Courseiva

AWS Certified Data Engineer Associate DEA-C01 (DEA-C01) — Questions 901–975

1711 questions total · 23pages · All types, answers revealed

Take a mock examExam hub
Page 12

Page 13 of 23

Page 14
901
MCQeasy

A company wants to enforce that all data written to an S3 bucket is encrypted with a customer-managed AWS KMS key. The data engineer has created the KMS key and attached an S3 bucket policy. However, users are still able to upload objects without specifying the KMS key. What is the most likely cause?

A.The S3 bucket policy does not include a condition that denies s3:PutObject without the correct encryption
B.The S3 bucket has default encryption enabled with SSE-S3
C.The KMS key policy does not grant the users kms:Encrypt permission
D.The IAM role for the users does not have s3:PutObject permission
AnswerA

The bucket policy must have a deny condition.

Why this answer

The bucket policy must explicitly deny s3:PutObject if the encryption header does not match the required KMS key. Without this condition, users can upload objects without specifying the KMS key, even if the bucket has default encryption. Option B is wrong because default encryption with SSE-S3 does not enforce a customer-managed KMS key.

Option C is wrong because the KMS key policy grants encryption permissions, but the issue is that the bucket policy does not deny non-compliant uploads. Option D is wrong because the IAM role's s3:PutObject permission is not the issue; the issue is the lack of a condition in the bucket policy.

Full explanation →
902
MCQeasy

A data engineer needs to transform JSON data from a Kinesis Data Stream into Parquet format and store it in an S3 data lake. The transformation includes simple field mapping and data type conversions. Which AWS service is the most cost-effective for performing this transformation in near-real-time?

A.Amazon Athena with CTAS (CREATE TABLE AS SELECT)
B.AWS Lambda function triggered by Kinesis Data Firehose
C.AWS Glue ETL job
D.Amazon EMR with Spark Streaming
AnswerB

Lambda can be invoked by Firehose for record transformation and can output Parquet; it is serverless and cost-effective for near-real-time.

Why this answer

AWS Lambda functions triggered by Kinesis Data Firehose are the most cost-effective solution for near-real-time transformations because Lambda allows you to perform lightweight field mapping and data type conversions on streaming data with a pay-per-invocation model, while Firehose handles buffering, compression, and direct delivery to S3 in Parquet format. This serverless approach avoids the overhead and cost of provisioning clusters or running continuous jobs, making it ideal for simple transformations on high-frequency, low-latency streams.

Exam trap

The trap here is that candidates often choose AWS Glue ETL jobs or Amazon EMR because they associate them with data transformation, but the question specifies 'near-real-time' and 'most cost-effective' for simple transformations, which points to the serverless, pay-per-use Lambda integration with Firehose rather than provisioned cluster-based solutions.

How to eliminate wrong answers

Option A is wrong because Amazon Athena with CTAS is a batch query engine that reads data from S3, not a streaming ingestion service; it cannot process data from a Kinesis Data Stream in near-real-time and would require intermediate storage, adding latency and cost. Option C is wrong because AWS Glue ETL jobs are designed for batch processing and incur costs for DPU hours even when idle; they are not optimized for continuous, low-latency streaming transformations and would be overkill for simple field mapping. Option D is wrong because Amazon EMR with Spark Streaming requires provisioning and managing a cluster of EC2 instances, which incurs significant cost even for small workloads, and is more complex than necessary for simple transformations on a single Kinesis stream.

Full explanation →
903
MCQhard

A company is building a real-time analytics dashboard using Amazon Kinesis Data Streams and Amazon DynamoDB. The data engineer needs to ensure that the DynamoDB table can handle write spikes without throttling. Which approach is the most cost-effective?

A.Use DynamoDB Accelerator (DAX) to cache writes.
B.Use provisioned capacity with auto-scaling set to a maximum of 10,000 WCU.
C.Use an Amazon Lambda function to buffer writes and batch them to DynamoDB.
D.Use DynamoDB on-demand capacity mode.
AnswerD

On-demand scales instantly and is cost-effective for unpredictable workloads.

Why this answer

DynamoDB on-demand capacity mode automatically scales to handle write spikes without requiring capacity planning or management, making it the most cost-effective choice for unpredictable workloads like a real-time analytics dashboard. It charges per request, so you only pay for the writes you actually use, avoiding over-provisioning costs.

Exam trap

The trap here is that candidates often confuse DAX's read caching with write handling, or assume that auto-scaling provisioned capacity can handle sudden spikes instantly, when in reality it scales gradually and can still throttle during rapid bursts.

How to eliminate wrong answers

Option A is wrong because DAX is an in-memory cache for reads, not writes; it does not prevent write throttling. Option B is wrong because provisioned capacity with auto-scaling can still throttle during sudden spikes due to the lag in scaling up, and setting a maximum of 10,000 WCU may be insufficient or wasteful. Option C is wrong because using Lambda to buffer writes adds latency and complexity, and while it can batch writes, it does not eliminate the risk of throttling if the batch rate exceeds the table's capacity.

Full explanation →
904
MCQeasy

A data engineer needs to store time-series sensor data from thousands of IoT devices. The data is written once, read frequently for the last 24 hours, and rarely accessed after 30 days. Which storage solution is MOST cost-effective?

A.Amazon Redshift with automatic compression and distribution keys.
B.Amazon DynamoDB with TTL to expire data after 30 days.
C.Amazon Timestream with a 30-day retention policy.
D.Amazon S3 with lifecycle policies to transition to S3 Glacier after 30 days.
AnswerC

Timestream is designed for time-series data, with cost-effective tiered storage and built-in analytics.

Why this answer

Amazon Timestream is purpose-built for time-series data, offering automatic storage tiering where recent data resides in memory for fast queries and historical data is moved to a cost-optimized magnetic store. A 30-day retention policy aligns perfectly with the requirement to keep data accessible for frequent reads over the last 24 hours while automatically expiring older data, minimizing storage costs without manual intervention.

Exam trap

The trap here is that candidates often choose Amazon S3 with lifecycle policies (Option D) because they associate S3 with cost-effective storage, but they overlook the requirement for frequent reads of recent data, which S3 cannot serve with low latency without additional caching layers, and they miss that Timestream is the only AWS service natively designed for time-series data with automatic tiering and retention.

How to eliminate wrong answers

Option A is wrong because Amazon Redshift is a columnar data warehouse optimized for complex analytical queries on structured data, not for high-frequency time-series ingestion from thousands of IoT devices; its cost and overhead are excessive for simple sensor data storage. Option B is wrong because Amazon DynamoDB with TTL is designed for key-value and document workloads, not for time-series queries like range scans over the last 24 hours; TTL only deletes expired items but does not provide efficient time-based querying or automatic tiering, leading to higher read costs and complexity. Option D is wrong because Amazon S3 with lifecycle policies to transition to S3 Glacier after 30 days is cost-effective for archival but does not support low-latency frequent reads for the last 24 hours without additional services like S3 Select or Athena, and S3 is not optimized for high-write, time-ordered data ingestion from IoT devices.

Full explanation →
905
MCQmedium

A company uses AWS Glue to process streaming data from Amazon Kinesis Data Streams. The job fails intermittently with a 'MemoryError'. What is the MOST likely cause?

A.The Glue job worker type is too small for the data volume
B.The Glue job uses too many DynamicFrames
C.The S3 output bucket is in a different region
D.The Kinesis stream has insufficient shards
AnswerA

Small worker type leads to out-of-memory errors when data volume exceeds capacity.

Why this answer

The 'MemoryError' in AWS Glue indicates that the worker type allocated to the job does not have sufficient memory to process the data volume. Glue workers (Standard, G.1X, G.2X) have fixed memory allocations (e.g., 16 GB for Standard), and if the streaming data from Kinesis exceeds this, the job fails. Increasing the worker type or the number of workers resolves this.

Exam trap

The trap here is that candidates confuse memory errors with throttling or connectivity issues, leading them to pick insufficient shards (Option D) or cross-region problems (Option C), when the root cause is almost always an undersized worker type for the data volume.

How to eliminate wrong answers

Option B is wrong because using too many DynamicFrames does not directly cause a MemoryError; DynamicFrames are lazy transformations and memory issues arise from data volume or worker size, not the number of frames. Option C is wrong because an S3 output bucket in a different region would cause a cross-region access error (e.g., AccessDenied or timeout), not a MemoryError. Option D is wrong because insufficient Kinesis shards cause throttling (ProvisionedThroughputExceededException) or data latency, not a memory exhaustion in the Glue job.

Full explanation →
906
MCQmedium

A company uses AWS Glue DataBrew to clean and transform data for analytics. The source data is in Parquet format in Amazon S3. The transformation includes filtering rows and adding calculated columns. What is the MOST cost-effective way to run these transformations on a schedule?

A.Use Amazon EMR with Spark
B.Create a Glue DataBrew recipe and schedule the job using a cron expression
C.Create an AWS Lambda function triggered by S3 events
D.Use AWS Glue ETL with PySpark
AnswerB

DataBrew supports scheduling directly.

Why this answer

AWS Glue DataBrew is purpose-built for visual data preparation, and scheduling a DataBrew recipe job with a cron expression directly meets the requirement to run filtering and column calculations on Parquet data in S3 without writing code. This is the most cost-effective approach as it avoids provisioning or managing compute resources beyond the serverless DataBrew job runs.

Exam trap

The trap here is that candidates may over-engineer the solution by choosing Glue ETL or EMR, assuming that Parquet processing requires custom Spark code, when DataBrew's visual recipes can handle filtering and calculated columns without any code and at lower cost.

How to eliminate wrong answers

Option A is wrong because Amazon EMR with Spark requires provisioning and managing a cluster, which incurs higher costs and operational overhead for simple transformations that DataBrew can handle natively. Option C is wrong because AWS Lambda has a maximum execution timeout of 15 minutes and is not designed for data transformation workloads that may process large Parquet files, making it unsuitable for scheduled batch jobs. Option D is wrong because AWS Glue ETL with PySpark requires writing and maintaining custom Spark code, which is more complex and costly than using DataBrew's visual recipe approach for the described transformations.

Full explanation →
907
MCQeasy

The exhibit shows the output of describe-table for a DynamoDB table. The application is experiencing throttling errors when reading data. What is the MOST likely cause?

A.The sort key is not used correctly for queries.
B.The table has a hot partition due to the HASH key.
C.The table size is too large, causing slow reads.
D.The table's provisioned read capacity is too low.
AnswerD

5 RCUs is very low; if the application reads more than 5 RCUs, throttling occurs.

Why this answer

The describe-table output shows the table has provisioned read capacity set to 5, but the application is experiencing throttling errors. Throttling occurs when read requests exceed the provisioned read capacity units (RCUs). Increasing the read capacity or implementing retries with exponential backoff would resolve this.

The throttling is directly caused by insufficient provisioned read capacity for the workload.

Exam trap

The trap here is that candidates may confuse throttling with performance issues like hot partitions or inefficient queries, but the describe-table output directly shows low provisioned read capacity, making insufficient capacity the most likely cause.

How to eliminate wrong answers

Option A is wrong because the sort key not being used correctly would cause inefficient queries (e.g., full table scans) but not necessarily throttling; throttling is a capacity issue, not a query pattern issue. Option B is wrong because a hot partition due to the HASH key would cause throttling on specific partitions, but the question states the application is experiencing throttling errors when reading data generally, not just on a single partition; the describe-table output does not indicate a hot partition. Option C is wrong because table size does not directly cause throttling; DynamoDB can handle large tables efficiently with proper partitioning, and throttling is based on provisioned capacity, not storage size.

Full explanation →
908
MCQhard

A data engineer is designing a data pipeline that ingests CSV files from an FTP server to Amazon S3. The files arrive hourly and each file is about 500 MB. The engineer wants to minimize operational overhead and cost. Which approach is best?

A.Write a Python script in AWS Lambda using boto3 to download from FTP and upload to S3
B.Use AWS Snowball Edge to transfer files weekly
C.Use AWS Transfer for SFTP and point the endpoint to an S3 bucket
D.Deploy an Amazon EC2 instance with a cron job to run wget and aws s3 cp
AnswerC

Fully managed, no servers to manage, direct to S3.

Why this answer

AWS Transfer for SFTP provides a fully managed FTP service that writes directly to S3, eliminating the need to manage servers. Lambda with boto3 is code-heavy; EC2 requires management; Snowball is for large offline transfers.

Full explanation →
909
MCQmedium

A data engineer needs to migrate an on-premises PostgreSQL database to Amazon RDS for PostgreSQL. The database is 2 TB and has a continuous stream of write operations. The migration should minimize downtime. Which AWS service should be used?

A.AWS DataSync
B.AWS Database Migration Service (DMS)
C.AWS Snowball Edge
D.AWS Glue
AnswerB

DMS supports ongoing replication and minimal downtime for database migrations.

Why this answer

AWS Database Migration Service (DMS) is the correct choice because it supports ongoing replication (change data capture) from an on-premises PostgreSQL source to Amazon RDS for PostgreSQL, enabling a near-zero downtime migration. DMS can handle the 2 TB dataset and continuous write stream by performing a full load followed by continuous replication of changes until the cutover. Other services lack the ability to perform live, transactional replication with minimal interruption.

Exam trap

The trap here is that candidates often choose AWS DataSync (Option A) because they confuse it with a database migration tool, but DataSync cannot replicate live transactional changes and is meant for file or object storage, not relational databases with ongoing writes.

How to eliminate wrong answers

Option A is wrong because AWS DataSync is designed for one-time or periodic bulk data transfers between on-premises storage and AWS, not for continuous database replication or minimizing downtime during a live database migration. Option C is wrong because AWS Snowball Edge is a physical device for offline data transfer, which would require stopping writes to the database to export the data, causing significant downtime and not supporting ongoing replication. Option D is wrong because AWS Glue is a serverless data integration service for ETL (extract, transform, load) jobs, not a database migration tool; it cannot perform live replication or handle continuous write streams from a source database.

Full explanation →
910
Multi-Selectmedium

A data engineer is designing a data pipeline using AWS Step Functions to orchestrate multiple AWS Glue ETL jobs. The pipeline must handle failures and retries. Which TWO configurations should the engineer use to ensure the pipeline is resilient? (Choose two.)

Select 2 answers
A.Configure a dead-letter queue (DLQ) for the state machine
B.Configure the state machine to use a 'Catch' rule to handle specific errors and transition to a fallback state
C.Set the 'Retry' interval to a fixed value instead of exponential backoff
D.Define a 'Timeout' for each state to prevent the pipeline from hanging indefinitely
E.Use a 'Parallel' state to run multiple Glue jobs simultaneously
AnswersB, D

Catch rules handle errors gracefully.

Why this answer

To ensure resilience in AWS Step Functions, the engineer should configure a Catch rule to handle errors by transitioning to a fallback state (Option B) and define a Timeout for each state to prevent the pipeline from hanging indefinitely (Option D). A dead-letter queue (DLQ) is not directly used by Step Functions but by services like Lambda. A fixed retry interval is less effective than exponential backoff.

Using a Parallel state is for concurrency, not resilience.

Full explanation →
911
MCQhard

A company uses AWS Database Migration Service (DMS) to migrate an on-premises Oracle database to Amazon RDS for PostgreSQL. The migration completes successfully, but the data engineer notices that some tables have fewer rows in the target than the source. Which DMS setting should be checked to ensure full data migration?

A.The LOB mode is set to 'Limited LOB mode' instead of 'Full LOB mode'.
B.The task logs show that some rows failed to apply due to data type conversion errors.
C.The 'Enable validation' option is turned off.
D.The 'Parallel Apply' feature is disabled, slowing down the migration.
AnswerB

Failed rows would be logged and can be reviewed.

Why this answer

If some rows failed to apply due to data type conversion errors, those rows would be logged as errors and not written to the target, resulting in fewer rows. AWS DMS task logs capture these failures, and checking them is the direct way to identify rows that were skipped or rejected during migration. This is the most common cause of row count mismatches after a successful DMS task.

Exam trap

The trap here is that candidates often assume row count mismatches are always due to LOB settings or validation being off, but the most direct cause is data type conversion errors logged in the task logs, which DMS does not surface in the task status summary.

How to eliminate wrong answers

Option A is wrong because LOB mode settings (Limited vs. Full) affect how large objects are handled, not the total row count; even in Limited LOB mode, all rows are migrated, but LOB columns may be truncated if the LOB exceeds the max size. Option C is wrong because 'Enable validation' is a post-migration check that compares source and target data, but turning it off does not cause rows to be lost during migration; it only prevents validation reports from being generated.

Option D is wrong because 'Parallel Apply' affects the speed of applying changes to the target, not the completeness of data; disabling it may slow down the migration but does not cause rows to be omitted.

Full explanation →
912
MCQeasy

A financial services company uses AWS Glue ETL jobs to process credit card transaction data stored in Amazon S3. The data includes PII such as names and credit card numbers. The security team requires that all PII be masked before the data is written to the curated zone of the data lake. The data engineer has implemented a Glue job that reads from the raw zone, applies a custom transform to mask credit card numbers using a regular expression, and writes to the curated zone. However, during a recent audit, the security team discovered that some masked data still contained partial credit card numbers (e.g., showing the last four digits) when viewed by analysts who should only see masked data. The company's policy is that credit card numbers must be completely masked, showing only asterisks or a fixed string like "XXXX-XXXX-XXXX-XXXX". The Glue job uses a DynamicFrame and applies a Map transform with a Python function that replaces digits with 'X'. The data is stored in Parquet format. What should the data engineer do to ensure complete masking of credit card numbers?

A.Use an AWS Glue crawler to classify the data and apply a masking rule based on the classification.
B.Enable server-side encryption with AWS KMS on the curated S3 bucket.
C.Replace the custom Python Map transform with a built-in Glue Transform for data masking, such as the Mask transform available in Glue Studio.
D.Change the output format from Parquet to CSV and use a different write mode.
AnswerC

Built-in masking transforms are designed to handle common patterns and ensure complete masking.

Why this answer

AWS Glue provides a built-in Mask transform that can be applied directly in Glue Studio or via the AWS Glue API. This transform is designed to reliably obfuscate sensitive data like credit card numbers by replacing them with a fixed string (e.g., 'XXXX-XXXX-XXXX-XXXX') or asterisks, ensuring complete masking regardless of input format. The custom Python Map transform in the current implementation is error-prone because it relies on a regular expression that may not catch all patterns or partial digits, whereas the Mask transform uses predefined logic to guarantee full masking.

Exam trap

The trap here is that candidates may assume any custom Python logic with a regex is sufficient for masking, but the exam tests the understanding that AWS Glue's built-in Mask transform provides a more reliable and policy-compliant solution for sensitive data obfuscation.

How to eliminate wrong answers

Option A is wrong because an AWS Glue crawler is used for schema discovery and classification, not for applying data masking rules; masking must be performed during ETL processing, not at the crawler level. Option B is wrong because enabling server-side encryption with AWS KMS protects data at rest but does not alter the content of the data; it does not mask or obfuscate credit card numbers, so analysts would still see partial digits. Option D is wrong because changing the output format from Parquet to CSV and using a different write mode has no effect on the masking logic; the custom Python Map transform would still produce the same incomplete masking, and CSV format does not inherently mask data.

Full explanation →
913
MCQmedium

A company is using Amazon S3 to store sensitive data. To meet compliance requirements, they need to automatically transition objects to S3 Glacier Deep Archive after 90 days and delete them after 7 years. What is the MOST cost-effective way to configure this?

A.Configure an S3 Lifecycle policy to transition objects to Glacier Deep Archive after 90 days and expire them after 7 years.
B.Manually move objects to Glacier Deep Archive and delete them using a script.
C.Use S3 Intelligent-Tiering to automatically move objects to Glacier Deep Archive and set expiration.
D.Enable S3 Object Lock with a retention period of 7 years and use a lifecycle policy to transition to Glacier Deep Archive.
AnswerA

Lifecycle policies provide automated transitions and expirations based on object age.

Why this answer

An S3 Lifecycle policy can automate both the transition of objects to S3 Glacier Deep Archive after 90 days and their expiration (permanent deletion) after 7 years. This is the most cost-effective approach as it eliminates manual effort and leverages S3's native, serverless lifecycle management, which incurs no additional cost beyond the storage and transition fees.

Exam trap

The trap here is that candidates may confuse S3 Intelligent-Tiering with lifecycle policies, not realizing that Intelligent-Tiering does not support Glacier Deep Archive transitions, or they may overcomplicate the solution by adding Object Lock when a simple lifecycle policy suffices.

How to eliminate wrong answers

Option B is wrong because manually moving objects and deleting them via a script is not cost-effective due to ongoing operational overhead, risk of human error, and lack of automation for compliance; it also does not scale. Option C is wrong because S3 Intelligent-Tiering does not support automatic movement to Glacier Deep Archive; it only moves data between Frequent Access, Infrequent Access, and Archive Instant Retrieval tiers, not to Glacier Deep Archive. Option D is wrong because S3 Object Lock is used for write-once-read-many (WORM) compliance and preventing object deletion or overwrites, not for automating transitions or expirations; combining it with a lifecycle policy adds unnecessary complexity and cost without providing any benefit for the stated requirements.

Full explanation →
914
MCQmedium

A data engineer is designing a data pipeline that processes sensitive financial data. The data must be encrypted at rest and in transit. The pipeline uses Amazon Kinesis Data Streams to ingest data and AWS Lambda to process it. Which combination of actions ensures the data is encrypted in transit? (Select TWO.)

A.Enable TLS for Kinesis Data Streams.
B.Enable Encryption in Transit for the Lambda function's VPC configuration.
C.Enable Server-Side Encryption (SSE-S3) on the S3 bucket used for data storage.
D.Use AWS KMS to encrypt data at rest in Kinesis Data Streams.
E.Encrypt the Lambda function's CloudWatch Logs using KMS.
AnswerA, B

TLS encrypts data in transit between producers and Kinesis.

Why this answer

Enabling TLS for Kinesis Data Streams encrypts data in transit between producers and the stream. Option B is correct because enabling encryption in transit for the Lambda function's VPC configuration ensures TLS is used when Lambda communicates, such as with Kinesis over a VPC endpoint. Option C is incorrect because SSE-S3 encrypts data at rest in S3, not in transit.

Option D is incorrect because encrypting data at rest in Kinesis using KMS does not address encryption in transit. Option E is incorrect because encrypting CloudWatch Logs with KMS is for data at rest.

Full explanation →
915
MCQmedium

Refer to the exhibit. A data engineer is troubleshooting write throttling on the Orders table. The table has a composite primary key (OrderID as partition key, CustomerID as sort key). The engineer notices that writes are throttled even though the write capacity is not fully utilized. What is the most likely cause?

A.The table is empty and has no items.
B.A global secondary index (GSI) is consuming write capacity.
C.The read capacity units are too low.
D.Writes are concentrated on a single partition key value.
AnswerD

Hot partition causes throttling even if total capacity is not exceeded.

Why this answer

D is correct because write throttling on an Amazon DynamoDB table occurs when requests exceed the provisioned throughput for a specific partition, even if the overall table write capacity is underutilized. With a composite primary key where OrderID is the partition key, writes concentrated on a single OrderID value (e.g., a hot key) will hit that partition's 3,000 WCU or 1,000 WCU (on-demand) limit, causing throttling while other partitions remain idle.

Exam trap

AWS often tests the misconception that overall table capacity utilization is the sole indicator of throttling, but the trap here is that throttling can occur at the partition level due to hot keys, even when the table's total write capacity is underutilized.

How to eliminate wrong answers

Option A is wrong because an empty table does not cause write throttling; throttling is based on capacity consumption, not table size. Option B is wrong because a global secondary index (GSI) consumes write capacity from its own provisioned throughput, not from the base table's write capacity, and the question states the write capacity is not fully utilized. Option C is wrong because read capacity units are independent of write operations; low RCU would throttle reads, not writes.

Full explanation →
916
Multi-Selecthard

A company runs an Amazon RDS for PostgreSQL instance for an OLTP application. The database size is 500 GB. The company wants to minimize downtime during backups and ensure point-in-time recovery (PITR) for the last 7 days. Which TWO features should the company use? (Choose TWO.)

Select 2 answers
A.Enable Multi-AZ deployment for high availability.
B.Create a read replica in a different Availability Zone.
C.Enable automated backups with a retention period of 7 days.
D.Create daily manual snapshots and copy them to another region.
E.Enable Enhanced Monitoring to track backup progress.
AnswersA, C

Multi-AZ reduces downtime during automated backups by taking backups from the standby.

Why this answer

Multi-AZ deployment for Amazon RDS provides high availability by automatically provisioning and maintaining a synchronous standby replica in a different Availability Zone. This minimizes downtime during backups by allowing automated backups to be taken from the standby instance, eliminating I/O suspension on the primary. Option C is correct because enabling automated backups with a retention period of 7 days enables point-in-time recovery (PITR) within that window, restoring the database to any second within the retention period using transaction logs.

Exam trap

The trap here is that candidates often confuse read replicas or manual snapshots with backup and recovery features, failing to recognize that only automated backups with a retention period enable point-in-time recovery, and that Multi-AZ is required to minimize downtime during backups by offloading them to the standby instance.

Full explanation →
917
MCQhard

A company uses Amazon Kinesis Data Firehose to deliver data to Amazon S3. The data is transformed using an AWS Lambda function. Some records fail transformation and are lost because the Lambda function throws an exception. The data engineer needs to capture the failed records for analysis without affecting the pipeline. What should the engineer do?

A.Configure the Firehose delivery stream to send failed records to a backup S3 bucket
B.Increase the buffer size of the Firehose stream
C.Disable the Lambda transformation and process all records in batch later
D.Modify the Lambda function to write failed records to Amazon DynamoDB
AnswerA

Firehose can be configured to send failed records to a backup S3 bucket.

Why this answer

Amazon Kinesis Data Firehose natively supports a 'backup' or 'error output' configuration: when a Lambda transformation fails (e.g., throws an exception), Firehose can automatically route the failed records to a designated Amazon S3 bucket for failed data. This allows the engineer to capture and analyze the failed records without blocking or altering the main delivery pipeline, as the stream continues processing successfully transformed records.

Exam trap

The trap here is that candidates often confuse Firehose's 'backup' mode (which copies all records) with the 'error output' configuration (which only captures failed records), or they assume that modifying the Lambda function to handle failures is the only option, missing the native Firehose feature that requires no code changes.

How to eliminate wrong answers

Option B is wrong because increasing the buffer size (e.g., MBs or interval) only affects how long Firehose waits before delivering a batch; it does not capture or handle Lambda transformation failures. Option C is wrong because disabling the Lambda transformation would stop all data transformation, which is a core requirement of the pipeline, and processing records in batch later would not recover records already lost during the stream. Option D is wrong because while writing failed records to DynamoDB from within the Lambda function is possible, it requires modifying the Lambda code and does not leverage Firehose's built-in error handling; moreover, DynamoDB has a 400 KB item size limit and is not designed for high-volume streaming failure capture, making it less suitable than the native S3 backup bucket.

Full explanation →
918
MCQeasy

A company uses Amazon Redshift for data warehousing. They notice that query performance has degraded over time. Which maintenance operation should be performed to improve performance?

A.Run the VACUUM command
B.Drop and recreate the table
C.Run the REINDEX command
D.Run the ANALYZE command
AnswerA

Correct. VACUUM re-sorts rows and reclaims space, improving performance.

Why this answer

The VACUUM command re-sorts rows according to the sort key and reclaims disk space from deleted rows, which can improve query performance. Option B is incorrect because dropping and recreating the table is a heavy operation that requires redefining the table and reloading data; it is not a standard maintenance operation for performance. Option C is incorrect because Redshift uses sort keys and distribution keys instead of indexes; there is no REINDEX command in Redshift.

Option D is incorrect because the ANALYZE command updates table statistics to help the query optimizer, but it does not physically reorganize the data; thus it may help with query planning but does not directly improve performance from data fragmentation.

Full explanation →
919
MCQeasy

A company needs to transfer 20 TB of historical data from an on-premises Hadoop cluster to Amazon S3. The network bandwidth is limited and the transfer must complete within one week. Which service should the company use?

A.Amazon S3 Transfer Acceleration
B.AWS Snowball Edge
C.AWS Direct Connect with DataSync
D.AWS DataSync over a VPN connection
AnswerB

Snowball is a physical device that can transfer large data quickly.

Why this answer

AWS Snowball Edge is designed for large-scale data transfers (up to 80 TB per device) over limited bandwidth. It physically ships the data, bypassing network constraints entirely. The requirement of 20 TB within one week with limited bandwidth makes Snowball the ideal choice.

Option A is wrong because S3 Transfer Acceleration still uses the internet and cannot guarantee completion within a week with limited bandwidth. Option C is wrong because Direct Connect provides a dedicated network connection but requires sufficient bandwidth; if bandwidth is limited, it cannot complete the transfer in time. Option D is wrong because DataSync over VPN still relies on the internet bandwidth and would not meet the deadline.

Full explanation →
920
MCQhard

A company uses Amazon EMR to run Spark jobs on a transient cluster. The jobs are submitted via a step in the cluster. The cluster is configured to auto-terminate after the last step completes. However, the cluster is not terminating even though the step shows as 'COMPLETED'. What could be the cause?

A.The cluster's root device size is too large.
B.The step failed with an error, but the status shows 'COMPLETED' due to a reporting bug.
C.The cluster is configured as a long-running cluster.
D.The step's 'ActionOnFailure' parameter is set to 'CONTINUE' and 'KeepClusterAliveOnFailure' is true.
AnswerD

These settings prevent auto-termination.

Why this answer

In Amazon EMR, the step-level parameter `KeepClusterAliveOnFailure` (or `KeepJobFlowAliveWhenNoSteps` for the cluster) can prevent auto-termination. When `ActionOnFailure` is set to `CONTINUE` and `KeepClusterAliveOnFailure` is `true`, the cluster remains running even after the last step completes, overriding the transient cluster's auto-terminate setting. Option A is incorrect because root device size does not affect termination.

Option B is incorrect because the step status 'COMPLETED' indicates success, not a bug. Option C is incorrect because the cluster is explicitly configured as transient and auto-terminating, not long-running.

Full explanation →
921
MCQeasy

A company is ingesting streaming data from IoT devices into Amazon Kinesis Data Streams. The data must be transformed into Parquet format and stored in Amazon S3. Which AWS service can perform the transformation in near real-time with minimal operational overhead?

A.Amazon EMR cluster running Spark Streaming
B.AWS Glue ETL job triggered by Kinesis stream
C.Amazon Kinesis Data Firehose with a transformation Lambda function
D.Amazon Kinesis Data Analytics for Apache Flink
AnswerC

Kinesis Data Firehose can invoke a Lambda function to convert data to Parquet and deliver to S3.

Why this answer

Amazon Kinesis Data Firehose is the fully managed service designed to load streaming data into S3 with built-in data format conversion. By attaching a Lambda transformation function, you can convert incoming records to Parquet format in near real-time without managing any infrastructure, making it the lowest-operational-overhead choice for this task.

Exam trap

The trap here is that candidates often confuse AWS Glue's batch ETL capabilities with near real-time streaming, or assume that Kinesis Data Analytics is the only option for transformations, overlooking Firehose's simpler managed conversion feature.

How to eliminate wrong answers

Option A is wrong because Amazon EMR running Spark Streaming requires you to provision and manage a cluster, incurring significant operational overhead for a simple transformation task. Option B is wrong because AWS Glue ETL jobs are batch-oriented and not designed for near real-time streaming; they cannot be directly triggered by a Kinesis stream in a low-latency manner. Option D is wrong because Amazon Kinesis Data Analytics for Apache Flink is intended for complex stream processing and analytics (e.g., windowed aggregations), not for simple data format conversion to Parquet, and it requires more operational effort than Firehose.

Full explanation →
922
MCQmedium

A company stores sensitive data in an Amazon S3 bucket. A compliance requirement mandates that all data must be encrypted at rest with a key that is automatically rotated every year. The company also needs to maintain an audit trail of who used the key. Which solution meets these requirements?

A.Use AWS KMS customer managed keys (SSE-KMS) with automatic key rotation enabled.
B.Use customer-provided encryption keys (SSE-C) and rotate keys manually.
C.Use S3 managed keys (SSE-S3) and enable S3 server access logs.
D.Configure a bucket policy to enforce encryption using the 'aws:SecureTransport' condition.
AnswerA

KMS customer managed keys support automatic annual rotation and CloudTrail auditing.

Why this answer

AWS KMS customer managed keys (SSE-KMS) with automatic key rotation enabled satisfies both requirements: it encrypts data at rest in S3 and automatically rotates the KMS key every year. Additionally, KMS integrates with AWS CloudTrail to log every API call (e.g., Decrypt, GenerateDataKey) that uses the key, providing an audit trail of who used the key and when.

Exam trap

The trap here is that candidates confuse SSE-S3's automatic rotation (which is invisible and lacks audit trails) with SSE-KMS's automatic rotation (which provides both rotation and CloudTrail logging), or they mistakenly think SSE-C or bucket policies can satisfy the audit trail requirement.

How to eliminate wrong answers

Option B is wrong because SSE-C requires the customer to provide and manage their own encryption keys, and AWS does not support automatic rotation for customer-provided keys — rotation must be done manually, which violates the compliance requirement for automatic yearly rotation. Option C is wrong because SSE-S3 uses S3-managed keys that are automatically rotated by AWS, but it does not provide a per-key audit trail of who used the key; S3 server access logs only record requests to the bucket, not granular key usage events. Option D is wrong because the 'aws:SecureTransport' condition enforces encryption in transit (HTTPS), not encryption at rest, and it does not involve key rotation or audit trails for key usage.

Full explanation →
923
Multi-Selecteasy

A company needs to audit access to their Amazon S3 buckets. Which TWO services can be used together to achieve this? (Choose two.)

Select 2 answers
A.Amazon Macie
B.Amazon S3 Inventory
C.Amazon CloudWatch Logs
D.AWS Config
E.AWS CloudTrail
AnswersC, E

CloudWatch Logs can store and monitor CloudTrail logs for access patterns.

Why this answer

CloudTrail records S3 API calls, and CloudWatch Logs can be used to store and monitor those logs. Config records configuration changes, not data access. S3 server access logs record object-level access, but the question asks for auditing access; CloudTrail with CloudWatch Logs is a common solution.

S3 Inventory provides metadata, not access logs.

Full explanation →
924
MCQmedium

A company uses AWS Glue to transform data in S3. The transformation job reads Parquet files, filters rows, and writes to another S3 bucket. The job takes longer than expected. Which change would MOST likely reduce the job execution time?

A.Use a single large file instead of multiple small files.
B.Reduce the number of partitions in the output data.
C.Convert the input files from Parquet to CSV format.
D.Increase the number of DPUs allocated to the Glue job.
AnswerD

More DPUs allow more parallel processing, reducing runtime.

Why this answer

Increasing the number of DPUs (Data Processing Units) allocated to the Glue job directly increases the parallelism of the Apache Spark-based execution environment. Since the job reads Parquet files, filters rows, and writes output, a bottleneck in compute capacity is the most likely cause of prolonged execution time. More DPUs allow Spark to distribute the workload across more executors, reducing overall runtime.

Exam trap

The trap here is that candidates often assume optimizing file format or output partitioning will always improve performance, but for a compute-bound transformation job, increasing parallelism via DPUs is the most direct solution.

How to eliminate wrong answers

Option A is wrong because using a single large file instead of multiple small files would reduce parallelism in Spark's file scanning, potentially increasing execution time due to less efficient task distribution. Option B is wrong because reducing the number of partitions in the output data affects the write phase but does not address the root cause of slow processing during the read and filter stages. Option C is wrong because converting from Parquet to CSV would increase I/O and CPU overhead due to CSV's lack of compression, schema enforcement, and columnar storage, making the job slower, not faster.

Full explanation →
925
MCQhard

A company uses AWS Glue to process data from Amazon RDS MySQL into Amazon S3. The Glue job uses a JDBC connection and runs on a schedule. Recently, the job has been failing with a 'Communications link failure' error. The RDS instance is in a private subnet. Which troubleshooting step should the data engineer take FIRST?

A.Check the Glue job's DPU allocation; increase if too low.
B.Review the Glue job script for data type mismatches.
C.Verify that the Glue job's VPC subnet and security group allow outbound traffic to RDS.
D.Increase the RDS instance's max_connections parameter.
AnswerC

Network connectivity is the first thing to check for link failures.

Why this answer

The 'Communications link failure' error typically indicates a network connectivity issue between the Glue job and the RDS instance. Since the RDS instance is in a private subnet, the Glue job must be configured with a VPC subnet and security group that allows outbound traffic to the RDS instance's security group on port 3306 (MySQL). Without this network path, the JDBC connection cannot be established, making verifying the VPC and security group configuration the first logical troubleshooting step.

Exam trap

The trap here is that candidates often assume 'Communications link failure' is a database-side issue (like connection limits or timeouts) and jump to tuning RDS parameters, when in fact it is most commonly a network connectivity problem in a VPC environment.

How to eliminate wrong answers

Option A is wrong because DPU allocation affects job parallelism and memory, not network connectivity; increasing DPUs would not resolve a 'Communications link failure' caused by a missing network path. Option B is wrong because data type mismatches typically cause runtime errors during data conversion, not connection-level failures like 'Communications link failure'. Option D is wrong because increasing max_connections addresses connection limits on the RDS side, but the error indicates the Glue job cannot even reach the database, not that connections are being refused due to exhaustion.

Full explanation →
926
Multi-Selecthard

A company is running a 10-node Amazon EMR cluster to process data from Amazon S3. The cluster is using Apache Spark for transformations. The data processing is taking longer than expected. Which THREE actions can improve the performance of the Spark jobs on EMR? (Choose THREE.)

Select 3 answers
A.Reduce the number of shuffle partitions.
B.Enable dynamic allocation of executors.
C.Disable speculative execution to reduce redundant tasks.
D.Use a larger instance type for core nodes.
E.Use EMRFS consistent view to ensure data consistency.
AnswersB, D, E

Dynamic allocation allows Spark to scale resources based on workload.

Why this answer

Enabling dynamic allocation of executors allows Amazon EMR to automatically scale the number of executors up or down based on workload demand. This prevents resource underutilization or over-provisioning, which can significantly improve Spark job performance by ensuring that the cluster's resources are efficiently matched to the processing needs of the transformations.

Exam trap

The trap here is that candidates often confuse 'reducing shuffle partitions' (Option A) as a universal performance fix, when in fact it can degrade performance due to data skew and memory issues, while the correct answer focuses on resource elasticity through dynamic allocation.

Full explanation →
927
MCQmedium

A company uses Amazon Kinesis Data Analytics for Apache Flink to process streaming data. The application reads from a Kinesis data stream and writes results to an Amazon S3 bucket. Recently, the application has been failing with 'ResourceNotFoundException' for the S3 bucket. What is the MOST likely cause?

A.The IAM role used by the application does not have s3:PutObject permission.
B.The S3 bucket ARN is incorrectly specified in the application configuration.
C.The Flink application code specifies the wrong AWS Region for the S3 bucket.
D.The S3 bucket has versioning disabled.
AnswerB

Correct. An incorrect S3 bucket name or ARN in the configuration causes the application to fail with 'ResourceNotFoundException' because the bucket cannot be located.

Why this answer

The 'ResourceNotFoundException' for the S3 bucket indicates that the application cannot find the bucket. This is most likely due to an incorrectly specified bucket name or ARN in the application configuration. If the bucket name is misspelled or the ARN is malformed, the Kinesis Data Analytics application cannot resolve the bucket resource.

Option A is incorrect because missing 's3:PutObject' permission would cause an 'AccessDenied' error, not 'ResourceNotFoundException'. Option C is incorrect because the AWS Region for S3 is determined by the bucket's location, and specifying a wrong region in Flink code would typically result in a different error (e.g., 'IllegalArgumentException' or cross-region access issues) but not 'ResourceNotFoundException'. Option D is incorrect because versioning is unrelated to bucket existence; disabling versioning does not cause a resource not found error.

Exam trap

Candidates often confuse permission errors with resource-not-found errors. A missing IAM permission typically results in 'AccessDenied', not 'ResourceNotFoundException'.

Full explanation →
928
MCQmedium

A company is migrating its on-premises Oracle database to Amazon RDS for Oracle. The database is 2 TB in size and has a 24-hour maintenance window. The migration must have minimal downtime. Which AWS service should be used for the migration?

A.Amazon RDS native backup and restore
B.AWS Database Migration Service (DMS)
C.Amazon S3 Transfer Acceleration
D.AWS Snowball Edge
AnswerB

DMS supports minimal downtime migrations.

Why this answer

AWS Database Migration Service (DMS) is the correct choice because it supports heterogeneous migrations (Oracle to RDS for Oracle) with minimal downtime using ongoing replication via Oracle LogMiner or binary reader. DMS can perform a full load of the 2 TB database and then continuously replicate changes from the source to the target during the 24-hour maintenance window, allowing a final cutover with only seconds of downtime.

Exam trap

The trap here is that candidates often confuse AWS Snowball Edge for any large data migration, but Snowball is designed for offline transfers where downtime is acceptable, not for minimal-downtime online migrations that require continuous replication.

How to eliminate wrong answers

Option A is wrong because Amazon RDS native backup and restore requires creating a backup file from the on-premises Oracle database and restoring it into RDS, which involves significant downtime for the backup and restore process, and does not support ongoing replication for minimal downtime. Option C is wrong because Amazon S3 Transfer Acceleration is a service for speeding up uploads to S3 over the internet, but it does not provide database migration capabilities, schema conversion, or ongoing replication needed for a live database migration. Option D is wrong because AWS Snowball Edge is a physical data transfer device for moving large volumes of data (e.g., 2 TB) offline, which introduces days of latency for shipping and cannot achieve minimal downtime; it also lacks the ability to capture and apply ongoing transactional changes during transit.

Full explanation →
929
MCQeasy

Refer to the exhibit. A data engineer runs this CLI command on an S3 bucket. The data is ingested from multiple sources. Which AWS service would be best to process these files in a single batch transformation?

A.AWS Lambda
B.Amazon Kinesis Data Analytics
C.Amazon Athena
D.AWS Glue
AnswerD

Glue can run batch ETL jobs on multiple files.

Why this answer

AWS Glue is designed for batch ETL processing, capable of handling multiple files of varying sizes in a single transformation job. Option A is wrong because Lambda has limitations on execution time (15 minutes) and memory (10 GB), making it unsuitable for large-scale batch transforms. Option B is wrong because Kinesis Data Analytics is for real-time stream processing, not batch.

Option C is wrong because Athena is an interactive query service for ad-hoc analysis of data in S3, not for batch transformations.

Full explanation →
930
Multi-Selecteasy

A company wants to audit API calls made to its Amazon S3 buckets. Which AWS services can be used to achieve this? (Choose TWO.)

Select 2 answers
A.IAM Access Analyzer
B.AWS Config
C.VPC Flow Logs
D.AWS CloudTrail
E.Amazon S3 server access logs
AnswersD, E

CloudTrail can log S3 data events.

Why this answer

Options D and E are correct. AWS CloudTrail can log API calls to S3 by enabling data events, and S3 server access logs record detailed request information. Option A is wrong because IAM Access Analyzer reviews resource policies, not API calls.

Option B is wrong because AWS Config tracks configuration changes, not API calls. Option C is wrong because VPC Flow Logs capture network traffic, not API calls.

Full explanation →
931
Multi-Selecthard

A data engineering team is designing a batch processing workflow using AWS Glue. The job reads from an S3 bucket, transforms data, and writes to another S3 bucket. The job runs daily and processes new data incrementally. Which THREE features should they use to optimize performance and cost?

Select 3 answers
A.Convert all input data to Parquet format before processing.
B.Enable Glue job autoscaling.
C.Manually increase the number of DPUs for each run.
D.Use predicate pushdown and column pruning in the script.
E.Enable job bookmarks to process only new data.
AnswersB, D, E

Adjusts resources to workload.

Why this answer

Options B, D, and E are correct. Glue job autoscaling (B) dynamically adjusts resources, optimizing cost and performance. Predicate pushdown and column pruning (D) reduce data scanned, improving efficiency.

Job bookmarks (E) enable incremental processing, avoiding reprocessing of old data. Option A (converting to Parquet) is a good practice but not a Glue feature. Option C (manually increasing DPUs) is not optimal because it lacks flexibility and may waste resources.

Full explanation →
932
Multi-Selecteasy

A company is designing a data ingestion pipeline for real-time IoT sensor data. The data volume peaks at 10,000 messages per second. The pipeline must process messages in order per sensor and persist raw data to Amazon S3 for archival. Which TWO services should be used together to meet these requirements? (Choose TWO.)

Select 2 answers
A.Amazon Kinesis Data Firehose
B.Amazon Kinesis Data Streams
C.AWS Lambda
D.Amazon AppFlow
E.Amazon Simple Queue Service (Amazon SQS)
AnswersA, B

Delivers streaming data to S3.

Why this answer

Amazon Kinesis Data Streams (KDS) provides the ordered, real-time ingestion layer required for per-sensor message ordering, as it partitions data by a partition key (e.g., sensor ID) and guarantees order within a shard. Amazon Kinesis Data Firehose then reliably reads from the KDS stream and delivers the raw data to Amazon S3 for archival, handling buffering, compression, and automatic retries without requiring custom code.

Exam trap

The trap here is that candidates often choose AWS Lambda as a processing step without realizing it is not required for the core ingestion and archival pipeline, and they may overlook that Kinesis Data Streams is needed for ordering while Firehose handles the S3 delivery.

Full explanation →
933
MCQhard

Refer to the exhibit. An IAM policy is attached to an IAM user. The user is trying to upload an object to 's3://data-lake-bucket/confidential/report.pdf' using the AWS CLI. The upload fails with an AccessDenied error. What is the reason for the failure?

A.The policy does not include 's3:PutObject' action.
B.The resource ARN in the Allow statement does not cover the specific object.
C.The user does not have permission to access the bucket at all.
D.An explicit Deny statement overrides the Allow statement for the 'confidential/' prefix.
AnswerD

Explicit Deny always takes precedence over Allow.

Why this answer

The IAM policy includes an explicit Deny statement that denies all s3 actions on the 'confidential/' prefix. Even though there is an Allow statement that grants s3:PutObject on the bucket, the explicit Deny overrides it, causing the upload to fail with AccessDenied. Option A is incorrect because the policy does include the s3:PutObject action.

Option B is incorrect because the resource ARN in the Allow statement covers the bucket and objects, but the Deny specifically targets 'confidential/'. Option C is incorrect because the user does have permission to access the bucket via the Allow statement, but the Deny blocks access to the specific object under 'confidential/'.

Full explanation →
934
MCQmedium

A data engineer is designing a pipeline to ingest change data capture (CDC) events from an Amazon RDS for PostgreSQL database into Amazon S3. The CDC events are captured using AWS DMS. The data must be available for querying within 5 minutes of the change. Which approach meets these requirements?

A.Export the database to S3 using pg_dump and then use AWS Glue to load into S3 in Parquet format.
B.Use AWS DMS to replicate data to Amazon Redshift, then unload to S3.
C.Use AWS DMS to replicate data directly to S3 in near real-time.
D.Use AWS DMS to replicate data to an SQS queue, then process with Lambda to write to S3.
AnswerC

DMS can write CDC to S3 with low latency.

Why this answer

AWS DMS supports continuous replication (change data capture) directly to Amazon S3 as a target endpoint. DMS can write CDC events to S3 in near real-time (typically seconds to minutes), meeting the 5-minute latency requirement without intermediate services. The data is stored in comma-separated value (CSV) or Parquet format, ready for querying via Athena or Glue.

Exam trap

The trap here is that candidates may overcomplicate the solution by introducing intermediate services (like Redshift or SQS) when DMS’s native S3 target endpoint already provides near-real-time CDC replication, and they may confuse pg_dump (a batch export tool) with a CDC mechanism.

How to eliminate wrong answers

Option A is wrong because pg_dump is a one-time logical backup tool, not a CDC solution; it cannot capture ongoing changes and would require full exports, exceeding the 5-minute latency window. Option B is wrong because replicating to Redshift then unloading to S3 adds unnecessary complexity and latency; Redshift is optimized for analytics, not as a CDC staging area, and the unload operation introduces additional delay. Option D is wrong because DMS does not natively support SQS as a target endpoint; DMS can write to S3, Kinesis, or other targets, but not directly to SQS, and the proposed architecture would require custom integration, breaking the near-real-time requirement.

Full explanation →
935
MCQhard

A data engineer is optimizing an Amazon Redshift cluster that runs a nightly ETL workload. The engineer notices that the query performance degrades over the week and improves after a VACUUM operation. Which action should the engineer take to automate this maintenance and minimize impact on performance?

A.Run VACUUM manually only when performance degrades significantly.
B.Disable auto vacuum and run a manual VACUUM every night after the ETL.
C.Schedule a VACUUM command using a query scheduler like Amazon EventBridge.
D.Drop and recreate the tables weekly to avoid unsorted data.
AnswerC

Automates the maintenance task.

Why this answer

It enables automated scheduling of VACUUM using Amazon EventBridge or Redshift's query scheduler, ensuring regular maintenance without manual intervention. Option A is wrong because manual intervention only when performance degrades is not automated and allows performance to degrade unnecessarily. Option B is wrong because disabling auto vacuum and running manual VACUUM nightly is not as efficient or integrated as using a scheduler, and it may disrupt the ETL if not timed properly.

Option D is wrong because dropping and recreating tables weekly is disruptive and loses data or requires complex re-creation logic, whereas VACUUM re-sorts data in place.

Full explanation →
936
MCQhard

A company uses AWS Lake Formation to manage access to data in a data lake. A new data engineer has been granted SELECT permission on a table but receives an 'AccessDeniedException' when querying via Amazon Athena. The table is registered in Lake Formation and the data is encrypted with SSE-KMS. Which of the following is the MOST likely cause?

A.The table's resource-based policy does not include the engineer's IAM role.
B.The S3 bucket policy denies access to the engineer's IAM role.
C.The AWS Glue Data Catalog has not been granted permission to the engineer's role.
D.The IAM role used by Athena does not have kms:Decrypt permission on the KMS key.
AnswerD

Correct. The IAM role used by Athena must have kms:Decrypt permission on the KMS key to access encrypted data.

Why this answer

The IAM role used by Athena does not have kms:Decrypt permission on the KMS key. When data is encrypted with SSE-KMS, Athena's IAM role requires kms:Decrypt to read the data from S3. Even if Lake Formation grants SELECT permission, the query fails without KMS access.

Option A is incorrect because Lake Formation does not use resource-based policies on tables; it uses LF-Tags or resource links to grant permissions. Option B is incorrect because while an S3 bucket policy could block access, the most likely issue with encrypted data is missing KMS permissions. Option C is incorrect because the Glue Data Catalog does not enforce data access; Lake Formation is the service that manages fine-grained access.

Full explanation →
937
MCQeasy

A data engineer is troubleshooting a failed AWS Glue ETL job that reads from an S3 bucket and writes to an Amazon Redshift table. The job logs show a permission error. Which IAM policy change would resolve the issue?

A.Enable encryption on the S3 bucket using AWS KMS
B.Add s3:GetObject permission to the Glue job's IAM role
C.Add redshift:DataAPI access to the Glue job's IAM role
D.Attach an IAM role with redshift:GetClusterCredentials to the Redshift cluster
AnswerC

Glue needs permission to write to Redshift via the Data API or JDBC.

Why this answer

The Glue job's IAM role needs the redshift:DataAPI permission to write to the Redshift table via the Data API. Option A is irrelevant because enabling encryption on the S3 bucket does not resolve permission errors related to Redshift. Option B is incorrect because s3:GetObject is needed for reading from S3, but the error is about writing to Redshift, not reading.

Option D is incorrect because attaching an IAM role to the Redshift cluster grants permissions to the cluster itself, not to the Glue job's role; the Glue job's role must have the redshift:DataAPI permission directly.

Full explanation →
938
MCQeasy

A data engineer attached this IAM policy to a Lambda function used to transform data in S3. The function is unable to write output to the bucket. What is the most likely reason?

A.The resource ARN is missing the bucket-level ARN.
B.The policy does not allow the s3:DeleteObject action.
C.The policy does not allow the s3:ListBucket action on the bucket.
D.The policy does not allow the s3:PutObjectAcl action.
AnswerC

To write objects, the function needs ListBucket permission on the bucket itself.

Why this answer

The policy allows GetObject and PutObject on objects, but not the s3:ListBucket action required to check existence or list objects. The function likely needs ListBucket to write or verify.

Full explanation →
939
MCQeasy

An IAM policy includes the above resource ARN for CloudWatch Logs. A data engineer needs to allow a Lambda function to create log streams and put logs to the log group 'my-log-group'. However, the Lambda function is failing with access denied. What is the issue?

A.The region in the ARN does not match the Lambda function's region.
B.The Lambda function does not have an execution role.
C.The ARN does not include the log-stream portion.
D.The ARN is incorrectly formatted because of the wildcard.
AnswerC

The correct ARN for log streams should be 'arn:aws:logs:us-east-1:123456789012:log-group:my-log-group:log-stream:*'.

Why this answer

The ARN provided in the policy is for the log group itself (arn:aws:logs:region:account-id:log-group:my-log-group), but CloudWatch Logs requires separate permissions for the log-stream subresource. To allow a Lambda function to create log streams and put logs, the ARN must include the log-stream portion, typically with a wildcard like arn:aws:logs:region:account-id:log-group:my-log-group:log-stream:*. Without this, the IAM policy does not grant access to the log-stream actions (CreateLogStream, PutLogEvents), causing an access denied error even if the log group ARN is correct.

Exam trap

The trap here is that candidates assume granting access to the log group ARN implicitly covers log streams, but AWS IAM requires explicit resource-level permissions for each subresource in the ARN hierarchy.

How to eliminate wrong answers

Option A is wrong because the region in the ARN must match the Lambda function's region for the policy to apply, but the question does not indicate a region mismatch; the error is specifically about log-stream permissions. Option B is wrong because a Lambda function must have an execution role to access AWS resources, and the question implies a role exists (the policy is attached), but the role lacks the necessary log-stream permissions. Option D is wrong because the wildcard in the ARN is correctly placed for the log group name (my-log-group) and is not the cause of the failure; the issue is the missing log-stream component, not the wildcard format.

Full explanation →
940
Multi-Selecthard

A data engineer is troubleshooting slow query performance on an Amazon Redshift cluster. The cluster has 10 nodes and is using automatic distribution style. The engineer suspects that data distribution is causing excessive data movement. Which steps should the engineer take to diagnose and resolve the issue? (Choose THREE.)

Select 3 answers
A.Choose appropriate distribution keys for large tables
B.Use the EXPLAIN command to analyze query plans
C.Run the VACUUM command to reclaim space
D.Query the STL_DIST and STL_BCAST system tables
E.Increase the number of nodes in the cluster
AnswersA, B, D

Proper distribution keys minimize data movement.

Why this answer

Choosing appropriate distribution keys for large tables ensures that data is evenly distributed across the cluster slices, minimizing the need for data redistribution during joins and aggregations. Automatic distribution style may not always select the optimal key, leading to excessive data movement and slow query performance.

Exam trap

The trap here is that candidates often confuse VACUUM (which only reorganizes data within slices) with distribution optimization, or assume scaling out nodes automatically resolves distribution-related performance issues without addressing the underlying key choice.

Full explanation →
941
MCQeasy

A company uses Amazon S3 to store log files from multiple applications. The logs are written in JSON format. A data engineer wants to use Amazon Athena to query these logs. The logs are stored in a bucket with the following structure: 's3://logs/app1/date=2021-01-01/'. The engineer creates an Athena table with partitions. However, when querying, Athena returns zero results for partitions that exist. The engineer has run MSCK REPAIR TABLE to add partitions. What is the most likely cause of the issue?

A.The MSCK REPAIR TABLE command failed silently.
B.The partition key name in the table definition does not match the S3 folder naming convention.
C.The log files are in JSON format and Athena does not support JSON.
D.The log files need to be copied to a different bucket in the same region.
AnswerB

This is the correct answer. The S3 folder structure uses 'date=' as the partition key prefix, so the Athena table must define a partition key named 'date' exactly. If it is named differently, MSCK REPAIR will not register those folders as partitions.

Why this answer

The most likely cause is that the partition key name in the Athena table definition does not match the S3 folder naming convention. When using MSCK REPAIR TABLE, Athena relies on the partition folder structure (e.g., 'date=2021-01-01') to automatically add partitions. If the table's partition key is named differently (e.g., 'dt' instead of 'date'), MSCK REPAIR will not recognize the folders and will not register the partitions, resulting in zero results.

Option A is incorrect because MSCK REPAIR does not fail silently; it either adds partitions or reports none if the structure doesn't match. Option C is incorrect because Athena fully supports JSON format. Option D is incorrect because the bucket location does not affect partition registration; data can be queried in any bucket as long as the table points to it.

Full explanation →
942
MCQhard

An application uses the 'orders' DynamoDB table with the schema and provisioned throughput shown in the exhibit. The application frequently queries by customer_id (range key) without specifying the order_id (partition key). What is the most likely impact on performance?

A.Queries will require a full table scan, consuming significant read capacity.
B.Queries will be throttled because the table does not have a global secondary index.
C.Queries will be fast because the sort key is indexed.
D.Queries will cause hot partitions on the table.
AnswerA

Without partition key, DynamoDB scans the entire table.

Why this answer

The application queries by customer_id (the sort key) without specifying order_id (the partition key). In DynamoDB, a Query operation requires the partition key to be specified; without it, the only way to retrieve items is a full table Scan, which reads every item in the table. This consumes read capacity proportional to the entire table size, leading to high latency and cost.

Exam trap

The trap here is that candidates assume the sort key alone can be used for efficient queries, forgetting that DynamoDB's indexing requires the partition key to be specified for a Query operation.

How to eliminate wrong answers

Option B is wrong because throttling is not caused by the absence of a GSI; throttling occurs when consumed capacity exceeds provisioned throughput, and a Scan can cause throttling indirectly by consuming high capacity, but the lack of a GSI itself does not throttle queries. Option C is wrong because the sort key (customer_id) is only indexed within the context of a specific partition key (order_id); without the partition key, the sort key index cannot be used for efficient lookup. Option D is wrong because hot partitions are caused by uneven access patterns on a single partition key, not by queries that omit the partition key; a Scan reads all partitions evenly, so it does not create hot spots.

Full explanation →
943
MCQmedium

A company is using Amazon RDS for MySQL with Multi-AZ deployment. The database size is 2 TB and the workload is read-heavy. To improve read performance, which option should be used?

A.Use Amazon ElastiCache to cache database queries
B.Increase the instance size to 16xlarge
C.Create Read Replicas in the same or different regions
D.Enable Multi-AZ on additional instances
AnswerC

Read Replicas allow offloading read traffic.

Why this answer

Amazon RDS for MySQL Read Replicas offload read traffic from the primary DB instance, directly improving read performance for a read-heavy workload. With a 2 TB database, Read Replicas can be created in the same or different regions, providing horizontal read scaling without impacting the primary instance's write capacity. Multi-AZ deployment already provides high availability but does not improve read performance, as the standby instance is not used for reads.

Exam trap

The trap here is that candidates often confuse Multi-AZ with read scaling, assuming the standby instance can serve reads, but Multi-AZ is strictly for high availability and disaster recovery, not for read traffic.

How to eliminate wrong answers

Option A is wrong because Amazon ElastiCache caches query results, reducing database load, but it does not directly improve read performance for all queries, especially those that cannot be cached (e.g., write-heavy or dynamic queries), and it introduces cache invalidation complexity. Option B is wrong because increasing the instance size to 16xlarge vertically scales the database, which can improve performance, but it is less cost-effective and does not provide the same read scalability as horizontal scaling with Read Replicas; it also does not leverage the Multi-AZ deployment's standby for reads. Option D is wrong because enabling Multi-AZ on additional instances is not a valid configuration; Multi-AZ is a feature of the primary instance that provisions a standby in a different Availability Zone for failover, not for read scaling, and additional instances cannot have Multi-AZ enabled independently.

Full explanation →
944
MCQeasy

A data engineer needs to grant an IAM user read-only access to an S3 bucket named 'data-lake'. Which IAM policy statement should be used?

A.{"Effect":"Allow","Action":["s3:PutObject","s3:DeleteObject"],"Resource":"arn:aws:s3:::data-lake/*"}
B.{"Effect":"Allow","Action":"s3:*","Resource":"*"}
C.{"Effect":"Allow","Action":["s3:ListBucket","s3:GetObject"],"Resource":["arn:aws:s3:::data-lake","arn:aws:s3:::data-lake/*"]}
D.{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::data-lake"}
AnswerC

Correctly allows ListBucket (list objects) and GetObject (read objects), providing read-only access.

Why this answer

It allows ListBucket on the bucket and GetObject on objects, enabling read-only access. Option A is wrong because it grants write actions (PutObject, DeleteObject). Option B is wrong because it allows all S3 actions (s3:*).

Option D is wrong because it only allows ListBucket, not GetObject.

Full explanation →
945
MCQmedium

A data engineer is configuring S3 bucket policies to restrict access to a specific VPC. Which condition key should be used in the bucket policy to enforce that requests originate only from the desired VPC?

A.aws:VpcSourceIp
B.aws:SourceVpc
C.aws:RequestedRegion
D.aws:SourceIp
AnswerB

aws:SourceVpc restricts requests to a specific VPC.

Why this answer

Aws:SourceVpc is the condition key used in S3 bucket policies to restrict access to requests originating from a specific VPC. Option A is incorrect because aws:VpcSourceIp is not a valid AWS condition key. Option C is incorrect because aws:RequestedRegion is used to restrict based on the region, not VPC.

Option D is incorrect because aws:SourceIp restricts based on IP addresses, not VPC.

Full explanation →
946
MCQmedium

A data pipeline ingests CSV files from an S3 bucket into a Redshift table using the COPY command. Recently, files with inconsistent column delimiters (some use pipes, others use commas) have been arriving. The pipeline must handle both delimiters without manual intervention. What is the MOST efficient solution?

A.Configure the COPY command with a fixed delimiter (e.g., comma) and manually convert files with pipes before ingestion.
B.Create an AWS Lambda function triggered by S3 events that reads the first line of each file, detects the delimiter, and runs the COPY command with the appropriate DELIMITER option.
C.Use AWS Glue to crawl the S3 bucket and automatically detect the schema and delimiter before writing to Redshift.
D.Use Amazon Athena to query the files with the OpenCSVSerDe, which automatically detects delimiters, and then write the results to Redshift.
AnswerB

Lambda provides a lightweight, event-driven solution to dynamically detect and handle delimiters.

Why this answer

It provides an automated, event-driven solution that dynamically detects the delimiter of each incoming CSV file and executes the COPY command with the appropriate DELIMITER option. This approach eliminates manual intervention and leverages AWS Lambda's ability to process S3 events in near real-time, making it the most efficient for handling inconsistent delimiters.

Exam trap

The trap here is that candidates may assume AWS Glue or Athena are suitable for dynamic delimiter detection, but they lack the ability to directly and efficiently execute Redshift COPY commands with per-file delimiter customization without significant additional orchestration.

How to eliminate wrong answers

Option A is wrong because it requires manual conversion of files with pipes, which contradicts the requirement of no manual intervention and is not efficient for a data pipeline. Option C is wrong because AWS Glue crawlers are designed for schema discovery and cataloging, not for dynamically executing Redshift COPY commands with varying delimiters; they would require additional orchestration to handle the actual data ingestion. Option D is wrong because Amazon Athena with OpenCSVSerDe does not automatically detect delimiters; it requires the delimiter to be specified in the table DDL, and writing results to Redshift adds unnecessary complexity and latency compared to a direct COPY command.

Full explanation →
947
MCQmedium

Refer to the exhibit. A data engineer is troubleshooting an AWS Glue ETL job that fails with an access denied error when writing to S3. The IAM role attached to the Glue job has the policy shown. What is the most likely cause of the error?

A.The Glue job is missing the s3:ListBucket permission on the bucket
B.The Glue job is writing to an S3 bucket that is not included in the Resource ARN
C.The S3 bucket is encrypted with AWS KMS and the policy does not include kms:Decrypt permissions
D.The Glue job does not have permission to call glue:StartJobRun
AnswerB

The policy only grants access to my-data-bucket, not other buckets.

Why this answer

The IAM policy shown in the exhibit explicitly restricts the `s3:PutObject` action to a specific ARN pattern (e.g., `arn:aws:s3:::example-bucket/*`). If the Glue job attempts to write to a different S3 bucket—one not matching that ARN—the request will be denied with an access denied error. AWS Glue ETL jobs use the attached IAM role's permissions, and a mismatch between the target bucket and the resource ARN in the policy is the most common cause of such failures.

Exam trap

The trap here is that candidates often overlook the explicit resource ARN in the policy and assume the error is due to missing permissions like `s3:ListBucket` or KMS, when the real issue is a bucket name mismatch in the resource specification.

How to eliminate wrong answers

Option A is wrong because the `s3:ListBucket` permission is required for listing objects (e.g., `s3:ListBucket` on the bucket resource), not for writing objects; the error occurs during a write operation, and the policy already includes `s3:PutObject` on the bucket objects. Option C is wrong because the error message is specifically 'access denied when writing to S3', not a KMS-related error; if KMS encryption were the issue, the error would typically mention 'KMS' or 'decrypt' and the policy would need `kms:GenerateDataKey` or `kms:Decrypt`, not just `kms:Decrypt`. Option D is wrong because `glue:StartJobRun` is a permission to start a Glue job run, not a permission for writing to S3; the error occurs during the job execution (writing to S3), not during job initiation.

Full explanation →
948
MCQmedium

A data engineer is troubleshooting a slow-running query on Amazon Redshift. The query scans a large table but returns few rows. Which diagnostic step should be taken first?

A.Use EXPLAIN to review the query plan.
B.Run ANALYZE on the table.
C.Check the concurrency scaling status.
D.Run VACUUM on the table.
AnswerA

Reveals how the query is executed, helps identify bottlenecks.

Why this answer

When a query scans a large table but returns few rows, the most likely cause is an inefficient query plan—such as a full table scan instead of using indexes or zone maps. Using EXPLAIN first reveals the execution plan, allowing the engineer to identify whether the query is performing unnecessary sequential scans, missing filter pushdown, or using suboptimal join strategies. This diagnostic step should always precede tuning actions like ANALYZE or VACUUM, which address data distribution or storage bloat rather than query planning.

Exam trap

The trap here is that candidates often jump to performance-tuning commands like ANALYZE or VACUUM without first diagnosing the query plan, but the DEA-C01 exam emphasizes that EXPLAIN is the foundational step for identifying inefficient scan patterns before applying any corrective actions.

How to eliminate wrong answers

Option B is wrong because ANALYZE updates table statistics for the query optimizer, but if the query plan is already suboptimal (e.g., missing a WHERE clause filter), fresh statistics won't fix the root cause—EXPLAIN must be checked first. Option C is wrong because concurrency scaling handles increased query load by adding cluster capacity, but it does not improve the efficiency of a single slow query that scans many rows unnecessarily. Option D is wrong because VACUUM reclaims disk space and sorts rows for better compression, but it does not change the query execution path—a full table scan will remain a full table scan even after a vacuum.

Full explanation →
949
Multi-Selecthard

A company is migrating a large Oracle database to Amazon Aurora PostgreSQL. The migration must have minimal downtime and preserve data consistency. Which THREE AWS services or features should be used?

Select 3 answers
A.Amazon RDS for Oracle as the target
B.AWS DataSync for initial load
C.AWS Schema Conversion Tool (SCT) for schema conversion
D.Amazon Aurora PostgreSQL as the target database
E.AWS Database Migration Service (DMS) for continuous replication
AnswersC, D, E

SCT converts Oracle schema to Aurora PostgreSQL compatible schema.

Why this answer

The AWS Schema Conversion Tool (SCT) is required to convert the source Oracle database schema (including stored procedures, functions, and data types) to a format compatible with Amazon Aurora PostgreSQL. Without SCT, the heterogeneous migration would fail due to incompatible SQL dialects and database objects.

Exam trap

The trap here is that candidates often confuse AWS DataSync (a file-transfer service) with database migration tools, or mistakenly think RDS for Oracle can serve as a migration target when the question explicitly specifies Aurora PostgreSQL.

Full explanation →
950
MCQeasy

A company runs a data pipeline on AWS Glue that processes streaming data from Amazon Kinesis Data Streams and writes results to an Amazon Redshift cluster. The pipeline has been running smoothly, but recently the Glue job started failing with 'ResourceNotFoundException' for the Redshift table. What should the data engineer check first?

A.Verify that the target Redshift table exists and was not dropped or renamed.
B.Ensure the Redshift table schema matches the Glue job output.
C.Check the IAM role permissions for the Glue job to access Redshift.
D.Review security group rules for the Redshift cluster.
AnswerA

ResourceNotFoundException indicates the table is missing.

Why this answer

The error indicates the table does not exist or was deleted. Option B is wrong because IAM role issues would cause Access Denied, not ResourceNotFoundException. Option C is wrong because network issues would cause timeout or connection refused.

Option D is wrong because schema changes could cause type mismatch but not ResourceNotFoundException.

Full explanation →
951
MCQmedium

An IAM policy is attached to an AWS Glue job. The job needs to read from and write to S3 buckets, and also trigger other Glue jobs. The job is failing with an AccessDenied error when trying to write to a bucket named 'example-bucket'. What is the MOST likely cause?

A.The policy does not include s3:PutObject action.
B.The bucket name in the resource ARN does not match the actual bucket name.
C.The policy uses a resource ARN with a wildcard, which is not allowed.
D.The policy does not allow Glue actions.
AnswerB

The ARN uses 'example-bucket' but the actual bucket might have a different name.

Why this answer

The AccessDenied error when writing to 'example-bucket' most likely occurs because the resource ARN in the IAM policy specifies a different bucket name, causing the S3 service to deny the s3:PutObject action. IAM policies require exact ARN matches for resource-based permissions, and a mismatch between the ARN bucket name and the actual bucket name will result in an implicit deny, even if the action is allowed.

Exam trap

The trap here is that candidates assume the error is due to a missing action (like s3:PutObject) rather than a resource ARN mismatch, which is a subtle but common IAM misconfiguration that AWS explicitly tests in the DEA-C01 exam.

How to eliminate wrong answers

Option A is wrong because the error is specifically about writing (s3:PutObject), and if the policy lacked that action, the error would still occur, but the question asks for the 'most likely' cause given the policy is attached; the mismatch in the resource ARN is a more precise and common cause. Option C is wrong because wildcards in resource ARNs are allowed in IAM policies (e.g., 'arn:aws:s3:::example-bucket/*'), and using a wildcard would not cause an AccessDenied error if the bucket name matches. Option D is wrong because the job is failing on an S3 write, not on triggering other Glue jobs; Glue actions (like 'glue:StartJobRun') are separate and would produce a different error if missing.

Full explanation →
952
MCQhard

A company runs a nightly AWS Glue ETL job that reads from a JDBC source (PostgreSQL) and writes to S3 in Parquet format. The job takes over 6 hours, but the SLA requires completion within 4 hours. The source table has 500 million rows and is updated frequently. Which approach will most reliably reduce job duration?

A.Enable job bookmark and schedule the job to run more frequently.
B.Use multiple JDBC connections in parallel by setting 'hashexpression' and 'hashfield'.
C.Partition the source table by year and use pushdown predicates in the Glue job.
D.Increase the number of DPUs for the Glue job to 100.
AnswerC

This reduces the data scanned by filtering on partition columns.

Why this answer

Partitioning the source table by year and using pushdown predicates allows AWS Glue to read only the relevant partitions from PostgreSQL, drastically reducing the data scanned and transferred. This directly addresses the 500 million row volume by minimizing the JDBC read workload, which is the primary bottleneck. Option B, using multiple JDBC connections in parallel via hash partitioning, can improve performance but is less reliable: it significantly increases load on the source database, may hit connection limits, and its effectiveness depends on the JDBC driver's support for hashfield/hashexpression.

Moreover, it still reads all rows, whereas pushdown predicates reduce the data volume at the source, making option C more reliable for meeting the 4-hour SLA.

Exam trap

The trap here is that candidates often assume increasing DPUs (Option D) or adding parallelism (Option B) will linearly speed up JDBC reads, but they fail to recognize that the bottleneck is the source database's I/O and network throughput, not Glue's compute capacity, and that predicate pushdown is the only option that reduces the data volume at the source.

How to eliminate wrong answers

Option A is wrong because job bookmarks track previously processed data to avoid reprocessing, but they do not reduce the initial full load or the per-run data volume; scheduling more frequently would only compound the problem by running incomplete jobs. Option B is wrong because 'hashexpression' and 'hashfield' are not valid JDBC parallelism parameters in AWS Glue; the correct approach for parallel JDBC reads is to set 'hashfield' and 'hashpartitions' (not 'hashexpression'), and even then, parallelism alone cannot overcome the I/O bottleneck of scanning 500 million rows without filtering. Option D is wrong because increasing DPUs to 100 may improve compute parallelism for transformations, but the bottleneck is the JDBC read from PostgreSQL, which is constrained by the source database's network and query capacity, not by Glue's compute resources; excessive DPUs can also cause throttling or connection limits.

Full explanation →
953
MCQeasy

A company stores sensitive data in Amazon S3 and needs to ensure that data is encrypted at rest. Which AWS service can be used to manage the encryption keys?

A.AWS Key Management Service (KMS)
B.AWS Secrets Manager
C.AWS Identity and Access Management (IAM)
D.AWS Certificate Manager (ACM)
AnswerA

KMS is the service for managing encryption keys.

Why this answer

AWS Key Management Service (KMS) is the managed service for creating and controlling encryption keys used to encrypt data at rest in Amazon S3. Option A is correct. Option B (Secrets Manager) is for managing secrets like database passwords, not encryption keys.

Option C (IAM) manages access permissions, not encryption keys. Option D (Certificate Manager) handles SSL/TLS certificates, not encryption keys for data at rest.

Full explanation →
954
MCQmedium

A company is using Amazon RDS for PostgreSQL with Multi-AZ deployment. The primary instance fails and a failover occurs. After the failover, the application cannot connect to the database. What is the MOST likely cause?

A.The database instance is in a 'stopped' state after failover.
B.The Multi-AZ failover requires manual intervention to complete.
C.The security group for the RDS instance was not updated during failover.
D.The application is using the old primary instance endpoint instead of the RDS CNAME.
AnswerD

The application should use the CNAME, which updates automatically after failover.

Why this answer

After a Multi-AZ failover in Amazon RDS for PostgreSQL, the DNS CNAME record automatically updates to point to the new primary instance in the standby Availability Zone. If the application hardcodes the old primary instance's endpoint (specific IP or DNS name) instead of using the RDS CNAME (which remains constant), it will attempt to connect to the failed instance, causing connectivity loss. The CNAME is the stable connection point that always resolves to the current primary instance.

Exam trap

The trap here is that candidates may assume security groups or instance state are the issue, but AWS explicitly tests the concept that the RDS CNAME is the correct connection target and that hardcoding endpoints leads to failover failures.

How to eliminate wrong answers

Option A is wrong because RDS Multi-AZ failover does not stop the database instance; the new primary is promoted and remains in an 'available' state. Option B is wrong because Multi-AZ failover is fully automated and requires no manual intervention to complete. Option C is wrong because security groups are associated with the RDS instance itself, not with a specific AZ or IP, and they remain unchanged during failover; the new primary inherits the same security group configuration.

Full explanation →
955
Multi-Selectmedium

A data engineer is designing a data ingestion pipeline to load clickstream data from an Amazon S3 bucket into an Amazon Redshift cluster. The data arrives in 5-minute batches. Which TWO actions should the engineer take to ensure data consistency and avoid duplicates? (Select TWO.)

Select 2 answers
A.Define a SORTKEY on the target table to improve deduplication.
B.Disable workload management (WLM) to maximize resources.
C.Use the STL_LOAD_ERRORS system table to monitor and resolve load errors.
D.Load data into a single slice to maintain order.
E.Use a staging table and perform a MERGE operation to avoid duplicates.
AnswersC, E

Monitoring load errors helps catch and fix issues that could cause duplicates or missing data.

Why this answer

Options C and E are correct. Using the STL_LOAD_ERRORS system table (option C) allows the engineer to monitor and resolve load errors, ensuring data consistency. Using a staging table with a MERGE operation (option E) helps avoid duplicates by performing an upsert.

Option A (defining a SORTKEY) improves query performance but does not affect deduplication. Option B (disabling WLM) would reduce resource management and is not recommended. Option D (loading into a single slice) reduces performance and does not maintain order for consistency.

Full explanation →
956
MCQmedium

A company uses AWS Glue to process sensitive customer data stored in S3. The security team requires that all data be encrypted at rest using a customer-managed KMS key and that access to the key be auditable. Which solution meets these requirements?

A.Encrypt the data client-side before uploading to S3.
B.Configure the S3 bucket to use SSE-KMS with a customer-managed KMS key and enable CloudTrail for KMS events.
C.Enable default SSE-S3 encryption on the S3 bucket.
D.Use SSE-C with a customer-provided key.
AnswerB

SSE-KMS with customer-managed key provides encryption and auditability via CloudTrail.

Why this answer

SSE-KMS with a customer-managed KMS key provides encryption at rest and, when combined with CloudTrail logging for KMS events, offers full auditability of key usage. Option A (client-side encryption) does not encrypt data at rest within S3; it encrypts before upload. Option C (SSE-S3) uses AWS-managed keys, which do not allow customer audit of key access.

Option D (SSE-C) relies on customer-provided keys that are not managed by KMS and cannot be audited via CloudTrail.

Full explanation →
957
MCQhard

The exhibit shows the output of describe-table for a DynamoDB table. The table is used for a reporting job that queries by 'pk' and filters on 'sk' using a range condition. The job is running slowly. What is the most likely cause?

A.The table lacks a global secondary index (GSI).
B.The provisioned read capacity is too low.
C.The table uses provisioned throughput instead of on-demand.
D.The table needs a local secondary index (LSI) on 'sk'.
AnswerB

5 RCU is very low for reporting queries.

Why this answer

The describe-table output shows the table has a primary key composed of 'pk' (partition key) and 'sk' (sort key), which is ideal for the query pattern described (query by 'pk' and filter on 'sk' with a range condition). The job is running slowly, and the most likely cause is insufficient provisioned read capacity, as the reporting job may be consuming more read capacity units than provisioned, leading to throttling and slower performance.

Exam trap

The trap here is that candidates often assume a missing index (GSI or LSI) is the cause of slow queries, but the table already has a sort key that supports the query pattern, so the real issue is likely throughput capacity.

How to eliminate wrong answers

Option A is wrong because a GSI is not needed; the table already has 'sk' as a sort key, which supports efficient range queries on 'sk' when querying by 'pk'. Option C is wrong because switching to on-demand capacity would not necessarily fix slowness caused by low provisioned read capacity; on-demand is for unpredictable traffic, not a direct solution to throttling from insufficient capacity. Option D is wrong because an LSI is unnecessary; the table already has a sort key ('sk') on the base table, which supports the same range query pattern that an LSI would provide.

Full explanation →
958
MCQhard

A company has a data lake in Amazon S3 with millions of objects. The security team wants to enforce that all objects are encrypted with a specific customer-managed KMS key. The data engineer configures an S3 bucket policy to deny PutObject if the encryption is not set to that key. However, some existing objects are not encrypted with that key. What is the most efficient way to remediate the existing objects?

A.Use S3 Cross-Region Replication to replicate objects to a new bucket with the correct encryption.
B.Write a script using the AWS SDK to iterate over all objects and re-upload them with the correct encryption.
C.Use S3 Batch Operations to copy objects in the same bucket with the new encryption settings.
D.Use S3 Object Lambda to dynamically encrypt objects on read.
AnswerC

Batch Operations can efficiently update encryption for large numbers of objects.

Why this answer

S3 Batch Operations can copy objects within the same bucket with new encryption settings, efficiently updating millions of objects in place. Option A is incorrect because S3 Cross-Region Replication replicates objects to a different bucket or region, not to the same bucket with changed encryption. Option B is inefficient compared to Batch Operations for large-scale remediation.

Option D is incorrect because S3 Object Lambda transforms data on read, not at rest, so it does not change the stored encryption of existing objects.

Full explanation →
959
MCQmedium

A company is storing sensitive user data in an Amazon S3 bucket. The security team requires that all data be encrypted at rest using a customer-managed key stored in AWS KMS. The bucket policy must deny any PUT request that does not include the appropriate encryption header. Which bucket policy condition key should be used?

A.s3:x-amz-server-side-encryption-aws-kms-key-id
B.s3:x-amz-server-side-encryption
C.s3:x-amz-acl
D.aws:SourceArn
AnswerA

This condition key allows requiring a specific KMS key ID for encryption.

Why this answer

The `s3:x-amz-server-side-encryption-aws-kms-key-id` condition key allows the bucket policy to enforce that PUT requests include a specific customer-managed KMS key ID in the `x-amz-server-side-encryption-aws-kms-key-id` header, ensuring encryption at rest with the required key. This directly meets the security team's requirement to deny PUT requests that lack the appropriate encryption header tied to a customer-managed KMS key.

Exam trap

The trap here is that candidates often confuse `s3:x-amz-server-side-encryption` (which only checks the encryption algorithm, not the key) with `s3:x-amz-server-side-encryption-aws-kms-key-id` (which checks the specific KMS key ID), leading them to pick option B when the requirement explicitly demands a customer-managed key.

How to eliminate wrong answers

Option B is wrong because `s3:x-amz-server-side-encryption` only checks whether the `x-amz-server-side-encryption` header is present (e.g., `AES256` or `aws:kms`), but it cannot enforce that a specific customer-managed KMS key ID is used; it would allow any KMS key, including AWS-managed keys. Option C is wrong because `s3:x-amz-acl` is used to control access control list (ACL) headers in requests, not encryption headers, so it is irrelevant to encryption enforcement. Option D is wrong because `aws:SourceArn` is a global condition key used to restrict requests based on the ARN of the source resource (e.g., an SNS topic or Lambda function), not to enforce encryption headers in S3 PUT requests.

Full explanation →
960
MCQhard

A company uses Amazon Kinesis Data Streams with enhanced fan-out consumers. The stream has 5 shards. Each consumer reads from all shards. The total incoming data rate is 25 MB/s. What is the maximum read throughput per consumer if enhanced fan-out is enabled?

A.2 MB/s
B.10 MB/s
C.1 MB/s
D.5 MB/s
AnswerB

Each shard provides 2 MB/s read capacity with enhanced fan-out; 5 shards = 10 MB/s.

Why this answer

With enhanced fan-out, each consumer gets a dedicated 2 MB/s read throughput per shard. Since the stream has 5 shards, the maximum read throughput per consumer is 5 shards × 2 MB/s = 10 MB/s. This is because enhanced fan-out eliminates the 2 MB/s total read limit per shard shared among all consumers, providing each consumer with its own 2 MB/s pipe per shard.

Exam trap

The trap here is that candidates confuse the standard consumer throughput limit (2 MB/s total per shard shared among all consumers) with the enhanced fan-out limit (2 MB/s per shard per consumer), leading them to pick 2 MB/s or 5 MB/s instead of correctly multiplying by the number of shards.

How to eliminate wrong answers

Option A is wrong because 2 MB/s is the per-shard read throughput with enhanced fan-out, not the total for 5 shards. Option C is wrong because 1 MB/s is the per-shard read throughput for standard (non-enhanced) consumers, not for enhanced fan-out. Option D is wrong because 5 MB/s would be the total read throughput if each shard provided only 1 MB/s (standard) across 5 shards, but enhanced fan-out provides 2 MB/s per shard per consumer.

Full explanation →
961
MCQmedium

A data engineer is troubleshooting a data pipeline that uses Amazon Kinesis Data Firehose to deliver data to Amazon S3. The engineer notices that the S3 bucket contains many small files (less than 1 MB). This is causing performance issues in downstream processing. What is the BEST way to reduce the number of small files?

A.Increase the buffer size to at least 128 MB in the Firehose delivery stream configuration.
B.Use an AWS Lambda function to transform the data before delivery.
C.Change the compression format from GZIP to Snappy.
D.Decrease the buffer interval in the Firehose delivery stream configuration.
AnswerA

Larger buffer size leads to fewer, larger files.

Why this answer

Increasing the buffer size (e.g., to 128 MB) causes Firehose to deliver fewer, larger files, reducing the number of small files. Option B is incorrect because using a Lambda transformation does not inherently change buffering behavior. Option C is incorrect because changing the compression format (e.g., from GZIP to Snappy) affects storage size but not the number of files delivered.

Option D is incorrect because decreasing the buffer interval would cause more frequent deliveries, creating more small files.

Full explanation →
962
Multi-Selectmedium

A company is designing a data lake on Amazon S3 for analytics. The data includes sensitive personally identifiable information (PII). Which TWO actions should the company take to protect the data? (Choose TWO.)

Select 2 answers
A.Enable S3 Block Public Access.
B.Enable Requester Pays.
C.Enable S3 Transfer Acceleration.
D.Enable cross-region replication.
E.Enable default encryption with SSE-KMS.
AnswersA, E

Why this answer

S3 Block Public Access (Option A) prevents any public access to S3 buckets and objects, which is critical for protecting PII from unintended exposure. Default encryption with SSE-KMS (Option E) ensures that all data written to S3 is encrypted at rest using AWS KMS-managed keys, providing both encryption and centralized key management for sensitive data.

Exam trap

The trap here is that candidates often confuse operational features like Requester Pays or Transfer Acceleration with security controls, or they think replication alone provides data protection, when in fact encryption and access blocking are the direct mechanisms for safeguarding PII.

Full explanation →
963
MCQmedium

A data engineer runs the above CLI command to describe the DynamoDB table 'Orders'. The table has a partition key 'OrderID' and sort key 'CustomerID'. Which query operation is most efficient for retrieving all orders for a specific customer?

A.Query the table using CustomerID as the partition key
B.Scan the table and filter by CustomerID
C.Use GetItem with CustomerID as the key
D.Create a Global Secondary Index on CustomerID and query the index
AnswerD

A GSI allows efficient query by CustomerID alone.

Why this answer

A Global Secondary Index (GSI) on CustomerID allows you to query efficiently using CustomerID as the partition key, avoiding a full table scan. Since the base table's primary key is (OrderID, CustomerID), you cannot directly query by CustomerID alone; a GSI provides an alternative access pattern optimized for this query.

Exam trap

The trap here is that candidates assume the sort key can be used as a query filter without an index, but DynamoDB requires the partition key for Query operations, and a Scan is often mistakenly chosen as a simpler alternative despite its performance cost.

How to eliminate wrong answers

Option A is wrong because CustomerID is the sort key, not the partition key, so a Query operation requires the partition key (OrderID) to be specified; you cannot query using only the sort key. Option B is wrong because a Scan reads every item in the table, which is inefficient and costly for large datasets, especially when a targeted query is possible. Option C is wrong because GetItem requires both the partition key and sort key to retrieve a single item; it cannot return multiple orders for a customer.

Full explanation →
964
MCQhard

A company has an AWS Glue ETL job that reads data from an S3 bucket encrypted with SSE-S3. The job runs successfully, but the output written to another S3 bucket with SSE-KMS fails. The IAM role for the Glue job has s3:PutObject and kms:GenerateDataKey permissions. What is the most likely cause?

A.The IAM role is missing kms:Encrypt permission
B.The target S3 bucket policy denies s3:PutObject
C.The KMS key policy does not grant the Glue role kms:GenerateDataKey
D.The source bucket's encryption type is incompatible with the target
AnswerA

Writing with SSE-KMS requires kms:Encrypt.

Why this answer

For SSE-KMS, the IAM role needs both kms:GenerateDataKey and kms:Encrypt permissions to write objects. The role already has kms:GenerateDataKey, but missing kms:Encrypt causes the write to fail. Option A is correct.

Option B is incorrect because if the bucket policy denied s3:PutObject, the job would fail on the PutObject action itself, not on encryption. Option C is incorrect because the role already has kms:GenerateDataKey; the missing permission is kms:Encrypt. Option D is incorrect because the source bucket's encryption (SSE-S3) is irrelevant to the write operation; the error occurs on the target bucket with SSE-KMS.

Full explanation →
965
MCQhard

Your company runs a data pipeline that ingests data from AWS Database Migration Service (DMS) into Amazon S3 in Parquet format. An AWS Glue ETL job then transforms the data and loads it into an Amazon Redshift cluster. The Glue job uses a JDBC connection to Redshift. Recently, the Glue job started failing with a 'communication failure' error when writing to Redshift. The Redshift cluster is in a VPC with public accessibility disabled. The Glue job runs in a VPC with a subnet that has a route to a NAT gateway. The security group for Redshift allows inbound traffic from the Glue job's security group. The Glue job's IAM role has the necessary permissions. What is the most likely cause?

A.The Glue job's IAM role does not have the redshift:DescribeClusters permission.
B.The Redshift cluster's public accessibility is disabled, but the Glue job is trying to connect over the internet.
C.The Glue job and Redshift cluster are in different VPCs that are not peered or connected via VPC Transit Gateway.
D.The NAT gateway is not configured to allow traffic to the Redshift cluster's subnet.
AnswerC

Without VPC peering or transit gateway, the Glue job cannot reach the Redshift cluster.

Why this answer

Even though the security group allows inbound traffic, the Glue job's VPC may not have a route to the Redshift cluster's VPC if they are in different VPCs. Option A is wrong because IAM permissions are not the issue. Option B is wrong because the Redshift cluster is in a VPC and not publicly accessible.

Option D is wrong because the NAT gateway is for outbound internet, not for connecting to Redshift within the same VPC.

Full explanation →
966
MCQhard

A company uses AWS Lake Formation to manage data lake permissions. The data engineer notices that a user with SELECT permission on a table can also query the underlying data in Amazon S3 directly. How can the engineer enforce that access to the S3 data is only through Lake Formation?

A.Use S3 Access Points with a policy that restricts access to only Lake Formation
B.Grant the user permissions only through Lake Formation and remove any IAM policies that allow direct S3 access to the data location
C.Enable S3 Block Public Access on the bucket
D.Change the S3 bucket policy to deny all access except from Lake Formation
AnswerB

This ensures that the user can only access data through Lake Formation, and direct S3 access is blocked.

Why this answer

When using Lake Formation, you should grant permissions only through Lake Formation and remove any IAM policies that allow direct S3 access. This ensures that users cannot bypass Lake Formation's fine-grained access controls. Option A (S3 Access Points) can restrict access but does not inherently enforce Lake Formation-only access unless properly configured with a policy that specifically allows only Lake Formation, which is more complex and not the recommended approach.

Option C (S3 Block Public Access) only prevents public access but does not prevent authorized IAM users from direct access. Option D (bucket policy denying all except Lake Formation) could work but is not the simplest or most standard method; the recommended practice is to use Lake Formation's integration and manage permissions centrally.

Full explanation →
967
MCQmedium

A company is ingesting log files from multiple EC2 instances into Amazon S3 using the CloudWatch agent. The logs are delivered to a CloudWatch Logs group, and a subscription filter sends them to a Lambda function for transformation, then to Firehose. The Firehose stream is configured with a buffer interval of 60 seconds and buffer size of 5 MB. The logs are critical and must be available in S3 within 5 minutes. What is the most cost-effective way to reduce the delivery latency?

A.Replace Firehose with Amazon Kinesis Data Streams
B.Increase the buffer size to 10 MB
C.Increase the buffer interval to 120 seconds
D.Decrease the buffer interval to 10 seconds
AnswerD

Lower buffer interval reduces delivery latency.

Why this answer

Decreasing the Firehose buffer interval to 10 seconds directly reduces the maximum time data waits in the buffer before being delivered to S3, ensuring logs reach S3 within the required 5-minute window. Since the current 60-second buffer interval is the primary contributor to latency, lowering it to 10 seconds minimizes delivery delay without incurring additional costs, as Firehose charges are based on data volume, not buffer frequency.

Exam trap

The trap here is that candidates may think increasing buffer size or interval improves throughput, but the question asks for reduced latency, so decreasing the buffer interval is the direct and cost-effective solution.

How to eliminate wrong answers

Option A is wrong because replacing Firehose with Kinesis Data Streams would require additional components (e.g., a consumer to write to S3) and increase cost and complexity, not reduce latency cost-effectively. Option B is wrong because increasing the buffer size to 10 MB would allow more data to accumulate before delivery, potentially increasing latency, not reducing it. Option C is wrong because increasing the buffer interval to 120 seconds would double the maximum buffering time, worsening delivery latency.

Full explanation →
968
MCQmedium

A data engineering team notices that an AWS Glue ETL job, which processes hourly data from an S3 bucket, is taking progressively longer to run. The job reads Parquet files partitioned by date and hour. Which action is MOST likely to improve the job's performance?

A.Enable pushdown predicate filtering on the job's data source.
B.Convert Parquet files to CSV to improve read performance.
C.Increase the number of DPUs for the job.
D.Switch from Spark to Python shell for simpler processing.
AnswerA

Pushdown predicates filter data at the source, reducing data scanned.

Why this answer

Enabling pushdown predicate filtering allows the Glue job to read only the relevant partitions (e.g., specific date and hour) instead of scanning all data. This directly addresses the symptom of progressively longer run times as data accumulates. Option B is incorrect because Parquet is a columnar format optimized for performance, while CSV would increase I/O.

Option C, increasing DPUs, can improve parallelism but does not reduce the amount of data read, so it may not address the root cause. Option D, switching to Python shell, would lose Spark's distributed processing capabilities and is unlikely to improve performance.

Full explanation →
969
MCQhard

Refer to the exhibit. A data engineer applies this bucket policy to an S3 bucket. A user within the 10.0.0.0/24 IP range attempts to upload an object to the bucket using an HTTP (non-HTTPS) request. What is the outcome?

A.The upload succeeds because the Allow statement grants permission.
B.The upload succeeds because the user's IP is allowed.
C.The upload fails because the user's IP is not in the allowed range for PutObject.
D.The upload fails because the request is not using HTTPS.
AnswerD

Explicit Deny for non-HTTPS requests.

Why this answer

The bucket policy includes a condition `aws:SecureTransport` set to `false`, which explicitly denies any request that does not use HTTPS. Since the user is making an HTTP (non-HTTPS) request, the Deny statement overrides any Allow statement, causing the upload to fail. The correct answer is D.

Exam trap

The DEA-C01 exam often tests the precedence of explicit Deny over Allow in IAM policies, and the trap here is that candidates focus on the IP range in the Allow statement and overlook the Deny condition that blocks non-HTTPS requests.

How to eliminate wrong answers

Option A is wrong because the Allow statement is overridden by the explicit Deny when the condition `aws:SecureTransport` equals `false`; the upload does not succeed. Option B is wrong because even though the user's IP is within the allowed range (10.0.0.0/24), the Deny statement for non-HTTPS requests takes precedence and blocks the upload. Option C is wrong because the user's IP is actually within the allowed range for PutObject; the failure is due to the lack of HTTPS, not the IP range.

Full explanation →
970
Multi-Selectmedium

A company uses AWS Glue to perform ETL on data stored in Amazon S3. The Glue job reads CSV files, converts them to Parquet, and partitions by date. The job runs daily and processes about 500 GB of data. The team wants to optimize costs and performance. Which three actions should the team take? (Select THREE.)

Select 3 answers
A.Increase the Spark shuffle partitions to 500.
B.Use column pruning to read only necessary columns in the Glue script.
C.Use G.1X or G.2X worker types for better performance.
D.Increase the number of DPUs for the job.
E.Write the output as JSON instead of Parquet to avoid compression overhead.
AnswersB, C, D

Reduces data scanned and improves performance.

Why this answer

Column pruning in AWS Glue scripts reduces the amount of data read from Amazon S3 by specifying only the columns needed for the ETL transformation. This minimizes I/O and network overhead, directly lowering costs and improving job performance, especially when processing large CSV files.

Exam trap

The trap here is that candidates often confuse increasing DPUs or shuffle partitions as a universal performance fix, but AWS Glue's cost optimization relies on reducing data processed (column pruning) and choosing appropriate worker types for the workload, not simply scaling resources.

Full explanation →
971
MCQeasy

A company needs to transfer 10 TB of historical data from an on-premises HDFS cluster to Amazon S3. The data is stored on a single 20 TB disk. The network link to AWS has a bandwidth of 1 Gbps. The transfer must be completed within 2 days. Which solution meets these requirements?

A.Use AWS Snowball Edge to transfer the data physically.
B.Use Amazon Kinesis Data Streams to stream data to S3.
C.Use AWS DMS to migrate data from HDFS to S3.
D.Use AWS CLI to copy data directly to S3 over the network.
AnswerA

Snowball Edge provides fast, reliable transfer for large datasets.

Why this answer

AWS Snowball Edge is the correct solution because it can physically transfer 10 TB of data from a single 20 TB disk within the 2-day window, bypassing the network bandwidth limitation. With a 1 Gbps link, the theoretical maximum transfer of 10 TB would take approximately 22.2 hours under ideal conditions, but real-world overhead, latency, and potential congestion make it unreliable to complete within 2 days. Snowball Edge provides a petabyte-scale physical transport solution that avoids network constraints entirely.

Exam trap

The trap here is that candidates may calculate the theoretical transfer time (10 TB / 1 Gbps ≈ 22.2 hours) and assume it fits within 2 days, ignoring real-world network inefficiencies, disk I/O limits, and the fact that AWS CLI transfers over a single TCP connection cannot saturate a 1 Gbps link without tuning (e.g., multipart uploads, parallel connections).

How to eliminate wrong answers

Option B is wrong because Amazon Kinesis Data Streams is designed for real-time streaming of small records (up to 1 MB per record) and cannot handle bulk transfer of 10 TB of historical data from an HDFS cluster; it lacks the throughput and batch processing capability for such large volumes. Option C is wrong because AWS DMS (Database Migration Service) is intended for migrating databases (e.g., Oracle, MySQL) and does not support HDFS as a source endpoint; it cannot read data from HDFS or transfer it to S3. Option D is wrong because using AWS CLI to copy data directly over a 1 Gbps network link would take at least 22.2 hours under perfect conditions, but real-world factors like TCP overhead, retransmissions, and network congestion make it highly unlikely to complete within 2 days, especially with a single 20 TB disk that may have I/O bottlenecks.

Full explanation →
972
MCQhard

A company runs a data ingestion pipeline that uses AWS Glue to read 500 GB of JSON files from an S3 bucket (s3://raw-data/) every hour. The Glue ETL job transforms the data and writes Parquet files to another S3 bucket (s3://processed-data/). The job is triggered by a time-based CloudWatch Events rule. Recently, the job has started taking over 2 hours to complete, causing delays in downstream processes. The data volume has been consistent, and no changes have been made to the job code or infrastructure. The S3 bucket 's3://raw-data/' receives new files continuously, but the Glue job reads all files in the bucket each run (no incremental processing). The engineer suspects that the job is reprocessing old data. Which action should the engineer take FIRST to reduce the job duration?

A.Enable Glue job bookmarking and configure the job to process only new data.
B.Increase the parallelism of the Spark job by repartitioning the data.
C.Add partition pruning by modifying the S3 path to include date-based partitions.
D.Increase the number of DPUs for the Glue job to 100.
AnswerA

Bookmarking tracks processed files, so subsequent runs only process new files, drastically reducing runtime.

Why this answer

Enabling job bookmarking in Glue allows the job to process only new files since the last run, dramatically reducing processing time. Option D (increasing DPUs) would help with resource constraints but does not address the root cause of reprocessing old data. Option B (increasing parallelism) may help but not as much as eliminating reprocessing.

Option C (using partition pruning) assumes the data is partitioned, but the stem says all files are read; partitioning might not help if files are not organized by time. The most impactful first step is to enable bookmarking.

Full explanation →
973
MCQmedium

A data engineer is designing a data ingestion pipeline to load data from an on-premises Oracle database to Amazon S3. The pipeline should capture changes in near real-time (within minutes) and minimize impact on the source database. The source table has a 'last_modified' timestamp column. Which service combination would meet these requirements?

A.AWS DMS with a replication task in CDC mode, writing to S3 in Parquet format.
B.Amazon Kinesis Data Firehose with a Lambda function that queries Oracle.
C.AWS Data Pipeline with a periodic SQL query activity to copy full table snapshots.
D.AWS Glue with a JDBC connection to Oracle, running a crawler every 5 minutes.
AnswerA

DMS CDC captures minimal changes and writes to S3 with low latency.

Why this answer

AWS DMS with a replication task in CDC (Change Data Capture) mode is the correct choice because it continuously reads the Oracle redo logs to capture near real-time changes (within seconds to minutes) with minimal impact on the source database. It can directly write to S3 in Parquet format, meeting the requirement for low-latency ingestion without full table scans.

Exam trap

The trap here is that candidates assume a 'last_modified' timestamp column enables easy CDC via polling (options B, D), but the question tests that true near real-time CDC with minimal source impact requires reading database redo logs, not querying the table, and that services like Kinesis or Glue cannot perform log-based CDC without additional custom logic.

How to eliminate wrong answers

Option B is wrong because Kinesis Data Firehose with a Lambda function that queries Oracle would require periodic polling of the source table, which either misses changes between polls or causes high load on the database if polled too frequently, and it does not natively support CDC from Oracle redo logs. Option C is wrong because AWS Data Pipeline with a periodic SQL query activity to copy full table snapshots performs full table scans, which impacts the source database and cannot capture changes in near real-time (only at scheduled intervals). Option D is wrong because AWS Glue with a JDBC connection running a crawler every 5 minutes performs full table scans or incremental queries based on the 'last_modified' column, but this still causes repeated query load on Oracle and cannot achieve true near real-time CDC without reading redo logs.

Full explanation →
974
MCQhard

A data engineer is designing a data ingestion pipeline for clickstream data from a mobile app. The data volume varies, with occasional spikes up to 10 MB/s. The pipeline must persist the raw data in Amazon S3 and make it available for near-real-time analytics via Amazon Athena. Which combination of services minimizes cost and operational overhead?

A.Amazon Kinesis Data Streams with Amazon Kinesis Data Analytics, then Amazon S3
B.Amazon SQS with an Auto Scaling group of EC2 instances writing to Amazon S3
C.Amazon Kinesis Data Streams with AWS Lambda for transformation, then Amazon S3
D.Amazon Kinesis Data Firehose with direct delivery to Amazon S3, then Amazon Athena
AnswerD

Firehose is fully managed, scales automatically, and delivers to S3.

Why this answer

Amazon Kinesis Data Firehose is the most cost-effective and low-overhead solution for ingesting variable-volume clickstream data (up to 10 MB/s) into Amazon S3 because it is a fully managed service that automatically scales, buffers, and compresses data before delivery. It integrates directly with S3 without requiring custom code or infrastructure management, and the data is immediately queryable by Amazon Athena with no additional transformation steps.

Exam trap

The trap here is that candidates often choose Amazon Kinesis Data Streams with Lambda (Option C) because they think it provides more control, but they overlook Lambda's concurrency limits and the operational burden of managing stream shards, making Firehose the simpler and cheaper choice for raw data ingestion to S3.

How to eliminate wrong answers

Option A is wrong because Amazon Kinesis Data Analytics adds unnecessary cost and complexity for a pipeline that only needs to persist raw data to S3, and it requires a separate stream consumer. Option B is wrong because Amazon SQS with Auto Scaling EC2 instances introduces significant operational overhead for managing instance scaling, SQS polling, and potential data loss or duplication, and it is not optimized for near-real-time streaming at 10 MB/s. Option C is wrong because AWS Lambda has a maximum invocation duration of 15 minutes and a concurrency limit that can cause throttling during spikes, making it unsuitable for sustained 10 MB/s throughput without complex sharding and retry logic.

Full explanation →
975
MCQmedium

A data engineer needs to set up a cross-account access for an S3 bucket so that users in Account B can read objects. The bucket in Account A has a bucket policy that grants access. What additional step is required?

A.Enable S3 object ACLs on the bucket.
B.Create an IAM role in Account B and attach a policy that allows s3:GetObject for the bucket.
C.Disable S3 Block Public Access settings on the bucket.
D.Set up an S3 Lifecycle policy to replicate objects to Account B.
AnswerB

Users in Account B need an IAM role or user with explicit permissions to access the bucket.

Why this answer

Cross-account S3 access requires both a bucket policy in the source account (Account A) that grants permissions to the target account or role, and an IAM role in the target account (Account B) with a policy allowing the necessary actions (e.g., s3:GetObject). This ensures that users in Account B can assume the role and access the bucket. Option A (enabling ACLs) is unnecessary and not recommended; ACLs are legacy and can be disabled.

Option C (disabling Block Public Access) is not required because the bucket policy is not public; it only grants cross-account access to a specific role. Option D (lifecycle policy) is for object lifecycle management and does not provide access control.

Full explanation →
Page 12

Page 13 of 23

Page 14

All pages

1234567891011121314151617181920212223

Practice DEA-C01 by domain

Target a specific domain to shore up weak areas.

Data Ingestion and TransformationData Operations and SupportData Security and GovernanceData Store Management
See all domains with question counts →