Courseiva

AWS Certified Data Engineer Associate DEA-C01 (DEA-C01) — Questions 1051–1125

1711 questions total · 23pages · All types, answers revealed

Take a mock examExam hub
Page 14

Page 15 of 23

Page 16
1051
MCQhard

A company uses Amazon DynamoDB for a gaming leaderboard. The table has a partition key of 'game_id' and a sort key of 'score'. The read capacity is provisioned at 1000 RCUs. During peak hours, users report high latency when querying the top 10 scores for a specific game. The DynamoDB metrics show ConsumedReadCapacityUnits averaging 800 but occasional throttling. What is the most likely cause and solution?

A.Create a global secondary index with the same key schema to distribute reads
B.Remove the sort key and use a global secondary index
C.Increase the provisioned RCUs to 2000
D.The hot game_id partition is exceeding its throughput; add DynamoDB Accelerator (DAX) to cache reads
AnswerD

DAX caches frequent reads, reducing load on the hot partition and lowering latency.

Why this answer

The hot game_id partition is exceeding its provisioned throughput because DynamoDB distributes RCUs evenly across partitions, and a single partition can only handle up to (1000 RCUs / number of partitions) per second. When a specific game_id becomes popular, all reads hit the same partition, causing throttling despite low overall consumed capacity. Adding DynamoDB Accelerator (DAX) caches the top 10 scores for that partition, reducing read pressure and eliminating throttling without increasing RCUs.

Exam trap

The trap here is that candidates see 'ConsumedReadCapacityUnits averaging 800' and assume overall capacity is sufficient, missing that DynamoDB throttles at the partition level, not the table level, so a hot partition can be throttled even when table-level consumption is below provisioned RCUs.

How to eliminate wrong answers

Option A is wrong because creating a global secondary index with the same key schema would not distribute reads across partitions—it would still have the same hot partition issue, as the GSI inherits the same partition key. Option B is wrong because removing the sort key and using a GSI would break the leaderboard's ability to query by score order, and the GSI would still suffer from the same hot partition if the partition key remains 'game_id'. Option C is wrong because increasing RCUs to 2000 would only double the per-partition limit, but the hot partition would still be throttled if the traffic spike exceeds the new per-partition limit; it does not address the root cause of uneven access patterns.

Full explanation →
1052
MCQhard

A data engineer applies the above S3 bucket policy to an S3 bucket used by a Glue ETL job. The Glue job writes objects to the bucket. Which of the following is true about the behavior of the policy?

A.The policy allows PutObject with aws:kms encryption because the Allow statement is broader.
B.The policy allows PutObject with no encryption because the Deny only applies to PutObject.
C.The policy denies all PutObject requests because the Allow and Deny statements are contradictory.
D.The policy allows PutObject with AES256 encryption and denies PutObject with aws:kms encryption.
AnswerC

The Allow requires AES256, the Deny requires aws:kms; no request can satisfy both, and Deny overrides Allow.

Why this answer

In AWS IAM policy evaluation, an explicit Deny always overrides any Allow. The policy has an Allow statement granting s3:PutObject for all principals, but a separate Deny statement explicitly denies s3:PutObject when the encryption condition is not aws:kms. Since the Deny applies to all PutObject requests (including those with no encryption or AES256), and the Allow does not include a condition to match only aws:kms, the Deny takes precedence and blocks all PutObject requests, making the policy effectively deny all PutObject operations.

Exam trap

The trap here is that candidates assume an Allow statement with a broader scope can override a Deny, but AWS IAM policy evaluation strictly enforces that an explicit Deny always takes precedence over any Allow, making the policy effectively deny all actions that match the Deny condition.

How to eliminate wrong answers

Option A is wrong because the Allow statement does not include a condition requiring aws:kms encryption; it is unconditional, but the explicit Deny overrides it, so PutObject with aws:kms is also denied. Option B is wrong because the Deny statement explicitly denies PutObject when the encryption condition is not aws:kms, which includes requests with no encryption; however, the Deny also applies to all PutObject requests because the condition key 's3:x-amz-server-side-encryption' is not present in requests without encryption, causing the Deny to match and block them. Option D is wrong because the Deny statement denies PutObject when the encryption is not aws:kms, which includes AES256 and no encryption, but the explicit Deny overrides the Allow, so no PutObject is allowed at all, not even with AES256.

Full explanation →
1053
MCQmedium

A company uses AWS Data Pipeline to copy data from DynamoDB to S3 daily. Recently, the pipeline started failing with 'ThrottlingException' errors. The DynamoDB table has on-demand capacity. Which action should be taken to resolve the issue?

A.Increase the write capacity units of the DynamoDB table.
B.Replace Data Pipeline with AWS Glue using a DynamoDB connector.
C.Configure the pipeline to use a retry strategy with exponential backoff.
D.Disable the pipeline's retry logic and increase the timeout.
AnswerC

Retries with backoff alleviate throttling by slowing down requests.

Why this answer

ThrottlingException errors in AWS Data Pipeline when reading from DynamoDB indicate that the pipeline's read requests are exceeding the table's available throughput. Since the table uses on-demand capacity, which can handle spikes but has a per-second throughput limit, implementing exponential backoff in the pipeline's retry strategy allows it to reduce request rate upon throttling, aligning with AWS SDK best practices for handling DynamoDB throttling.

Exam trap

The trap here is that candidates assume on-demand capacity eliminates all throttling, but it only handles traffic spikes within a per-second limit, so throttling can still occur with sustained high read rates, and the correct fix is to implement exponential backoff in the pipeline's retry strategy rather than modifying capacity or switching tools.

How to eliminate wrong answers

Option A is wrong because DynamoDB on-demand capacity does not use provisioned write capacity units; increasing write capacity units is irrelevant and would require switching to provisioned mode, which is unnecessary. Option B is wrong because replacing Data Pipeline with AWS Glue using a DynamoDB connector does not inherently resolve throttling; Glue also uses the same DynamoDB read APIs and would face the same throttling issue without proper retry handling. Option D is wrong because disabling retry logic and increasing the timeout would cause the pipeline to fail permanently on the first throttling error, as it would not retry the request, and a longer timeout does not prevent throttling.

Full explanation →
1054
MCQhard

A company runs an Amazon RDS for PostgreSQL instance that stores financial data. The company requires point-in-time recovery (PITR) with a retention period of 35 days. Additionally, the company needs to create a new database from a specific snapshot every night for testing. Which combination of actions should the data engineer take to meet these requirements?

A.Enable automated backups with a 35-day retention period and create a manual snapshot each night for testing.
B.Create a read replica and promote it to a new instance for testing each night.
C.Enable Multi-AZ and use the standby instance for testing.
D.Disable automated backups to reduce storage costs and take manual snapshots with 35-day retention.
AnswerA

Automated backups provide PITR; manual snapshots are independent and can be restored for testing.

Why this answer

Automated backups in Amazon RDS for PostgreSQL support a maximum retention period of 35 days, which satisfies the PITR requirement. Additionally, creating a manual snapshot each night provides a stable, independent copy for testing without interfering with the automated backup schedule or the source database's performance.

Exam trap

The trap here is that candidates often confuse the purpose of Multi-AZ standby instances (which are not directly usable for testing) or assume that manual snapshots alone can provide PITR, but automated backups are strictly required for point-in-time recovery in RDS.

How to eliminate wrong answers

Option B is wrong because a read replica is designed for read scaling and high availability, not for creating a nightly test database; promoting a read replica each night would disrupt replication and require re-creating the replica, which is inefficient and does not meet the PITR retention requirement. Option C is wrong because Multi-AZ provides high availability and automatic failover, but the standby instance is not directly accessible for testing; it cannot be used to create a new database without promoting it, which would break the Multi-AZ configuration. Option D is wrong because disabling automated backups eliminates the ability to perform point-in-time recovery (PITR), and manual snapshots alone do not support PITR; automated backups are required for transaction log retention and restore to any point within the retention window.

Full explanation →
1055
MCQmedium

A real-time analytics application uses Amazon Kinesis Data Streams. The consumer application falls behind, causing increased latency. Which action would MOST effectively improve throughput?

A.Reduce the RecordMaxBufferedTime parameter in the Firehose delivery stream.
B.Increase the number of shards in the data stream.
C.Increase the batch size in the Kinesis Producer Library.
D.Use enhanced fan-out to dedicate a shard per consumer.
AnswerB

More shards increase parallelism and throughput capacity.

Why this answer

Increasing the number of shards in the Kinesis Data Stream directly increases the stream's read capacity (each shard supports up to 2 MB/s read and 5 transactions per second for shared throughput). This allows the consumer application to process more data in parallel, reducing the backlog and latency. The question specifies a consumer application falling behind, which is a read-throughput bottleneck, and scaling shards is the most effective way to address it.

Exam trap

The trap here is that candidates confuse producer-side optimizations (like KPL batch size or Firehose buffering) with consumer-side throughput issues, or they assume enhanced fan-out alone solves a shard-scaling problem without recognizing that the root cause is insufficient shard count for the consumer's processing rate.

How to eliminate wrong answers

Option A is wrong because RecordMaxBufferedTime is a Kinesis Firehose parameter that controls how long data is buffered before delivery to a destination; it does not affect Kinesis Data Streams consumer throughput or latency. Option C is wrong because increasing the batch size in the Kinesis Producer Library (KPL) improves write efficiency by aggregating records, but the problem is with the consumer falling behind, not the producer. Option D is wrong because enhanced fan-out provides dedicated 2 MB/s read throughput per consumer per shard, but it does not increase the total number of shards; if the consumer is already saturated on a single shard, enhanced fan-out helps only if multiple consumers exist, but the core issue of insufficient shard count remains.

Full explanation →
1056
MCQeasy

A data engineer needs to store log files from multiple applications in a centralized location. The logs are generated in JSON format and each log entry is about 1 KB. The engineer needs to query the logs occasionally using SQL-like queries. Which AWS service is most appropriate?

A.Amazon DynamoDB
B.Amazon Redshift
C.Amazon Athena with data stored in S3
D.Amazon RDS for MySQL
AnswerC

Athena queries S3 data directly with SQL, suitable for occasional queries.

Why this answer

Amazon Athena is the most appropriate service because it allows you to query log files stored in S3 directly using standard SQL, without needing to load or transform the data. Since the logs are in JSON format and each entry is about 1 KB, Athena's schema-on-read approach works perfectly for occasional SQL-like queries, and you only pay for the data scanned per query, making it cost-effective for infrequent access.

Exam trap

The trap here is that candidates often choose Amazon Redshift or RDS because they think 'SQL-like queries' require a traditional database, overlooking Athena's ability to query data directly in S3 without loading it, which is a key serverless pattern for log analytics.

How to eliminate wrong answers

Option A is wrong because Amazon DynamoDB is a NoSQL key-value and document database optimized for low-latency, high-throughput access patterns, not for ad-hoc SQL-like queries on large volumes of log data, and it would require schema design and provisioning. Option B is wrong because Amazon Redshift is a petabyte-scale data warehouse designed for complex analytical queries on structured, transformed data, which is overkill and costly for occasional log queries on JSON files stored in S3. Option D is wrong because Amazon RDS for MySQL is a relational database that requires schema definition, data loading, and ongoing management, making it unsuitable for storing raw JSON log files directly without ETL, and it lacks the serverless, pay-per-query model for infrequent access.

Full explanation →
1057
MCQeasy

A company wants to centrally manage access to multiple AWS accounts for its data engineers. The company already uses AWS Organizations. Which AWS service should be used to define fine-grained permissions across accounts?

A.AWS IAM
B.AWS IAM Identity Center (AWS Single Sign-On)
C.AWS Resource Access Manager (AWS RAM)
D.AWS Key Management Service (AWS KMS)
AnswerB

IAM Identity Center provides centralized access management across accounts.

Why this answer

AWS IAM Identity Center (formerly AWS Single Sign-On) enables centralized management of permissions across multiple AWS accounts by allowing administrators to define fine-grained permissions using permission sets. This eliminates the need to create individual IAM users in each account. Option A is incorrect because IAM is per-account and does not support cross-account permission management without additional configuration.

Option C is incorrect because AWS Resource Access Manager (RAM) is used to share resources, not to define permissions. Option D is incorrect because AWS Key Management Service (KMS) is for encryption key management, not access control.

Full explanation →
1058
MCQhard

A financial services company uses AWS KMS to encrypt data in Amazon S3. The compliance team requires that all encryption keys be rotated automatically every 365 days. The data engineer needs to implement this requirement without manual intervention. Which solution meets the requirement with the LEAST operational overhead?

A.Create a customer managed key (CMK) in KMS with automatic rotation enabled every 365 days. Use this CMK to encrypt S3 objects.
B.Create a customer managed key with imported key material and configure a Lambda function to rotate the key every 365 days.
C.Use the AWS managed key for Amazon S3 (aws/s3) for server-side encryption.
D.Use S3 server-side encryption with S3 managed keys (SSE-S3).
AnswerC

AWS managed keys are automatically rotated every year with no operational overhead.

Why this answer

The AWS managed key for Amazon S3 (aws/s3) is automatically rotated by AWS every 365 days (or less) with no configuration or maintenance required. This satisfies the compliance requirement with zero operational overhead, as the rotation is handled entirely by the AWS KMS service without any manual intervention or custom automation.

Exam trap

The trap here is that candidates often assume customer managed keys (CMK) with automatic rotation are the only way to meet a specific rotation interval, overlooking that AWS managed keys already rotate on a 365-day schedule and require zero configuration, making them the least overhead solution.

How to eliminate wrong answers

Option A is wrong because customer managed keys (CMKs) with automatic rotation have a default rotation period of 365 days, but enabling automatic rotation requires manual activation and does not meet the 'least operational overhead' requirement compared to using an AWS managed key. Option B is wrong because using imported key material disables automatic rotation in KMS, requiring a custom Lambda function to manually rotate the key, which introduces significant operational overhead and complexity. Option D is wrong because SSE-S3 uses S3 managed keys (Amazon S3-managed keys) that are rotated automatically, but the rotation frequency is not guaranteed to be exactly every 365 days and is not configurable; the compliance team specifically requires a 365-day rotation interval, which is not a documented behavior of SSE-S3.

Full explanation →
1059
MCQeasy

A company uses Amazon Redshift for data warehousing. The security team requires that all data in transit between the Redshift cluster and clients be encrypted. Which feature should be enabled?

A.Client-side VPN
B.SSL/TLS encryption
C.AWS KMS key
D.VPC peering
AnswerB

Redshift supports SSL/TLS for encrypting client connections.

Why this answer

Amazon Redshift supports SSL/TLS encryption for client connections to ensure data in transit is encrypted. Option A (Client-side VPN) is not a Redshift feature for encrypting client connections. Option C (AWS KMS key) is used for encrypting data at rest, not in transit.

Option D (VPC peering) does not provide encryption of data in transit between the cluster and clients.

Full explanation →
1060
Multi-Selecthard

A company uses Amazon Redshift for data warehousing. The security team requires that all queries be logged for audit and that sensitive columns be masked for non-privileged users. Which THREE steps should the data engineer take? (Choose 3)

Select 3 answers
A.Implement row-level security using Redshift's row-level security feature.
B.Enable audit logging on the Redshift cluster.
C.Enable CloudTrail logging for Redshift data events.
D.Use IAM roles to restrict access to specific columns.
E.Create views that expose only non-sensitive columns and grant access to those views.
AnswersA, B, E

Row-level security filters rows based on user.

Why this answer

The correct answers are A, B, and E. Option A: Redshift supports row-level security, which restricts access to rows based on user authorization, meeting the requirement to mask sensitive data for non-privileged users. Option B: Enabling audit logging on the Redshift cluster captures all queries for audit purposes, satisfying the logging requirement.

Option E: Creating views that expose only non-sensitive columns and granting access to those views is a common method to implement column-level masking in Redshift. Option C is incorrect because AWS CloudTrail logs API calls to Redshift (e.g., cluster operations) but does not log SQL queries; for query logging, audit logging must be enabled. Option D is incorrect because IAM roles control access to the Redshift database itself but cannot restrict access to specific columns; column-level control is achieved through views or column-level security.

Full explanation →
1061
MCQeasy

A company stores sensitive data in Amazon S3 and uses AWS Lake Formation to manage fine-grained access control. A data engineer notices that users are able to access data in S3 directly via the AWS Management Console, bypassing Lake Formation permissions. What should the engineer do to enforce Lake Formation access controls for all access methods?

A.Add a bucket policy that denies all access except from Lake Formation.
B.Disable AWS CloudTrail logging for S3 access.
C.Register the S3 location in Lake Formation and disable IAM access control for the registered location.
D.Enable S3 Block Public Access on the bucket.
AnswerC

This ensures Lake Formation controls all access to the data.

Why this answer

To enforce Lake Formation permissions for all access methods, you must register the S3 location in Lake Formation and disable IAM access control for that location. This ensures that Lake Formation's fine-grained permissions are enforced, preventing direct S3 access. Option A is incorrect because adding a bucket policy that denies all access except from Lake Formation is not the recommended approach and can break legitimate access.

Option B is incorrect because disabling CloudTrail does not affect access control. Option D is incorrect because S3 Block Public Access only prevents public access, not IAM user access.

Full explanation →
1062
MCQeasy

A company is using Amazon EMR to process large datasets stored in Amazon S3. The data engineer wants to reduce the time it takes to read data from S3 by optimizing the data format. Which file format should the engineer recommend?

A.CSV
B.Parquet
C.ORC
D.JSON
AnswerB

Parquet is columnar, compressed, and ideal for analytics.

Why this answer

Parquet is the correct choice because it is a columnar storage format that significantly reduces the amount of data read from Amazon S3 during analytical queries. By storing data column-wise, Parquet enables predicate pushdown and compression, which minimizes I/O and speeds up data processing in Amazon EMR, especially for large datasets.

Exam trap

The trap here is that candidates often assume ORC is the default or preferred format for all big data engines. However, for Amazon EMR, Parquet is generally recommended because of its superior performance with Spark and its ability to handle complex nested data structures efficiently.

How to eliminate wrong answers

Option A is wrong because CSV is a row-oriented text format that requires full file scans and offers no compression or predicate pushdown, leading to slower reads. Option C is wrong because ORC is also a columnar format optimized for Hive workloads, but it is not natively as performant with Spark and EMR as Parquet, and the question asks for the best recommendation for EMR. Option D is wrong because JSON is a row-oriented, self-describing format that is verbose and lacks efficient compression or columnar access patterns, resulting in high I/O and slower processing.

Full explanation →
1063
MCQhard

A data engineer is designing a data ingestion pipeline for real-time financial transactions. The pipeline must ensure exactly-once processing semantics and must handle duplicate records that may occur due to retries. Which combination of AWS services can achieve exactly-once processing?

A.Amazon Kinesis Data Streams with Amazon Kinesis Data Analytics for Apache Flink
B.Amazon SQS with AWS Lambda
C.Amazon MSK with AWS Lambda
D.Amazon Kinesis Data Firehose with AWS Lambda
AnswerA

Flink supports exactly-once processing with KDS.

Why this answer

Amazon Kinesis Data Streams with Kinesis Data Analytics for Apache Flink enables exactly-once processing by leveraging Flink's built-in checkpointing and two-phase commit protocols. Kinesis Data Streams provides a durable, ordered record store, while Flink uses its internal state and idempotent sinks to deduplicate records that arise from retries, ensuring each record is processed exactly once.

Exam trap

The trap here is that candidates often assume SQS FIFO or Lambda's idempotency can achieve exactly-once, but they overlook that without a stream processing framework with checkpointing and transactional sinks, retries can still introduce duplicates in distributed systems.

How to eliminate wrong answers

Option B is wrong because Amazon SQS with AWS Lambda provides at-least-once delivery by default; SQS does not guarantee deduplication without a FIFO queue and idempotent Lambda logic, and even then, exactly-once is not natively supported across retries. Option C is wrong because Amazon MSK (Kafka) with AWS Lambda requires custom checkpointing and idempotency logic in the Lambda function; MSK does not natively provide exactly-once semantics without a stream processing framework like Flink or Kafka Streams. Option D is wrong because Amazon Kinesis Data Firehose with AWS Lambda delivers records at least once and cannot guarantee exactly-once processing; Firehose buffers and batches data but does not support transactional commits or deduplication across retries.

Full explanation →
1064
MCQhard

A company uses Amazon RDS for PostgreSQL to store financial data. The security team requires that all database connections be encrypted in transit and that the database audit logs be stored in Amazon S3 for at least 7 years. Which steps should the data engineer take to meet these requirements?

A.Enable encryption at rest using AWS KMS, and configure the RDS instance to publish logs to an S3 bucket with a lifecycle policy
B.Configure the DB security group to allow only TLS connections, and set up AWS CloudTrail to log all database queries
C.Use an SSL certificate from AWS Certificate Manager (ACM) and attach it to the RDS instance, and stream logs to Amazon Kinesis Data Firehose with S3 destination
D.Set the `rds.force_ssl` parameter to 1 in the DB parameter group, and export RDS audit logs to Amazon CloudWatch Logs with a subscription to Amazon S3
AnswerD

Forces TLS and enables long-term storage.

Why this answer

Setting `rds.force_ssl` to 1 in the DB parameter group forces all connections to use SSL/TLS, ensuring encryption in transit. To store audit logs in S3 for at least 7 years, you can export RDS audit logs to Amazon CloudWatch Logs and create a subscription filter to stream them to Amazon S3, where an S3 lifecycle policy can manage retention. Option A is incorrect because encryption at rest does not enforce TLS for connections, and RDS cannot publish logs directly to S3.

Option B is incorrect because security groups control network access, not encryption protocol, and CloudTrail logs AWS API calls, not database queries. Option C is incorrect because ACM certificates are not used with RDS for SSL connections, and streaming to Kinesis Firehose is unnecessary and not directly supported for RDS audit logs.

Full explanation →
1065
Multi-Selecthard

Which TWO are benefits of using Amazon S3 Object Lock? (Choose TWO.)

Select 2 answers
A.Helps meet regulatory requirements for write-once-read-many (WORM) storage.
B.Encrypts objects at rest using AWS KMS.
C.Prevents objects from being deleted or overwritten for a fixed time.
D.Automatically transitions objects to lower-cost storage classes.
E.Enables automatic versioning of objects.
AnswersA, C

Object Lock supports compliance and governance modes.

Why this answer

Amazon S3 Object Lock helps meet regulatory requirements for write-once-read-many (WORM) storage by allowing you to set retention periods and legal holds on objects. This ensures that data cannot be deleted or overwritten for a specified duration, which is a common requirement for compliance frameworks such as SEC Rule 17a-4 or FINRA.

Exam trap

The trap here is that candidates confuse S3 Object Lock with S3 Versioning or S3 Lifecycle policies, mistakenly thinking Object Lock handles encryption or storage tier transitions, when in reality it is solely focused on preventing object deletion or overwrite for compliance-driven WORM scenarios.

Full explanation →
1066
MCQeasy

A data engineer is troubleshooting an AWS Glue ETL job that fails with a memory error when processing a large dataset. Which approach can help reduce memory usage?

A.Set the job to use only one worker
B.Reduce the number of partitions in the data source
C.Increase the number of workers for the job
D.Increase the worker type to G.2X
AnswerC

Increasing the number of workers distributes the workload across more resources, reducing memory pressure per worker.

Why this answer

Increasing the number of workers distributes the workload across more resources, reducing memory pressure per worker. Option A is incorrect because using only one worker reduces parallelism and increases memory consumption per worker, worsening the issue. Option B is incorrect because reducing partitions increases the size of each partition, leading to higher memory usage per task.

Option D is incorrect because although increasing the worker type to G.2X provides more memory per worker, it does not increase parallelism and may be less cost-effective than increasing the number of workers.

Full explanation →
1067
Multi-Selectmedium

A data engineering team is designing a data ingestion pipeline for a social media analytics platform. The pipeline must handle up to 100,000 events per second with less than 1 second processing latency. Which TWO services should be used together to meet these requirements?

Select 2 answers
A.AWS Glue streaming ETL
B.Amazon Kinesis Data Firehose
C.Amazon SQS
D.Amazon Kinesis Data Analytics for Apache Flink
E.Amazon Kinesis Data Streams
AnswersD, E

Flink can process streaming data with sub-second latency.

Why this answer

Amazon Kinesis Data Streams (Option E) is designed for real-time data ingestion at scale, supporting up to 1,000 records per second per shard with sub-second latency, making it suitable for 100,000 events per second when provisioned with sufficient shards. Amazon Kinesis Data Analytics for Apache Flink (Option D) can consume data directly from Kinesis Data Streams and perform low-latency stream processing (e.g., aggregations, filtering) with exactly-once semantics, meeting the <1 second processing latency requirement. Together, they form a fully managed, scalable pipeline for high-throughput, low-latency streaming analytics.

Exam trap

The trap here is that candidates often confuse Kinesis Data Firehose (near-real-time, buffered delivery) with Kinesis Data Streams (real-time, unbuffered ingestion), or assume AWS Glue streaming ETL can achieve sub-second latency when it is actually optimized for micro-batch processing with higher overhead.

Full explanation →
1068
MCQeasy

A data engineer needs to ensure that all data stored in an S3 bucket is encrypted at rest. Which S3 bucket policy condition key should be used to enforce encryption using AWS KMS?

A.s3:x-amz-server-side-encryption
B.kms:EncryptionContext
C.s3:x-amz-acl
D.s3:x-amz-server-side-encryption-aws-kms-key-id
AnswerD

This condition key allows you to require that a specific KMS key is used for server-side encryption, enforcing encryption at rest with a particular key.

Why this answer

The s3:x-amz-server-side-encryption-aws-kms-key-id condition key allows you to enforce that a specific KMS key is used for server-side encryption with AWS KMS (SSE-KMS). Option A is incorrect because s3:x-amz-server-side-encryption only checks whether server-side encryption is enabled, but does not require a specific KMS key. Option B is incorrect because kms:EncryptionContext is a condition key used in KMS policies, not S3 bucket policies.

Option C is incorrect because s3:x-amz-acl is used for access control lists, not encryption.

Full explanation →
1069
MCQhard

A company uses AWS Lake Formation to manage data lakes on Amazon S3. The data engineer needs to grant a data analyst access to query specific columns in a table using Amazon Athena, but deny access to columns containing personally identifiable information (PII). Which Lake Formation feature should be used?

A.Row-level security filters.
B.Column-level permissions in Lake Formation.
C.Tag-based access control with Lake Formation tags.
D.Cell-level security with AWS Glue.
AnswerB

Column-level permissions allow granting access to specific columns and denying others.

Why this answer

Lake Formation column-level permissions allow granting access to specific columns and denying access to others. This is the correct feature for restricting access to PII columns while allowing querying other columns. Row-level security (A) controls which rows are visible, not columns.

Tag-based access control (C) is for resource categorization, not fine-grained column access. Cell-level security (D) is not a feature of Lake Formation or AWS Glue.

Full explanation →
1070
Multi-Selecthard

A company runs a data lake on Amazon S3 with AWS Glue and Amazon Athena. The data engineer notices that queries are slow and scanning large amounts of data. Which THREE actions should the engineer take to optimize query performance and reduce costs?

Select 3 answers
A.Increase the query timeout in Athena.
B.Increase the number of DPUs in the Glue job.
C.Compress data files using gzip or snappy.
D.Partition the data by frequently filtered columns (e.g., date, region).
E.Use columnar data formats like Parquet or ORC.
AnswersC, D, E

Reduces storage and data scanned.

Why this answer

The correct actions to optimize query performance and reduce costs are C, D, and E. Compressing data (C) reduces the amount of data scanned, lowering costs and improving I/O. Partitioning (D) by frequently filtered columns (e.g., date, region) allows Athena to prune partitions, scanning only relevant data.

Using columnar formats like Parquet or ORC (E) improves compression and enables column pruning, reducing scan size and improving performance. Option A (increasing query timeout) does not reduce data scanned or improve performance; it only allows queries to run longer before failing. Option B (increasing DPUs in a Glue job) is unrelated to Athena query performance; DPUs are for Glue ETL jobs, not Athena queries.

Full explanation →
1071
MCQeasy

A company runs a data pipeline that uses AWS Lambda to process files uploaded to an S3 bucket. Recently, some files have been processed multiple times. The Lambda function is triggered by S3 event notifications. What is the MOST likely cause of duplicate processing?

A.The Lambda function has a high error rate and retries.
B.The Lambda function is not idempotent.
C.The Lambda function has a reserved concurrency setting.
D.S3 event notifications are delivered at least once.
AnswerD

S3 can send duplicate events.

Why this answer

S3 event notifications are delivered at least once, meaning they can be sent multiple times, causing the Lambda function to be invoked repeatedly for the same file. This is the most likely cause of duplicate processing. Option A is incorrect: while Lambda retries on error for asynchronous invocations, it retries the same failed invocation, not creating multiple invocations for a successful event.

Option B is incorrect: lack of idempotency does not cause duplicates; it simply means the function might not handle duplicates properly, but the root cause is the duplicate trigger. Option C is incorrect: reserved concurrency limits the number of concurrent executions but does not generate duplicate invocations.

Full explanation →
1072
Multi-Selectmedium

A data engineering team is building a pipeline to transform CSV files uploaded to Amazon S3 into Parquet format using AWS Glue. The transformation must be serverless and handle files that arrive at irregular intervals. Which TWO actions should the team take? (Choose two.)

Select 2 answers
A.Configure an Amazon EMR cluster with Apache Spark for on-demand transformation.
B.Use an AWS Glue ETL job to convert CSV to Parquet.
C.Use AWS Data Pipeline to schedule a periodic transformation.
D.Use Amazon Redshift Spectrum to convert files during query execution.
E.Set up an S3 event notification to invoke an AWS Lambda function that triggers the Glue job.
AnswersB, E

Glue ETL jobs are serverless and can transform data formats.

Why this answer

AWS Glue ETL jobs provide a serverless Spark-based environment that can directly read CSV files from S3 and write them as Parquet, meeting the requirement for serverless transformation. Glue handles schema inference and conversion without managing any infrastructure, making it ideal for irregularly scheduled data.

Exam trap

The trap here is that candidates may confuse serverless with managed services like EMR or Data Pipeline, or assume Redshift Spectrum can transform data, when in fact it only queries external formats without writing back converted files.

Full explanation →
1073
MCQeasy

A company needs to ingest data from multiple SaaS sources (e.g., Salesforce, Marketo) into Amazon S3 for analytics. Which AWS service is designed for this purpose?

A.AWS Transfer Family
B.AWS Glue
C.Amazon AppFlow
D.AWS DataSync
AnswerC

AppFlow is purpose-built for SaaS data ingestion.

Why this answer

Amazon AppFlow is a fully managed integration service specifically designed to securely transfer data between SaaS applications (like Salesforce, Marketo, Slack, and Zendesk) and AWS services such as Amazon S3 and Amazon Redshift. It supports scheduled, event-driven, or on-demand data ingestion with built-in transformations, filtering, and validation, making it the ideal choice for this use case.

Exam trap

The trap here is that candidates often confuse AWS Glue's ETL capabilities with native SaaS connectivity, but Glue requires custom connectors or AWS Glue Studio's visual ETL jobs to connect to SaaS sources, whereas AppFlow is purpose-built for this task.

How to eliminate wrong answers

Option A is wrong because AWS Transfer Family is used for transferring files into and out of Amazon S3 or Amazon EFS using SFTP, FTPS, or FTP protocols, not for integrating with SaaS APIs. Option B is wrong because AWS Glue is a serverless data integration service for ETL (extract, transform, load) jobs, but it does not natively connect to SaaS sources like Salesforce or Marketo without custom connectors or third-party libraries. Option D is wrong because AWS DataSync is designed for moving large volumes of data between on-premises storage and AWS (e.g., NFS, SMB, S3) or between AWS storage services, not for ingesting data from SaaS applications.

Full explanation →
1074
MCQeasy

A data engineer needs to ensure that an Amazon Redshift cluster only accepts encrypted connections. Which parameter should be modified?

A.enable_user_activity_logging
B.max_concurrency_scaling_clusters
C.require_SSL
D.wlm_json_configuration
AnswerC

This parameter enforces SSL connections.

Why this answer

Setting the `require_SSL` parameter to `true` forces all connections to the Amazon Redshift cluster to use SSL/TLS encryption, ensuring that data in transit is encrypted. This parameter is modified in the cluster's parameter group and applies to both JDBC and ODBC connections, as well as the Redshift Query Editor.

Exam trap

The trap here is that candidates may confuse `require_SSL` with other security-related parameters like `enable_user_activity_logging` (auditing) or assume that encryption is handled by a different mechanism (e.g., WLM or concurrency scaling), leading them to pick a wrong option that sounds security-adjacent but is technically unrelated.

How to eliminate wrong answers

Option A is wrong because `enable_user_activity_logging` controls the logging of user activity (e.g., queries run by users) for auditing purposes, not connection encryption. Option B is wrong because `max_concurrency_scaling_clusters` defines the maximum number of concurrency scaling clusters that can be used to handle spikes in concurrent queries, unrelated to encryption. Option D is wrong because `wlm_json_configuration` defines workload management (WLM) queue configurations (e.g., concurrency, memory allocation) and has no effect on SSL/TLS enforcement.

Full explanation →
1075
Multi-Selecthard

A data engineer is designing a data lake on Amazon S3 with AWS Lake Formation. The data lake contains personally identifiable information (PII). The company has a policy that only users who have completed data privacy training can access the PII data. The training status is stored in an external identity provider (IdP) as an attribute. The data engineer needs to enforce this policy using Lake Formation. Which THREE steps should the data engineer take? (Choose THREE.)

Select 3 answers
A.Create an LF-tag called 'trainingCompleted' with values 'true' and 'false'. Grant 'SELECT' permission on the LF-tag 'trainingCompleted=true' to the federated users.
B.Configure SAML-based federation between the IdP and AWS to pass the training status attribute in the SAML assertion.
C.Create a column-level filter on the PII columns that limits access based on the user's training attribute.
D.Create an IAM role for each user and attach a policy that allows 'lakeformation:GetDataAccess' only if the user has the training attribute.
E.Associate the LF-tag 'trainingCompleted=true' with the PII columns in the tables.
AnswersA, B, E

This allows users with the tag to access data associated with that tag.

Why this answer

LF-tags allow Lake Formation to manage access based on metadata attributes. By creating an LF-tag 'trainingCompleted' with values 'true' and 'false', and granting SELECT permission on the tag value 'true' to federated users, the data engineer can enforce that only users with the training attribute can access the tagged resources. This approach decouples access control from IAM roles and leverages tag-based authorization, which is the recommended method for attribute-based access control (ABAC) in Lake Formation.

Exam trap

The trap here is that candidates often confuse column-level filters (Option C) with tag-based access control, not realizing that column-level filters cannot dynamically evaluate external IdP attributes, whereas LF-tags with SAML assertions can enforce attribute-based policies.

Full explanation →
1076
MCQeasy

A data engineer needs to set up a disaster recovery solution for an Amazon RDS for MySQL database. The database must be available in another AWS Region with minimal data loss. What is the simplest approach?

A.Enable Multi-AZ deployment in the same Region.
B.Set up AWS Database Migration Service (DMS) for continuous replication.
C.Take a manual snapshot and copy it to the other Region daily.
D.Create a cross-Region read replica of the database.
AnswerD

A read replica can be promoted to a standalone DB in a disaster, with minimal data loss.

Why this answer

Cross-Region read replica. Amazon RDS for MySQL supports cross-Region read replicas, which provide asynchronous replication to another Region. In a disaster, you can promote the read replica to a standalone primary database, minimizing data loss (typically seconds).

Option A is wrong because Multi-AZ is within a single Region and does not provide cross-Region protection. Option B is wrong because AWS DMS is a separate service that requires ongoing management and cost; it is not the simplest approach. Option C is wrong because manual snapshots copied daily have a Recovery Point Objective (RPO) of up to 24 hours, resulting in significant data loss.

Full explanation →
1077
MCQhard

A company uses Amazon Redshift for its data warehouse. The data engineer notices that the most frequently accessed table is sorted by date, but queries often filter by customer_id. The table has 500 million rows and uses AUTO distribution style. What change would MOST improve query performance?

A.Change distribution style to KEY on customer_id.
B.Change distribution style to EVEN.
C.Change the sort key to include customer_id as a compound sort key.
D.Change the sort key to an interleaved sort key on date and customer_id.
AnswerC

A compound sort key with customer_id first will optimize queries filtering by customer_id.

Why this answer

Since queries frequently filter by customer_id but the table is sorted only by date, Redshift must scan all rows that match the date range and then filter by customer_id. By adding customer_id as a compound sort key (date, customer_id), Redshift can use zone maps to skip blocks that don't contain the requested customer_id within the date range, dramatically reducing the number of rows scanned and improving query performance.

Exam trap

The trap here is that candidates often assume distribution style (KEY or EVEN) is the primary lever for query performance on filtered columns, when in fact sort keys—especially compound sort keys—are far more impactful for reducing scanned data in range-filtered queries.

How to eliminate wrong answers

Option A is wrong because changing distribution style to KEY on customer_id would colocate rows with the same customer_id on the same slice, but it does not help with filtering within a node; without a sort key on customer_id, each slice still must scan all its rows to find matching customer_ids. Option B is wrong because EVEN distribution spreads rows randomly across slices, which can improve load balancing but does nothing to reduce the amount of data scanned per query; filtering by customer_id still requires a full scan of all slices. Option D is wrong because an interleaved sort key on date and customer_id would give equal weight to both columns, but for a table with 500 million rows and frequent range-based date queries, interleaved sort keys can cause significant overhead during maintenance (e.g., VACUUM REINDEX) and may not outperform a compound sort key when the leading column (date) is used in range filters.

Full explanation →
1078
MCQhard

A data engineer uses the AWS CLI to list KMS keys and describe one. The output shows two keys. The described key has KeyState 'Enabled' and Origin 'AWS_KMS'. Which statement is true about this key?

A.The key is a KMS managed key that is enabled and ready for use
B.The key material was imported from an external source
C.The key is scheduled for deletion
D.The key is disabled and cannot be used
AnswerA

Origin 'AWS_KMS' and KeyState 'Enabled' indicate it is a managed, enabled key.

Why this answer

The key has KeyState 'Enabled' and Origin 'AWS_KMS', which means it is an AWS KMS managed key that is enabled and ready for use. Option B is incorrect because Origin 'AWS_KMS' indicates the key material is generated by AWS, not imported. Option C is incorrect because a key scheduled for deletion would have KeyState 'PendingDeletion'.

Option D is incorrect because KeyState 'Enabled' means the key is not disabled.

Full explanation →
1079
MCQhard

A financial services company ingests stock trade data from multiple exchanges into an Amazon S3 bucket (trade-bucket). Each exchange sends a CSV file every 5 minutes. The data must be transformed into Parquet format and partitioned by exchange and date (trade_date) for efficient querying using Amazon Athena. The pipeline must handle late-arriving data (files up to 2 hours late) and ensure exactly-once processing to avoid duplicates. Currently, a scheduled AWS Glue ETL job runs every hour, reads new CSV files, converts them to Parquet, and writes to an output bucket. However, the team is experiencing data duplication: if the job fails midway, upon retry it reprocesses all files in the input folder, causing duplicates in the output. Additionally, the job takes too long because it scans all files each run. The engineer must redesign the pipeline to eliminate duplicates and improve efficiency. What should the engineer do?

A.Use AWS Glue Workflows to orchestrate the job and add a condition to check for duplicates before writing.
B.Set up an S3 event notification to invoke an AWS Lambda function that starts a Glue job with a parameter containing the S3 object key of the new file; modify the Glue job to process only that file and use the file key to avoid duplicates.
C.Modify the Glue job to move processed CSV files to an archive folder after successful transformation, and process only unprocessed files.
D.Replace Glue with Amazon EMR and use Spark Structured Streaming with checkpointing to process files incrementally.
AnswerB

This ensures each file is processed exactly once, and the job runs only on new files, improving efficiency.

Why this answer

The best approach. By setting up an S3 event notification to invoke a Lambda function that triggers a Glue job with the new file's S3 key as a parameter, the job processes only that specific file. Using the file key in the job logic ensures idempotency—if the job fails and retries, it reprocesses the same file key, and deduplication can be handled (e.g., by checking if the output partition already contains that file's data or using a job bookmark on the file key).

This achieves exactly-once processing and incremental processing (no full scans), improving efficiency. Option A (Glue Workflows) still processes all files each run and doesn't prevent duplicates if a file arrives after the job starts. Option C (moving CSV files to an archive folder) risks race conditions if late-arriving data comes while the job is running, and does not guarantee exactly-once if the job fails mid-way.

Option D (EMR with Spark Structured Streaming) is overly complex and expensive for a 5-minute CSV batch ingestion; checkpointing can handle failures but adds significant operational overhead.

Full explanation →
1080
Multi-Selecteasy

A company is building a data lake on Amazon S3 and needs to ingest data from various on-premises sources. Which TWO AWS services can be used to transfer data securely over the internet?

Select 2 answers
A.AWS Snowcone
B.AWS DataSync
C.Amazon Kinesis Data Firehose
D.AWS Direct Connect
E.AWS CLI
AnswersB, E

DataSync can transfer data over the internet.

Why this answer

AWS DataSync is designed to securely transfer large amounts of data from on-premises storage to AWS over the internet. It uses TLS encryption for data in transit and can automate and accelerate transfers by leveraging parallel multi-threading and incremental updates. This makes it a correct choice for securely ingesting data into an S3-based data lake.

Exam trap

The trap here is that candidates often confuse AWS DataSync with AWS Direct Connect, thinking both are required for secure transfers, but Direct Connect is a network service that bypasses the internet entirely, while DataSync is a data transfer service that works over the internet or Direct Connect.

Full explanation →
1081
MCQmedium

A company uses AWS Lake Formation to manage permissions on a data lake stored in S3. A data analyst reports that they can see a table in the AWS Glue Data Catalog but cannot query it using Amazon Athena. The analyst has been granted 'SELECT' permission on the table in Lake Formation. The table's underlying S3 location is encrypted with AWS KMS. The IAM role used by Athena has the necessary S3 and KMS permissions. What is the most likely reason for the failure?

A.The analyst does not have 'DESCRIBE' permission on the table.
B.Athena is not integrated with Lake Formation.
C.The KMS key policy does not allow the analyst's IAM role to decrypt.
D.The analyst does not have 'DESCRIBE' permission on the database.
AnswerA

Athena needs DESCRIBE on the table to retrieve metadata; without it, queries fail.

Why this answer

Lake Formation requires explicit grant of 'DESCRIBE' permission on the table for Athena to read metadata; SELECT alone is insufficient. Option B is incorrect because Athena can be integrated with Lake Formation. Option C is incorrect because KMS permissions are already in place.

Option D is incorrect because the analyst can see the table, meaning DESCRIBE is not required at the database level.

Full explanation →
1082
MCQhard

A company runs an Amazon EMR cluster with Spark jobs. One job fails with 'Container killed by YARN for exceeding memory limits'. The data engineer has already increased the executor memory. What is the NEXT best step to resolve the issue?

A.Set spark.executor.memoryOverhead to a higher value.
B.Increase the YARN container memory allocation (yarn.nodemanager.resource.memory-mb).
C.Decrease the number of Spark partitions.
D.Increase the driver memory.
AnswerB

This allows larger containers, preventing YARN from killing them.

Why this answer

Increasing the yarn.nodemanager.resource.memory-mb allows YARN to allocate larger containers, preventing the kill. Option A: Setting spark.executor.memoryOverhead increases off-heap memory but may still exceed YARN limits if they are not also raised. Option C: Reducing partitions decreases parallelism and may reduce memory per executor, but does not address the root cause of insufficient container memory.

Option D: Increasing driver memory is not relevant because the issue is with executors.

Full explanation →
1083
Multi-Selectmedium

A company is building a data lake on Amazon S3. They need to ingest data from multiple sources, including relational databases, streaming data, and log files. Which THREE AWS services can be used to ingest data into the data lake?

Select 3 answers
A.Amazon Kinesis Data Firehose
B.AWS Database Migration Service (DMS)
C.Amazon Athena
D.Amazon Redshift Spectrum
E.AWS Glue
AnswersA, B, E

Ingests streaming data into S3.

Why this answer

Amazon Kinesis Data Firehose is a fully managed service for streaming data ingestion that can capture, transform, and load streaming data into Amazon S3 in near real-time. It supports sources like Amazon CloudWatch Logs, AWS IoT, and custom producers via the Kinesis Agent, making it ideal for log files and streaming data.

Exam trap

The trap here is confusing query engines (Athena, Redshift Spectrum) with ingestion services, as candidates often assume any service that touches S3 can be used for data loading.

Full explanation →
1084
Multi-Selecteasy

A data engineer needs to ingest streaming data from an e-commerce application into Amazon S3 for near-real-time analytics. The solution must handle variable throughput and allow reprocessing of failed records. Which TWO AWS services should the engineer use? (Choose two.)

Select 2 answers
A.Amazon Kinesis Data Streams
B.Amazon SQS
C.Amazon DynamoDB Streams
D.Amazon Kinesis Data Firehose
E.Amazon RDS
AnswersA, D

Kinesis Data Streams ingests and stores streaming data in shards for real-time processing.

Why this answer

Amazon Kinesis Data Streams is correct because it provides a durable, scalable, real-time data ingestion layer that can handle variable throughput by sharding, and it retains data for up to 365 days, enabling reprocessing of failed records by replaying from a specific sequence number or timestamp.

Exam trap

The trap here is that candidates often confuse Amazon SQS with a streaming service, but SQS is a pull-based queue with no replay capability, whereas Kinesis Data Streams provides the persistent, replayable stream needed for reprocessing failed records.

Full explanation →
1085
MCQhard

A data engineer is monitoring an Amazon Redshift cluster using Amazon CloudWatch. The engineer notices that the 'WriteThroughput' metric is consistently below the provisioned IOPS for the cluster's EBS volumes. The query performance is slower than expected. Which action is MOST likely to improve write performance?

A.Reduce the number of concurrent queries to the database.
B.Upgrade to a larger node type with more CPU and memory.
C.Add sort keys to the tables to improve data distribution.
D.Increase the provisioned IOPS on the EBS volumes.
AnswerB

Larger nodes provide more processing power, improving write throughput.

Why this answer

The 'WriteThroughput' metric being consistently below the provisioned IOPS indicates that the EBS volumes are not the bottleneck; the bottleneck is more likely insufficient compute resources (CPU/memory). Upgrading to a larger node type (e.g., from DC2 to RA3 or a higher node size) increases CPU and memory, which can improve query processing and write performance. Option A is incorrect because reducing concurrent queries may help with contention, but if the underlying node lacks resources, it won't fully address the low throughput.

Option C is incorrect because sort keys primarily optimize read performance (e.g., range-restricted scans), not write throughput. Option D is incorrect because increasing IOPS on EBS volumes will not help when the provisioned IOPS are already not being fully utilized.

Full explanation →
1086
MCQeasy

A data engineer is setting up an Amazon RDS for MySQL database. The compliance team requires that all data at rest be encrypted. What must the engineer do to enable encryption for this database?

A.Specify an AWS KMS key when launching the DB instance
B.Enable encryption after the DB instance is created by modifying the DB instance
C.Use AWS Secrets Manager to store the encryption key and attach it to the DB instance
D.Encrypt the underlying EBS volumes after the instance is created
AnswerA

Encryption must be enabled at launch by choosing a KMS key.

Why this answer

Encryption at rest for Amazon RDS can only be enabled at launch time. After creation, you cannot enable encryption; you must create a new encrypted instance and migrate data.

Full explanation →
1087
MCQhard

A data engineer needs to set up a new Amazon RDS for PostgreSQL database for a production workload. The database must be highly available and resilient to a single Availability Zone failure. Which configuration should the engineer choose?

A.Single-AZ with automated backups
B.Multi-AZ deployment with one standby in a different AZ
C.Multi-AZ with two readable standbys
D.Single-AZ with a read replica
AnswerB

Provides automatic failover and high availability.

Why this answer

A Multi-AZ deployment for Amazon RDS PostgreSQL automatically provisions and maintains a synchronous standby replica in a different Availability Zone. This configuration provides automatic failover in the event of an AZ failure, ensuring high availability and resilience without manual intervention. The synchronous replication ensures zero data loss during failover, which is critical for production workloads.

Exam trap

The trap here is that candidates often confuse Multi-AZ with read replicas, assuming that a read replica can serve as a failover target, but in RDS PostgreSQL, read replicas are asynchronous and require manual promotion, making them unsuitable for automatic high availability against AZ failures.

How to eliminate wrong answers

Option A is wrong because a Single-AZ deployment with automated backups only protects against data loss via point-in-time recovery, but does not provide automatic failover or resilience to an AZ failure; the database becomes unavailable if the AZ goes down. Option C is wrong because Amazon RDS for PostgreSQL does not support Multi-AZ with two readable standbys; that feature is specific to Amazon RDS for Oracle and SQL Server Enterprise Edition, and PostgreSQL Multi-AZ only provides a single standby that is not readable. Option D is wrong because a Single-AZ with a read replica provides read scaling and some disaster recovery capability, but the read replica is asynchronous and does not provide automatic failover; a manual promotion is required, and the primary remains vulnerable to AZ failure.

Full explanation →
1088
Matchingmedium

Match each AWS networking concept to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Virtual private cloud isolated network

Segment of VPC IP address range

Stateful firewall for instances

Stateless firewall for subnets

Enables VPC to internet communication

Why these pairings

Networking fundamentals for AWS: VPC is a virtual network, subnets are subdivisions, security groups are instance-level firewalls, and NACLs are subnet-level stateless firewalls.

Full explanation →
1089
MCQmedium

Refer to the exhibit. A data engineer is attaching this IAM policy to an IAM role used by an AWS Glue job. The job reads from a Kinesis Data Streams stream and writes transformed data to an S3 bucket. When the job runs, it fails with an AccessDenied error for the Kinesis stream. What is the MOST likely cause?

A.The stream ARN in the policy is incorrect.
B.The IAM policy is missing the 'kinesis:DescribeStream' action.
C.The Glue job does not have permissions to call 'kinesis:PutRecord'.
D.The S3 bucket policy blocks the PutObject action from the Glue role.
AnswerB

Required to read stream metadata.

Why this answer

When an AWS Glue job reads from Kinesis Data Streams, it requires the `kinesis:DescribeStream` action to retrieve stream metadata such as shard IDs and the stream's current state. Without this permission, the Glue job cannot discover the stream's shards and fails with an AccessDenied error, even if other Kinesis actions like `GetRecords` are allowed. The error occurs because the IAM policy attached to the Glue role is missing this prerequisite action.

Exam trap

The trap here is that candidates assume only data-plane actions like `GetRecords` are needed for reading, forgetting that the Glue job's underlying KCL requires the control-plane `DescribeStream` action to discover shard topology before it can read any data.

How to eliminate wrong answers

Option A is wrong because if the stream ARN were incorrect, the error would typically be a 'ResourceNotFoundException' or 'InvalidArgumentException', not an AccessDenied error. Option C is wrong because the Glue job is reading from the stream, not writing to it; `kinesis:PutRecord` is for writing data, and the job would need `kinesis:GetRecords` and `kinesis:GetShardIterator` instead. Option D is wrong because the error is specifically for the Kinesis stream, not for S3; an S3 bucket policy blocking PutObject would cause an AccessDenied error on the S3 PutObject operation, not on the Kinesis stream.

Full explanation →
1090
MCQhard

A data engineering team is building a real-time analytics pipeline using Amazon Kinesis Data Streams, AWS Lambda, and Amazon DynamoDB. The Lambda function consumes records from the stream and writes aggregated data to a DynamoDB table. The application requires that each record be processed exactly once to avoid duplicates. The Lambda function is idempotent, but occasionally duplicate records are written due to retries from Kinesis. The team needs to ensure exactly-once semantics for DynamoDB writes. Which solution should they implement?

A.Enable DynamoDB Streams and use a second Lambda to deduplicate.
B.Use DynamoDB TransactWriteItems with a condition check on a unique transaction ID.
C.Use the Kinesis Client Library (KCL) to checkpoint after processing and ignore duplicates.
D.Ensure the Lambda function is idempotent by using upsert operations.
AnswerB

Condition check ensures only one write succeeds per unique ID.

Why this answer

DynamoDB TransactWriteItems with a condition check on a unique transaction ID ensures that the write only succeeds if the transaction ID does not already exist in the table. This provides exactly-once semantics by preventing duplicate writes even when Kinesis retries deliver the same record multiple times. The condition check acts as a distributed lock at the item level, guaranteeing idempotency without relying on downstream deduplication.

Exam trap

The trap here is that candidates often assume idempotent Lambda functions alone guarantee exactly-once processing, but they overlook that Kinesis retries can still cause duplicate writes unless a conditional write with a unique identifier is used at the database level.

How to eliminate wrong answers

Option A is wrong because enabling DynamoDB Streams and using a second Lambda to deduplicate introduces eventual consistency and additional latency, and does not prevent duplicate writes at the point of ingestion; it only attempts to clean up duplicates after they have already been written. Option C is wrong because the Kinesis Client Library (KCL) checkpointing tracks processing progress but does not prevent duplicate records from being delivered to the Lambda function during retries, so duplicates can still be written to DynamoDB. Option D is wrong because simply ensuring the Lambda function is idempotent using upsert operations (e.g., UpdateItem) does not guarantee exactly-once semantics; upsert can still overwrite data or create duplicate items if the record lacks a unique identifier or condition check.

Full explanation →
1091
MCQeasy

A data engineer needs to transfer 10 TB of data from an on-premises data center to Amazon S3. The network bandwidth is limited to 100 Mbps, and the data transfer must be completed within 5 days. What is the most cost-effective solution?

A.Use AWS Snowball Edge to physically ship the data.
B.Use S3 Transfer Acceleration to speed up the transfer over the internet.
C.Use AWS DataSync over the internet to transfer the data.
D.Set up an AWS Direct Connect connection to increase bandwidth.
AnswerA

Snowball bypasses network limitations and is cost-effective for large data volumes.

Why this answer

With 10 TB of data and a 100 Mbps link, the theoretical transfer time over the internet is approximately 10 days (10 TB * 8 / 100 Mbps = 800,000 seconds ≈ 9.26 days), which exceeds the 5-day requirement. AWS Snowball Edge is the most cost-effective solution because it bypasses the network bottleneck entirely by physically shipping the data, and it is designed for large-scale data transfers where network constraints make online transfer impractical.

Exam trap

The trap here is that candidates assume S3 Transfer Acceleration or DataSync can magically overcome bandwidth limitations, but they only optimize the path, not increase the pipe size, so the math of bandwidth vs. data volume always dictates the minimum transfer time.

How to eliminate wrong answers

Option B is wrong because S3 Transfer Acceleration only optimizes the network path using AWS edge locations and does not increase the available bandwidth; it cannot overcome the fundamental 100 Mbps bottleneck, so the transfer would still take over 9 days. Option C is wrong because AWS DataSync over the internet is still limited by the 100 Mbps bandwidth, and even with optimization, it cannot complete 10 TB within 5 days. Option D is wrong because setting up AWS Direct Connect requires significant upfront cost and provisioning time (often weeks), making it neither cost-effective nor timely for a one-time transfer within 5 days.

Full explanation →
1092
MCQmedium

A media company stores large video files in Amazon S3 and uses Amazon CloudFront for content delivery. Users in different regions report slow download speeds for popular content. The data engineer needs to improve performance while minimizing cost. Which solution should the engineer implement?

A.Change the S3 storage class to S3 Standard-IA
B.Enable S3 Transfer Acceleration on the bucket
C.Create multiple S3 buckets in different regions and configure CloudFront with multiple origins
D.Enable CloudFront Origin Shield
AnswerD

Origin Shield provides an additional cache layer that improves cache hit ratio and reduces load on the origin, thereby improving download performance for users.

Why this answer

CloudFront Origin Shield acts as a centralized caching layer in front of the S3 origin, reducing the number of requests that reach the origin and improving cache hit ratios. This minimizes latency for users in different regions by serving popular content from the edge or shield cache, while also reducing origin load and data transfer costs.

Exam trap

The trap here is that candidates may confuse S3 Transfer Acceleration (which optimizes uploads) with download acceleration, or assume that multiple regional origins are needed when CloudFront's global edge network already handles geographic distribution.

How to eliminate wrong answers

Option A is wrong because changing the storage class to S3 Standard-IA reduces storage costs for infrequently accessed data but does not improve download speeds or reduce latency for users. Option B is wrong because S3 Transfer Acceleration speeds up uploads to S3 over long distances using AWS edge locations, but it does not accelerate downloads or improve CloudFront delivery performance. Option C is wrong because creating multiple S3 buckets in different regions and configuring CloudFront with multiple origins increases complexity and cost without addressing the core issue of cache efficiency; CloudFront already uses a global edge network, and adding more origins does not inherently improve cache hit ratios or reduce origin load.

Full explanation →
1093
MCQeasy

An organization needs to ingest data from on-premises databases into AWS S3 for archival purposes. The data volume is several TB per day, and the network has moderate bandwidth. Which AWS service is BEST suited for this bulk data transfer?

A.AWS Direct Connect
B.Amazon S3 Transfer Acceleration
C.AWS Snowball
D.AWS DataSync
AnswerD

DataSync automates and accelerates moving data from on-premises to AWS.

Why this answer

AWS DataSync is the best choice because it is designed for efficiently moving large volumes of data (several TB per day) from on-premises storage to AWS, including S3. It automates and accelerates data transfer over the existing network using a purpose-built protocol and parallel multi-threading, while handling encryption, validation, and scheduling. For moderate bandwidth, DataSync optimizes throughput and can resume interrupted transfers, making it ideal for ongoing archival ingestion.

Exam trap

The trap here is that candidates often confuse AWS DataSync with AWS Direct Connect, thinking a dedicated network link is required for large transfers, but DataSync is optimized to work over existing internet connections with moderate bandwidth, making it the more practical and cost-effective service for this use case.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect provides a dedicated network connection, but it is a network service, not a data transfer service; it requires significant setup and cost, and does not include built-in data management features like scheduling or validation for bulk ingestion. Option B is wrong because Amazon S3 Transfer Acceleration only speeds up uploads to S3 over the public internet using edge locations, but it does not handle the initial data extraction from on-premises databases or provide the orchestration needed for multi-TB daily transfers. Option C is wrong because AWS Snowball is a physical device for offline data transfer, which is suitable for very large datasets (petabytes) or low-bandwidth scenarios, but it introduces latency for shipping and is not ideal for daily recurring transfers of several TB per day.

Full explanation →
1094
MCQhard

A company is using Amazon S3 to store sensitive data. The security team requires that all data be encrypted at rest using a customer-managed AWS KMS key. The data engineer must ensure that only a specific IAM role can decrypt the data. Which policy should the data engineer attach to the KMS key?

A.A KMS key policy that allows the IAM role to perform kms:Decrypt
B.An IAM user policy that allows kms:Decrypt for the specific key
C.An IAM policy attached to the role that allows kms:Decrypt
D.An S3 bucket policy that denies access unless encryption is used
AnswerA

KMS key policies grant permissions to use the key.

Why this answer

KMS key policies are the primary mechanism for controlling access to a customer-managed KMS key. By specifying the IAM role as a principal in the key policy and granting kms:Decrypt, you ensure that only that role can decrypt data encrypted with this key, regardless of any IAM policies that might otherwise allow broader access.

Exam trap

The DEA-C01 exam often tests the misconception that IAM policies alone can control KMS key access, but the correct approach is to use a KMS key policy that explicitly grants the required action to the specific principal.

How to eliminate wrong answers

Option B is wrong because an IAM user policy alone is insufficient; KMS key access requires either a key policy that explicitly grants permissions to the user/role or a grant, and IAM policies only take effect if the key policy allows IAM policy-based access (via a root principal). Option C is wrong because while an IAM policy attached to the role can allow kms:Decrypt, it will only work if the KMS key policy also permits IAM policy-based access (e.g., by allowing the root account), which is not guaranteed and does not restrict decryption to that specific role as tightly as a key policy. Option D is wrong because an S3 bucket policy that denies access unless encryption is used does not control who can decrypt data; it only enforces encryption in transit or at rest, and does not restrict decryption permissions to a specific IAM role.

Full explanation →
1095
Multi-Selectmedium

A data engineer is designing a data pipeline that processes PII data in AWS Glue. They need to ensure data is encrypted at rest and in transit. Which TWO actions should they take? (Choose TWO.)

Select 2 answers
A.Disable SSL for Glue connections
B.Configure S3 bucket server-side encryption for job output
C.Use a KMS key for Glue job bookmarks
D.Use CloudWatch Logs for encryption
E.Enable encryption at rest for the AWS Glue Data Catalog
AnswersB, E

Encrypts data stored in S3.

Why this answer

To ensure data is encrypted at rest and in transit, the data engineer should configure S3 bucket server-side encryption for job output (Option B) because Glue jobs write output to S3, and server-side encryption protects data at rest. Additionally, enabling encryption at rest for the AWS Glue Data Catalog (Option E) encrypts the catalog metadata at rest. Option A is incorrect because SSL should not be disabled; SSL provides encryption in transit.

Option C is incorrect because KMS keys for Glue job bookmarks encrypt only bookmarks, not all data. Option D is incorrect because CloudWatch Logs are for logging, not for encryption.

Full explanation →
1096
MCQhard

A data engineer is troubleshooting a slow Amazon Redshift query that joins a large fact table with several dimension tables. The EXPLAIN plan shows a hash join on the distribution key, but the query still runs slowly. The fact table is distributed by KEY(column_x) and the dimension tables are distributed ALL. The engineer notices that the fact table has a high number of rows with the same value in column_x. What is the most likely cause of the slow performance?

A.The fact table's distribution key column has data skew, causing uneven data distribution across nodes.
B.The dimension tables should be distributed by KEY instead of ALL.
C.The Redshift cluster does not have enough disk space.
D.The fact table does not have a sort key.
AnswerA

Skew leads to some nodes doing more work, slowing the query.

Why this answer

Data skew in the distribution key column_x causes some slices to hold a disproportionate number of rows, leading to uneven workload distribution during the hash join. The EXPLAIN plan shows a hash join on the distribution key, which should be efficient if data is evenly distributed, but skew forces the node with the most rows to become a bottleneck, slowing the entire query.

Exam trap

The trap here is that candidates often assume a hash join on the distribution key is always optimal, overlooking that data skew in the distribution key itself can negate the benefit and cause severe performance degradation.

How to eliminate wrong answers

Option B is wrong because distributing dimension tables by KEY would likely worsen performance by requiring redistribution or broadcasting during joins, whereas ALL distribution is optimal for small dimension tables to avoid data movement. Option C is wrong because insufficient disk space would manifest as disk-full errors or failed writes, not as slow query performance with a hash join plan. Option D is wrong because while a sort key can improve query performance for range-restricted scans, the EXPLAIN plan indicates the bottleneck is the hash join on the distribution key, not a missing sort key.

Full explanation →
1097
MCQmedium

A company uses AWS DMS to migrate data from Oracle to Aurora MySQL. During the ongoing replication, the target table shows duplicate primary key errors. What is the most likely cause?

A.DMS is using 'Limited LOB mode' and truncating LOB data, causing row mismatches.
B.The source table has a trigger that inserts additional rows.
C.The target table has an auto-increment column, and DMS is inserting explicit values that conflict.
D.The DMS task is configured with 'Parallel apply' threads that cause race conditions.
AnswerC

DMS inserts values for the PK, but auto-increment may also generate values, causing duplicates.

Why this answer

When DMS replicates into a target table with an auto-increment column, it attempts to insert explicit values from the source. If the target's auto-increment counter has already generated a value matching one of those explicit inserts, a duplicate primary key error occurs. This is the most likely cause because DMS does not automatically skip or re-map auto-increment columns unless explicitly configured.

Exam trap

The DEA-C01 exam often tests the misconception that duplicate key errors are caused by data type mismatches or LOB truncation, but the real trap is forgetting that auto-increment columns on the target can conflict with explicit primary key values from the source during ongoing replication.

How to eliminate wrong answers

Option A is wrong because Limited LOB mode truncates LOB data to a maximum size, which can cause data loss or row mismatches, but it does not produce duplicate primary key errors. Option B is wrong because source triggers that insert additional rows would add extra rows to the source, but DMS captures changes from the source transaction logs (e.g., Oracle Redo Logs) and would replicate those additional inserts as separate events; they would not cause duplicate key errors on the target unless the inserted rows have the same primary key as existing rows, which is not a typical trigger behavior. Option D is wrong because Parallel apply threads improve performance by applying changes concurrently, but DMS handles conflict resolution and ordering to prevent race conditions; duplicate key errors from parallel apply are extremely rare and not the most likely cause.

Full explanation →
1098
MCQhard

A company uses AWS Glue to run ETL jobs that process data from Amazon RDS to Amazon S3. The jobs run nightly and take 3 hours to complete. The data volume is growing by 20% each month. The engineer needs to reduce job runtime and cost. The source RDS is a db.r5.large instance. Which approach would be MOST effective?

A.Reduce the number of DPUs to lower cost and accept longer runtime.
B.Increase the number of Glue workers and choose a G.1X or G.2X worker type.
C.Create a read replica of the RDS instance and point the Glue job to the replica.
D.Enable S3 Transfer Acceleration on the destination bucket.
AnswerB

More workers increase parallelism.

Why this answer

Increasing the number of Glue workers and choosing a G.1X or G.2X worker type directly increases parallelism and provides more memory per worker, reducing job runtime at a manageable cost increase. Option A is wrong; reducing DPUs would increase runtime, not reduce it. Option C is wrong because a read replica does not improve Glue processing speed; the bottleneck is Glue's processing capacity, not the source database's read capacity.

Option D is wrong because S3 Transfer Acceleration improves upload speed to S3, not Glue job processing.

Full explanation →
1099
MCQeasy

A company needs to enforce that all objects uploaded to an S3 bucket are encrypted at rest. Which bucket setting should be used?

A.Default encryption
B.S3 Object Lock
C.Bucket policy requiring s3:x-amz-server-side-encryption header
D.S3 Block Public Access
AnswerA

Default encryption automatically encrypts objects at rest.

Why this answer

Default encryption, is the correct bucket setting because it ensures all objects uploaded to the bucket are automatically encrypted at rest using SSE-S3 or SSE-KMS. Option B is incorrect because S3 Object Lock is used for compliance and retention, not encryption. Option C is incorrect because while a bucket policy can enforce encryption via the s3:x-amz-server-side-encryption header, the question asks for a bucket setting, and default encryption is the simpler and direct setting.

Option D is incorrect because S3 Block Public Access controls public access, not encryption.

Full explanation →
1100
MCQmedium

Refer to the exhibit. An IAM policy is attached to a user who needs to read objects from the 'example-bucket' S3 bucket. The user reports being unable to read any object under the 'confidential/' prefix. What is the reason for this access issue?

A.The allow statement is evaluated before the deny statement
B.The deny statement is missing an explicit allow for the confidential prefix
C.The explicit deny statement overrides the allow statement
D.The resource ARN in the deny statement is incorrect
AnswerC

Explicit deny overrides all allows.

Why this answer

An explicit deny statement overrides any allow statement, regardless of the order in which they appear. In this policy, there is an allow for GetObject on all objects in example-bucket, but there is an explicit deny for GetObject on the 'confidential/' prefix. Since explicit deny takes precedence, the user cannot read objects under that prefix.

Option A is incorrect because the order of evaluation does not matter; explicit deny always wins. Option B is incorrect because the deny statement does not need an explicit allow; the deny itself is effective. Option D is incorrect because the resource ARN in the deny statement is correctly specified as 'arn:aws:s3:::example-bucket/confidential/*'.

Full explanation →
1101
MCQmedium

A data engineer needs to ensure that an Amazon S3 bucket used for sensitive data is encrypted at rest using a customer-managed AWS KMS key. The bucket policy must enforce encryption for all PUT requests. Which policy statement should be added to the bucket policy?

A.{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"Null":{"s3:x-amz-server-side-encryption":"true"}}}
B.{"Effect":"Allow","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"arn:aws:kms:us-east-1:123456789012:key/abc123"}}}
C.{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"},"Null":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"true"}}}
D.{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"arn:aws:kms:us-east-1:123456789012:key/abc123"}}}
AnswerC

This denies if encryption is not aws:kms or if the key ID is not provided, enforcing the required encryption.

Why this answer

It uses a Deny effect with a condition that blocks PUT requests unless the encryption header specifies 'aws:kms' (SSE-KMS) AND the KMS key ID matches the required customer-managed key. The combination of StringNotEquals on the encryption type and Null on the key ID ensures that any request not using the specified KMS key is denied, enforcing both encryption at rest and the use of the customer-managed key.

Exam trap

The trap here is that candidates often choose a simple Deny on a missing encryption header (Option A) without realizing that it does not enforce the use of a specific KMS key, or they mistakenly use an Allow effect (Option B) which cannot block non-compliant requests due to the default Allow behavior of S3 bucket policies.

How to eliminate wrong answers

Option A is wrong because it denies requests only when the 's3:x-amz-server-side-encryption' header is null, which would allow requests with any encryption header (including AES256 or a different KMS key) to succeed, failing to enforce the specific customer-managed KMS key. Option B is wrong because it uses an Allow effect, which cannot override an explicit Deny and does not enforce encryption; it merely allows requests that match the condition but does not block non-compliant requests. Option D is wrong because it denies requests only when the KMS key ID does not match, but it does not require the encryption header to be present at all, allowing unencrypted PUT requests to bypass the policy.

Full explanation →
1102
MCQmedium

A financial company needs to ingest real-time stock trade data from multiple sources and store it in Amazon S3 for compliance. The data must be delivered within 1 minute of the trade occurring. The data volume is approximately 10,000 records per second, with occasional spikes to 50,000 records per second. The engineer has set up Amazon Kinesis Data Streams with 10 shards and a Kinesis Data Firehose delivery stream that reads from the Kinesis stream and writes to S3. However, during spikes, the Firehose delivery stream falls behind, causing data to be delayed beyond the 1-minute SLA. What should the engineer do to meet the SLA without over-provisioning?

A.Increase the buffer size in Kinesis Data Firehose from 1 MB to 5 MB to batch more data per delivery.
B.Use Amazon SQS as a buffer between Kinesis and Firehose to absorb spikes.
C.Replace Firehose with an AWS Lambda function that writes directly to S3 for lower latency.
D.Increase the number of shards in the Kinesis data stream to handle peak throughput and enable auto-scaling.
AnswerD

More shards increase read capacity; auto-scaling adjusts during spikes.

Why this answer

Increasing the number of shards in the Kinesis data stream allows it to handle the peak throughput of 50,000 records per second, and enabling auto-scaling ensures the stream adapts to varying loads without manual intervention. This reduces the backlog that causes Firehose to fall behind, meeting the 1-minute SLA. Option A is incorrect because increasing the buffer size in Firehose would increase latency, not reduce it.

Option B is incorrect because adding SQS as a buffer adds another hop, increasing latency and complexity. Option C is incorrect because AWS Lambda may not scale to 50,000 records per second and adds processing latency.

Full explanation →
1103
MCQhard

Refer to the exhibit. A data engineer runs the command above. The DataAdminRole is used by an application to decrypt data. The security team wants to ensure that a SecurityAdminRole can revoke the grant. What must be done to allow the SecurityAdminRole to retire the grant?

A.Set the RetiringPrincipal to the root user
B.Add a grant with Revoke operation for the SecurityAdminRole
C.No action needed; the SecurityAdminRole can retire the grant
D.Create a new grant with SecurityAdminRole as GranteePrincipal
AnswerC

The RetiringPrincipal is already set.

Why this answer

The grant's RetiringPrincipal field is already set to SecurityAdminRole, so no additional action is needed. Option A is incorrect because setting the RetiringPrincipal to the root user would not grant SecurityAdminRole the ability to retire. Option B is incorrect because a Revoke grant is not required; retire is handled by the RetiringPrincipal.

Option D is incorrect because creating a new grant is unnecessary when the existing grant already has the correct RetiringPrincipal.

Full explanation →
1104
Multi-Selecthard

Which THREE factors should a data engineer consider when choosing between Amazon Redshift and Amazon Athena for querying large datasets in Amazon S3? (Choose three.)

Select 3 answers
A.Both support standard SQL queries.
B.Redshift requires provisioning and managing clusters, while Athena is serverless.
C.Athena charges per query based on data scanned, while Redshift charges for cluster compute capacity.
D.Athena can only query data stored in Amazon S3, while Redshift can also query data in S3.
E.Redshift is optimized for highly structured, frequently queried data, while Athena is better for ad-hoc queries on raw data.
AnswersB, C, E

Redshift needs cluster management; Athena is serverless.

Why this answer

Amazon Redshift requires manual provisioning, configuration, and ongoing management of clusters, including node sizing, scaling, and maintenance windows. In contrast, Amazon Athena is a serverless service that automatically handles infrastructure, requiring no cluster management and allowing users to query data directly from Amazon S3 without any setup overhead.

Exam trap

The trap here is that candidates may assume Athena is limited to S3-only queries or that both services have identical SQL support, overlooking the fundamental architectural differences in provisioning, cost models, and workload optimization that are the real decision factors.

Full explanation →
1105
Multi-Selectmedium

A company uses Amazon Kinesis Data Streams to ingest clickstream data. The data must be transformed and stored in Amazon S3 for batch analytics. The engineer wants to use AWS Lambda for transformation. Which TWO configurations are required? (Choose two.)

Select 2 answers
A.Configure the Lambda function to write to S3 via Kinesis Data Firehose.
B.Configure the Kinesis stream to send records directly to S3.
C.Set up an SQS queue as a destination for Lambda errors.
D.Create an event source mapping from the Kinesis stream to the Lambda function.
E.Assign an IAM role to Lambda with permissions to read from Kinesis and write to S3.
AnswersD, E

Event source mapping enables Lambda to poll from Kinesis.

Why this answer

The correct answers are D and E. D: An event source mapping is required for Lambda to poll records from Kinesis. E: Lambda needs an IAM role with permissions to read from Kinesis and write to S3.

Option A is incorrect because Lambda does not write to S3 via Firehose; Firehose is a separate service that could directly write to S3, but in this scenario, Lambda is the transformation actor and writes directly to S3. Option B is incorrect because a Kinesis stream cannot send records directly to S3; it needs a consumer or Firehose. Option C is incorrect because Lambda errors can be sent to SQS but it is not required for this setup; the question asks for required configurations.

Full explanation →
1106
Multi-Selecteasy

Which TWO data stores are considered fully managed, serverless, and suitable for storing JSON documents?

Select 2 answers
A.Amazon Redshift
B.Amazon ElastiCache for Redis
C.Amazon DocumentDB (with MongoDB compatibility)
D.Amazon DynamoDB
E.Amazon RDS for MySQL
AnswersC, D

DocumentDB is a managed document database, supports JSON.

Why this answer

Amazon DocumentDB (with MongoDB compatibility) is a fully managed, serverless document database that natively stores JSON documents. It supports MongoDB workloads, allowing you to store, query, and index JSON data without managing infrastructure, making it ideal for content management and catalog applications.

Exam trap

AWS often tests the distinction between fully managed serverless services (DocumentDB, DynamoDB) and those requiring provisioning or cluster management (Redshift, ElastiCache, RDS), leading candidates to mistakenly select ElastiCache for Redis due to its JSON module support, ignoring its non-serverless nature and primary use as a cache.

Full explanation →
1107
MCQmedium

A company needs to ingest real-time sensor data from thousands of IoT devices into Amazon S3, with a latency of less than 1 minute. The data must be transformed (e.g., convert to Parquet) before landing in S3. Which combination of services is MOST cost-effective?

A.Amazon Kinesis Data Streams to AWS Lambda to S3.
B.Amazon Kinesis Data Streams to Amazon Kinesis Data Analytics to S3.
C.Amazon Kinesis Data Streams to AWS Glue streaming ETL to S3.
D.Amazon Kinesis Data Streams to Amazon Kinesis Data Firehose to S3.
AnswerD

Firehose can transform and deliver with low latency, cost-effective for high throughput.

Why this answer

The most cost-effective because Amazon Kinesis Data Firehose directly ingests data from Kinesis Data Streams, can perform transformations (e.g., convert to Parquet) using built-in or Lambda functions, and delivers to S3 with low latency (under 1 minute). Option A is incorrect because AWS Lambda, while capable of transformation, does not scale cost-effectively for thousands of devices due to per-invocation costs and concurrency limits. Option B is incorrect because Kinesis Data Analytics is designed for complex stream processing with SQL, not simple transformations, and adds unnecessary cost.

Option C is incorrect because AWS Glue streaming ETL is more suited for near-real-time batch processing and can incur higher costs and latency for high-throughput ingestion.

Full explanation →
1108
MCQhard

Refer to the exhibit. A data engineer runs the above command and sees that the DataLakeAdmin role has the AmazonS3FullAccess and AWSLakeFormationDataAdmin policies attached. The engineer wants to ensure that the role can only access S3 data through Lake Formation. What should the engineer do?

A.Create a new IAM policy that explicitly denies s3:GetObject and attach it to the role
B.Detach the AWSLakeFormationDataAdmin policy from the role
C.Detach the AmazonS3FullAccess policy from the role
D.Modify the S3 bucket policy to deny all access except from Lake Formation
AnswerC

This removes direct S3 access, forcing the role to use Lake Formation for data access.

Why this answer

To enforce that access is only through Lake Formation, the engineer should detach the AmazonS3FullAccess policy because it allows direct S3 access, bypassing Lake Formation. The LakeFormationAdmin policy is needed for Lake Formation administration. Changing the S3 bucket policy to deny all access except from Lake Formation is not straightforward because Lake Formation uses the principal's IAM role.

Creating a new policy that denies S3 access would be redundant if the full access policy is removed.

Full explanation →
1109
MCQhard

A data engineer notices that an Amazon Athena query on a partitioned table in S3 scans more data than expected. The table is partitioned by year, month, day. The query includes a WHERE clause on a non-partition column but also filters on day='2023-01-01'. What is the most likely cause of the excessive data scan?

A.The data is stored in JSON format instead of Parquet
B.The table is not partitioned by the column used in the WHERE clause
C.The partition column data type in the table definition does not match the actual partition folder names
D.The data is not sorted within partitions
AnswerC

If the partition column is defined as string but folders are dates, pruning fails and full scan occurs.

Why this answer

The most likely cause is that the partition column data type in the table definition does not match the actual partition folder names. Athena uses the folder names to determine which partitions to scan (partition pruning). If the data type mismatch causes Athena to be unable to correctly interpret the folder names, partition pruning fails, and Athena scans all partitions, leading to excessive data scan.

Option A is incorrect because JSON format does not prevent partition pruning; it may affect compression but not pruning. Option B is incorrect because the WHERE clause filters on a non-partition column, but it also filters on the partition column 'day', so partition pruning should work if the column data type matches. Option D is incorrect because sorting within partitions does not affect scan size; it affects query performance but not the amount of data scanned.

Full explanation →
1110
MCQeasy

A data engineer has set up an Amazon S3 lifecycle policy to transition objects to Glacier Instant Retrieval after 30 days. After 60 days, objects should transition to Deep Archive. However, objects are not transitioning to Deep Archive. What is the most likely cause?

A.The bucket has versioning enabled.
B.Deep Archive is not supported in the bucket's region.
C.Objects are smaller than 128 KB.
D.The transition to Deep Archive requires a minimum of 30 days after the previous transition.
AnswerC

Objects must be at least 128 KB to transition to S3 Glacier Instant Retrieval. If objects are smaller, the first transition fails, preventing subsequent transitions.

Why this answer

Amazon S3 lifecycle policies have a minimum object size requirement for transitions to certain storage classes. Objects must be at least 128 KB to transition to S3 Glacier Instant Retrieval. Since the policy first transitions objects to Glacier Instant Retrieval after 30 days, objects smaller than 128 KB cannot undergo that transition, and subsequent transitions to Deep Archive will also fail.

The 30-day minimum interval requirement is met (30 days between transitions), so option D is not the cause. Versioning (A) does not prevent transitions, and Deep Archive (B) is supported in all commercial AWS regions. Therefore, the most likely cause is that objects are smaller than 128 KB.

Exam trap

Candidates often overlook the 128 KB minimum object size for transitions to S3 Glacier Instant Retrieval, mistakenly attributing the failure to the 30-day interval rule.

How to eliminate wrong answers

Option A is wrong because S3 versioning does not prevent lifecycle transitions; lifecycle policies can be applied to both current and noncurrent versions independently. Option B is wrong because Deep Archive is supported in all AWS regions where S3 is available, including the standard commercial regions. Option C is wrong because the 128 KB minimum object size restriction applies only to S3 Intelligent-Tiering and S3 Glacier Instant Retrieval for automatic tiering, not to lifecycle transitions to Deep Archive; lifecycle policies can transition objects of any size.

Full explanation →
1111
MCQmedium

Refer to the exhibit. A data engineer runs the above AWS CLI command to view the table metadata in the AWS Glue Data Catalog. The data is stored as CSV in S3 with partitions by year and month. When querying the table using Amazon Athena, no data is returned. What is the most likely cause?

A.The partitions have not been added to the Glue Data Catalog.
B.The SerDe is not compatible with CSV files.
C.The S3 location points to a file instead of a folder.
D.The column data types are incorrect for the CSV data.
AnswerA

Partitions must be explicitly registered for Athena to query them.

Why this answer

The AWS CLI command shown only retrieves table metadata, not partition metadata. In AWS Glue, partitions must be explicitly added to the Data Catalog via `MSCK REPAIR TABLE`, `ALTER TABLE ADD PARTITION`, or a Glue crawler. Without partition metadata, Athena cannot locate the data files under the partitioned S3 paths (e.g., `s3://bucket/year=2024/month=01/`), resulting in zero rows returned even though the table schema is defined.

Exam trap

The trap here is that candidates assume the `PARTITIONED BY` clause in the table definition automatically registers the partitions in the Glue Data Catalog, but it only defines the schema; partition metadata must be added separately.

How to eliminate wrong answers

Option B is wrong because the default SerDe for CSV in Athena (`LazySimpleSerDe`) is fully compatible with standard CSV files; no SerDe mismatch would cause zero rows. Option C is wrong because the `LOCATION` in the Glue table points to a folder (the base path), not a file; Athena expects a folder and would fail with an error if a file were specified, not silently return no data. Option D is wrong because incorrect column data types would cause query failures or data conversion errors, not an empty result set; Athena would still attempt to read the data and return rows with nulls or errors.

Full explanation →
1112
MCQmedium

Refer to the exhibit. A data engineer notices that the Redshift cluster 'mycluster' does not have automated backups beyond 7 days. However, the compliance team requires a minimum of 35 days of backup retention. What should the engineer do?

A.Change the node type to ra3.xlplus to enable automatic backups for 35 days.
B.Enable audit logging to capture changes for recovery.
C.Take manual snapshots every day and retain them for 35 days.
D.Modify the cluster's automated snapshot retention period to 35 days.
AnswerD

The retention period can be increased up to 35 days via modification.

Why this answer

Amazon Redshift allows you to modify the automated snapshot retention period for a cluster up to 35 days. The engineer can use the AWS Management Console, CLI, or API to change the `automated_snapshot_retention_period` parameter from the current 7 days to 35 days, meeting the compliance requirement without additional manual intervention.

Exam trap

The trap here is that candidates may confuse backup retention with node type capabilities or audit logging, assuming that hardware or logging features inherently extend backup duration, when in fact the retention period is a simple configuration parameter.

How to eliminate wrong answers

Option A is wrong because changing the node type to ra3.xlplus does not affect the automated backup retention period; retention is configured independently of node type. Option B is wrong because audit logging captures user activity and SQL queries for security and compliance, not for point-in-time recovery of data; it does not replace backup retention. Option C is wrong because while manual snapshots can be retained for 35 days, this approach requires daily manual effort and does not leverage the automated backup feature that is already available; modifying the automated retention period is simpler and more reliable.

Full explanation →
1113
MCQeasy

A data engineer needs to store streaming data from IoT devices for real-time analytics. The data has a fixed schema and requires low-latency queries. Which AWS service should be used?

A.Amazon DynamoDB
B.Amazon Redshift
C.Amazon S3
D.Amazon Timestream
AnswerD

Timestream is designed for time-series data with low-latency queries.

Why this answer

Amazon Timestream is a time-series database purpose-built for IoT and operational applications that generate large volumes of time-stamped data. It automatically manages data retention and storage tiers (memory and magnetic) to provide fast query performance for recent data and cost-effective storage for historical data, making it ideal for real-time analytics on streaming IoT data with a fixed schema.

Exam trap

AWS often tests the misconception that any database can handle time-series data equally well, but the trap here is that candidates choose DynamoDB for its low-latency reads, overlooking that Timestream is the only AWS service purpose-built for time-series workloads with native support for time-based partitioning, retention policies, and analytical functions.

How to eliminate wrong answers

Option A is wrong because Amazon DynamoDB is a NoSQL key-value and document database optimized for high-throughput, low-latency read/write operations on individual items, but it lacks native time-series optimizations such as automatic downsampling, interpolation, and time-based partitioning, making it less efficient for time-series queries like aggregations over time windows. Option B is wrong because Amazon Redshift is a petabyte-scale data warehouse designed for complex analytical queries on structured and semi-structured data using SQL, but it is not optimized for real-time streaming ingestion or low-latency queries on high-frequency time-series data; its batch-oriented architecture introduces higher latency for streaming use cases. Option C is wrong because Amazon S3 is an object storage service that provides durable, scalable storage for any type of data, but it does not support real-time querying directly; querying S3 requires services like Athena or S3 Select, which add latency and are not designed for sub-second, low-latency queries on streaming data.

Full explanation →
1114
MCQmedium

A company uses AWS Glue to catalog data in Amazon S3. The security team requires that all sensitive data be identified and encrypted at rest using customer-managed KMS keys. Which combination of steps should a data engineer take to meet these requirements?

A.Enable S3 Access Logs and use Athena to query the logs for sensitive data patterns.
B.Use Amazon Macie to scan the S3 bucket and automatically apply S3 default encryption.
C.Enable S3 default encryption for the bucket and use IAM policies to restrict access.
D.Configure AWS Glue to use Detect Sensitive Data and write encrypted output to S3 with SSE-KMS.
AnswerD

Glue's Detect Sensitive Data identifies sensitive columns, and the ETL job can encrypt output using customer-managed KMS keys.

Why this answer

AWS Glue provides a 'Detect Sensitive Data' transform (such as FindMatches or custom classifiers) that can be used in a Glue ETL job to identify sensitive data within the catalog. The same ETL job can then write the processed data to Amazon S3 with server-side encryption using customer-managed KMS keys (SSE-KMS), meeting both identification and encryption-at-rest requirements. Option A is incorrect because S3 Access Logs and Athena queries do not directly identify sensitive data patterns reliably, nor do they enforce encryption.

Option B is incorrect because Amazon Macie can scan for sensitive data, but it does not automatically apply S3 default encryption; moreover, default encryption uses S3-managed keys, not customer-managed KMS keys. Option C is incorrect because enabling S3 default encryption and using IAM policies addresses encryption and access control but lacks the sensitive data identification step required by the security team.

Full explanation →
1115
MCQmedium

A company uses AWS Glue DataBrew to clean and transform data. A data engineer notices that a DataBrew recipe step that should remove duplicates is not working as expected. The dataset has millions of rows. What is the MOST likely reason?

A.The data source is an S3 bucket with a large number of files
B.The dataset contains null values in the key columns
C.The dataset is not sorted by the columns used for deduplication
D.The DataBrew project is using a sampling of the data
AnswerC

DataBrew's dedup is based on consecutive duplicates; sorting is required.

Why this answer

DataBrew's 'Remove duplicate rows' step identifies duplicates by comparing each row to the previous row in the dataset. If the data is not sorted by the key columns, duplicate rows may not be adjacent and thus will not be removed, causing the step to appear ineffective. Option A: The number of files does not directly affect deduplication logic.

Option B: Null values may be treated as distinct, but the most likely issue is lack of sorting. Option D: DataBrew projects can use sampling for preview, but recipes are applied to the full dataset when run, so sampling does not prevent deduplication.

Full explanation →
1116
MCQhard

A data engineer is designing a data lake on Amazon S3. The data is frequently accessed by multiple analytics services, and the company needs to enforce fine-grained access control based on data tags. Which combination of AWS services should be used?

A.S3 Block Public Access settings
B.AWS Lake Formation with tag-based access control
C.S3 Access Points with bucket policies
D.S3 Object Lambda with IAM policies
AnswerB

Lake Formation provides fine-grained access control using tags.

Why this answer

AWS Lake Formation with tag-based access control (TBAC) is the correct choice because it provides fine-grained, attribute-based access control (ABAC) at the column, row, and cell level across a data lake on S3. By assigning LF-tags to Data Catalog resources and defining permissions based on those tags, you can enforce granular access policies that scale without managing individual user-to-resource mappings. This directly meets the requirement for tag-driven, fine-grained access for multiple analytics services.

Exam trap

The trap here is that candidates often confuse S3 Access Points (which provide network-level or prefix-level restrictions) with the fine-grained, tag-driven access control that Lake Formation TBAC uniquely offers, leading them to pick Option C despite its inability to enforce column- or row-level security based on tags.

How to eliminate wrong answers

Option A is wrong because S3 Block Public Access settings only prevent public exposure of S3 objects and do not provide any fine-grained, tag-based access control for internal users or services. Option C is wrong because S3 Access Points with bucket policies can restrict access based on VPC or IP, but they do not natively support tag-based access control at the column or row level; they operate at the bucket or prefix level only. Option D is wrong because S3 Object Lambda transforms data on read but does not enforce access control based on data tags; IAM policies attached to it cannot dynamically filter data by tags without custom code, and it lacks the centralized governance Lake Formation provides.

Full explanation →
1117
Multi-Selecthard

A company uses a Kinesis Data Firehose delivery stream to load data into an S3 bucket. The data is in JSON format and must be converted to Parquet before landing in S3. Which steps are required to achieve this? (Choose THREE.)

Select 3 answers
A.Configure the Firehose delivery stream to enable data format conversion to Parquet.
B.Create a table in the AWS Glue Data Catalog with the schema.
C.Store the schema in Amazon DynamoDB.
D.Set the Firehose's schema mapping to reference the Glue table.
E.Use Kinesis Data Analytics to convert the data.
AnswersA, B, D

Firehose has built-in conversion capability.

Why this answer

Kinesis Data Firehose natively supports converting incoming data from JSON to Parquet format. This conversion is enabled directly in the delivery stream configuration, eliminating the need for separate processing steps.

Exam trap

The trap here is that candidates may think DynamoDB is needed for schema storage or that Kinesis Data Analytics is required for the conversion, but Firehose's built-in Parquet conversion with Glue schema support is the correct and simpler approach.

Full explanation →
1118
MCQhard

A company runs a Redshift cluster for analytics. The data engineering team notices that COPY commands from S3 are failing for large files (>1 GB) with the error 'S3ServiceException: SlowDown'. What is the most effective solution?

A.Use Redshift Spectrum to query the data directly in S3.
B.Enable automatic compression on the target tables.
C.Increase the number of Redshift nodes to distribute the load.
D.Split the large files into smaller parts (e.g., 100 MB each) and use parallel COPY.
AnswerD

Smaller files reduce per-object throttling and allow higher parallelism.

Why this answer

The SlowDown error indicates throttling from S3. Splitting large files into smaller parts increases parallelism and reduces the chance of throttling per object. Option A is wrong because using Redshift Spectrum is for querying external tables, not for addressing S3 throttling during COPY.

Option B is wrong because enabling automatic compression is for compression, not throttling. Option C is wrong because increasing the number of Redshift nodes does not directly address S3 throttling.

Full explanation →
1119
MCQeasy

A data engineer needs to store JSON documents that are frequently accessed by a low-latency web application. The data does not require complex queries, and the access pattern is primarily by a key. Which AWS service is most appropriate?

A.Amazon ElastiCache for Redis
B.Amazon S3
C.Amazon RDS for MySQL
D.Amazon DynamoDB
AnswerD

DynamoDB provides low-latency key-value access for JSON documents.

Why this answer

Amazon DynamoDB is the most appropriate service because it is a fully managed NoSQL key-value and document database designed for single-digit millisecond latency at any scale. It natively supports JSON documents and provides fast, consistent access by primary key without requiring complex query capabilities, making it ideal for low-latency web applications.

Exam trap

The trap here is that candidates often confuse ElastiCache for Redis as a persistent data store for JSON documents, but it is primarily an in-memory cache with optional persistence, not a durable, low-latency database designed for primary key access patterns.

How to eliminate wrong answers

Option A is wrong because Amazon ElastiCache for Redis is an in-memory data store primarily used for caching, session management, and real-time analytics, not for persistent storage of JSON documents that need durability and key-based access with low latency. Option B is wrong because Amazon S3 is an object storage service with higher latency (typically tens to hundreds of milliseconds) and is not optimized for frequent, low-latency key-based lookups required by a web application. Option C is wrong because Amazon RDS for MySQL is a relational database that requires predefined schemas and supports complex queries via SQL, which is overkill and adds unnecessary overhead for simple key-based access to JSON documents.

Full explanation →
1120
Multi-Selecthard

A company uses Amazon DynamoDB to store session data for a web application. The application experiences throttling during peak hours. The data engineer needs to reduce throttling. Which THREE actions should the engineer take?

Select 3 answers
A.Use DynamoDB Accelerator (DAX) to cache read requests.
B.Increase the provisioned read capacity units.
C.Implement exponential backoff in the application.
D.Design the partition key to include a random suffix to distribute writes.
E.Enable auto scaling on the table.
AnswersA, C, D

Reduces read capacity consumption.

Why this answer

DynamoDB Accelerator (DAX) is an in-memory cache that reduces read latency and offloads read requests from the DynamoDB table, directly decreasing the number of read capacity units consumed. By caching frequently accessed session data, DAX mitigates throttling during peak hours without requiring changes to the table's provisioned capacity.

Exam trap

The trap here is that candidates confuse reactive scaling (auto scaling) or capacity increases with proactive throttling reduction techniques, while the correct answers focus on caching, request distribution, and retry logic that directly reduce the load on the table.

Full explanation →
1121
MCQhard

A company uses Amazon DynamoDB with on-demand capacity for a gaming application that experiences unpredictable traffic spikes. The application reads the same set of 'hot' items frequently. Users report high latency during peak hours. Which action would MOST effectively reduce read latency for the hot items?

A.Enable DynamoDB Accelerator (DAX) for the table.
B.Switch to provisioned capacity with auto-scaling.
C.Increase the read capacity units for the table.
D.Enable DynamoDB Global Tables for multi-region replication.
AnswerA

DAX caches hot items, reducing read latency.

Why this answer

DynamoDB Accelerator (DAX) is an in-memory cache that sits between the application and DynamoDB, providing microsecond read latency for frequently accessed items. Since the application reads the same set of 'hot' items repeatedly, DAX can serve these reads from its cache, bypassing the storage layer and reducing latency during traffic spikes without requiring any table schema changes.

Exam trap

The trap here is that candidates often confuse throughput capacity (RCUs/WCUs) with latency, assuming that increasing capacity will speed up individual reads, when in fact capacity only controls the rate of requests, not the response time per request.

How to eliminate wrong answers

Option B is wrong because switching to provisioned capacity with auto-scaling does not reduce read latency; it only manages throughput capacity based on load, but the underlying read latency from DynamoDB remains the same. Option C is wrong because increasing read capacity units (RCUs) is only applicable to provisioned capacity mode, not on-demand capacity, and even if it were, it would not reduce latency for hot items—it only increases the maximum throughput. Option D is wrong because DynamoDB Global Tables replicate data across regions for disaster recovery and low-latency reads from distant regions, but it does not reduce latency for reads within the same region; it adds complexity and cost without addressing the hot-item caching issue.

Full explanation →
1122
Multi-Selecteasy

A data engineer needs to monitor the performance of an Amazon Redshift cluster. Which Amazon CloudWatch metric should the engineer monitor to detect disk space issues?

Select 1 answer
A.ReadIOPS
B.WriteIOPS
C.PercentageDiskSpace
D.NetworkThroughput
E.CPUUtilization
AnswersC

PercentageDiskSpace directly measures the percentage of disk space used on the Redshift cluster, making it the correct metric for detecting disk space issues.

Why this answer

Option C. PercentageDiskSpace is a direct CloudWatch metric that tracks the percentage of disk space used on the Redshift cluster, making it ideal for detecting disk space issues. ReadIOPS and WriteIOPS measure I/O operations per second and are not indicators of disk space usage.

NetworkThroughput measures network traffic, and CPUUtilization measures compute usage; neither relates to disk space.

Full explanation →
1123
MCQmedium

A data engineer is troubleshooting an AWS Glue ETL job that fails intermittently. The job is triggered by an AWS Lambda function that uses the IAM policy shown. The Lambda function invokes the Glue job, but sometimes the job does not start. Which action should the engineer take to ensure the job starts reliably?

A.Replace the resource "*" in the Glue action with the specific Glue job ARN.
B.Add s3:GetObject and s3:PutObject permissions for the Glue job's output bucket.
C.Modify the Lambda function to batch multiple job start requests.
D.Add the iam:PassRole permission for the IAM role used by the Glue job.
AnswerD

The Lambda function needs iam:PassRole to pass the Glue job role; missing this causes intermittent failures.

Why this answer

The Lambda function must have the `iam:PassRole` permission to pass the IAM role used by the AWS Glue job. Without this permission, the Glue job cannot assume the role required for execution, leading to intermittent failures when the job is invoked. Option A is incorrect because the resource `*` already allows starting the job, and the issue is not about resource restriction.

Option B is incorrect because while S3 permissions may be necessary for the job's data access, they are not the cause of the job not starting. Option C is incorrect because batching job start requests does not address the underlying permission issue.

Full explanation →
1124
MCQmedium

The exhibit shows an S3 bucket policy. What is the effect of this policy?

A.Allows all S3 actions over HTTPS only.
B.Allows all S3 actions to the bucket over any protocol.
C.Denies all S3 actions to the bucket.
D.Allows only GetObject and PutObject over HTTPS.
AnswerD

Explicit allow for those actions over HTTPS; deny for HTTP.

Why this answer

The S3 bucket policy in the exhibit uses a condition key `aws:SecureTransport` set to `true`, which restricts access to HTTPS only. The `Effect` is `Allow` for `s3:GetObject` and `s3:PutObject` actions, meaning only these two actions are permitted over HTTPS. This matches option D.

Exam trap

The trap here is that candidates see the `Deny` statement and assume the entire policy denies all actions, overlooking the `Allow` statement that permits specific actions over HTTPS.

How to eliminate wrong answers

Option A is wrong because the policy does not allow all S3 actions; it explicitly allows only `s3:GetObject` and `s3:PutObject`. Option B is wrong because the policy denies all actions over non-HTTPS protocols via the `Deny` statement with `aws:SecureTransport=false`, and the `Allow` statement only permits HTTPS. Option C is wrong because the policy does not deny all S3 actions; it allows `GetObject` and `PutObject` over HTTPS, while only denying actions that do not use HTTPS.

Full explanation →
1125
Multi-Selecthard

A data engineer is configuring a VPC for an Amazon Redshift cluster. The cluster must be accessible only from a specific on-premises network via a Direct Connect connection. Which TWO actions should the engineer take to meet this requirement? (Choose TWO.)

Select 2 answers
A.Enable Redshift Enhanced VPC Routing.
B.Configure a security group to allow inbound traffic from the on-premises CIDR block.
C.Configure a network ACL to allow inbound traffic from the on-premises CIDR block.
D.Create a VPC endpoint for Redshift.
E.Make the Redshift cluster publicly accessible.
AnswersB, C

Security groups act as a firewall to control inbound traffic.

Why this answer

To restrict access to an Amazon Redshift cluster from a specific on-premises network via Direct Connect, the engineer should use a security group (option B) to control inbound traffic at the instance level, and a network ACL (option C) for subnet-level traffic control. Both should allow traffic from the on-premises CIDR block. Option A (Enhanced VPC Routing) is incorrect because it controls how traffic flows between the cluster and other resources, not inbound access.

Option D (VPC endpoint) is incorrect because a VPC endpoint provides private connectivity from within the VPC, not from on-premises via Direct Connect. Option E (publicly accessible) is insecure and unnecessary when using Direct Connect.

Full explanation →
Page 14

Page 15 of 23

Page 16

All pages

1234567891011121314151617181920212223

Practice DEA-C01 by domain

Target a specific domain to shore up weak areas.

Data Ingestion and TransformationData Operations and SupportData Security and GovernanceData Store Management
See all domains with question counts →