AWS Certified Data Engineer Associate DEA-C01 DEA-C01 Questions 826–900 | Page 12/23

826

Matchingmedium

Match each AWS Glue component to its role.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Scans data sources and populates catalog

Central metadata repository

Transform and load data

Orchestrates multiple jobs and crawlers

Interactive development environment

Why these pairings

AWS Glue components work together for ETL. The Data Catalog stores metadata, Crawlers populate the catalog, Classifiers infer schema, and ETL Jobs execute transformations. Connections provide connectivity but are not listed here.

Full explanation →

827

MCQhard

A data engineer creates an IAM policy as shown in the exhibit. The engineer then attaches this policy to an IAM role used by an application that uploads objects to the S3 bucket 'my-bucket'. When the application uploads an object without specifying server-side encryption, what happens?

A.The object is uploaded with SSE-S3 encryption by default.

B.The upload fails with a 403 Access Denied error.

C.The object is uploaded without encryption.

D.The object is uploaded with SSE-C encryption.

AnswerB

The condition is not met, so the request is denied.

Why this answer

The IAM policy includes a condition that requires the `s3:x-amz-server-side-encryption` header to be present and set to `AES256`. If the application uploads an object without specifying server-side encryption, this condition is not met, so the request is denied with a 403 Access Denied error. Options A, C, and D are incorrect because the upload fails and the object is not stored at all.

Full explanation →

828

MCQmedium

A company uses AWS Glue to catalog data in Amazon S3. The data includes personally identifiable information (PII). The security team requires that PII be masked when queried by users who are not data owners. Which AWS service should be used to enforce this requirement?

A.Use Amazon Macie to automatically redact PII from S3 objects.

B.Use IAM policies with condition keys to restrict access based on tags.

C.Use AWS Lake Formation to define column-level security and data masking.

D.Use Amazon S3 Object Lambda to transform data on the fly.

AnswerC

Lake Formation provides column-level permissions and dynamic masking.

Why this answer

AWS Lake Formation provides fine-grained access control and column-level masking for data cataloged in the Glue Data Catalog, enabling PII masking at query time. Option A is wrong because Amazon Macie discovers and classifies PII but does not automatically redact data from S3 objects. Option B is wrong because IAM policies with condition keys can restrict access but cannot perform data masking.

Option D is wrong because Amazon S3 Object Lambda can transform data at the object level but not at the query level for dynamic masking.

Full explanation →

829

MCQhard

A data engineer is responsible for a data pipeline that uses Amazon S3 as a data lake, AWS Glue for ETL, and Amazon Athena for ad-hoc queries. The pipeline ingests CSV files from an external partner via SFTP into an S3 bucket. The files are then processed by a Glue job that converts them to Parquet and writes to a separate S3 bucket partitioned by date. The Glue job runs daily and is triggered by a scheduled CloudWatch Events rule. Recently, the data engineer noticed that some days the Glue job fails because of memory errors, and on those days the Athena queries that rely on the data return incomplete results. The engineer needs to ensure that the pipeline is resilient and that Athena queries always see a complete view of the data, even if the Glue job fails mid-run. The engineer also needs to minimize re-processing of data. Which course of action should the engineer take?

A.Increase the number of workers and the worker type to G.2X to handle the memory errors, and enable job retries.

B.Replace the Glue job with an AWS Lambda function that processes the CSV files and writes Parquet to S3, and use S3 Event Notifications to trigger the function.

C.Modify the Glue job to use job bookmarks for incremental processing and write the Parquet output to a temporary location, then use an S3 copy operation to move the data into the final partitioned location only after the job completes successfully.

D.Use Athena partition projection to automatically discover partitions and set up a retry mechanism using AWS Step Functions.

AnswerC

Bookmarks prevent reprocessing; atomic move ensures Athena sees complete data.

Why this answer

Using Glue job bookmarks enables incremental processing and the ability to resume from the last successful checkpoint. Staging the data in a temporary location and moving it atomically ensures that Athena sees only complete data, even if the job fails mid-run. Option A is wrong because increasing worker capacity does not prevent partial writes during failures.

Option B is wrong because using Lambda for conversion is less scalable and error-prone, and it still doesn't solve the atomicity issue. Option D is wrong because partition projection does not address the atomicity of writes after job failures.

Full explanation →

830

MCQmedium

A data engineer is troubleshooting a Kinesis Data Firehose delivery stream that is failing to deliver data to an Amazon S3 bucket. The stream is configured with a Lambda transformation function. The CloudWatch logs show that the Lambda function is timing out. Which action should the engineer take to resolve the issue?

A.Reduce the Firehose buffer interval.

B.Increase the Lambda function timeout setting.

C.Decrease the Lambda function's batch size in Firehose.

D.Increase the memory allocated to the Lambda function.

AnswerB

Extending timeout allows more time for processing.

Why this answer

The CloudWatch logs indicate the Lambda function is timing out. The default Lambda timeout for a Firehose transformation is 60 seconds, and if the function's processing exceeds this limit, it will fail. Increasing the Lambda function timeout setting (Option B) directly addresses this by allowing the function more time to complete its execution before being terminated.

Exam trap

The trap here is that candidates often confuse a Lambda timeout with a performance issue and immediately choose to increase memory (Option D) or reduce batch size (Option C), when the correct first step is to increase the timeout setting as indicated by the specific CloudWatch error.

How to eliminate wrong answers

Option A is wrong because reducing the Firehose buffer interval does not affect the Lambda function's execution time; it only causes Firehose to send smaller batches more frequently, which could increase the number of invocations but not resolve a timeout. Option C is wrong because decreasing the Lambda function's batch size reduces the number of records per invocation, which might reduce processing time per invocation, but the root cause is the function's timeout setting, not the batch size; a smaller batch size may not fix the timeout if the function itself is slow. Option D is wrong because increasing memory allocated to the Lambda function can improve CPU performance and reduce execution time, but the immediate and direct fix for a timeout error is to increase the timeout setting; memory adjustments are a secondary optimization.

Full explanation →

831

MCQmedium

A company uses Amazon S3 to store historical stock market data as CSV files. They run daily Amazon Athena queries to generate reports. Recently, the finance team reported that queries are timing out and costs have increased significantly. The data engineering team notices that the S3 bucket contains thousands of small files (average 100 KB) due to a misconfigured ingestion pipeline. They need to improve query performance and reduce costs without changing the existing reporting schedule. The team has access to AWS Glue and can create new tables. Which solution should they implement?

A.Partition the data by date and create a new Athena table with partitions.

B.Use S3 Select to filter rows within each file before Athena processes them.

C.Increase the Athena query timeout to 30 minutes.

D.Use AWS Glue ETL to read the CSV files, convert them to Parquet, and write them back to S3 in fewer, larger files.

AnswerD

Consolidates small files and uses columnar format to reduce scan size.

Why this answer

Converting the thousands of small CSV files into fewer, larger Parquet files using AWS Glue ETL directly addresses the root cause of poor Athena performance and high costs. Parquet is a columnar format that reduces the amount of data scanned per query, and larger files minimize the overhead of S3 LIST and GET operations, improving throughput. This solution does not change the reporting schedule and leverages existing Glue capabilities to create new optimized tables.

Exam trap

The trap here is that candidates often assume partitioning (Option A) is a universal performance fix, but they overlook that partitioning does not address the 'small files problem' which is a distinct performance killer in Athena due to S3 request overhead and file open costs.

How to eliminate wrong answers

Option A is wrong because partitioning by date does not solve the problem of thousands of tiny files; while partitioning can help prune scanned data, the overhead of reading many small files per partition still causes high latency and cost due to excessive S3 API calls. Option B is wrong because S3 Select operates at the object level to filter rows within a single file, but it does not consolidate files or change the file format; Athena would still need to process thousands of small files, and S3 Select cannot be used directly within Athena queries to replace table scans. Option C is wrong because increasing the query timeout does not reduce the amount of data scanned or the number of S3 requests; it merely allows the query to run longer without addressing the performance bottleneck or cost issue.

Full explanation →

832

Multi-Selectmedium

A company is using AWS Glue to process data from an Amazon S3 data lake. The Glue job runs daily and transforms data into multiple output formats. Which TWO actions can the company take to optimize the Glue job's performance and reduce costs? (Choose TWO.)

Select 2 answers

A.Increase the number of DPUs allocated to the job.

B.Reduce the number of DPUs (Data Processing Units) allocated to the job.

C.Disable job bookmarking to force full reprocessing every run.

D.Increase the job timeout to allow more time for processing.

E.Enable job bookmarking to process only new data.

AnswersA, E

More DPUs can speed up processing, reducing runtime and possibly cost.

Why this answer

Options A and E are correct. Increasing the number of DPUs (A) can parallelize processing and improve performance for data-intensive Glue jobs, potentially reducing runtime and cost if the job runs faster. Enabling job bookmarking (E) allows Glue to track processed data and process only new or changed data in incremental runs, reducing processing time and cost by avoiding full reprocessing.

Option B (reducing DPUs) would likely decrease performance. Option C (disabling bookmarking) would force full reprocessing, increasing cost and time. Option D (increasing job timeout) does not optimize performance or cost; it only allows the job to run longer, which could increase cost if the job is inefficient.

Full explanation →

833

MCQhard

A company ingests IoT sensor data into an S3 bucket. Daily, a Lambda function reads new objects, processes them, and writes results to a DynamoDB table. Recently, the Lambda function started timing out after 15 minutes. The data volume has increased, and the function processes records one by one. Which solution would improve performance without significant cost increase?

A.Replace Lambda with an AWS Glue ETL job.

B.Increase the Lambda function timeout to 30 minutes.

C.Use S3 Batch Operations to invoke the Lambda function in parallel for each object.

D.Increase the DynamoDB write capacity units.

AnswerC

S3 Batch Operations processes objects concurrently, drastically reducing processing time.

Why this answer

S3 Batch Operations invokes the Lambda function for each object in parallel, efficiently handling increased volume without significant cost increase. Option A is incorrect because AWS Glue ETL jobs have startup overhead and may cost more. Option B is incorrect because increasing the timeout does not address the root cause of sequential processing; the function would still process records one by one and may still timeout.

Option D is incorrect because increasing DynamoDB write capacity does not speed up the Lambda processing; the bottleneck is the sequential processing within the function.

Full explanation →

834

MCQhard

A company ingests millions of small files (1-10 KB) into Amazon S3 every hour. These files are then processed by AWS Glue ETL jobs. The Glue jobs are slow because of the overhead of reading many small files. Which strategy will most effectively improve Glue job performance?

A.Enable Glue job bookmark.

B.Increase the number of DPUs for the Glue job.

C.Use S3 Select to filter data before Glue reads it.

D.Use a Lambda function to merge small files into larger ones before Glue processes them.

AnswerD

Merging files reduces the number of objects, speeding up Glue's list and read operations.

Why this answer

Grouping small files into larger ones (e.g., by merging in a preprocessing step) reduces the number of file read operations and improves Glue's efficiency. Using S3 Select or increasing DPUs helps but doesn't address the root cause.

Full explanation →

835

Multi-Selectmedium

A company is using Amazon Kinesis Data Streams to process real-time stock trade data. The data is consumed by a Lambda function that calculates moving averages and stores results in Amazon DynamoDB. The Lambda function is failing with 'ProvisionedThroughputExceededException' on the DynamoDB table. The table has on-demand capacity. Which TWO actions should the engineer take to resolve this issue?

Select 2 answers

A.Add a dead-letter queue and configure the Lambda function to retry on failure with exponential backoff.

B.Decrease the batch window to 0 seconds to process records immediately.

C.Increase the Lambda function's reserved concurrency to process more shards.

D.Increase the batch size of the Kinesis event source mapping for the Lambda function.

AnswersA, D

Retries with backoff help handle throttling gracefully.

Why this answer

Adding a dead-letter queue (DLQ) and configuring the Lambda function to retry on failure with exponential backoff allows the function to handle transient ProvisionedThroughputExceededExceptions from DynamoDB. Since the table uses on-demand capacity, the exception indicates a momentary throttle due to traffic spikes; exponential backoff with retries gives DynamoDB time to scale up, while the DLQ captures records that persistently fail for later analysis.

Exam trap

The trap here is that candidates may think increasing concurrency (Option C) helps with DynamoDB throttling, but it actually increases write pressure, while the correct approach is to reduce the request rate via batching (Option D) and handle retries with exponential backoff (Option A).

Full explanation →

836

MCQmedium

A company is migrating an on-premises Hadoop cluster to AWS. The cluster processes large files in CSV format using Apache Spark. Which data store should be used as the primary storage for the data lake to optimize cost and performance?

A.Amazon EMR File System (EMRFS) backed by HDFS

B.Amazon RDS for MySQL

C.Amazon EBS volumes attached to the EMR cluster

D.Amazon S3

AnswerD

S3 provides unlimited storage, high durability, and integrates with EMR via EMRFS.

Why this answer

Amazon S3 is the most suitable primary storage for a data lake on AWS due to its high durability, scalability, and cost-effectiveness. It integrates seamlessly with Amazon EMR and Apache Spark for processing large CSV files. Option A is wrong because EMRFS is a connector that allows EMR to access data in S3, not a separate storage system; it is not an alternative to HDFS.

Option B is wrong because Amazon RDS for MySQL is a relational database service, not designed for storing large-scale data lake files like CSV. Option C is wrong because Amazon EBS volumes are block-level storage for EC2 instances, which are limited in scalability and not cost-effective for large data lakes, especially when used as primary storage.

Full explanation →

837

Multi-Selecthard

Which THREE factors should a data engineer consider when choosing between Amazon RDS and Amazon DynamoDB for a new application? (Choose three.)

Select 3 answers

A.Whether the workload requires serverless scaling.

B.Whether the data model is relational or key-value.

C.Whether the data must be encrypted at rest by default.

D.Whether the application requires VPC isolation.

E.Whether the application needs to scale horizontally for high throughput.

AnswersA, B, E

DynamoDB is serverless; RDS requires manual scaling.

Why this answer

Amazon RDS is a relational database service that requires provisioning and managing server capacity, while DynamoDB is a fully managed NoSQL key-value and document database that supports serverless scaling. Option A is correct because DynamoDB can automatically scale throughput capacity up or down based on traffic patterns, making it suitable for unpredictable workloads, whereas RDS requires manual scaling or the use of Auto Scaling with predefined policies.

Exam trap

The trap here is that candidates mistakenly think encryption at rest or VPC isolation are exclusive to one service, when in fact both RDS and DynamoDB support these features, making them irrelevant as differentiators.

Full explanation →

838

MCQeasy

A data engineer needs to set up a new Amazon RDS for MySQL database for a web application. The application experiences variable read traffic and requires low read latency. The engineer needs to minimize downtime during maintenance and provide read scalability. Which configuration meets these requirements?

A.Multi-AZ db.r5.large instance with two Read Replicas

B.Multi-AZ db.r5.large instance

C.Single-AZ db.r5.large instance

D.Single-AZ db.r5.xlarge instance

AnswerA

Multi-AZ provides failover, and Read Replicas provide read scalability.

Why this answer

A Multi-AZ deployment provides high availability and automatic failover to minimize downtime during maintenance, while adding two Read Replicas offloads read traffic from the primary instance, reducing read latency and enabling read scalability. The db.r5.large instance size is sufficient for the variable read workload, and Read Replicas can be promoted to standalone instances if needed.

Exam trap

The trap here is that candidates often assume Multi-AZ alone provides read scalability, but Multi-AZ only provides high availability and failover, not read offloading—Read Replicas are required for read scaling.

How to eliminate wrong answers

Option B is wrong because a Multi-AZ instance alone provides high availability and failover but does not offer read scalability or reduce read latency for variable read traffic, as all reads still hit the primary instance. Option C is wrong because a Single-AZ instance lacks high availability, meaning any maintenance or failure causes downtime, and it provides no read scalability. Option D is wrong because a Single-AZ db.r5.xlarge instance, while larger, still lacks high availability and read scalability; scaling vertically does not address variable read traffic efficiently and does not minimize downtime during maintenance.

Full explanation →

839

MCQmedium

A company is using Amazon S3 to store sensitive data. The security team requires that all objects be encrypted using server-side encryption with AWS KMS (SSE-KMS) and that the bucket policy denies any PutObject request that does not include the required encryption header. Which bucket policy condition should be added?

A.s3:x-amz-server-side-encryption-aws-kms-key-id

B.s3:x-amz-server-side-encryption

C.kms:EncryptionContext

D.aws:SecureTransport

AnswerA

This condition enforces the use of a specific KMS key.

Why this answer

S3:x-amz-server-side-encryption-aws-kms-key-id can be used to enforce a specific KMS key. Option B is wrong because s3:x-amz-server-side-encryption only enforces SSE-S3 or SSE-KMS, not a specific key. Option C is wrong because kms:EncryptionContext is for KMS, not S3.

Option D is wrong because aws:SecureTransport is for in-transit encryption.

Full explanation →

840

MCQmedium

A data engineering team is ingesting streaming data from IoT devices into Amazon Kinesis Data Streams. The data is then consumed by an AWS Lambda function that transforms and loads it into Amazon S3. Recently, the team noticed that the Lambda function is failing with throttling errors (HTTP 429) from the Kinesis API. Which configuration change should the team make to resolve this issue?

A.Disable retries on the Lambda function and configure a dead-letter queue for failed records.

B.Replace Kinesis Data Streams with Amazon DynamoDB Streams for ingestion.

C.Reduce the batch size and increase the number of shards in the Kinesis stream to increase parallelism.

D.Increase the batch size in the Lambda event source mapping to reduce the number of invocations.

AnswerC

Reducing batch size lowers records per invocation, and more shards increase parallelism, reducing throttling.

Why this answer

Reducing the batch size and increasing the number of shards directly addresses the HTTP 429 throttling errors from the Kinesis API. Each shard supports up to 5 read transactions per second and a maximum read rate of 2 MB/s; by increasing shards, you increase the available read throughput, and reducing the batch size lowers the number of records per invocation, preventing the Lambda function from exceeding the per-shard read limits.

Exam trap

The trap here is that candidates often assume increasing the batch size reduces invocations and thus throttling, but in reality, larger batches increase the data volume per GetRecords call, making throttling worse; the correct approach is to reduce batch size and increase shards to distribute the read load.

How to eliminate wrong answers

Option A is wrong because disabling retries would cause data loss for failed records; a dead-letter queue captures failures but does not resolve the root cause of throttling from the Kinesis API. Option B is wrong because replacing Kinesis Data Streams with DynamoDB Streams would change the ingestion mechanism entirely and does not address the existing throttling issue; DynamoDB Streams have their own throughput limitations and are not a direct substitute for high-throughput IoT data ingestion. Option D is wrong because increasing the batch size would cause the Lambda function to request more records per invocation, increasing the read load on the Kinesis shards and exacerbating the throttling errors.

Full explanation →

841

MCQhard

A data engineer is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database is 5 TB in size and has a 1 Gbps network connection. The migration must be completed within 48 hours. Which service should be used?

A.AWS DataSync.

B.Amazon S3 Transfer Acceleration.

C.AWS Snowball Edge.

D.AWS Database Migration Service (DMS).

AnswerD

Online migration over network, capable of migrating 5 TB within 48 hours.

Why this answer

AWS DMS is the correct choice because it is designed for migrating databases to AWS with minimal downtime, and it can handle a 5 TB Oracle database over a 1 Gbps network within 48 hours. DMS supports ongoing replication to keep the source and target in sync, and it can use Oracle-specific features like supplemental logging and change data capture (CDC) to reduce migration time. The 1 Gbps connection provides sufficient bandwidth to transfer 5 TB in under 12 hours at full utilization, leaving ample time for setup and validation.

Exam trap

The trap here is that candidates might choose Snowball Edge (option C) thinking 5 TB is too large for a 1 Gbps connection within 48 hours, but they overlook that the bandwidth is sufficient (5 TB at 1 Gbps takes ~11 hours), making an online migration via DMS the correct and more practical choice.

How to eliminate wrong answers

Option A is wrong because AWS DataSync is designed for moving large volumes of file data (e.g., NFS, SMB) to Amazon S3 or EFS, not for database migrations; it cannot handle Oracle-specific schema, stored procedures, or ongoing replication. Option B is wrong because Amazon S3 Transfer Acceleration is a feature for speeding up uploads to S3 buckets over long distances using AWS edge locations, but it does not migrate databases or support Oracle database engines. Option C is wrong because AWS Snowball Edge is a physical device for offline data transfer when network bandwidth is insufficient (e.g., less than 1 Gbps or limited time), but here the 1 Gbps connection is adequate to transfer 5 TB within 48 hours, making an online migration via DMS more efficient and less complex.

Full explanation →

842

MCQhard

Refer to the exhibit. A data engineer applies this bucket policy to an S3 bucket named my-data-bucket. The bucket contains sensitive data. The company's security team reports that data was accessed from an IP address outside the allowed range. What is the MOST likely reason that the policy failed to block the unauthorized access?

A.The Deny statement's condition on SecureTransport overrides the IP condition.

B.The policy has a syntax error in the Condition element.

C.The Deny statement does not restrict access based on IP address; it only denies non-HTTPS requests.

D.The bucket policy does not apply to requests made from within the same AWS account.

AnswerC

The Deny only applies to non-SecureTransport, not to IP addresses outside the allowed range.

Why this answer

The Deny statement in the policy only denies requests that are not using HTTPS (SecureTransport: false). It does not include any condition to restrict access based on IP address. Therefore, a request made from an IP outside the allowed range but using HTTPS would not be denied by this policy, allowing unauthorized access to the sensitive data.

Exam trap

The trap here is that candidates assume a Deny statement with any condition will block all unauthorized access, but in reality, each condition must be explicitly specified to deny the intended requests.

How to eliminate wrong answers

Option A is wrong because SecureTransport and IP address conditions are independent; a Deny statement with SecureTransport does not override an IP condition—it simply does not evaluate IP at all. Option B is wrong because there is no syntax error indicated in the exhibit; the policy is syntactically valid but logically incomplete. Option D is wrong because bucket policies apply to all principals, including requests made from within the same AWS account, unless explicitly scoped otherwise.

Full explanation →

843

MCQeasy

A company wants to encrypt data at rest in Amazon S3 using server-side encryption. They need to manage the encryption keys themselves and rotate them annually. Which S3 encryption option should they use?

A.SSE-KMS

B.SSE-S3

C.SSE-C

D.Client-side encryption

AnswerC

SSE-C allows the customer to provide their own encryption keys and manage them.

Why this answer

SSE-C (Server-Side Encryption with Customer-Provided Keys) allows customers to provide their own encryption keys, manage them, and rotate them as needed. SSE-S3 uses AWS-managed keys, offering no customer control over key management. SSE-KMS uses AWS KMS keys, where AWS manages the key material, though customers can manage key policies and automatic rotation.

Client-side encryption is not server-side and does not meet the requirement. Therefore, SSE-C is the correct option.

Full explanation →

844

MCQhard

A data engineer is designing a data warehouse using Amazon Redshift. The workload includes complex queries that join large tables. The engineer notices that queries are slow due to disk-based operations. Which configuration change would MOST improve query performance?

A.Define appropriate sort keys on the large tables.

B.Increase the number of slices per node by choosing a different node type.

C.Choose an appropriate distribution style (e.g., KEY or ALL) for the tables.

D.Enable compression on all columns.

AnswerC

Proper distribution minimizes data movement across nodes, reducing disk I/O for joins.

Why this answer

Choosing an appropriate distribution style (KEY or ALL) minimizes data movement between nodes during query execution. In Amazon Redshift, disk-based operations often result from large volumes of data being redistributed across the network for joins. By colocating related data on the same slices via KEY distribution or replicating small tables with ALL distribution, you reduce the need for broadcast or redistribution, which directly alleviates disk-based spills and improves query performance.

Exam trap

The trap here is that candidates often confuse sort keys (which improve scan efficiency) with distribution keys (which reduce data movement), leading them to choose sort keys when the real bottleneck is disk-based operations from join-related data shuffling.

How to eliminate wrong answers

Option A is wrong because sort keys primarily optimize data skipping and range-restricted scans, not the data movement or disk spills caused by large joins. Option B is wrong because increasing the number of slices per node (by choosing a different node type) does not inherently reduce disk-based operations; it may even increase network shuffling if distribution is not optimized, and the bottleneck is often data redistribution, not slice count. Option D is wrong because compression reduces storage size and I/O for scans, but it does not address the root cause of disk-based operations during joins, which is excessive data movement and intermediate result spills.

Full explanation →

845

MCQhard

An IAM policy is attached to a user who tries to upload an object to the S3 bucket example-bucket using the AWS CLI without specifying the --server-side-encryption flag. What will happen?

A.The upload fails with an AccessDenied error.

B.The upload succeeds and the object is encrypted with SSE-S3 by default.

C.The upload fails because the user does not have permission to use KMS.

D.The upload succeeds because the policy allows s3:PutObject.

AnswerA

The condition is not satisfied, so the upload is denied.

Why this answer

The IAM policy denies s3:PutObject unless the request includes the `x-amz-server-side-encryption` header with a value of `AES256`. Since the user did not specify `--server-side-encryption` in the AWS CLI command, the request lacks this required header, causing S3 to evaluate the policy and return an AccessDenied error. The upload fails before any default encryption setting on the bucket is applied.

Exam trap

AWS often tests the misconception that bucket default encryption automatically satisfies an IAM policy requiring encryption headers, but in reality, the policy condition is evaluated first and the request is denied if the header is missing, regardless of the bucket's default encryption setting.

How to eliminate wrong answers

Option B is wrong because the bucket's default encryption (SSE-S3) only applies when the PutObject request does not include an encryption header and the policy does not explicitly require one; here the policy requires the header, so the request is denied before default encryption can take effect. Option C is wrong because the policy does not mention KMS at all; the error is due to the missing `x-amz-server-side-encryption` header, not any KMS permission issue. Option D is wrong because the policy condition `s3:x-amz-server-side-encryption` is not satisfied, so the `s3:PutObject` action is effectively denied despite the user having the action allowed in the policy.

Full explanation →

846

MCQeasy

A data engineer is building a pipeline to ingest JSON files from Amazon S3 into Amazon Redshift. The files are 100 MB each and arrive every 5 minutes. Which service is BEST suited for this ingestion?

A.AWS Glue ETL job

B.Amazon Redshift COPY command

C.AWS Lambda with Redshift Data API

D.Amazon Kinesis Data Firehose with Redshift destination

AnswerB

COPY is optimized for loading large data from S3.

Why this answer

The Amazon Redshift COPY command is the most efficient and best-suited service for bulk loading 100 MB JSON files from S3 into Redshift at regular 5-minute intervals. It is optimized for high-throughput, parallel ingestion directly from S3, minimizing latency and resource overhead compared to other services.

Exam trap

The trap here is that candidates often overcomplicate the solution by choosing AWS Glue or Kinesis Firehose for batch ingestion, overlooking that the Redshift COPY command is the simplest, fastest, and most cost-effective option for bulk loading files from S3.

How to eliminate wrong answers

Option A is wrong because AWS Glue ETL jobs are designed for complex data transformation and schema conversion, not for simple, periodic bulk loading of JSON files into Redshift; using Glue adds unnecessary cost and complexity for a straightforward COPY operation. Option C is wrong because AWS Lambda with Redshift Data API is intended for small, transactional queries and has a 15-minute execution timeout and payload size limits, making it unsuitable for ingesting 100 MB files every 5 minutes. Option D is wrong because Amazon Kinesis Data Firehose with Redshift destination is built for streaming data ingestion with near-real-time delivery, not for batch loading of pre-existing files from S3; it would require additional setup to read from S3 and introduces unnecessary buffering and transformation overhead.

Full explanation →

847

MCQeasy

A data engineer is designing a data lake on Amazon S3. The data is ingested from multiple sources and needs to be partitioned by year, month, day, and event type for efficient querying with Amazon Athena. Which S3 key prefix structure is most appropriate?

A.s3://bucket/events/2024-01-01/event_type=data.parquet

B.s3://bucket/2024/01/01/event_type/events/data.parquet

C.s3://bucket/event_type=events/year=2024/month=01/day=01/data.parquet

D.s3://bucket/day=01/month=01/year=2024/event_type=events/data.parquet

AnswerC

Correct Hive-style partitioning with logical key order (year, month, day) and event type, enabling efficient partition pruning.

Why this answer

Uses Hive-style partitioning (event_type=events/year=2024/month=01/day=01), which Athena and other query engines natively support. This structure allows Athena to perform partition pruning, reading only the relevant directories based on WHERE clause filters, significantly reducing data scanned and improving query performance. Option D also uses Hive-style partitioning but with a different order of partition keys (day, month, year).

While still valid, this non-standard order may cause issues with automatic partition discovery when using MSCK REPAIR TABLE, which expects the partition order to match the table definition. Therefore, option C is the most appropriate because it follows the common convention of listing partitions from coarse to fine granularity (year > month > day) and can be easily loaded into Athena without additional configuration.

Exam trap

AWS often tests the distinction between Hive-style partitioning (key=value) and flat or date-only prefixes, where candidates mistakenly choose a structure that does not support partition pruning or is incompatible with Athena's partition discovery.

How to eliminate wrong answers

Option A is wrong because it embeds the date as a single prefix (2024-01-01) and places event_type as a filename suffix, which does not create separate partition directories; Athena cannot prune partitions efficiently without explicit partition columns. Option B is wrong because it uses a date-only hierarchy (year/month/day) but does not include event_type as a partition column, forcing full scans when filtering by event type. Option D is identical to C and is also correct, but the question expects the most appropriate structure; since both C and D are the same, the intended correct answer is C (the first occurrence).

Full explanation →

848

MCQhard

A data engineer is troubleshooting a Kinesis Data Firehose delivery stream that sends data to an Amazon S3 bucket. The delivery stream has a buffer size of 5 MB and a buffer interval of 60 seconds. The data ingestion rate is 2 MB per second. The engineer notices that S3 objects are created every 60 seconds but each object is only about 2 MB. What should the engineer do to reduce the number of small S3 objects?

A.Increase the buffer size to 10 MB.

B.Decrease the buffer interval to 30 seconds.

C.Reduce the buffer size to 2 MB.

D.Switch to Kinesis Data Streams and use a Lambda function to write to S3.

AnswerA

Increasing the buffer size to 10 MB will allow the stream to buffer more data before writing to S3, resulting in larger objects.

Why this answer

Increasing the buffer size to 10 MB will allow the stream to buffer more data before writing to S3, resulting in larger objects. Option B is wrong because decreasing the buffer interval would create objects more frequently, making the problem worse. Option C is wrong because reducing the buffer size would create even smaller objects.

Option D is wrong because switching to Kinesis Data Streams does not solve the buffering issue.

Full explanation →

849

MCQmedium

Refer to the exhibit. An IAM policy is attached to an IAM user. The user is trying to download an object from the S3 bucket 'example-bucket' from an IP address 10.1.1.1, but the request is denied. What is the most likely reason?

A.The policy does not allow the s3:GetObject action.

B.The policy has a syntax error.

C.There is an explicit deny statement elsewhere that overrides the allow.

D.The user's IP address does not match the condition in the policy.

AnswerD

The condition restricts access to IP range 10.0.0.0/16; 10.1.1.1 is outside.

Why this answer

The policy includes a condition that allows s3:GetObject only if the request originates from the 10.0.0.0/16 IP range. The user's IP address 10.1.1.1 falls outside this range, so the condition is not satisfied, resulting in an implicit deny. Therefore, the most likely reason for the denial is that the user's IP address does not match the condition, making option D correct.

Option A is incorrect because the policy does allow s3:GetObject. Option B is incorrect because the policy has no syntax error. Option C is incorrect because there is no explicit deny statement.

Full explanation →

850

MCQmedium

A data engineer is troubleshooting an AWS Glue ETL job that fails intermittently with the error 'Rate exceeded.' The job reads from an Amazon RDS for MySQL source and writes to Amazon S3. What is the MOST likely cause of this error?

A.The Glue job is using Amazon Kinesis Data Streams as a source, which has a shard throughput limit.

B.The number of Glue job workers or parallel queries is exceeding the maximum connections or IOPS of the RDS instance.

C.The Amazon S3 bucket has a bucket policy that limits the number of objects written per second.

D.The IAM role attached to the Glue job does not have sufficient permissions to read from RDS.

AnswerB

This is the typical cause of rate exceeded errors when reading from RDS.

Why this answer

The 'Rate exceeded' error when reading from RDS typically indicates that the number of connections or queries per second exceeds the RDS instance's maximum limits. Option A is incorrect because the job reads from RDS, not Kinesis. Option C is incorrect because S3 writes return a 503 SlowDown error, not 'Rate exceeded'.

Option D is incorrect because insufficient IAM permissions cause an access denied error.

Full explanation →

851

MCQmedium

A data engineer needs to share a dataset stored in Amazon S3 with another AWS account. The bucket policy currently grants access only to the owning account. What is the simplest way to grant cross-account access?

A.Add a bucket policy that grants access to the other account's IAM role

B.Set the object ACL to public-read

C.Use an S3 access control list (ACL) to grant access to the other account

D.Create an IAM role in the other account and attach a policy to it

AnswerA

A bucket policy can specify a principal from another account.

Why this answer

The simplest way to grant cross-account access to an S3 bucket is to add a bucket policy that specifies the other AWS account's IAM role as the principal. This allows the role to access the bucket without requiring additional setup in the target account. Option B (public-read ACL) would make the data publicly accessible, which is not secure and not recommended for cross-account sharing.

Option C (using an ACL) is less flexible and does not support granting access to specific IAM roles across accounts. Option D (creating an IAM role in the other account) is unnecessary because the bucket policy can directly grant access to the other account's role.

Full explanation →

852

Multi-Selecthard

A company is using Amazon S3 for a data lake. The data engineer needs to ensure that all new objects are automatically encrypted with a customer-managed KMS key and that the bucket policy enforces encryption. Which THREE steps should be taken? (Choose THREE.)

Select 3 answers

A.Configure default encryption on the bucket to use SSE-KMS.

B.Add a bucket policy that denies PutObject if the x-amz-server-side-encryption header is not set to aws:kms.

C.Create a customer-managed KMS key.

D.Use a lifecycle policy to apply encryption to existing objects.

E.Enable AWS CloudTrail to monitor encryption.

AnswersA, B, C

Ensures new objects are encrypted with SSE-KMS by default.

Why this answer

Configuring default encryption on the S3 bucket to use SSE-KMS ensures that any object uploaded without an explicit encryption header is automatically encrypted with the specified customer-managed KMS key. This satisfies the requirement for automatic encryption of all new objects.

Exam trap

The trap here is that candidates often confuse lifecycle policies (which manage object transitions) with encryption enforcement, or they think CloudTrail can enforce encryption rather than just audit it.

Full explanation →

853

Matchingmedium

Match each AWS data compression format to its typical use case.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

General-purpose, good compression ratio

Fast compression/decompression for real-time

Columnar storage with built-in compression

Optimized for Hive and large-scale analytics

High compression ratio, slower speed

Why these pairings

In AWS data engineering, compression format choice depends on trade-offs between compression ratio and speed. Snappy and LZO are optimized for speed, Gzip and Bzip2 for higher compression (with Bzip2 highest), and Zstandard offers a middle ground. Common misassociations include confusing Gzip with Bzip2 for highest compression and missing Snappy's speed focus.

Full explanation →

854

MCQeasy

A data engineer is configuring an S3 bucket for a data lake. The engineer runs the command shown in the exhibit. What does the output indicate about the bucket?

A.Versioning is enabled on the bucket.

B.The bucket retains only the latest version of each object.

C.Versioning is suspended on the bucket.

D.MFA Delete is enabled for the bucket.

AnswerA

Status: Enabled means versioning is active.

Why this answer

'Status: Enabled' indicates that versioning is enabled on the bucket. Option B is incorrect because when versioning is enabled, all versions of objects are retained, not just the latest, unless lifecycle rules are configured to remove older versions. Option C is incorrect because the status is 'Enabled', not 'Suspended'.

Option D is incorrect because 'MFA Delete' is a separate setting; the output shows 'MFADelete: Disabled', meaning MFA Delete is not enabled.

Full explanation →

855

Multi-Selectmedium

A data engineer is designing a data pipeline that ingests streaming data from an IoT device fleet. The data must be processed in near real-time and stored in Amazon S3 for long-term analytics. Which TWO AWS services should the engineer use together to achieve this?

Select 2 answers

A.Amazon Athena

B.AWS Glue

C.Amazon Kinesis Data Firehose

D.Amazon Kinesis Data Streams

E.Amazon Simple Queue Service (SQS)

AnswersC, D

Delivers streaming data to S3.

Why this answer

Amazon Kinesis Data Streams (Option D) enables real-time ingestion of streaming data from IoT devices. Amazon Kinesis Data Firehose (Option C) can consume data from a Kinesis Data Stream and deliver it to Amazon S3 for long-term analytics. Option A (Athena) is a query service, not an ingestion or delivery service.

Option B (AWS Glue) is designed for batch ETL, not real-time streaming. Option E (SQS) is a message queue service, not optimized for real-time streaming and delivery to S3.

Full explanation →

856

MCQmedium

A data engineer is designing a data lake on Amazon S3. The data is accessed frequently for the first 30 days, then rarely after that. Which lifecycle policy is MOST cost-effective?

A.Transition to S3 Standard-Infrequent Access (Standard-IA) after 30 days.

B.Transition to S3 One Zone-IA after 30 days.

C.Transition to S3 Glacier Deep Archive after 30 days.

D.Keep in S3 Standard for 90 days, then delete.

AnswerA

Standard-IA is cost-effective for infrequently accessed data with low latency.

Why this answer

Transitioning to S3 Standard-Infrequent Access (Standard-IA) after 30 days is the most cost-effective because it reduces storage costs for data that is rarely accessed while maintaining low latency and high durability. Option B (One Zone-IA) offers lower durability and is not recommended for a data lake. Option C (Glacier Deep Archive) has high retrieval times, which may not be suitable even for rare access.

Option D (keeping in Standard for 90 days then deleting) is more expensive for the first 90 days and deletes data that might still be needed.

Full explanation →

857

MCQhard

A data engineer is troubleshooting an AWS Glue ETL job that fails with an 'Access Denied' error when trying to write to an S3 bucket. The IAM role used by the job has the policy shown in the exhibit. The bucket 'my-bucket' uses S3 default encryption with AWS KMS. What is the most likely missing permission?

A.s3:GetObjectVersion

B.glue:GetObject

C.s3:ListBucketMultipartUploads

D.s3:PutObjectAcl

E.kms:GenerateDataKey and kms:Decrypt

AnswerE

KMS permissions are necessary to encrypt and decrypt objects when default encryption uses KMS.

Why this answer

When an S3 bucket uses AWS KMS for default encryption, any write operation requires the IAM role to have kms:GenerateDataKey and kms:Decrypt permissions on the KMS key. The policy in the exhibit grants s3:PutObject but does not include any KMS actions, resulting in an 'Access Denied' error. Option A (s3:GetObjectVersion) is not needed for writing.

Option B (glue:GetObject) is not a valid AWS action. Option C (s3:ListBucketMultipartUploads) is not required for a write operation. Option D (s3:PutObjectAcl) is unnecessary unless the job explicitly sets ACLs.

Full explanation →

858

MCQhard

A data engineer runs the AWS CLI command shown in the exhibit to list objects in an S3 bucket. The command returns only two objects even though the bucket contains thousands of objects under the prefix. What should the engineer do to retrieve the next batch of objects?

A.Increase the --max-items value to a larger number.

B.Use the --starting-token parameter with the value from the NextToken field.

C.Use the --page-size parameter to request more items per API call.

D.Change the --prefix to a more specific value.

AnswerB

The NextToken is used with --starting-token to get the next page of results.

Why this answer

The AWS CLI `list-objects-v2` command paginates results by default. When the output is truncated, the response includes a `NextToken` field. To retrieve the next batch, the engineer must use the `--starting-token` parameter with the value from that `NextToken` field, which tells the CLI to resume listing from where it left off.

Exam trap

The trap here is confusing `--page-size` (which controls API call size but not pagination) with `--starting-token` (which actually advances the pagination cursor), leading candidates to incorrectly choose option C.

How to eliminate wrong answers

Option A is wrong because `--max-items` controls the maximum number of items returned per paginated output, not the total number of items retrieved; increasing it would still only return a single page of up to that many items, not the next batch. Option C is wrong because `--page-size` controls the number of items requested per underlying API call (e.g., `ListObjectsV2`), but the CLI automatically handles pagination; changing it does not retrieve the next batch—it only affects the size of each API request. Option D is wrong because changing the `--prefix` would filter to a different set of objects, not retrieve the next batch of objects under the original prefix.

Full explanation →

859

MCQhard

A company uses Amazon Kinesis Data Streams to ingest IoT sensor data. The data is processed by an AWS Lambda function that transforms the records and writes to an Amazon S3 bucket. Recently, the Lambda function has been failing with 'Rate exceeded' errors for the S3 PUT API calls. The data volume is 10 MB/s with average record size 2 KB. What should be done to resolve this issue?

A.Add a random prefix to the S3 object key to distribute writes across multiple prefixes

B.Switch to Amazon Kinesis Data Firehose to write to S3

C.Increase the Lambda function's reserved concurrency

D.Increase the number of Kinesis shards

AnswerA

Random prefixes increase the number of S3 partitions, raising the PUT request limit.

Why this answer

The 'Rate exceeded' error for S3 PUT API calls indicates that the Lambda function is hitting S3 request rate limits. S3 buckets have a default limit of 3,500 PUT requests per second per prefix. With a data volume of 10 MB/s and an average record size of 2 KB, the Lambda function is generating approximately 5,000 PUT requests per second (10 MB/s ÷ 2 KB), which exceeds the per-prefix limit.

Adding a random prefix to the S3 object key distributes writes across multiple prefixes, effectively increasing the aggregate request rate limit to 3,500 PUT requests per second per prefix, thereby resolving the throttling issue.

Exam trap

The trap here is that candidates often confuse Kinesis shard scaling (Option D) or Lambda concurrency (Option C) with S3 rate limits, not realizing that the bottleneck is the S3 API request rate per prefix, not the data ingestion pipeline throughput.

How to eliminate wrong answers

Option B is wrong because Amazon Kinesis Data Firehose writes to S3 in batches and can also encounter S3 rate limits if the underlying prefix is not partitioned; it does not inherently solve the per-prefix request rate limit issue. Option C is wrong because increasing the Lambda function's reserved concurrency would increase the number of concurrent invocations, which would generate even more S3 PUT requests per second, exacerbating the rate limiting problem. Option D is wrong because increasing the number of Kinesis shards increases the data ingestion parallelism but does not affect the S3 PUT request rate limit; the Lambda function would still write to the same S3 prefix at the same rate.

Full explanation →

860

Multi-Selectmedium

A company uses AWS Glue to process data from Amazon S3. The Glue job fails with a 'SchemaDetectionException'. The data engineer wants to ensure the schema is correctly inferred. Which TWO actions should the engineer take? (Choose two.)

Select 2 answers

A.Use the Glue Data Catalog as the source for schema definition.

B.Add a column with a default value to the data.

C.Increase the number of Glue DPUs to speed up processing.

D.Convert all input files to Parquet format.

E.Set the 'groupFiles' option to 'inPartition' to combine small files.

AnswersA, E

Using the Glue Data Catalog as the source for schema definition ensures the schema is predefined and consistent, preventing schema detection errors.

Why this answer

The correct answers are A and E. Option A uses the Glue Data Catalog as the source for schema definition, providing a consistent schema and avoiding schema detection failures. Option E sets the 'groupFiles' option to 'inPartition', which helps Glue combine small files within a partition for schema inference, reducing 'SchemaDetectionException' errors.

Option B is incorrect because adding a column with a default value does not affect schema detection. Option C is incorrect because increasing DPUs only improves processing speed, not schema inference. Option D is incorrect because converting to Parquet may change the schema but does not directly address schema detection issues.

Full explanation →

861

Multi-Selectmedium

A company is building a data lake on Amazon S3. The data sources include relational databases, streaming data, and log files. The data engineer needs to ensure that the data ingestion pipeline can handle schema evolution, support both batch and streaming, and provide a unified metadata catalog. Which THREE services should the engineer use? (Choose three.)

Select 3 answers

A.AWS Glue

B.Amazon DynamoDB

C.Amazon Athena

D.Amazon S3

E.Amazon Kinesis Data Firehose

AnswersA, D, E

Provides schema discovery, catalog, and batch ETL.

Why this answer

AWS Glue is correct because it provides a unified metadata catalog (the AWS Glue Data Catalog) that stores schema information for data stored in Amazon S3. It supports schema evolution by allowing you to update the catalog schema as data formats change, and it integrates with both batch (AWS Glue ETL jobs) and streaming (AWS Glue Streaming ETL) ingestion pipelines, making it the central service for metadata management in a data lake.

Exam trap

The trap here is that candidates often confuse Amazon Athena as a metadata catalog or ingestion service, but it is only a query engine that reads from S3 and relies on Glue for metadata, so it does not fulfill the ingestion or catalog requirements.

Full explanation →

862

MCQmedium

A company uses Amazon Kinesis Data Streams to ingest real-time clickstream data. The data is consumed by a Lambda function that writes to an S3 bucket. Recently, the Lambda function started timing out. Which step should be taken to resolve this issue?

A.Increase the Lambda function timeout

B.Set the Lambda reserved concurrency to 1

C.Decrease the batch size in the event source mapping

D.Increase the number of shards in the Kinesis stream

AnswerA

Allows the function to run longer without timing out.

Why this answer

The Lambda function is timing out, indicating that the current timeout is insufficient for processing the records from Kinesis within the allowed time. Increasing the timeout gives the function more time to complete its work, resolving the timeout issue. Option B is incorrect because setting reserved concurrency to 1 limits the number of concurrent executions but does not increase the time available per invocation.

Option C is incorrect because decreasing the batch size reduces the number of records per invocation but does not extend the timeout; it may even increase the number of invocations. Option D is incorrect because increasing the number of shards increases the stream's throughput and may increase the number of concurrent Lambda invocations, but it does not address the root cause of the function timing out.

Full explanation →

863

MCQeasy

A data engineer needs to transform CSV files to Parquet format using AWS Glue. The source data contains sensitive columns that must be masked. Which Glue feature should be used?

A.AWS Glue DataBrew

B.AWS Glue Studio

C.AWS Glue Crawler

D.AWS Glue Schema Registry

AnswerA

DataBrew provides visual data preparation with built-in masking.

Why this answer

AWS Glue DataBrew is a visual data preparation tool that includes built-in transformations for masking sensitive data, such as hashing, tokenizing, or redacting columns. This makes it the correct choice for transforming CSV files to Parquet while applying column-level masking without writing custom code.

Exam trap

The trap here is confusing AWS Glue DataBrew's visual data preparation and masking capabilities with AWS Glue Studio's visual ETL job authoring, which lacks built-in masking transforms and requires custom code.

How to eliminate wrong answers

Option B (AWS Glue Studio) is wrong because it is a visual authoring tool for building ETL jobs, but it does not natively include data masking transformations; you would need to write custom PySpark or Spark SQL code to implement masking. Option C (AWS Glue Crawler) is wrong because it is used for schema discovery and populating the Data Catalog, not for transforming or masking data. Option D (AWS Glue Schema Registry) is wrong because it manages and validates schema evolution for streaming data, not for masking sensitive columns during batch transformations.

Full explanation →

864

MCQeasy

A data engineer notices that an Amazon Kinesis Data Firehose delivery stream is failing to deliver data to an Amazon S3 bucket. The CloudWatch metrics show 'DeliveryToS3.Success' is 0 and 'S3.BucketExists' is 1. What is the MOST likely cause?

A.The S3 bucket has an ACL that denies access to Firehose.

B.The Firehose delivery stream Lambda transformation function is failing.

C.The IAM role for Firehose lacks s3:PutObject permission.

D.The S3 bucket does not exist.

AnswerC

Write permission is required for delivery.

Why this answer

The metric 'S3.BucketExists' is 1, confirming the S3 bucket exists, so the issue is not bucket existence. With 'DeliveryToS3.Success' at 0, the failure is in the write operation. The IAM role assumed by Firehose must have the s3:PutObject permission to deliver data; lacking it would cause all delivery attempts to fail silently, matching the observed metrics.

Exam trap

The trap here is that candidates may confuse 'S3.BucketExists' with successful delivery, or assume a missing bucket is the issue when the metric clearly shows the bucket exists, leading them to overlook the IAM permission gap.

How to eliminate wrong answers

Option A is wrong because S3 bucket ACLs are not evaluated when the IAM role grants the s3:PutObject permission via a bucket policy or identity-based policy; ACLs are legacy and Firehose uses IAM for authorization. Option B is wrong because a failing Lambda transformation function would cause 'DeliveryToS3.Success' to be 0 only if the transformation is mandatory, but the metric 'S3.BucketExists' would still be 1, and the failure would be logged as 'Lambda.ExecutionErrors' or similar, not directly as a delivery failure. Option D is wrong because 'S3.BucketExists' is 1, which explicitly indicates the bucket exists, so the bucket not existing cannot be the cause.

Full explanation →

865

Multi-Selecthard

A company uses AWS Glue to run ETL jobs that transform data from Amazon S3 (Parquet) into a denormalized format for Amazon Redshift. The Glue job uses the DynamicFrame API. The job is failing with a 'MemoryError' when performing a join operation. The data is skewed on the join key. Which THREE actions can reduce memory usage and improve job stability? (Choose THREE.)

Select 3 answers

A.Use a broadcast join if one of the tables is small enough.

B.Use a salted join key to distribute skewed keys across partitions.

C.Increase the number of DPUs for the Glue job.

D.Repartition the data on the join key before the join operation.

E.Split the transformation into multiple Glue job steps to reduce per-step memory.

AnswersA, B, E

Avoids shuffling small table.

Why this answer

A broadcast join (using `join` with `broadcast` hint or `DynamicFrame.join(..., transformation_ctx='...')` with broadcast enabled) avoids shuffling the larger table across the cluster by copying the small table to every executor. This eliminates the memory pressure from skewed key distribution during the shuffle phase, reducing the risk of a MemoryError.

Exam trap

The trap here is that candidates often assume increasing resources (DPUs) or repartitioning will fix memory issues, but they fail to recognize that data skew on the join key is the root cause, which requires skew-aware techniques like salting or broadcast joins.

Full explanation →

866

MCQhard

Refer to the exhibit. A data engineer is setting up an Amazon Kinesis Data Firehose delivery stream that writes to an S3 bucket named 'example-bucket'. The IAM role assumed by Firehose has the attached policy shown. When testing, the Firehose delivery stream fails with an access denied error. What is the most likely cause?

A.The S3 bucket has server-side encryption enabled that needs additional permissions.

B.The IAM role does not have permission to use AWS KMS keys.

C.The bucket policy denies access from the Firehose service principal.

D.The IAM policy is missing the s3:AbortMultipartUpload and s3:ListBucket actions.

AnswerD

Firehose uses multipart uploads and needs these permissions.

Why this answer

Kinesis Data Firehose requires the s3:AbortMultipartUpload and s3:ListBucket permissions in addition to s3:PutObject to successfully write data to an S3 bucket. The IAM policy shown only grants s3:PutObject and s3:GetObject, so without these missing actions, the delivery stream fails with access denied. Option A is incorrect because enabling server-side encryption on the S3 bucket does not inherently cause access denial if the IAM role has the necessary permissions; the issue here is the missing S3 actions.

Option B is incorrect because the policy does not involve KMS keys, and the error is not related to encryption key access. Option C is incorrect because there is no indication that the bucket policy explicitly denies the Firehose service principal; the problem is the IAM role's insufficient permissions.

Full explanation →

867

MCQeasy

A data engineer needs to transform JSON data from Amazon S3 into Parquet format using AWS Glue. The source files are in a bucket with thousands of small files. What is the best practice to optimize the Glue job performance?

A.Convert the JSON files to CSV before processing with Glue.

B.Enable 'Group small files' in the Glue job or use a DynamicFrame with coalesce.

C.Use an AWS Lambda function to pre-process the files.

D.Increase the number of DPUs to the maximum.

AnswerB

Grouping reduces the number of tasks and improves performance.

Why this answer

Enabling 'Group small files' in AWS Glue automatically coalesces thousands of small input files into larger partitions, reducing the number of tasks and minimizing overhead from task scheduling and S3 list operations. This is the recommended best practice for handling small files in Glue ETL jobs, as it optimizes read performance without requiring manual coalesce or repartitioning.

Exam trap

The trap here is that candidates assume more DPUs always improve performance, but for small files the bottleneck is metadata overhead, not compute capacity, so increasing DPUs without addressing file grouping leads to wasted resources and no speedup.

How to eliminate wrong answers

Option A is wrong because converting JSON to CSV adds an unnecessary preprocessing step and does not address the root cause of small file overhead; Glue can read JSON directly and convert to Parquet efficiently. Option C is wrong because using Lambda to pre-process files introduces additional cost, complexity, and potential timeout issues for large numbers of files, and does not leverage Glue's built-in optimization for small files. Option D is wrong because simply increasing DPUs does not solve the small file problem; it may even worsen performance by creating more task slots that compete for the same small files, leading to inefficient resource utilization.

Full explanation →

868

Multi-Selecthard

A company is migrating its data warehouse from on-premises to Amazon Redshift. The migration involves copying 50 TB of data from an S3 bucket to Redshift. The network bandwidth is limited to 1 Gbps. Which TWO approaches should the team use to complete the transfer within 7 days?

Select 2 answers

A.Use Amazon S3 Transfer Acceleration

B.Use AWS Direct Connect with 10 Gbps

C.Use AWS Snowball Edge to transfer the data to S3

D.Use AWS Lambda to copy data in parallel

E.Use Amazon Kinesis Data Firehose

AnswersA, C

S3 Transfer Acceleration can speed up uploads over the network.

Why this answer

Amazon S3 Transfer Acceleration (option A) uses AWS edge locations to accelerate uploads over the public internet by routing traffic through optimized paths, which can significantly improve transfer speeds for large datasets when bandwidth is limited. With 1 Gbps bandwidth, the theoretical maximum transfer for 50 TB over 7 days is approximately 75.6 TB (1 Gbps * 7 days * 86400 seconds/day / 8 bits/byte), so the raw bandwidth is sufficient, but Transfer Acceleration helps overcome latency and packet loss issues that can reduce effective throughput. This makes it a valid approach to ensure the transfer completes within the time window.

Exam trap

The trap here is that candidates assume 1 Gbps bandwidth is sufficient for 50 TB in 7 days based on raw calculations, but they overlook real-world network inefficiencies like TCP window scaling, packet loss, and latency, which can drastically reduce effective throughput, making S3 Transfer Acceleration or Snowball Edge necessary.

Full explanation →

869

MCQeasy

A company needs to ingest data from an on-premises database to Amazon S3 with minimal impact on the source database. The data volume is several TB. Which AWS service is best suited for this task?

A.AWS Direct Connect

B.AWS Snowball Edge

C.AWS Database Migration Service (DMS)

D.Amazon S3 Transfer Acceleration

AnswerC

DMS can migrate data from on-premises to S3 with minimal impact using CDC.

Why this answer

AWS Database Migration Service (DMS) is best suited because it can continuously replicate data from an on-premises database to Amazon S3 with minimal impact on the source. DMS uses change data capture (CDC) to capture only incremental changes after an initial full load, avoiding heavy read loads on the source database. This makes it ideal for migrating several TB of data while keeping the source operational.

Exam trap

The trap here is that candidates confuse network acceleration services (Direct Connect, Transfer Acceleration) or offline transfer devices (Snowball) with database-specific migration tools, overlooking that DMS is the only option that directly reads from a database with minimal impact via CDC.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect provides a dedicated network connection for consistent bandwidth, but it does not perform data ingestion or migration itself; it is a transport layer, not a service that reads from a database. Option B is wrong because AWS Snowball Edge is a physical device for offline data transfer, which is suitable for very large datasets (petabytes) but introduces significant latency and is not designed for minimal impact on a live database during continuous ingestion. Option D is wrong because Amazon S3 Transfer Acceleration speeds up uploads to S3 over the internet using optimized network paths, but it does not interact with the source database or handle database-specific data extraction and transformation.

Full explanation →

870

MCQeasy

A company uses Amazon DynamoDB to store session data for a web application. The application experiences sudden spikes in traffic, causing occasional throttling errors. The data engineer needs to handle these spikes without over-provisioning capacity. What is the MOST cost-effective solution?

A.Set up a TTL (Time to Live) attribute to automatically delete old session data.

B.Enable DynamoDB Accelerator (DAX) to cache read requests.

C.Configure DynamoDB Auto Scaling to automatically adjust provisioned capacity.

D.Switch to DynamoDB on-demand mode.

AnswerC

Auto Scaling dynamically adapts to traffic patterns, preventing throttling and reducing cost.

Why this answer

DynamoDB Auto Scaling (option C) is the most cost-effective solution because it automatically adjusts the provisioned read/write capacity based on actual traffic patterns, handling sudden spikes without manual intervention or over-provisioning. This avoids paying for unused capacity during low-traffic periods while still accommodating bursts within the configured limits.

Exam trap

The trap here is that candidates often confuse DynamoDB on-demand mode (option D) as the default solution for unpredictable traffic, but the exam tests cost optimization—on-demand is premium-priced per request, while Auto Scaling with provisioned capacity is more cost-effective for workloads with variable but not extreme traffic patterns.

How to eliminate wrong answers

Option A is wrong because TTL (Time to Live) only deletes expired session data to reduce storage costs and stale items, but it does not address throttling errors caused by capacity limits during traffic spikes. Option B is wrong because DynamoDB Accelerator (DAX) is an in-memory cache that improves read performance and reduces read throttling, but it does not help with write throttling or capacity management for sudden spikes. Option D is wrong because DynamoDB on-demand mode automatically scales to handle any traffic level, but it is significantly more expensive for predictable or steady-state workloads compared to provisioned capacity with Auto Scaling, making it less cost-effective for this use case.

Full explanation →

871

MCQmedium

A data engineer needs to transform CSV files arriving in S3 into Parquet format and partition them by date. The transformation should be event-driven and run immediately after each file is uploaded. Which approach is most efficient?

A.Use S3 event notification to trigger an AWS Glue job

B.Use an S3 event notification to invoke a Lambda function that converts the file

C.Use an Amazon EMR cluster running Spark to process files as they arrive

D.Use Amazon Athena CREATE TABLE AS SELECT (CTAS) on a schedule

AnswerA

Glue jobs can be triggered by S3 events and efficiently convert to Parquet with partitioning.

Why this answer

AWS Glue jobs can be triggered directly by S3 event notifications, enabling event-driven, serverless transformation of CSV to Parquet with partitioning by date. Glue is optimized for this batch ETL workload, handling schema inference and partitioning efficiently without managing infrastructure, making it the most efficient choice for immediate, per-file transformation.

Exam trap

The trap here is that candidates often choose Lambda for its simplicity and event-driven nature, failing to recognize its execution limits and lack of native support for complex transformations like Parquet conversion with partitioning, which Glue is specifically designed to handle.

How to eliminate wrong answers

Option B is wrong because Lambda functions have a maximum execution time of 15 minutes and a 10 GB memory limit, making them unsuitable for converting large CSV files to Parquet, especially with partitioning logic that may require significant compute and memory. Option C is wrong because an Amazon EMR cluster running Spark is overkill for per-file transformations; it incurs startup latency and ongoing cluster costs, and is designed for large-scale batch processing, not event-driven, single-file triggers. Option D is wrong because Athena CTAS is a query-based operation that runs on a schedule, not event-driven; it scans the entire source data each time, which is inefficient for incremental file arrivals and cannot be triggered immediately per file upload.

Full explanation →

872

MCQhard

A healthcare company processes patient records in near-real-time using Amazon Kinesis Data Streams. Each record contains sensitive personal health information (PHI). The data must be encrypted at rest and in transit. The company also needs to audit access to the data. The data engineer is designing the ingestion pipeline. Which combination of services and configurations meets these requirements?

A.Use Kinesis Data Firehose to deliver data to S3 with SSE-S3, and enable CloudTrail for S3.

B.Use Kinesis Data Streams with TLS and enable CloudTrail for auditing. Do not enable SSE.

C.Use Kinesis Data Streams with SSE-KMS and TLS, and enable CloudTrail for data events.

D.Use Kinesis Data Streams with SSE-KMS and TLS. Do not enable any auditing.

AnswerC

Provides encryption at rest and in transit, plus auditing.

Why this answer

Kinesis Data Streams supports server-side encryption (SSE) using AWS KMS for at-rest encryption, and TLS for in-transit. CloudTrail can log Kinesis API calls for auditing. Option A lacks encryption at rest.

Option B lacks auditing. Option D is wrong because S3 does not replace Kinesis for streaming.

Full explanation →

873

MCQeasy

A data engineer needs to ingest data from an external HTTP API into Amazon S3. The API returns JSON data for a list of users, updated hourly. The engineer wants to use a serverless solution with minimal operational overhead. Which AWS service should the engineer use?

A.Amazon Kinesis Data Firehose with a custom HTTP endpoint.

B.AWS Lambda function triggered by CloudWatch Events.

C.Amazon AppFlow with an HTTP connector on a scheduled flow.

D.AWS Glue ETL job triggered by EventBridge.

AnswerC

AppFlow is serverless and designed for API ingestion.

Why this answer

Amazon AppFlow with an HTTP connector on a scheduled flow is the correct choice because it provides a fully managed, serverless integration that directly connects to external HTTP APIs, retrieves JSON data, and writes it to Amazon S3 on a scheduled basis (e.g., hourly) without requiring any custom code or infrastructure management. This minimizes operational overhead while meeting the ingestion requirements.

Exam trap

The trap here is that candidates often assume AWS Lambda is the default serverless choice for any custom integration, overlooking that AppFlow provides a purpose-built, no-code solution for SaaS and HTTP API ingestion with lower operational overhead.

How to eliminate wrong answers

Option A is wrong because Amazon Kinesis Data Firehose does not support a custom HTTP endpoint as a source; it can only ingest data from Kinesis Data Streams, Amazon CloudWatch, AWS IoT, or custom sources via the Kinesis Agent, not directly from an external HTTP API. Option B is wrong because while an AWS Lambda function triggered by CloudWatch Events can poll an HTTP API and write to S3, it requires custom code for HTTP requests, error handling, and data transformation, increasing operational overhead compared to a managed service like AppFlow. Option D is wrong because AWS Glue ETL jobs are designed for batch data transformation and processing, not for direct ingestion from external HTTP APIs; they would require a custom script to fetch the API data, adding complexity and overhead.

Full explanation →

874

MCQeasy

A data engineer needs to ingest on-premises CSV files into Amazon S3 every hour. The files are less than 1 GB each. Which service is the most cost-effective and requires the least operational overhead?

A.AWS DataSync

B.Amazon Kinesis Data Firehose

C.AWS Snowball Edge

D.AWS Database Migration Service (DMS)

AnswerA

DataSync automates scheduled transfers from on-premises to S3.

Why this answer

AWS DataSync is the most cost-effective and least overhead option for scheduled, recurring transfers of on-premises CSV files to S3. It provides a simple agent-based setup, supports hourly scheduling, and handles files under 1GB efficiently without complex configuration. In contrast, Amazon Kinesis Data Firehose is designed for streaming data ingestion, not batch file transfers; AWS Snowball Edge is intended for large-scale offline data migrations, not hourly incremental transfers; and AWS Database Migration Service (DMS) is specialized for migrating databases, not file transfers.

Full explanation →

875

MCQmedium

A data engineer needs to store JSON documents that are accessed by a key-value pattern. The workload requires single-digit millisecond latency at any scale. Which AWS service is most appropriate?

A.Amazon DocumentDB (with MongoDB compatibility)

B.Amazon RDS for PostgreSQL

C.Amazon DynamoDB

D.Amazon Neptune

AnswerC

Key-value and document store with consistent low latency.

Why this answer

Amazon DynamoDB is a fully managed NoSQL key-value and document database that delivers single-digit millisecond latency at any scale. It is optimized for key-value access patterns, making it the ideal choice for storing and retrieving JSON documents by a primary key with consistent low latency.

Exam trap

The trap here is that candidates may confuse DocumentDB's document storage capability with DynamoDB's key-value performance, overlooking that DocumentDB is not designed for single-digit millisecond latency at any scale, especially under high throughput.

How to eliminate wrong answers

Option A is wrong because Amazon DocumentDB is a document database designed for MongoDB workloads, but it does not guarantee single-digit millisecond latency at any scale; its performance can vary with query complexity and indexing. Option B is wrong because Amazon RDS for PostgreSQL is a relational database that requires schema definition and is not optimized for key-value access patterns; it incurs higher latency due to SQL parsing and ACID overhead. Option D is wrong because Amazon Neptune is a graph database built for highly connected data and graph queries (e.g., using Gremlin or SPARQL), not for simple key-value lookups, and its latency profile is not designed for single-digit millisecond key-value access at scale.

Full explanation →

876

MCQmedium

A data engineer is designing a data lake on Amazon S3. The data is accessed frequently for the first 30 days, then rarely after that. The engineer needs to minimize storage costs while ensuring data is available within minutes for the first 30 days and can be retrieved within 12 hours after that. Which lifecycle policy should be applied?

A.Transition to S3 One Zone-IA after 30 days.

B.Transition to S3 Standard-IA after 30 days.

C.Transition to S3 Glacier Deep Archive after 30 days.

D.Transition to S3 Glacier Flexible Retrieval after 30 days.

AnswerC

Cost-effective for rarely accessed data with 12-hour retrieval.

Why this answer

S3 Glacier Deep Archive offers the lowest storage cost for data that is rarely accessed after 30 days, and its retrieval time (within 12 hours) matches the requirement. The lifecycle policy transitions objects from S3 Standard (or S3 Intelligent-Tiering) to S3 Glacier Deep Archive after 30 days, minimizing costs while meeting the 12-hour retrieval window.

Exam trap

AWS often tests the distinction between retrieval time and cost, leading candidates to choose S3 Glacier Flexible Retrieval (Option D) because it is a 'Glacier' tier, but they overlook that Deep Archive is cheaper and still meets the 12-hour retrieval requirement.

How to eliminate wrong answers

Option A is wrong because S3 One Zone-IA is designed for infrequently accessed data that can be recreated if lost, but it does not provide the lowest cost for long-term archival and its retrieval is immediate, not within 12 hours. Option B is wrong because S3 Standard-IA is for infrequently accessed data with immediate retrieval, but it is more expensive than Glacier Deep Archive for data that is rarely accessed after 30 days. Option D is wrong because S3 Glacier Flexible Retrieval offers retrieval times from minutes to hours (typically 1-5 minutes for expedited, 3-5 hours for standard), but it is more expensive than Glacier Deep Archive and does not meet the 12-hour retrieval requirement as precisely as Deep Archive.

Full explanation →

877

MCQeasy

A team uses Amazon Kinesis Data Analytics to process streaming data. They notice that the application's output is delayed. Which AWS service can be used to monitor the application's performance and identify bottlenecks?

A.AWS CloudTrail

B.Amazon CloudWatch

C.Amazon Athena

D.AWS X-Ray

AnswerB

CloudWatch monitors Kinesis Data Analytics with metrics like MillisBehindLatest and CPU utilization.

Why this answer

(Amazon CloudWatch) is correct because CloudWatch provides metrics and logs for monitoring Kinesis Data Analytics application performance, such as CPU utilization, memory usage, and throughput, helping to identify bottlenecks causing output delays. Option A (AWS CloudTrail) is used for auditing API calls, not performance monitoring. Option C (Amazon Athena) is an interactive query service for analyzing data in S3, not for monitoring real-time streaming applications.

Option D (AWS X-Ray) traces requests through applications but is not the primary tool for monitoring Kinesis Data Analytics performance.

Full explanation →

878

MCQmedium

A company uses Amazon Kinesis Data Firehose to deliver streaming data to Amazon S3. The data is in JSON format. The delivery stream is configured with a buffer size of 5 MB and a buffer interval of 60 seconds. However, the data engineer notices that S3 objects are being created with sizes much smaller than 5 MB. What is a likely cause?

A.The data is being compressed before delivery, reducing object size.

B.The incoming data rate is too low, causing the buffer interval to trigger before reaching the buffer size.

C.The data transformation lambda is splitting records into smaller ones.

D.The S3 bucket is configured with a lifecycle policy that splits objects.

AnswerB

Buffer interval triggers first.

Why this answer

Kinesis Data Firehose delivers data to S3 when either the buffer size (5 MB) or the buffer interval (60 seconds) is reached, whichever occurs first. If the incoming data rate is low, the buffer interval will expire before accumulating 5 MB of data, resulting in smaller S3 objects.

Exam trap

The trap here is that candidates may assume the buffer size is a hard minimum that must be reached before delivery, but Firehose uses an 'or' condition between buffer size and buffer interval, so low data rate causes interval-based delivery of small objects.

How to eliminate wrong answers

Option A is wrong because compression reduces the size of data after buffering, but the buffer size limit is based on the uncompressed data; compression does not cause smaller objects to be created before the buffer interval triggers. Option C is wrong because a data transformation Lambda can modify records but does not inherently split records into smaller ones; it processes records as a batch and returns them, and any splitting would be a custom logic not default behavior. Option D is wrong because S3 lifecycle policies manage object transitions or deletions after objects are created; they do not split objects during delivery.

Full explanation →

879

MCQmedium

Refer to the exhibit. An IAM policy for an AWS Lambda function. The Lambda function is triggered by an S3 event (object created) and needs to read from a Kinesis stream. However, the function fails with access denied when trying to read from Kinesis. What is the most likely cause?

A.The Lambda function is not in the same region as the Kinesis stream

B.The Lambda function does not have permission to list S3 buckets

C.The Kinesis stream is encrypted with a customer managed KMS key, and the Lambda function lacks kms:Decrypt permission

D.The S3 bucket policy denies access to the Lambda function

AnswerC

If the stream uses SSE-KMS, Lambda needs kms:Decrypt on the key.

Why this answer

When a Kinesis stream is encrypted with a customer managed KMS key, the Lambda function must have the `kms:Decrypt` permission on that key to read data from the stream. Without this permission, the Lambda function will receive an access denied error even if it has the necessary Kinesis actions (e.g., `kinesis:GetRecords`) allowed in its IAM policy. The S3 event trigger only invokes the function; it does not grant Kinesis access.

Exam trap

The DEA-C01 exam often tests the interaction between Kinesis SSE-KMS and Lambda IAM permissions, trapping candidates who assume that Kinesis read permissions alone are sufficient without considering the KMS key policy.

How to eliminate wrong answers

Option A is wrong because Lambda functions can access Kinesis streams across regions as long as the IAM permissions and network connectivity (e.g., VPC endpoints) are correctly configured; region mismatch does not inherently cause access denied. Option B is wrong because the Lambda function is triggered by an S3 event and only needs permission to read from Kinesis; listing S3 buckets is irrelevant to the Kinesis read failure. Option D is wrong because the S3 bucket policy controls access to the S3 bucket itself, not to Kinesis; the error occurs when reading from Kinesis, not when the S3 event triggers the function.

Full explanation →

880

MCQeasy

A data engineer needs to audit data access events in Amazon S3. Which AWS service should be used to record and monitor API calls for S3 buckets?

A.AWS CloudTrail

B.AWS Config

C.Amazon Macie

D.Amazon GuardDuty

AnswerA

CloudTrail records API calls for auditing.

Why this answer

(AWS CloudTrail) is correct because it records API calls for S3 buckets, enabling auditing and monitoring of data access events. Option B (AWS Config) is incorrect as it tracks resource configuration changes, not API calls. Option C (Amazon Macie) is incorrect because it discovers sensitive data using machine learning.

Option D (Amazon GuardDuty) is incorrect as it is a threat detection service.

Full explanation →

881

Matchingmedium

Match each AWS storage class to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Frequent access, low latency

Auto-moves data between tiers

Archive retrieval in minutes to hours

Lowest cost, 12-hour retrieval

Infrequent access, single AZ

Why these pairings

Correct matches: S3 Standard for frequently accessed data, S3 Intelligent-Tiering for automatic cost optimization, and S3 Glacier for archival. Common confusions involve mixing up Standard-IA and Glacier Deep Archive definitions.

Full explanation →

882

MCQhard

A company uses AWS Glue to transform data in an S3 data lake. The transformation logic requires joining two large datasets that are each hundreds of gigabytes. The Glue job runs out of memory. Which configuration change will most likely resolve this issue?

A.Repartition the data before the join.

B.Increase the number of DPUs for the Glue job.

C.Use a different file format like Parquet with compression.

D.Use the 'spark.sql.autoBroadcastJoinThreshold' setting to broadcast the smaller table.

AnswerB

More DPUs provide more memory and parallelism, helping the join fit in memory.

Why this answer

Increasing the number of DPUs provides more memory for the join operation. Glue automatically distributes data across workers, so more workers mean more total memory.

Full explanation →

883

MCQhard

A company uses AWS Lake Formation to manage access to data in a data lake. The data engineer needs to grant a user the ability to query tables in the 'sales' database using Amazon Athena, but only when the user's IP address is within the corporate network (10.0.0.0/8). Which combination of actions should the data engineer take?

A.Grant Lake Formation permissions on the tables and attach an S3 bucket policy with aws:SourceIp condition

B.Grant Lake Formation permissions on the tables and attach an IAM policy to the user with aws:SourceIp condition

C.Use an S3 VPC endpoint and grant Lake Formation permissions on the tables

D.Grant Lake Formation permissions on the tables and configure a network ACL in the VPC

AnswerB

Correct combination.

Why this answer

Lake Formation permissions are needed to grant query access to the tables in the 'sales' database, and an IAM policy attached to the user with a condition key `aws:SourceIp` restricts Athena access to the corporate IP range (10.0.0.0/8). Option A is incorrect because S3 bucket policies with `aws:SourceIp` cannot be used to restrict Athena queries through Lake Formation; Lake Formation manages access at a higher level. Option C is incorrect because using an S3 VPC endpoint alone does not enforce IP-based restrictions; it only restricts network traffic to the VPC.

Option D is incorrect because network ACLs operate at the subnet level and do not control access to specific Lake Formation resources or Athena queries.

Full explanation →

884

Multi-Selectmedium

A data engineer is designing a data lake on Amazon S3 that will be accessed by multiple AWS Glue ETL jobs. The engineer needs to ensure that the data is organized efficiently for querying and that sensitive columns are masked for certain users. Which TWO actions should the engineer take? (Choose TWO.)

Select 2 answers

A.Use AWS Lake Formation to define column-level permissions for sensitive data.

B.Configure AWS Glue Data Catalog to automatically mask sensitive columns in table definitions.

C.Organize data in S3 using a partition structure like 'year=YYYY/month=MM/day=DD/region=XX/'.

D.Use S3 object tags to label sensitive data and apply bucket policies to restrict access.

E.Implement S3 lifecycle policies to transition sensitive data to S3 Glacier after 30 days.

AnswersA, C

Lake Formation provides column-level security to mask sensitive columns.

Why this answer

AWS Lake Formation provides fine-grained access control at the column level, allowing you to mask or restrict sensitive columns (e.g., PII) for specific IAM roles or users without altering the underlying data in S3. This is achieved through Lake Formation’s column-level permissions and data filtering, which integrate directly with the AWS Glue Data Catalog and query engines like Athena and Redshift Spectrum.

Exam trap

The trap here is that candidates often confuse S3 object tags or bucket policies with fine-grained column-level access control, or assume the Glue Data Catalog can natively mask columns, when in fact only Lake Formation provides that capability.

Full explanation →

885

MCQeasy

A data engineer is setting up an Amazon Kinesis Data Firehose delivery stream to load data into Amazon Redshift. The data is coming from an application that produces JSON records. The engineer needs to transform the data to match the Redshift table schema. Which approach is the MOST cost-effective and requires the least operational overhead?

A.Use AWS Glue as a transformation step between Firehose and Redshift, with a trigger on S3.

B.Use Kinesis Data Firehose with direct PUT to Redshift and rely on Redshift's COPY command to transform.

C.Configure a Lambda function in the Firehose delivery stream to transform records before delivery.

D.Use the Kinesis Client Library (KCL) to consume the stream, transform in an EC2 instance, and then load to Redshift.

AnswerC

Firehose supports Lambda for data transformation with minimal overhead.

Why this answer

Kinesis Data Firehose natively supports invoking a Lambda function as a transformation step within the delivery stream. This allows the engineer to write a simple Lambda function that parses the incoming JSON records and transforms them to match the Redshift table schema, all without provisioning or managing any additional infrastructure. This approach is the most cost-effective (pay per invocation) and requires the least operational overhead since Firehose handles the orchestration, retries, and delivery to Redshift automatically.

Exam trap

The trap here is that candidates often overestimate the transformation capabilities of Redshift's COPY command, mistakenly believing it can perform complex record-level transformations, when in fact it only supports basic data mapping and format parsing, not arbitrary JSON restructuring.

How to eliminate wrong answers

Option A is wrong because inserting AWS Glue as an intermediate step between Firehose and Redshift introduces unnecessary complexity, cost (Glue jobs run on a per-DPU-hour basis), and latency, as Glue is designed for batch ETL, not real-time streaming transformations. Option B is wrong because Redshift's COPY command does not perform record-level transformations; it only maps source fields to target columns and can apply basic data format conversions (e.g., JSON parsing via 'jsonpaths'), but it cannot restructure or compute new fields from the JSON payload. Option D is wrong because using the Kinesis Client Library (KCL) on an EC2 instance requires manual provisioning, scaling, and management of the EC2 fleet, which incurs significant operational overhead and cost compared to the serverless Lambda integration within Firehose.

Full explanation →

886

MCQeasy

A startup uses Amazon S3 to store user-uploaded images. The images are accessed frequently for the first week after upload, but after that they are rarely accessed. The company wants to optimize storage costs without compromising availability. The data engineer must implement a lifecycle policy to transition objects to a more cost-effective storage class after 30 days. The objects must be retrievable within minutes. Which storage class should the engineer transition the objects to?

A.S3 One Zone-Infrequent Access

B.S3 Standard

C.S3 Standard-Infrequent Access

D.S3 Glacier Instant Retrieval

AnswerC

Cost-effective for infrequent access with rapid retrieval.

Why this answer

S3 Standard-Infrequent Access (S3 Standard-IA) is the correct choice because it offers a per-GB storage cost lower than S3 Standard while maintaining high durability (99.999999999%) and availability (99.9%), with retrieval times in milliseconds. The lifecycle policy transitions objects after 30 days, aligning with the access pattern where images are rarely accessed after the first week, and the requirement for retrieval within minutes is satisfied by S3 Standard-IA's instant access.

Exam trap

The trap here is that candidates confuse 'retrievable within minutes' with S3 Glacier Instant Retrieval, overlooking that S3 Standard-IA also provides immediate access and is more cost-effective for data that is rarely accessed but not archival, especially with a 30-day transition window that avoids the 90-day minimum storage charge of Glacier Instant Retrieval.

How to eliminate wrong answers

Option A is wrong because S3 One Zone-Infrequent Access stores data in a single Availability Zone, which compromises availability and durability (99.99% object durability) and does not meet the requirement of 'without compromising availability'. Option B is wrong because S3 Standard is the default storage class with higher storage costs, and transitioning to it would not optimize costs; it is intended for frequently accessed data, not for rarely accessed objects after 30 days. Option D is wrong because S3 Glacier Instant Retrieval, while offering millisecond retrieval, is designed for long-term archival with a minimum storage duration charge of 90 days, making it cost-ineffective for a 30-day transition and not aligned with the 'rarely accessed' pattern described.

Full explanation →

887

MCQmedium

A company is building a data lake on Amazon S3 and wants to ingest data from multiple AWS services (CloudTrail, VPC Flow Logs, and ALB logs). The data should be stored in a central S3 bucket with a common partitioning scheme. Which service can be used to collect and centralize this data with minimal configuration?

A.Use AWS Data Pipeline to copy logs from each source S3 bucket to the central bucket.

B.Use AWS Glue to crawl the logs from each source and write to a central S3 bucket.

C.Set up Amazon Kinesis Data Firehose to ingest logs from each service and write to S3.

D.Configure each source service to deliver logs directly to the central S3 bucket.

AnswerD

CloudTrail, VPC Flow Logs, and ALB can all deliver to S3 directly.

Why this answer

CloudTrail, VPC Flow Logs, and ALB logs can each be configured to deliver logs directly to a specified S3 bucket, including a central bucket, with no intermediary service required. This approach minimizes configuration overhead and avoids data movement costs, as each service writes natively to S3 using its own built-in delivery mechanism.

Exam trap

The trap here is that candidates often overcomplicate the solution by choosing a data pipeline or ETL service (like Data Pipeline or Glue) when the simplest and most efficient method is to configure each source service to write directly to the central S3 bucket, leveraging native AWS integrations.

How to eliminate wrong answers

Option A is wrong because AWS Data Pipeline is designed for scheduled data movement and transformation between data stores, not for real-time log ingestion from multiple AWS services; it would require custom pipeline definitions and adds unnecessary complexity. Option B is wrong because AWS Glue is an ETL service for crawling, cataloging, and transforming data, not a log collection or delivery service; it cannot natively ingest logs from CloudTrail, VPC Flow Logs, or ALB logs without first having the data in S3. Option C is wrong because Amazon Kinesis Data Firehose can ingest streaming data but does not natively subscribe to CloudTrail, VPC Flow Logs, or ALB logs; these services do not send data to Firehose directly, requiring additional setup like CloudWatch Logs subscriptions or custom agents.

Full explanation →

888

MCQmedium

A data engineer needs to store semi-structured JSON data that is accessed infrequently but must be retrievable within minutes. The data is generated by IoT devices and each object is about 500 KB. The engineer wants the most cost-effective storage solution. Which AWS service should be used?

A.Amazon S3 Glacier Deep Archive

B.Amazon S3 Standard

C.Amazon S3 Standard-Infrequent Access (S3 Standard-IA)

D.Amazon Elastic Block Store (EBS)

AnswerC

Cost-effective for infrequent access with rapid retrieval.

Why this answer

Amazon S3 Standard-Infrequent Access (S3 Standard-IA) is the correct choice because it is designed for data that is accessed infrequently but requires rapid retrieval (within minutes). The 500 KB JSON objects from IoT devices fit the use case, and S3 Standard-IA offers lower storage costs than S3 Standard while maintaining the same low-latency retrieval performance, making it the most cost-effective option for this scenario.

Exam trap

The trap here is that candidates often confuse 'infrequent access' with 'archival' and choose Glacier Deep Archive, overlooking the retrieval time requirement of 'within minutes' which S3 Standard-IA satisfies but Glacier does not.

How to eliminate wrong answers

Option A is wrong because Amazon S3 Glacier Deep Archive is intended for long-term archival data with retrieval times of 12 hours or more, not within minutes, and its retrieval costs are higher for urgent access. Option B is wrong because Amazon S3 Standard is optimized for frequently accessed data with higher storage costs, making it less cost-effective for infrequently accessed IoT data. Option D is wrong because Amazon Elastic Block Store (EBS) is a block-level storage service designed for EC2 instances, not for storing semi-structured JSON objects as a standalone data store, and it incurs costs even when not in use.

Full explanation →

889

MCQhard

A company is running a critical Amazon RDS for MySQL database. They need to implement a backup strategy that allows point-in-time recovery (PITR) with a recovery time objective (RTO) of 15 minutes and a recovery point objective (RPO) of 5 minutes. Which solution meets these requirements?

A.Enable automated backups with 1-day retention and enable Multi-AZ deployment

B.Use cross-Region automated backups and promote the replica

C.Take manual snapshots every 5 minutes and restore from the latest snapshot

D.Enable a Read Replica and promote it during a disaster

AnswerA

Automated backups provide transaction logs every 5 minutes; Multi-AZ failover is fast.

Why this answer

Automated backups enable point-in-time recovery using transaction logs that record changes every 5 minutes, achieving an RPO of 5 minutes. Multi-AZ deployment provides automatic failover to a standby instance, achieving an RTO of typically 1-2 minutes, well within the 15-minute RTO. Option B is incorrect because cross-Region automated backups replicate data to another region, but the promotion of a replica in another region can take longer than 15 minutes, and replication lag may cause RPO to exceed 5 minutes.

Option C is incorrect because manual snapshots are taken at specific points in time and do not include transaction logs; even if taken every 5 minutes, restoring from a snapshot would not provide point-in-time recovery to any point within those 5 minutes, and the restore time is typically longer than 15 minutes. Option D is incorrect because a Read Replica is an asynchronous copy; promoting a read replica to a primary instance can take several minutes, and the RPO may be higher due to replication lag, thus not meeting the 5-minute RPO or 15-minute RTO.

Full explanation →

890

MCQmedium

A data engineer is configuring an Amazon Redshift cluster to encrypt data at rest. The company policy requires that encryption keys be stored in AWS CloudHSM. Which integration should the engineer use to meet this requirement?

A.Use AWS KMS with a customer managed key.

B.Configure Redshift to use an HSM for encryption.

C.Enable encryption using the AWS Redshift SSL/TLS feature.

D.Use Redshift automatic key rotation.

AnswerB

Redshift supports integration with CloudHSM for key storage.

Why this answer

The correct integration is to configure Amazon Redshift to use an HSM (Hardware Security Module) for encryption. Amazon Redshift supports AWS CloudHSM as an external HSM to store encryption keys. Option A (AWS KMS with a customer managed key) is not the integration for CloudHSM; it uses KMS, not CloudHSM.

Option C (SSL/TLS) is for encryption in transit, not at rest. Option D (automatic key rotation) is a feature of Redshift encryption but does not integrate with CloudHSM for key storage.

Full explanation →

891

MCQeasy

A data engineer needs to transfer 50 TB of historical data from an on-premises HDFS cluster to Amazon S3. The network bandwidth is limited to 100 Mbps. The transfer must be completed within one week. Which service should be used?

A.AWS DataSync

B.AWS Snowball

C.Amazon CloudFront

D.AWS Database Migration Service (DMS)

AnswerB

Physical device for large data transfers.

Why this answer

AWS Snowball is the correct choice because transferring 50 TB over a 100 Mbps network would take approximately 46 days (50 TB * 8 bits/byte / 100 Mbps / 86400 seconds/day), far exceeding the one-week deadline. Snowball provides a physical storage device that can be shipped to the on-premises location, allowing data to be loaded locally and shipped to AWS, bypassing network bandwidth constraints entirely.

Exam trap

The trap here is that candidates may underestimate the time required for online transfer and choose AWS DataSync, failing to calculate that 50 TB at 100 Mbps takes over 46 days, not one week, and overlooking Snowball's physical shipping approach for offline data transfer.

How to eliminate wrong answers

Option A is wrong because AWS DataSync is designed for online data transfer over the network, and at 100 Mbps, it would take over 46 days to transfer 50 TB, which does not meet the one-week requirement. Option C is wrong because Amazon CloudFront is a content delivery network (CDN) for caching and distributing content to edge locations, not a data transfer service for ingesting large volumes of historical data into S3. Option D is wrong because AWS Database Migration Service (DMS) is specialized for migrating databases (e.g., relational, NoSQL) and does not support transferring HDFS files or large-scale file-based data to S3.

Full explanation →

892

MCQmedium

A company stores sensitive data in Amazon S3 and requires that all data be encrypted at rest. The data is accessed by multiple AWS services. Which solution meets the encryption requirement with the LEAST operational overhead?

A.Use server-side encryption with AWS KMS (SSE-KMS)

B.Use client-side encryption with AWS KMS

C.Use server-side encryption with customer-provided keys (SSE-C)

D.Enable S3 default encryption with SSE-S3

AnswerD

Least overhead as AWS manages the keys.

Why this answer

Enabling S3 default encryption with SSE-S3 provides server-side encryption automatically without any key management overhead. Option A is wrong because SSE-KMS requires managing KMS keys. Option B is wrong because client-side encryption requires managing keys on the client side.

Option C is wrong because SSE-C requires managing your own keys.

Full explanation →

893

MCQhard

A company runs a MySQL-compatible Amazon Aurora database for its e-commerce platform. The database experiences high write latency during peak hours. The application performs frequent INSERT and UPDATE operations on a table with 50 million rows. The DB instance is db.r5.large with 500 GB of Provisioned IOPS storage. A recent performance analysis shows that the average queue depth is consistently above 32 and write latency exceeds 50 ms. The company needs to reduce write latency without changing the application code. What should a data engineer do?

A.Enable Aurora Auto Scaling to automatically add reader instances.

B.Convert the cluster to Aurora Serverless v2 to automatically scale compute capacity.

C.Resize the DB instance to a larger instance type such as db.r5.xlarge.

D.Create a read replica and configure the application to offload read queries.

AnswerC

Increasing instance size provides more CPU and memory, reducing queue depth and write latency.

Why this answer

The high queue depth (consistently above 32) and write latency exceeding 50 ms indicate that the current db.r5.large instance is CPU or I/O constrained for the write workload. Resizing to a larger instance type such as db.r5.xlarge increases the available vCPUs, memory, and network bandwidth, which directly reduces queue depth and write latency by allowing more concurrent write operations to be processed. This solution does not require application code changes and addresses the root cause of insufficient compute capacity for the frequent INSERT and UPDATE operations on the 50-million-row table.

Exam trap

The trap here is that candidates confuse read scaling solutions (Auto Scaling, read replicas) with write performance improvements, or assume that Aurora Serverless v2 automatically solves all performance issues without considering that write latency is often tied to instance size and storage configuration.

How to eliminate wrong answers

Option A is wrong because Aurora Auto Scaling adds reader instances to handle read traffic, not write traffic; write operations are always handled by the writer instance, so adding readers does not reduce write latency. Option B is wrong because converting to Aurora Serverless v2 changes the scaling model but does not guarantee lower write latency; it may even introduce cold start delays or scaling cooldown periods that could worsen latency during peak hours, and it does not directly address the queue depth issue caused by insufficient instance resources. Option D is wrong because creating a read replica and offloading read queries does not affect write latency; write operations still go to the writer instance, which remains the bottleneck.

Full explanation →

894

MCQeasy

A data engineer needs to ingest data from an Amazon RDS for PostgreSQL database into Amazon S3 on a daily basis. The data volume is approximately 500 GB per day. Which service is most appropriate for this task?

A.AWS Database Migration Service (DMS) with continuous replication

B.Amazon Athena with federated query to RDS

C.Amazon EMR with Spark job

D.AWS Glue with a scheduled ETL job

AnswerD

AWS Glue can run scheduled ETL jobs to extract from RDS and load to S3.

Why this answer

AWS Glue with a scheduled ETL job is the most appropriate choice because it provides a fully managed, serverless ETL service that can efficiently extract 500 GB of data daily from Amazon RDS for PostgreSQL and write it to Amazon S3. Glue can handle large volumes via its distributed Spark-based execution, and scheduling ensures the daily cadence without manual intervention.

Exam trap

The trap here is that candidates often overcomplicate by choosing EMR (Option C) due to familiarity with Spark, overlooking that AWS Glue provides the same Spark-based ETL capability in a fully managed, serverless form that is more cost-effective and simpler for scheduled batch ingestion.

How to eliminate wrong answers

Option A is wrong because AWS DMS with continuous replication is designed for ongoing, near-real-time data synchronization or migration, not for a daily batch ingestion of 500 GB; continuous replication would incur unnecessary overhead and cost for a scheduled daily load. Option B is wrong because Amazon Athena with federated query to RDS is an interactive query engine that can read data directly from RDS, but it is not designed for ingesting or moving large volumes of data into S3; it would require additional steps to write results and is inefficient for 500 GB daily transfers. Option C is wrong because Amazon EMR with a Spark job is a valid but overkill and more complex option; it requires provisioning and managing clusters, whereas AWS Glue offers a simpler, serverless alternative that is better suited for this scheduled batch ETL workload.

Full explanation →

895

Multi-Selectmedium

A company is using Amazon S3 to store sensitive financial data. They need to ensure that all objects are encrypted at rest. Which TWO methods can achieve this? (Choose TWO.)

Select 2 answers

A.Enable S3 Transfer Acceleration on the bucket.

B.Apply a bucket policy that denies PutObject without encryption.

C.Use SSE-KMS to encrypt objects with AWS KMS.

D.Use client-side encryption before uploading objects.

E.Enable default encryption on the S3 bucket using SSE-S3.

AnswersC, E

SSE-KMS provides server-side encryption with customer-managed keys.

Why this answer

SSE-KMS (Server-Side Encryption with AWS Key Management Service) allows you to encrypt objects at rest in S3 using customer-managed or AWS-managed KMS keys. This provides envelope encryption, separate key management, and audit trails via AWS CloudTrail, meeting compliance requirements for sensitive financial data.

Exam trap

The trap here is that candidates might think client-side encryption (Option D) is not a valid method for encryption at rest, or they might confuse S3 Transfer Acceleration (Option A) with encryption, or believe that a bucket policy (Option B) alone encrypts objects rather than just enforcing encryption requirements.

Full explanation →

896

MCQmedium

A company uses AWS DMS to migrate a 2 TB PostgreSQL database to Amazon Aurora PostgreSQL. The migration is taking longer than expected due to the initial load. Which AWS service can be used to accelerate the initial load by transferring the database files directly?

A.AWS Snowball

B.Amazon S3 Transfer Acceleration

C.AWS Direct Connect

D.Amazon Kinesis Data Firehose

AnswerA

Snowball allows physical transfer of data, which can be faster than network transfer for very large datasets.

Why this answer

AWS Snowball is a petabyte-scale data transport solution that uses physical storage devices to transfer large amounts of data into and out of AWS. For a 2 TB PostgreSQL database, the initial load via DMS over the network can be slow due to bandwidth constraints, especially for large datasets. By using Snowball, you can export the database files (e.g., using pg_dump or physical file copy) to the device, ship it to AWS, and have the data loaded directly into Amazon Aurora PostgreSQL, bypassing the network bottleneck and significantly accelerating the initial load.

Exam trap

The trap here is that candidates may assume network-based acceleration services (like S3 Transfer Acceleration or Direct Connect) are sufficient for large migrations, overlooking the fact that physical data transport (Snowball) is the only option that completely avoids network transfer for the initial load.

How to eliminate wrong answers

Option B (Amazon S3 Transfer Acceleration) is wrong because it only speeds up uploads to S3 over the internet using optimized network paths and edge locations, but it does not transfer database files directly to Aurora PostgreSQL; DMS would still need to read from S3 and apply the data, which does not bypass the network transfer for the initial load. Option C (AWS Direct Connect) is wrong because it provides a dedicated network connection from on-premises to AWS, which can improve bandwidth and latency but still requires the full 2 TB to traverse the network; it does not eliminate the network transfer bottleneck for large initial loads. Option D (Amazon Kinesis Data Firehose) is wrong because it is a real-time streaming data ingestion service designed for streaming data (e.g., logs, events) into S3, Redshift, or Elasticsearch, not for bulk transferring database files for a migration; it cannot handle the initial load of a 2 TB database directly to Aurora PostgreSQL.

Full explanation →

897

MCQeasy

A data engineer needs to monitor Amazon DynamoDB table metrics to detect throttled requests. Which CloudWatch metric should the engineer set an alarm on?

A.ReadThrottleEvents

B.SuccessfulRequestLatency

C.ThrottledRequests

D.ConsumedWriteCapacityUnits

AnswerC

This metric directly indicates requests that were throttled.

Why this answer

`ThrottledRequests` is the specific Amazon CloudWatch metric that tracks the number of requests to a DynamoDB table that are throttled due to exceeding the provisioned throughput capacity. This metric directly reflects throttling events, making it the appropriate choice for setting an alarm to detect throttled requests.

Exam trap

The trap here is that candidates confuse `ThrottledRequests` with `ReadThrottleEvents` or `WriteThrottleEvents`, which are not actual CloudWatch metrics, leading them to select a plausible-sounding but incorrect option.

How to eliminate wrong answers

Option A is wrong because `ReadThrottleEvents` is not a valid CloudWatch metric for DynamoDB; the correct metric for throttled reads is `ReadThrottleEvents` is a misconception, as DynamoDB exposes `ThrottledRequests` and `ThrottledGetRecords` for streams, but not a separate read-only throttle metric. Option B is wrong because `SuccessfulRequestLatency` measures the latency of successful requests, not throttling events, and is used for performance monitoring rather than detecting throttled requests. Option D is wrong because `ConsumedWriteCapacityUnits` tracks the amount of write capacity consumed, not throttling events, and is used for capacity planning, not for alerting on throttled requests.

Full explanation →

898

MCQmedium

A company uses AWS DMS to migrate data from an on-premises Oracle database to Amazon RDS for PostgreSQL. The migration is ongoing with continuous replication. The data engineer notices that some changes are not being captured in the target database. What is the MOST likely cause?

A.The VPC peering connection between on-premises and AWS is down.

B.The DMS task's table mapping is incorrectly configured.

C.DMS is not publishing task logs to CloudWatch Logs.

D.The source Oracle database is not configured to retain archived redo logs for a sufficient period.

AnswerD

DMS requires archived logs to capture changes; if logs are purged, changes are lost.

Why this answer

In AWS DMS continuous replication (CDC), the service reads changes from the source Oracle database's archived redo logs. If the logs are rotated or deleted before DMS has a chance to process them, changes are lost. Option D is correct because insufficient retention of archived redo logs is the most likely cause of missing changes in the target.

Exam trap

The trap here is that candidates often assume missing changes are due to network or configuration errors (like VPC or table mapping), but the real issue is the source database's log retention policy, which is a subtle but critical requirement for CDC with DMS.

How to eliminate wrong answers

Option A is wrong because a down VPC peering connection would cause a complete connectivity failure, not selective missing changes; DMS would report a connection error. Option B is wrong because incorrect table mapping would cause specific tables or columns to be missing entirely, not intermittent missing changes during CDC. Option C is wrong because DMS not publishing logs to CloudWatch Logs affects monitoring and troubleshooting, not the actual data capture or replication process.

Full explanation →

899

MCQeasy

A company is using Amazon Kinesis Data Firehose to ingest clickstream data from a website into an S3 bucket. The data is then analyzed using Amazon Athena. Recently, the company noticed that Athena queries are returning incomplete results for the last 30 minutes of data. The Firehose delivery stream is configured to buffer data for 60 seconds or 5 MB before delivering to S3. The S3 bucket has a lifecycle policy that transitions objects to Amazon S3 Glacier after 30 days. The IAM role for Firehose has permissions to write to S3 and access a CloudWatch Logs group. The engineer checks the Firehose monitoring and sees that the delivery rate is healthy, but the 'S3.Bytes' metric shows a spike in the last hour. The 'BackupToS3.Bytes' metric is zero. What is the MOST likely cause of the missing data?

A.The lifecycle policy is transitioning data before Athena can query it.

B.The backup is enabled and data is being sent to the backup bucket instead.

C.The data is still being buffered in Firehose and has not yet been delivered to S3.

D.The IAM role for Firehose does not have permissions to write to the S3 bucket.

AnswerC

The data is still being buffered in Firehose. With buffer settings of 60 seconds or 5 MB, data can be held for up to 60 seconds before delivery. Athena queries only see data that has been delivered to S3, so data still in the buffer is missing from query results.

Why this answer

The data is still being buffered in Firehose and has not yet been delivered to S3. The buffer settings (60 seconds or 5 MB) mean data can be held in the buffer for up to 60 seconds before being written to S3. For the last 30 minutes, some data may still be in the buffer and not yet delivered.

Athena queries only see data that has been delivered to S3. Option A (lifecycle policy) would not affect recent data. Option B (backup) is unrelated and the 'BackupToS3.Bytes' metric is zero, indicating backup is not active.

Option D (IAM permissions) would cause errors, not missing data.

Full explanation →

900

Multi-Selecteasy

A company is designing a data lake on Amazon S3. The data ingestion pipeline must handle both structured and unstructured data. The data must be cataloged for easy discovery. Which THREE services should be included in the solution? (Choose THREE.)

Select 3 answers

A.Amazon S3

B.AWS Glue Data Catalog

C.Amazon Athena

D.Amazon RDS

E.Amazon Redshift

AnswersA, B, C

S3 is the core storage for data lakes.

Why this answer

Amazon S3 is the core storage layer for the data lake, providing scalable, durable, and cost-effective object storage for both structured and unstructured data. AWS Glue Data Catalog acts as the central metadata repository, enabling data discovery and schema management across the data lake. Amazon Athena allows serverless querying of data directly from S3 using standard SQL, leveraging the Glue Data Catalog for schema-on-read, which is essential for easy discovery and analysis.

Exam trap

The trap here is that candidates often confuse Amazon Redshift as a data lake solution because it can query data in S3 via Redshift Spectrum, but it is not a cataloging service and does not handle unstructured data ingestion natively, making it incorrect for this specific requirement.

Full explanation →

AWS Certified Data Engineer Associate DEA-C01 (DEA-C01) — Questions 826–900