glue is required for schema evolution, not just any streaming service.

How to eliminate wrong answers

Option A is wrong because Amazon S3 and Amazon Athena are designed for querying data at rest, not for real-time ingestion or handling schema changes from a relational database to Redshift. Option C is wrong because AWS Glue and Amazon Redshift COPY are batch-oriented; COPY loads static files from S3 and does not support real-time CDC or automatic schema evolution from a live source. Option D is wrong because Amazon Kinesis Data Streams and AWS Lambda are suited for streaming data from applications or IoT devices, not for capturing CDC from a relational database, and Lambda would require custom code to manage schema changes and load into Redshift.

Full explanation →

Page 1 of 23

Page 2

All pages

1234567891011121314151617181920212223

Practice DEA-C01 by domain

Target a specific domain to shore up weak areas.

Data Ingestion and TransformationData Operations and SupportData Security and GovernanceData Store Management
See all domains with question counts →