Knowledge + Practice

AWS Certified Data Engineer Associate DEA-C01 (DEA-C01) — Questions 1126–1200

1711 questions total · 23pages · All types, answers revealed

Take a mock exam Exam hub

Page 16 of 23

1126

MCQhard

A data engineer runs an AWS Glue ETL job that writes to a table in the AWS Glue Data Catalog. The job fails occasionally with the error 'Resource Not Found' for the table. The table exists. What is a likely cause?

A.The job is using an outdated version of the table schema.

B.Multiple Glue jobs are writing to the same table concurrently.

C.The table location in S3 is incorrect.

D.The Glue job name contains special characters.

AnswerA

Schema version mismatch can cause 'Resource Not Found'.

Why this answer

AWS Glue jobs can cache the table schema at job start. If the table schema is updated while the job is running, the job may still reference the old schema version, which may no longer exist in the Data Catalog, causing a 'Resource Not Found' error even though the table exists. Option B is incorrect because concurrent writes do not cause this specific error; they may cause conflicts but not a 'Resource Not Found' for the table itself.

Option C is incorrect because if the table exists and the location is wrong, it would typically result in a different error (e.g., 'Access Denied' or 'PathNotFound') rather than 'Resource Not Found' for the table. Option D is incorrect because special characters in the job name do not affect table access.

Full explanation →

1127

MCQmedium

A data engineer is running a Glue ETL job that reads from a JDBC source and writes to S3 in Parquet format. The job is slow and the engineer notices that the number of DPUs used is low. What can be done to improve performance?

A.Disable job bookmarks to avoid reading metadata.

B.Use push-down predicates to filter data at the source.

C.Increase the number of workers (MaxCapacity) in the job configuration.

D.Change the output format to CSV to reduce CPU overhead.

AnswerC

Increasing the number of workers (MaxCapacity) increases the number of parallel executors, directly addressing the low DPU usage and improving job performance.

Why this answer

Increasing the number of workers (MaxCapacity) directly increases the parallelism of the Glue ETL job. Since the DPU usage is low, the job is not fully utilizing available resources; adding workers allows more concurrent processing, thus improving performance. Option A: Disabling job bookmarks avoids reading metadata but does not address low DPU usage and may cause reprocessing.

Option B: Push-down predicates filter data at the source, reducing data volume, but the primary bottleneck here is parallelism, not data volume. Option D: Changing output to CSV would increase overhead and worsen performance because Parquet is columnar and compressed, while CSV is not.

Full explanation →

1128

MCQmedium

A company uses Amazon S3 to store raw data and needs to transform it into Parquet format for analytics. The transformation job runs daily on a schedule. Which AWS service is BEST suited for this task?

A.Amazon Redshift

B.Amazon EMR

C.AWS Lambda

D.AWS Glue

AnswerD

Glue is serverless, supports Parquet, and can be scheduled with triggers.

Why this answer

AWS Glue is a fully managed, serverless ETL service that can automatically convert data formats (e.g., from CSV to Parquet) and run on a schedule (e.g., daily). It is ideal for this use case because it is purpose-built for ETL transformations and handles schema discovery, data cataloging, and job scheduling without managing infrastructure. Option A (Amazon Redshift) is wrong because Redshift is a data warehouse for querying, not a transformation service; it could load Parquet but not convert raw data to Parquet directly.

Option B (Amazon EMR) is wrong because EMR requires provisioning and managing clusters, adding operational overhead. Option C (AWS Lambda) is wrong because Lambda has a maximum execution timeout of 15 minutes, which is too short for daily large-scale data transformation jobs.

Full explanation →

1129

MCQmedium

A data engineer runs an AWS Glue job that reads from a JDBC connection to a PostgreSQL database. The job fails with a 'Connection timed out' error. The Glue job runs in a VPC with the appropriate security group. What is the most likely cause?

A.The network ACL associated with the Glue job's subnet is blocking outbound traffic.

B.The Glue job does not have permission to access the database.

C.The security group does not allow inbound traffic from the Glue job.

D.The database credentials are incorrect.

AnswerA

Network ACLs can block traffic.

Why this answer

The 'Connection timed out' error indicates a network connectivity issue. Since the Glue job runs in a VPC with a security group that likely allows outbound traffic, the most likely cause is that the network ACL (which is stateless) associated with the Glue job's subnet is blocking outbound traffic to the database. Option A is correct.

Option B is incorrect because the error is not an authentication or permission issue. Option C is incorrect because the security group's inbound rule does not affect outbound traffic from the Glue job. Option D is incorrect because the error is network-related, not a credentials issue.

Full explanation →

1130

MCQmedium

A data engineer needs to ensure that an S3 bucket containing sensitive customer data is encrypted at rest. The company requires that all encryption keys be managed by AWS and rotated annually. Which encryption option meets these requirements?

A.Use server-side encryption with AWS KMS (SSE-KMS)

B.Use client-side encryption with AWS KMS

C.Use server-side encryption with customer-provided keys (SSE-C)

D.Use server-side encryption with S3-managed keys (SSE-S3)

AnswerD

SSE-S3 uses AWS-managed keys that are rotated automatically.

Why this answer

SSE-S3 uses AWS-managed keys and automatically handles annual key rotation, meeting both requirements of encryption at rest and AWS-managed keys with rotation. SSE-KMS also uses AWS-managed keys but does not automatically rotate keys (unless using a custom KMS key with rotation enabled, but the question implies automatic rotation without extra configuration). SSE-C requires customer-provided keys, which violates the requirement that AWS manages the keys.

Client-side encryption (B) is not server-side and also involves customer management. Thus, only SSE-S3 fully satisfies the requirements.

Full explanation →

1131

Multi-Selecthard

Which THREE factors should be considered when choosing between AWS Glue and Amazon EMR for data transformation? (Choose three.)

Select 3 answers

A.Glue automatically stores data in S3 after transformation.

B.EMR allows fine-grained control over cluster configuration and software.

C.EMR supports real-time stream processing with Spark Streaming.

D.Glue is serverless, reducing operational overhead.

E.Glue integrates natively with the Glue Data Catalog for schema management.

AnswersB, D, E

EMR provides flexibility to install custom software and tune clusters.

Why this answer

Amazon EMR provides full control over cluster configuration, including the ability to customize software, install libraries, and tune Spark, Hadoop, or Hive parameters. This fine-grained control is essential for complex or specialized data transformation pipelines that require specific versions or custom configurations.

Exam trap

The trap here is that candidates may confuse Glue's automatic schema discovery with automatic data storage, or assume EMR is the only option for streaming, when in fact both services support streaming but with different levels of control and operational overhead.

Full explanation →

1132

MCQmedium

A company uses Amazon Kinesis Data Streams to ingest clickstream data from a website. The data is consumed by an AWS Lambda function that writes to Amazon DynamoDB. The Lambda function is seeing high error rates due to DynamoDB write throttling. Which action should be taken to reduce throttling?

A.Use Amazon Kinesis Data Firehose instead of Kinesis Data Streams

B.Add an Amazon SQS queue between Lambda and DynamoDB

C.Increase the Lambda function memory

D.Enable auto scaling on the DynamoDB table

AnswerD

Auto scaling adjusts write capacity to handle spikes and reduce throttling.

Why this answer

Enabling DynamoDB auto scaling increases write capacity automatically when needed. Using Kinesis Data Firehose would change the architecture but does not address throttling directly. Increasing Lambda memory does not help with DynamoDB throttling.

Using SQS would add a queue but does not increase DynamoDB capacity.

Full explanation →

1133

MCQmedium

A company needs to tag all resources created in a specific AWS account to enforce data governance policies. Which AWS service can automatically enforce tagging rules?

A.AWS Organizations SCPs

B.AWS Service Catalog

C.AWS Resource Access Manager

D.AWS Systems Manager

AnswerA

SCPs can enforce tagging policies.

Why this answer

(AWS Organizations SCPs) is correct. Service Control Policies (SCPs) can be used to enforce tagging rules across all accounts in an organization by denying actions that don't meet tagging requirements. Option B (AWS Service Catalog) is used for creating and managing approved IT services, not for enforcing tagging rules.

Option C (AWS Resource Access Manager) is for sharing resources across accounts, not for enforcement. Option D (AWS Systems Manager) is for operational management, not for governance policies.

Full explanation →

1134

Multi-Selecthard

A data engineer is troubleshooting a slow-running AWS Glue ETL job that reads from Amazon S3 and writes to Amazon Redshift. The job processes 500 GB of CSV data daily. The engineer wants to improve performance. Which THREE actions should the engineer take? (Choose three.)

Select 3 answers

A.Use a JDBC connection with a higher batch size for writing to Redshift.

B.Partition the input data in S3 by date or category.

C.Switch to a single-node Redshift cluster to reduce latency.

D.Increase the number of DPUs allocated to the Glue job.

E.Reduce the number of input files by combining them into larger files.

AnswersA, B, D

Larger batch sizes reduce round trips and improve write throughput.

Why this answer

Increasing the JDBC batch size for the Redshift connection reduces the number of network round trips and improves write throughput. The Glue JDBC connector batches rows into a single INSERT statement; a larger batch size (e.g., 1000 instead of the default 100) allows more rows per commit, reducing overhead and speeding up the write phase.

Exam trap

The trap here is that candidates often assume combining files always improves performance (due to Hadoop's small file problem), but in Glue ETL with Spark, moderate parallelism from many files is beneficial, and the real bottleneck is often the JDBC write path, not the S3 read path.

Full explanation →

1135

MCQmedium

A company uses AWS Lake Formation to manage permissions on a data lake stored in S3. A data engineer notices that a new IAM user can query data via Athena but cannot see the tables in the Lake Formation console. What is the most likely cause?

A.The user has not been granted DESCRIBE or SELECT permissions on the tables in Lake Formation

B.The Athena workgroup is not encrypted

C.The Glue Data Catalog is not enabled for the account

D.The IAM user lacks s3:GetObject permissions

AnswerA

Lake Formation controls metadata access.

Why this answer

Lake Formation permissions are separate from IAM permissions. Even if the IAM user has Athena access, Lake Formation must grant the user DESCRIBE and SELECT permissions on the tables to see them in the console and query them. Option B is incorrect because encryption settings do not affect table visibility.

Option C is incorrect because the Glue Data Catalog is enabled (since the user can query data). Option D is incorrect because the user can query data, so they have s3:GetObject permissions implicitly.

Full explanation →

1136

MCQeasy

A company is using AWS Glue to run ETL jobs that transform data from Amazon DynamoDB to Amazon S3. The DynamoDB table has a large number of items (over 10 million) and is heavily used by production applications. The Glue job reads the entire DynamoDB table each time it runs, causing increased read capacity consumption and affecting production performance. The team wants to reduce the impact on the source DynamoDB table while still keeping the S3 data up-to-date. What should the team do?

A.Use DynamoDB Streams and AWS Lambda to capture changes and write them to S3, then run incremental Glue jobs.

B.Increase the DynamoDB read capacity units to handle the Glue job's read load.

C.Use the DynamoDB console to export the table to S3 in Parquet format.

D.Reduce the parallelism of the Glue job to lower the read throughput.

AnswerA

Captures only changes, reducing read impact.

Why this answer

Using DynamoDB Streams with AWS Lambda enables incremental change data capture (CDC), which eliminates the need to read the entire DynamoDB table each time. This reduces read capacity consumption and minimizes impact on production performance. Option B is incorrect because increasing read capacity units would still involve full table scans, further straining the production workload.

Option C is incorrect because exporting via the DynamoDB console is a one-time export, not an incremental solution to keep S3 data up-to-date. Option D is incorrect because reducing Glue job parallelism does not change the fact that the entire table is read, and it would increase job duration without addressing the read capacity issue.

Full explanation →

1137

Multi-Selectmedium

A data engineer is designing a near-real-time streaming pipeline to ingest clickstream data from a web application. The data must be enriched with user metadata from a DynamoDB table before being stored in S3. Which combination of AWS services should the engineer use? (Choose TWO.)

Select 2 answers

A.Amazon Kinesis Data Firehose

B.Amazon Kinesis Data Analytics for Apache Flink

C.Amazon Kinesis Data Streams

D.AWS Lambda with DynamoDB Accelerator (DAX)

E.AWS Glue Streaming ETL

AnswersB, C

Performs stream enrichment with DynamoDB lookups.

Why this answer

Amazon Kinesis Data Streams (C) provides the low-latency, durable ingestion layer for the clickstream data, while Amazon Kinesis Data Analytics for Apache Flink (B) allows you to run a Flink application that can perform stream-to-stream joins with the DynamoDB user metadata in near-real time. The enriched output can then be written to S3 via a Kinesis Data Firehose delivery stream or directly from the Flink application.

Exam trap

The trap here is that candidates often confuse Kinesis Data Firehose's ability to invoke a Lambda for simple transformations with the need for stateful stream enrichment, leading them to select Firehose alone without a stream processing engine.

Full explanation →

1138

MCQeasy

Refer to the exhibit. A security analyst is reviewing CloudTrail logs and notices a PutObject event to the 'company-data-lake' bucket. The bucket policy requires all objects to be encrypted with SSE-KMS. What should the analyst conclude?

A.The object was uploaded by the bucket owner, bypassing the policy.

B.The request succeeded because SSE-S3 is acceptable.

C.The object was encrypted with SSE-KMS as required.

D.The object was encrypted with SSE-S3, which violates the bucket policy.

AnswerD

AES256 indicates SSE-S3, not KMS.

Why this answer

The bucket policy requires all objects to be encrypted with SSE-KMS. The CloudTrail log shows a PutObject event, but the encryption context (not shown in the exhibit) would indicate the encryption method used. Since the correct answer states the object was encrypted with SSE-S3, this violates the bucket policy, which mandates SSE-KMS.

Therefore, the analyst should conclude that the request succeeded but violated the policy, as SSE-S3 does not meet the requirement.

Exam trap

AWS often tests the nuance that a bucket policy requiring SSE-KMS does not automatically deny requests using SSE-S3; the policy must include an explicit Deny effect for non-compliant encryption to block the upload, so candidates may mistakenly think a requirement alone prevents the action.

How to eliminate wrong answers

Option A is wrong because the bucket owner does not bypass bucket policies; all principals, including the owner, are subject to the policy unless explicitly exempted (which is not indicated). Option B is wrong because the bucket policy explicitly requires SSE-KMS, so SSE-S3 is not acceptable; the request would succeed only if the policy allowed it, but it does not. Option C is wrong because if the object were encrypted with SSE-KMS as required, there would be no violation, but the correct answer indicates a violation occurred, meaning SSE-KMS was not used.

Full explanation →

1139

MCQeasy

A data engineer is troubleshooting a Kinesis Data Firehose delivery stream that ingests JSON log data from web servers. The stream is configured to transform records with an AWS Lambda function and deliver to an Amazon S3 bucket. Recently, the stream has been failing with 'InvalidData' errors. Which action should the engineer take to resolve the issue?

A.Verify the S3 bucket policy allows Firehose to write.

B.Increase the buffer size and interval in the Firehose delivery stream.

C.Change the data format to CSV in the Firehose configuration.

D.Check the CloudWatch Logs for the Lambda function to identify transformation errors.

AnswerD

Lambda errors are logged in CloudWatch and can reveal why transformation fails.

Why this answer

The 'InvalidData' error in Kinesis Data Firehose typically indicates that the Lambda function used for data transformation is failing or returning malformed records. By checking the CloudWatch Logs for the Lambda function, the engineer can identify specific transformation errors, such as incorrect JSON parsing, missing fields, or exceptions, which cause Firehose to reject the records. This is the most direct troubleshooting step because Firehose relies on the Lambda function to return valid transformed data in the expected format.

Exam trap

The trap here is that candidates often confuse 'InvalidData' errors with S3 permission issues or buffer configuration problems, but the error specifically points to a failure in the data transformation step, not the delivery destination or batching settings.

How to eliminate wrong answers

Option A is wrong because if the S3 bucket policy were the issue, the error would be a permission or access denied error, not 'InvalidData'. Option B is wrong because increasing buffer size or interval would not resolve data transformation errors; it only affects how data is batched before delivery. Option C is wrong because changing the data format to CSV would not fix transformation errors; Firehose expects the Lambda function to return data in the same format as the input (JSON) unless explicitly configured otherwise, and the 'InvalidData' error is unrelated to the output format.

Full explanation →

1140

MCQeasy

A data engineer needs to troubleshoot a failed AWS Glue job that reads from an Amazon RDS for MySQL database. The error log shows 'Communications link failure'. Which step should the engineer take FIRST?

A.Increase the job timeout and retry count.

B.Check that the security group associated with the Glue job allows outbound traffic to the RDS database.

C.Verify that the database username and password are correct in the Glue connection.

D.Confirm that the table schema in MySQL matches the Glue Data Catalog.

AnswerB

Network connectivity is the most common cause of this error.

Why this answer

A 'Communications link failure' often indicates network connectivity issues; verifying that the Glue job's security group allows outbound traffic to the RDS database is the first troubleshooting step. Option A is wrong because the error is not about authentication. Option C is wrong because the issue is not about table structure.

Option D is wrong because the error is not about permissions.

Full explanation →

1141

MCQeasy

A company is using Amazon S3 to store log files. The security team wants to ensure that any object uploaded to the S3 bucket is automatically scanned for malware before being processed by downstream applications. The data engineer needs to implement a solution that integrates with AWS services and minimizes latency. The bucket receives thousands of objects per day. Which solution should the data engineer use?

A.Deploy an EC2 instance with antivirus software that triggers on S3 events.

B.Enable Amazon GuardDuty with malware protection for S3.

C.Use AWS WAF to inspect objects as they are uploaded.

D.Enable Amazon Macie on the S3 bucket to detect malware.

AnswerB

GuardDuty malware protection scans S3 objects.

Why this answer

Amazon GuardDuty has a malware protection feature that can scan S3 objects for malware upon upload. It integrates with S3 events and minimizes latency. Option A is incorrect because Amazon Macie is for sensitive data discovery, not malware.

Option C is incorrect because AWS WAF is for web application firewall, not S3 scanning. Option D is incorrect because running a custom scanning solution on EC2 adds operational overhead and latency.

Full explanation →

1142

MCQmedium

A data engineer receives the error shown in the exhibit when trying to upload a file to my-bucket. The engineer uses the AWS CLI with the following command: aws s3 cp file.txt s3://my-bucket/. What is the most likely cause of the error?

A.The KMS key specified in the command is incorrect

B.The VPC endpoint policy is blocking the request

C.The object is not encrypted with SSE-KMS

D.The bucket does not have a default encryption configuration

AnswerC

The policy requires SSE-KMS encryption header.

Why this answer

The error indicates that the upload was denied because the object is not encrypted with SSE-KMS. The bucket policy likely requires SSE-KMS for all PutObject requests, but the AWS CLI command `aws s3 cp file.txt s3://my-bucket/` does not specify the `--sse aws:kms` flag, so the object is uploaded without the required encryption header. This causes the policy condition to evaluate to false, resulting in an access denied error.

Option A is wrong because the command does not specify any KMS key; the error is about encryption header, not key validity. Option B is wrong because the error is not related to VPC endpoint policies. Option D is wrong because a default encryption configuration would automatically apply encryption, but the error suggests the upload attempted to skip encryption entirely, which is denied by the explicit policy requirement.

Full explanation →

1143

Multi-Selectmedium

A company is designing a data ingestion pipeline for real-time sensor data from thousands of devices. The data must be processed with low latency and stored in Amazon S3. Which TWO services would be appropriate for this use case? (Choose TWO.)

Select 2 answers

A.AWS Glue

B.AWS DataSync

C.Amazon Athena

D.Amazon Kinesis Data Firehose

E.Amazon Kinesis Data Streams

AnswersD, E

Firehose can deliver streaming data to S3 with buffering.

Why this answer

Amazon Kinesis Data Firehose is the correct choice because it is a fully managed service designed to ingest real-time streaming data, transform it on the fly (e.g., convert to Parquet/ORC), and deliver it directly to Amazon S3 with low latency. It handles buffering, compression, and partitioning automatically, making it ideal for the described sensor data pipeline.

Exam trap

The trap here is that candidates may choose only one streaming service, but the question requires two services, and the correct pairing is Kinesis Data Streams for real-time ingestion and Kinesis Data Firehose for delivery to S3, as Firehose alone cannot provide sub-second latency.

Full explanation →

1144

MCQmedium

A company uses Amazon S3 to store log files. The security team notices that some objects are being accessed from an unexpected AWS account. The data engineer needs to identify which specific IAM user or role is accessing the objects. Which AWS service should be used to get this information?

A.AWS Trusted Advisor

B.Amazon S3 server access logs

C.AWS CloudTrail

D.AWS Config

AnswerC

CloudTrail logs API calls and can be used to trace S3 access to specific IAM users or roles.

Why this answer

AWS CloudTrail records API calls including S3 object-level operations. It logs who made the call, from which account, and other details. S3 server access logs provide similar info but are log files themselves, not a queryable service.

Config is for resource configuration tracking. Trusted Advisor gives best practice checks.

Full explanation →

1145

Multi-Selecthard

A data engineer is designing a data ingestion pipeline that uses AWS DMS to migrate data from an on-premises Oracle database to Amazon S3 in Parquet format. The engineer needs to ensure that data is continuously replicated with minimal latency. Which THREE steps should the engineer take? (Choose three.)

Select 3 answers

A.Configure a DMS task with a transformation rule to convert to Parquet.

B.Specify an S3 bucket as the target endpoint with data format set to Parquet.

C.Use AWS Schema Conversion Tool (SCT) to convert the schema.

D.Enable change data capture (CDC) on the source database.

E.Perform a full load only, without CDC.

AnswersA, B, D

Correct. A transformation rule in the DMS task converts the data to Parquet format during migration.

Why this answer

Options A, B, and D are correct. To continuously replicate data with minimal latency from Oracle to Amazon S3 in Parquet format, the engineer should: (A) configure a DMS task with a transformation rule to convert to Parquet, (B) specify an S3 bucket as the target endpoint with data format set to Parquet, and (D) enable change data capture (CDC) on the source database. Option C (using AWS SCT) is incorrect because SCT is for schema conversion, not for DMS replication.

Option E (full load only) is incorrect because it does not provide continuous replication.

Full explanation →

1146

MCQeasy

A data engineer needs to restrict access to an Amazon S3 bucket so that only objects encrypted with a specific AWS KMS key can be uploaded. Which S3 bucket policy condition should be used?

A.s3:x-amz-server-side-encryption-aws-kms-key-id

B.kms:ViaService

C.s3:x-amz-server-side-encryption

D.kms:EncryptionContext

AnswerA

This condition key allows you to specify a required KMS key ID for server-side encryption.

Why this answer

The correct condition is s3:x-amz-server-side-encryption-aws-kms-key-id (option A). This condition key allows you to require that objects uploaded to the S3 bucket are encrypted with a specific AWS KMS key by checking the key ID used in the encryption header. Option B (kms:ViaService) restricts KMS key usage to specific AWS services but does not enforce a key ID on S3 objects.

Option C (s3:x-amz-server-side-encryption) only checks whether server-side encryption is enabled, not the specific key. Option D (kms:EncryptionContext) is used to enforce encryption context, not the key ID.

Full explanation →

1147

MCQhard

Refer to the exhibit. A data engineer runs the AWS CLI command shown to encrypt a file using AWS KMS. The command succeeds. Later, the engineer tries to decrypt the file using the same key but without providing an encryption context. The decryption fails. What is the most likely reason?

A.The KMS key policy does not allow decryption.

B.The KMS key has been disabled.

C.The plaintext file was corrupted.

D.The encryption context must be provided during decryption.

AnswerD

KMS uses encryption context as AAD; it must match exactly.

Why this answer

When encrypting data with AWS KMS, an encryption context can be provided as additional authenticated data (AAD). This context must be supplied during decryption; otherwise, decryption fails. The command succeeded during encryption, so the key is not disabled (B is wrong) and the key policy is not the issue (A is wrong).

File corruption would cause a different error (C is wrong).

Full explanation →

1148

MCQeasy

A data engineer needs to troubleshoot why an AWS Glue job is failing with a 'Insufficient Memory' error. The job processes a 10 GB dataset. Which step should the engineer take FIRST?

A.Switch from using Apache Spark to Python shell.

B.Repartition the data into more partitions within the job.

C.Change the job type from Python to Java.

D.Increase the number of DPUs allocated to the job.

AnswerD

More DPUs provide more memory and compute resources.

Why this answer

The correct first step is to increase the number of DPUs allocated to the job. The 'Insufficient Memory' error indicates that the current memory per worker is insufficient for processing the 10 GB dataset. Increasing DPUs provides more memory and compute resources, directly addressing the issue.

Option A is incorrect because Python shell jobs are single-threaded and cannot handle large datasets efficiently; Glue Spark jobs are designed for distributed processing. Option B (repartitioning) can improve performance but does not add memory; it may help after resource allocation is adequate. Option C is invalid because AWS Glue does not support Java jobs; it supports Python and Scala.

Full explanation →

1149

Multi-Selecteasy

A company wants to ensure that an IAM user can only launch Amazon EC2 instances of a specific instance type. Which THREE IAM policy elements are required to define this permission? (Choose THREE.)

Select 3 answers

A.Action

B.Principal

C.Effect

D.Resource

E.Condition

AnswersA, C, D

Correct: The Action element specifies which AWS service actions are allowed or denied (e.g., ec2:RunInstances).

Why this answer

To define a permission in an IAM policy, the required elements are Effect (allow/deny), Action (e.g., ec2:RunInstances), and Resource (e.g., '*'). While a Condition can further restrict the permission (e.g., to a specific instance type), it is not mandatory. Therefore, the three required elements are Effect, Action, and Resource.

Full explanation →

1150

MCQhard

A data engineer is designing a system to handle sensitive customer data in Amazon RDS for PostgreSQL. The compliance team requires that the data be encrypted at rest and that encryption keys be rotated every 90 days. Which solution meets these requirements?

A.Use AWS CloudHSM to store the encryption key and create a custom key rotation Lambda function

B.Enable RDS encryption with a customer managed KMS key, enable automatic key rotation, and manually rotate the key every 90 days

C.Enable Transparent Data Encryption (TDE) on the RDS instance

D.Enable RDS encryption with a customer managed KMS key and enable automatic key rotation

AnswerB

Manual rotation every 90 days satisfies the requirement.

Why this answer

Amazon RDS for PostgreSQL encryption at rest uses AWS KMS with customer managed keys. Automatic key rotation in KMS rotates the key annually, but the requirement is every 90 days. Therefore, manual key rotation must be performed every 90 days in addition to enabling automatic key rotation.

Option A is incorrect because AWS CloudHSM is not directly integrated with RDS for encryption at rest; RDS encryption uses KMS. Option C is incorrect because Transparent Data Encryption (TDE) is not supported for Amazon RDS PostgreSQL; RDS uses KMS for encryption. Option D is incorrect because KMS automatic key rotation alone rotates keys only once per year, not every 90 days as required.

Full explanation →

1151

MCQmedium

A data engineer needs to design a data ingestion pipeline that ingests CSV files from an Amazon S3 bucket, transforms the data by adding a timestamp column, and loads it into an Amazon Redshift table. The pipeline should run automatically whenever a new file is uploaded to the S3 bucket. Which AWS service should be used to trigger the transformation?

A.AWS Lambda

B.AWS Step Functions

C.Amazon EventBridge

D.Amazon Simple Queue Service (SQS)

AnswerA

Lambda can be triggered directly by S3 events.

Why this answer

Amazon S3 can be configured to send events directly to AWS Lambda when a new CSV file is uploaded. Lambda then executes the transformation (adding a timestamp column) and loads the data into Redshift. Option B (Step Functions) is not triggered directly by S3 events without an intermediate service like Lambda.

Option C (EventBridge) can route S3 events to Lambda, but a direct S3 event notification to Lambda is simpler and more common; however, the key point is that Lambda is the direct trigger. Option D (SQS) requires a separate process to poll the queue and invoke Lambda; it is not a direct trigger.

Full explanation →

1152

MCQhard

A company needs to transfer 50 TB of historical data from an on-premises HDFS cluster to Amazon S3. The network bandwidth is limited to 1 Gbps, and the transfer must complete within 10 days. The data is compressible. Which solution is MOST appropriate?

A.Use AWS DataSync over a Direct Connect connection.

B.Use Amazon S3 Transfer Acceleration with multipart uploads.

C.Use multiple parallel AWS CLI sync commands over the internet.

D.Use AWS Snowball Edge to physically ship the data.

AnswerA

DataSync can saturate 1 Gbps, but 50 TB at 1 Gbps takes ~111 hours, plus overhead may exceed 10 days.

Why this answer

With a 1 Gbps link, transferring 50 TB would take approximately 111 hours (about 4.6 days) theoretically, well within the 10-day window. AWS DataSync over a Direct Connect connection provides a high-speed, secure, and reliable method to transfer large datasets online. DataSync automates the HDFS-to-S3 transfer, handles compression, and can saturate the 1 Gbps link, making it the most appropriate solution.

Snowball Edge involves physical shipment and logistics, which would likely exceed the 10-day deadline. Options B and C also rely on internet bandwidth and are less efficient than DataSync.

Full explanation →

1153

MCQmedium

A data engineering team is designing a data lake on Amazon S3 with a folder structure that separates raw, transformed, and curated data. The team needs to implement lifecycle policies to minimize storage costs while ensuring that data in the 'raw' zone is retained for 90 days before being moved to Amazon S3 Glacier Deep Archive. Additionally, data in the 'curated' zone should be deleted after 365 days. What is the MOST cost-effective way to achieve these requirements?

A.Configure S3 Intelligent-Tiering on both prefixes with automatic archiving to Glacier Deep Archive after 90 days in raw and deletion after 365 days in curated.

B.Create separate lifecycle policies for each prefix: one to transition raw to S3 Glacier Deep Archive after 90 days, another to delete curated after 365 days.

C.Create a lifecycle policy that transitions raw zone data to S3 Standard-IA after 90 days and deletes curated zone data after 365 days.

D.Create a single lifecycle policy with two rules: one to transition raw zone objects to S3 Glacier Deep Archive after 90 days, and another to delete curated zone objects after 365 days.

AnswerD

This meets cost and retention requirements efficiently.

Why this answer

A single S3 lifecycle policy can contain multiple rules, each applying to different prefixes. This allows you to transition raw zone objects to S3 Glacier Deep Archive after 90 days and delete curated zone objects after 365 days, minimizing storage costs without needing separate policies. S3 lifecycle policies are evaluated per object based on creation date, and using one policy reduces management overhead.

Exam trap

The trap here is that candidates might think separate lifecycle policies are required for different prefixes, but AWS allows multiple rules within a single policy, making it more cost-effective and easier to manage than creating separate policies.

How to eliminate wrong answers

Option A is wrong because S3 Intelligent-Tiering does not support automatic archiving to Glacier Deep Archive after a fixed number of days; it moves objects between access tiers based on usage patterns, not a scheduled transition, and it cannot enforce deletion after a specific period. Option B is wrong because while separate lifecycle policies can achieve the requirements, they are not the most cost-effective or efficient approach; a single policy with multiple rules is simpler and avoids potential policy conflicts or duplication of management. Option C is wrong because transitioning raw zone data to S3 Standard-IA after 90 days does not meet the requirement to move it to Glacier Deep Archive, which is the lowest-cost storage class for long-term archival; Standard-IA is more expensive than Glacier Deep Archive for data that is rarely accessed.

Full explanation →

1154

MCQhard

A company uses AWS Lake Formation to manage permissions on a data lake. A data engineer creates a table in the Data Catalog and grants SELECT permission to a group of analysts. The analysts report they can see the table but get an AccessDenied error when querying it with Amazon Athena. What is the most likely cause?

A.The analysts' IAM role does not have permission to call the Athena API.

B.The table is not registered with Lake Formation as a resource.

C.The Athena workgroup is configured with a per-query result location that the analysts cannot write to.

D.The S3 bucket policy does not allow the analysts' IAM role.

AnswerA

Lake Formation grants database permissions, but IAM must allow Athena actions.

Why this answer

The analysts can see the table in the Data Catalog but receive an AccessDenied error when querying with Athena. This indicates that Lake Formation has granted SELECT permission on the table, so the table is visible and the permission exists. The error occurs when Athena attempts to run the query, meaning the IAM role used by Athena (which is the analysts' role or a service role) lacks permission to call the Athena API (e.g., StartQueryExecution, GetQueryResults).

Lake Formation permissions cover Data Catalog and S3 access, but do not grant IAM permissions for Athena itself. Therefore, Option A is the most likely cause. Option B is incorrect because the table is visible, so it is registered.

Option C is incorrect because the workgroup result location issue would produce a different error (e.g., insufficient permissions on S3). Option D is incorrect because Lake Formation manages S3 access via registered locations, and if the table is registered, the bucket policy is overridden by Lake Formation permissions.

Full explanation →

1155

MCQmedium

Refer to the exhibit. A data engineer runs two queries on an Athena table partitioned by 'ds'. Both queries scan the same amount of data. What does this indicate?

A.The partition column is not being used as a filter

B.The table does not have any partitions defined

C.The table is not partitioned

D.Partition pruning is working correctly

AnswerA

The filter on ds is not being pushed down, possibly due to data type mismatch.

Why this answer

If both queries scan the same amount of data despite being on a partitioned table, it indicates that the partition column 'ds' is not being used as a filter in the queries, so partition pruning is not applied and all partitions are scanned. Option A is correct because the partition column is not used as a filter. Option B is incorrect because the table does have partitions defined (it is partitioned by 'ds').

Option C is incorrect because the table is partitioned. Option D is incorrect because partition pruning is not working correctly; if it were, the amount of data scanned would differ based on the filter.

Full explanation →

1156

MCQhard

The exhibit shows an IAM policy attached to a role used by an AWS Glue ETL job. The job reads from an S3 bucket and writes to another S3 bucket. However, the job fails with an access denied error when trying to write to the output bucket. What is the most likely cause?

A.The policy is missing permissions for AWS KMS to decrypt/encrypt objects

B.The policy does not allow glue:StartJobRun on the specific job

C.The policy only allows PutObject on the my-data-lake bucket, but the job writes to a different bucket

D.The policy does not include s3:ListBucket permission

AnswerC

The S3 permissions are scoped to my-data-lake/*; if output bucket is different, access is denied.

Why this answer

The policy allows s3:PutObject on my-data-lake/*, but if the output bucket is different (e.g., my-output-bucket), the policy does not cover it. The error is due to missing permissions on the output bucket. The Glue service role may not have permissions to write to the output bucket.

The policy does not restrict resource to only one bucket, but the ARN specifies my-data-lake. The job might be trying to write to a different bucket. There is no issue with Glue actions.

Full explanation →

1157

Multi-Selecteasy

A company is using AWS Glue to catalog data in Amazon S3. The data is in CSV format with varying schemas. The Data Engineering team wants to ensure the Glue Data Catalog is updated automatically when new partitions are added to S3. Which TWO actions should be taken? (Choose two.)

Select 2 answers

A.Enable partition indexing on the Glue Data Catalog.

B.Set up an S3 event notification to trigger a Lambda function that updates the Glue Data Catalog.

C.Configure a scheduled AWS Glue crawler to run on a regular basis.

D.Run Amazon Athena queries with MSCK REPAIR TABLE to add partitions.

E.Use AWS Glue ETL jobs to write data and update the catalog simultaneously.

AnswersA, C

Partition indexing enables automatic updates and efficient querying of new partitions.

Why this answer

A is correct because enabling partition indexing in the Glue Data Catalog allows partition pruning and automatic updates. C is correct because configuring a Glue crawler with a schedule will automatically discover new partitions. B is wrong because setting up an S3 event notification to trigger Lambda for manual updates is not as efficient as crawler scheduling.

D is wrong because using AWS Glue ETL jobs to update the catalog is not automatic. E is wrong because Amazon Athena does not update the catalog.

Full explanation →

1158

MCQmedium

Refer to the exhibit. A data engineer applies this S3 bucket policy to an S3 bucket. What is the effect of this policy?

A.Allows access only from specific IP addresses.

B.Allows only HTTPS requests to get and put objects, and denies HTTP requests.

C.Allows only GetObject actions over HTTPS.

D.Allows anonymous access to get and put objects over HTTP.

AnswerB

The condition enforces secure transport.

Why this answer

The bucket policy allows GetObject and PutObject actions only when the request uses HTTPS, and explicitly denies all S3 actions when the request uses HTTP due to the condition `aws:SecureTransport=false`. Therefore, only HTTPS requests for Get and Put are permitted. Option A is incorrect because the policy does not restrict by IP addresses.

Option C is incorrect because both Get and Put are allowed over HTTPS, not just Get. Option D is incorrect because the policy does not grant anonymous access; it requires secure transport and does not allow HTTP.

Full explanation →

1159

MCQeasy

A company needs to ingest data from a self-managed Apache Kafka cluster running on EC2 into Amazon S3. The data must be delivered in near real-time. Which AWS service is BEST suited for this task?

A.Use Amazon MSK to replicate the Kafka cluster and then use a connector to S3.

B.Use Amazon S3 Transfer Acceleration to speed up the transfer from Kafka brokers to S3.

C.Use Amazon Kinesis Data Streams as an intermediary to buffer data before writing to S3.

D.Use an AWS Glue streaming ETL job that reads from the Kafka cluster and writes to S3.

AnswerD

Glue supports streaming from Kafka and can write to S3.

Why this answer

AWS Glue streaming ETL jobs can connect directly to an Apache Kafka cluster (including self-managed) as a source and write data to Amazon S3 in near real-time, making it a fully managed and suitable solution. Option A (Amazon MSK) is a managed Kafka service but does not directly ingest into S3; Option B (S3 Transfer Acceleration) only accelerates uploads, not ingestion; Option C (Kinesis Data Streams) adds unnecessary complexity as an intermediary.

Full explanation →

1160

MCQhard

A company runs an AWS Glue ETL job that reads data from Amazon S3, transforms it, and writes back to S3 in a different partition structure. The job uses the 'spark.sql.shuffle.partitions' option set to 200. After the job completes, the output has many small files. The data engineer wants to minimize the number of output files while maintaining job performance. Which action should the engineer take?

A.Use 'coalesce(n)' with n based on target file size (e.g., 128 MB) before writing.

B.Enable S3 multipart upload for the Glue job.

C.Increase the 'spark.sql.shuffle.partitions' to 500.

D.Reduce the 'spark.sql.shuffle.partitions' to 50.

AnswerA

Coalesce reduces partitions without a full shuffle, minimizing files.

Why this answer

'coalesce(n)' reduces the number of partitions without triggering a full shuffle, allowing you to control the number of output files based on a target file size (e.g., 128 MB). This minimizes small files while preserving job performance, as coalesce is a narrow transformation that avoids the overhead of a shuffle. In contrast, 'repartition(n)' would cause a full shuffle, degrading performance.

Exam trap

The trap here is that candidates often confuse 'coalesce' with 'repartition' or assume that adjusting 'spark.sql.shuffle.partitions' directly controls output file count, when in fact it only controls the number of partitions during shuffle operations, not the final write partition count.

How to eliminate wrong answers

Option B is wrong because enabling S3 multipart upload does not reduce the number of output files; it only improves upload reliability and throughput for large objects, but the job still writes the same number of small files. Option C is wrong because increasing 'spark.sql.shuffle.partitions' to 500 would increase the number of shuffle partitions, leading to even more small output files and potentially worse performance due to higher task overhead. Option D is wrong because reducing 'spark.sql.shuffle.partitions' to 50 would reduce the number of shuffle partitions, but it does not directly control the number of output files written; it may cause data skew and memory pressure, and the output file count still depends on the final partition count, which may remain high if the job uses repartition or other transformations.

Full explanation →

1161

MCQhard

A company uses Amazon Kinesis Data Streams to ingest clickstream data. The data is consumed by an AWS Lambda function that processes each record and writes to an Amazon DynamoDB table. Recently, the Lambda function has been failing with 'ProvisionedThroughputExceededException' from DynamoDB. The Lambda function uses the AWS SDK to batch write items in batches of 25. The DynamoDB table has on-demand capacity mode. The stream has 10 shards, and the Lambda function is configured with a batch size of 100 and 5 concurrent invocations per shard. What step should the team take to resolve the issue?

A.Switch the DynamoDB table from on-demand to provisioned capacity with a high write capacity unit (WCU) value.

B.Reduce the Lambda batch size to 25 and implement exponential backoff with jitter in the Lambda code.

C.Increase the number of Kinesis shards to 20 to reduce the load per shard.

D.Increase the Lambda function's reserved concurrency to allow more parallel executions.

AnswerB

Reducing batch size and adding exponential backoff directly reduces the write rate and adds retry logic, mitigating throttling. This is the best approach.

Why this answer

The issue is DynamoDB throttling due to high write traffic from Lambda. The DynamoDB table is on-demand, which can throttle if bursts exceed sustained limits. Reducing the Lambda batch size from 100 to 25 decreases the number of records processed per invocation, lowering the instantaneous write rate.

Implementing exponential backoff with jitter in the Lambda code allows retries on throttled requests, making the system more resilient. Option A is not required because on-demand mode automatically scales, and switching to provisioned can be costly. Option C is incorrect because increasing shards would increase parallelism and worsen throttling.

Option D is incorrect because increasing concurrency would also increase write pressure on DynamoDB.

Full explanation →

1162

Multi-Selecthard

A data engineer is troubleshooting an AWS Glue job that reads from Amazon RDS MySQL and writes to Amazon S3. The job runs successfully but takes longer than expected. The engineer wants to optimize performance. Which THREE actions would improve job performance?

Select 3 answers

A.Increase the number of DPUs allocated to the Glue job.

B.Use a single JDBC connection per partition.

C.Increase the JDBC fetch size parameter.

D.Convert the output format from Parquet to CSV.

E.Use a pushdown predicate to filter data at the source.

AnswersA, C, E

More DPUs provide more parallelism.

Why this answer

Increasing the number of DPUs (Data Processing Units) allocated to the AWS Glue job provides more parallel processing capacity, allowing the job to process data faster. This is a direct way to improve performance when the job is CPU or memory-bound, as Glue distributes the workload across the allocated DPUs.

Exam trap

The trap here is that candidates might think converting to CSV improves performance due to simplicity, but in reality, Parquet's columnar storage and compression provide significant performance benefits for analytics workloads on S3.

Full explanation →

1163

MCQhard

A company is using Amazon Kinesis Data Firehose to deliver streaming data to an S3 bucket. The data includes a timestamp field. They want to partition the S3 objects by hour dynamically. The Firehose delivery stream is configured with a prefix like 'year=!{timestamp:yyyy}/month=!{timestamp:MM}/day=!{timestamp:dd}/hour=!{timestamp:HH}/'. However, the objects are not being partitioned as expected; all files end up in a single partition. What is the MOST likely cause?

A.Dynamic partitioning is not enabled in the Firehose delivery stream configuration.

B.The buffer size is set too large, delaying file delivery.

C.The timestamp is in UTC but the prefix uses local time.

D.The IAM role for Firehose lacks permissions to write to S3 with dynamic prefixes.

AnswerA

Without enabling dynamic partitioning, the prefix is static and all data goes into one S3 prefix.

Why this answer

Amazon Kinesis Data Firehose requires dynamic partitioning to be explicitly enabled in the delivery stream configuration in order to use custom partitioning keys and create partition prefixes dynamically. Without enabling dynamic partitioning, the timestamp expressions in the prefix are treated as static strings, resulting in a single partition. Option B is incorrect because buffer size affects delivery frequency, not partitioning behavior; even with large buffers, partitioning would still occur if dynamic partitioning were enabled.

Option C is incorrect because time zone differences would cause incorrect hours, not a single partition; all files would still be distributed across hours. Option D is incorrect because IAM permission issues would cause write failures, not mispartitioning; the objects would simply not be delivered.

Full explanation →

1164

Multi-Selectmedium

Which TWO AWS services can be used to ingest streaming data from a mobile application into Amazon S3 for near-real-time analytics? (Choose 2.)

Select 2 answers

A.Amazon Kinesis Data Firehose

B.Amazon Kinesis Data Streams

C.Amazon DynamoDB Streams

D.AWS Glue

E.Amazon SQS

AnswersA, B

Firehose can ingest streaming data and deliver to S3 near real-time.

Why this answer

Amazon Kinesis Data Firehose is the correct choice because it is a fully managed service designed to load streaming data directly into Amazon S3, Redshift, Elasticsearch, or Splunk without requiring custom code. It can capture and transform streaming data from mobile applications in near-real-time and automatically deliver it to S3, making it ideal for near-real-time analytics pipelines.

Exam trap

The DEA-C01 exam often tests the distinction between managed ingestion (Firehose) and raw stream processing (Data Streams), and the trap here is that candidates may incorrectly choose DynamoDB Streams or SQS because they associate 'streaming' with any service containing 'stream' or 'queue', without understanding that DynamoDB Streams only captures internal table changes and SQS requires custom code to write to S3.

Full explanation →

1165

MCQeasy

A data engineer is designing a data store for a real-time analytics application that requires sub-millisecond read and write latency. The data is key-value in nature and the workload is both read-heavy and write-heavy. Which AWS service is most suitable?

A.Amazon ElastiCache for Redis

B.Amazon DynamoDB

C.Amazon RDS for MySQL

D.Amazon S3

AnswerB

DynamoDB offers consistent single-digit millisecond latency at scale.

Why this answer

Amazon DynamoDB is the most suitable service because it is a fully managed NoSQL key-value and document database designed for single-digit millisecond latency at any scale, and with features like DynamoDB Accelerator (DAX) it can achieve sub-millisecond read latency. It supports both read-heavy and write-heavy workloads through its distributed architecture and auto-scaling capabilities, making it ideal for real-time analytics applications.

Exam trap

The trap here is that candidates often choose ElastiCache for Redis because of its sub-millisecond performance, overlooking that the question specifies a 'data store' for a write-heavy workload, which requires durability and persistence that Redis does not guarantee by default, whereas DynamoDB is a fully managed, durable database designed for such use cases.

How to eliminate wrong answers

Option A (Amazon ElastiCache for Redis) is wrong because while Redis provides sub-millisecond latency, it is an in-memory data store primarily designed for caching and not as a durable primary data store; data persistence is optional and can lead to data loss if not configured correctly, making it unsuitable for a write-heavy workload requiring durability. Option C (Amazon RDS for MySQL) is wrong because it is a relational database that incurs higher latency due to disk I/O and SQL query overhead, and it cannot consistently achieve sub-millisecond read and write latency for key-value workloads. Option D (Amazon S3) is wrong because it is an object storage service with eventual consistency for overwrite PUTS and DELETE operations, and its latency is typically in the tens to hundreds of milliseconds, far exceeding the sub-millisecond requirement.

Full explanation →

1166

MCQeasy

An organization uses AWS Lake Formation to manage a data lake in S3. A new data engineer needs to create a Glue ETL job that reads from a Lake Formation-managed table. The engineer has been granted SELECT permission on the table via Lake Formation. However, the job fails with an AccessDenied error. What is the MOST likely cause?

A.The IAM role used by the Glue job does not have Lake Formation permissions.

B.The S3 bucket policy does not allow the Glue job to access the data.

C.The table has not been registered with Lake Formation.

D.The Glue job is not running in the same VPC as Lake Formation.

AnswerA

Correct. The IAM role must have Lake Formation permissions to access the table.

Why this answer

The IAM role used by the Glue job must have Lake Formation permissions (such as lakeformation:GetDataAccess) to access the table. Without these permissions, the job will fail with an AccessDenied error even if the S3 bucket policy allows access. Option B is incorrect: S3 bucket policies are not the primary issue because Lake Formation manages fine-grained access; the role must have Lake Formation permissions.

Option C is incorrect: the table is already registered with Lake Formation if it is a Lake Formation-managed table; registration is a prerequisite for granting permissions. Option D is incorrect: Lake Formation does not require a specific VPC; Glue jobs can access Lake Formation over the internet or via a VPC endpoint, but that is not the cause of the AccessDenied error.

Full explanation →

1167

Multi-Selecthard

A company is using Amazon Kinesis Data Streams to ingest real-time clickstream data. The data must be stored in Amazon S3 in near real-time with minimal overhead. Which THREE steps should the data engineer take to achieve this? (Choose THREE.)

Select 3 answers

A.Configure a Lambda function to transform data before delivery to S3.

B.Create a Kinesis Data Firehose delivery stream that delivers data to S3.

C.Use Kinesis Data Analytics to process and store data in S3.

D.Enable S3 cross-region replication for the destination bucket.

E.Enable S3 compression (e.g., GZIP) in Firehose.

AnswersA, B, E

Why this answer

A Lambda function can be used as a data transformation step within a Kinesis Data Firehose delivery stream. This allows the clickstream data to be transformed (e.g., parsed, enriched, or reformatted) before being delivered to Amazon S3, enabling near real-time storage with minimal operational overhead.

Exam trap

The trap here is that candidates may confuse Kinesis Data Analytics with a storage service or think that cross-region replication is needed for near real-time ingestion, when in fact Firehose with Lambda transformation and compression is the correct, minimal-overhead solution.

Full explanation →

1168

MCQhard

A data engineer runs an AWS Glue Crawler that updates a table in the AWS Glue Data Catalog. The table is used by Amazon Athena queries. After the crawler runs, some queries start failing with the error 'HIVE_CANNOT_OPEN_SPLIT'. What is the most likely cause?

A.The crawler updated the schema and the partition metadata is inconsistent with the actual data.

B.The crawler does not have IAM permissions to read the S3 location.

C.The crawler created too many partitions, exceeding the Athena limit.

D.There are concurrent queries accessing the same table.

AnswerA

Schema changes can cause split errors.

Why this answer

The error 'HIVE_CANNOT_OPEN_SPLIT' occurs when Athena attempts to read a partition but the metadata in the Glue Data Catalog does not match the actual data in S3. This is commonly caused by running an AWS Glue Crawler that updates the schema of a table (e.g., adding, removing, or changing column types) without updating the partition metadata accordingly. The crawler may update the table schema but leave existing partition metadata unchanged, leading to a mismatch.

Option A correctly identifies this cause. Option B is incorrect because a permissions issue would result in an access denied error, not a split error. Option C is incorrect because while Athena has a limit on the number of partitions per table (currently 20,000), this limit would cause a different error or query failure, not 'HIVE_CANNOT_OPEN_SPLIT'.

Option D is incorrect because concurrent queries can cause throttling or other issues but not this specific split error.

Full explanation →

1169

Multi-Selecteasy

A data engineer is troubleshooting an Amazon EMR cluster that has been running for several days. The cluster uses Amazon S3 as the data source and HDFS for intermediate storage. The engineer notices that some tasks fail with 'Java heap space' errors. Which TWO actions should the engineer take to resolve this issue?

Select 2 answers

A.Enable EMRFS consistent view for S3.

B.Increase the number of containers per node.

C.Increase the maximum Java heap size for the task nodes (mapreduce.map.java.opts).

D.Increase the YARN memory overhead parameter (yarn.nodemanager.resource.memory-mb).

E.Decrease the YARN container size.

AnswersC, D

Increasing the maximum Java heap size for task nodes (mapreduce.map.java.opts) gives each task more memory, directly addressing the 'Java heap space' errors.

Why this answer

Options C and D are correct. Increasing the maximum Java heap size (mapreduce.map.java.opts) gives each task more memory to avoid heap space errors. Increasing YARN memory overhead (yarn.nodemanager.resource.memory-mb) allows containers to request more memory from YARN.

Option A is incorrect because EMRFS consistent view addresses S3 consistency, not memory. Option B is incorrect because increasing the number of containers per node without increasing total memory reduces memory per container, worsening heap issues. Option E is incorrect because decreasing YARN container size reduces available memory, counterproductive for out-of-memory errors.

Full explanation →

1170

MCQeasy

A company stores time-series sensor data in Amazon S3. They need to query the data using SQL with minimal latency and no infrastructure management. Which service should they use?

A.Amazon Kinesis Data Analytics

B.Amazon Athena

C.Amazon Redshift

D.Amazon DynamoDB

AnswerB

Athena is serverless and directly queries S3 using SQL.

Why this answer

Amazon Athena is the correct choice because it is a serverless interactive query service that allows you to analyze data directly in Amazon S3 using standard SQL without any infrastructure to manage. It is optimized for querying structured, semi-structured, and unstructured data stored in S3, making it ideal for time-series sensor data with minimal latency requirements.

Exam trap

The trap here is that candidates often confuse Amazon Athena with Amazon Redshift Spectrum, but the question explicitly requires 'no infrastructure management,' which eliminates Redshift; also, Kinesis Data Analytics is mistakenly chosen by those who think it can query static S3 data, but it is strictly for real-time streams.

How to eliminate wrong answers

Option A is wrong because Amazon Kinesis Data Analytics is designed for real-time stream processing using SQL or Apache Flink, not for querying static data already stored in S3; it requires a streaming data source and incurs ongoing processing costs. Option C is wrong because Amazon Redshift is a fully managed data warehouse that requires provisioning and managing clusters, which contradicts the 'no infrastructure management' requirement; it is also overkill for simple SQL queries on S3 data and incurs higher costs for idle compute. Option D is wrong because Amazon DynamoDB is a NoSQL key-value and document database, not designed for SQL queries on S3 data; it requires data to be loaded into tables and does not support direct querying of S3 objects.

Full explanation →

1171

Multi-Selecthard

A company is using Amazon Kinesis Data Analytics (now part of Amazon Managed Service for Apache Flink) for streaming data processing. The application is experiencing high latency and the data engineer wants to improve performance. Which THREE actions should the engineer consider? (Choose three.)

Select 3 answers

A.Use a larger Kinesis data stream with more shards.

B.Decrease the buffer time in the Flink application to reduce latency.

C.Increase the Flink parallelism parameter in the application configuration.

D.Increase the Parallelism of the Flink application.

E.Decrease the checkpoint interval to reduce state size.

AnswersA, C, D

More shards provide higher throughput.

Why this answer

Options A, C, and D are correct. Increasing the number of shards in the Kinesis stream (A) increases the ingestion capacity, which can reduce bottlenecks and lower latency. Increasing Flink parallelism (C and D) allows more parallel processing of data, improving throughput and reducing latency.

Option B is incorrect because decreasing the buffer time in Flink can lead to increased network overhead and may not improve overall performance; it can actually increase latency due to more frequent data transfers. Option E is incorrect because decreasing the checkpoint interval increases the frequency of state snapshots, adding overhead and potentially increasing latency rather than reducing it.

Full explanation →

1172

MCQhard

A data pipeline uses AWS Lambda to process records from an Amazon Kinesis Data Stream. The Lambda function is idempotent and runs once per record. Recently, the function started failing with 'ProvisionedThroughputExceededException' when writing to a DynamoDB table. Which action should the data engineer take to resolve this?

A.Decrease the Lambda function's batch size to process fewer records per invocation.

B.Increase the Lambda function's reserved concurrency.

C.Implement retry logic with exponential backoff in the Lambda function.

D.Increase the number of shards in the Kinesis stream.

AnswerC

Exponential backoff reduces the write rate when throttled, eventually succeeding.

Why this answer

Implementing retry logic with exponential backoff allows the Lambda function to handle transient 'ProvisionedThroughputExceededException' errors by retrying write operations with increasing delays, which reduces the load on DynamoDB and gives the table capacity to recover. Since the function is idempotent, retries are safe. Option A is incorrect: decreasing the batch size reduces the number of records per invocation but does not directly address DynamoDB throttling; it may even increase the number of concurrent invocations, potentially worsening the issue.

Option B is incorrect: increasing reserved concurrency allows more Lambda functions to run concurrently, which would increase the write rate to DynamoDB, exacerbating throttling. Option D is incorrect: increasing Kinesis shards increases the stream's ingestion capacity but does not affect DynamoDB's throughput limits; the bottleneck is at the DynamoDB table, not the stream.

Full explanation →

1173

MCQeasy

A data engineer needs to store semi-structured JSON transaction logs for analytics. The logs are written once and rarely accessed. The storage must be cost-effective. Which AWS service should be used?

A.Amazon S3

B.Amazon DynamoDB

C.Amazon RDS

D.Amazon Redshift

AnswerA

S3 is cost-effective for infrequently accessed semi-structured data.

Why this answer

Amazon S3 is the correct choice because it provides highly durable, cost-effective object storage ideal for semi-structured JSON transaction logs that are written once and rarely accessed. S3's lifecycle policies can automatically transition such infrequently accessed data to S3 Glacier or S3 Glacier Deep Archive for even lower storage costs, making it the most economical option for this use case.

Exam trap

The trap here is that candidates may choose DynamoDB or Redshift because they support JSON natively, but they overlook the core requirement of cost-effective storage for rarely accessed data, which is best met by S3's low-cost object storage and lifecycle management features.

How to eliminate wrong answers

Option B (Amazon DynamoDB) is wrong because it is a NoSQL key-value and document database optimized for low-latency, high-throughput read/write operations, not for cost-effective archival storage of rarely accessed logs; storing large volumes of infrequently accessed JSON logs in DynamoDB would incur significant costs for provisioned throughput and storage. Option C (Amazon RDS) is wrong because it is a relational database service designed for transactional workloads with structured data and frequent queries, not for storing semi-structured JSON logs at low cost; it would require schema management and incur higher per-GB storage costs compared to S3. Option D (Amazon Redshift) is wrong because it is a petabyte-scale data warehouse optimized for complex analytical queries on structured and semi-structured data, not for simple, cost-effective archival storage; using Redshift for rarely accessed logs would be over-provisioned and expensive due to its compute and storage costs.

Full explanation →

1174

Multi-Selecteasy

Which THREE are valid Amazon Redshift distribution styles? (Choose 3.)

Select 3 answers

A.HASH

B.ALL

C.AUTO

D.RANDOM

E.KEY

AnswersB, C, E

ALL is a valid distribution style; it replicates the entire table to every node.

Why this answer

All three distribution styles—ALL, AUTO, and KEY—are valid in Amazon Redshift. AUTO lets Redshift choose the distribution style based on table size and query patterns, ALL copies the entire table to every node for small dimension tables, and KEY distributes rows based on a specified column. The options HASH and RANDOM are not valid distribution styles.

Exam trap

The trap is that candidates may think AUTO is not a valid style because it’s newer, but it is a first-class distribution style in Amazon Redshift.

Full explanation →

1175

MCQmedium

A data engineer is designing a data lake on Amazon S3. The data is ingested from multiple sources in Parquet format, and the schema evolves over time. Which approach allows querying the data with Amazon Athena while supporting schema evolution?

A.Use AWS Glue Data Catalog with crawlers to automatically update the table schema.

B.Define Hive-style partitions in Athena and manually update the schema.

C.Use S3 Select to query the data directly without a schema.

D.Use Amazon Redshift Spectrum with external tables and update the schema manually.

AnswerA

Crawlers can detect schema changes and update the Data Catalog, which Athena uses.

Why this answer

AWS Glue Data Catalog with crawlers automatically infers and updates the table schema as new Parquet files with evolving schemas are ingested into S3. This allows Athena to query the data using the latest schema without manual intervention, making it the ideal solution for schema evolution in a data lake.

Exam trap

The trap here is that candidates may think S3 Select or Redshift Spectrum can handle schema evolution automatically, but they lack the schema inference and versioning capabilities that AWS Glue Data Catalog provides for Athena.

How to eliminate wrong answers

Option B is wrong because manually updating the schema in Athena is error-prone and does not scale with frequent schema changes; Hive-style partitions alone do not handle schema evolution. Option C is wrong because S3 Select operates on individual objects and returns data in CSV/JSON format, not Parquet, and it does not support schema evolution or table-level queries across multiple files. Option D is wrong because Redshift Spectrum requires manual schema updates for external tables and is not designed for automatic schema evolution like AWS Glue Data Catalog.

Full explanation →

1176

MCQeasy

A company needs to centralize audit logs from multiple AWS accounts into a single S3 bucket. Which service should be used to aggregate these logs?

A.AWS Config

B.Amazon Kinesis Data Firehose

C.AWS CloudTrail

D.Amazon CloudWatch Logs

AnswerC

CloudTrail supports multi-account trail that aggregates logs into a single S3 bucket.

Why this answer

AWS CloudTrail can be configured to deliver logs from multiple accounts to a single S3 bucket using a trail in the management account. Option C is correct.

Full explanation →

1177

MCQhard

A company runs an Apache Spark job on Amazon EMR that writes output to an S3 bucket. The job fails with the error 'S3AccessDeniedException' when writing the final output, but earlier stages succeed. The EMR cluster uses a service role and an instance profile. The S3 bucket policy allows access from the VPC only. What is the MOST likely cause?

A.The S3 bucket uses SSE-C encryption, and the EMR cluster does not have the encryption key.

B.The EMR service role does not have permissions to write to the S3 bucket.

C.The EMR cluster is not using a VPC endpoint for S3, so requests are denied by the bucket policy's VPC condition.

D.The S3 bucket is configured with 'Bucket owner enforced' setting for ACLs, and the EMR cluster's account is not the bucket owner.

AnswerC

The bucket policy restricts access to VPC, but since the Spark job runs on EMR, its requests originate from inside the VPC only if a VPC endpoint is used; otherwise, they come from public IPs.

Why this answer

The bucket policy restricts access to requests originating from the VPC, typically using a condition like `aws:SourceVpc`. If the EMR cluster does not use a VPC endpoint for S3 (either Gateway or Interface endpoint), traffic from the cluster to S3 traverses the public internet and does not match the VPC condition, causing the `S3AccessDeniedException`. Earlier stages may succeed if they use cached data or different paths, but the final write fails because it hits the bucket policy check.

Exam trap

The trap here is that candidates often assume the EMR service role (EMR_EC2_DefaultRole) is responsible for all S3 access, but in reality the instance profile (EC2 instance role) handles data plane operations, and the bucket policy's VPC condition is the key blocker when earlier stages succeed but final writes fail.

How to eliminate wrong answers

Option A is wrong because SSE-C encryption requires the client to provide the encryption key; if the key were missing, the error would be an encryption-related error (e.g., 'InvalidArgument' or 'AccessDenied' with a different message), not a generic 'S3AccessDeniedException'. Option B is wrong because the EMR service role is used for the cluster's service-level permissions (e.g., launching instances, reading logs), not for data access to S3; the instance profile (IAM role attached to EC2 instances) handles data read/write permissions, and the question states earlier stages succeed, indicating the instance profile has write permissions. Option D is wrong because the 'Bucket owner enforced' setting (S3 Object Ownership) controls ACLs and ownership of objects, not access permissions; it does not cause an 'S3AccessDeniedException' — it would affect who owns new objects, not whether the write is allowed.

Full explanation →

1178

MCQhard

A company runs a real-time analytics platform on AWS. Data is ingested from thousands of IoT devices into Amazon Kinesis Data Streams. A Lambda function consumes the stream, processes the data, and writes the results to an Amazon DynamoDB table. The DynamoDB table has a provisioned write capacity of 1000 WCU, and the read capacity is set to 200 RCU. Recently, the company noticed that the Lambda function is failing with ProvisionedThroughputExceededException on DynamoDB writes. The Lambda function is configured with a batch size of 100 and a concurrency limit of 10. The Kinesis shard count is 4. The number of devices has increased, but the data volume per device has remained the same. The company needs to resolve the write throttling without increasing the DynamoDB write capacity. Which action should the data engineer take?

A.Increase the number of Kinesis shards to 8.

B.Increase the Lambda concurrency limit to 20.

C.Increase the batch size to 200.

D.Reduce the batch size of the Lambda function to 10.

AnswerD

Smaller batches reduce write volume per invocation.

Why this answer

Reducing the batch size from 100 to 10 decreases the number of records processed per Lambda invocation, which reduces the burst of write requests to DynamoDB per invocation. This helps stay within the 1000 WCU limit without increasing capacity, as the same total throughput is spread across more invocations with smaller batches.

Exam trap

The trap here is that candidates assume increasing concurrency or shards will distribute the load better, but in reality, those actions increase the total write throughput, exacerbating throttling when DynamoDB capacity is fixed.

How to eliminate wrong answers

Option A is wrong because increasing Kinesis shards to 8 would increase the number of concurrent Lambda consumers, potentially amplifying the write throttling issue by generating more parallel writes to DynamoDB. Option B is wrong because increasing Lambda concurrency to 20 would allow more simultaneous invocations, each writing up to 100 records, which would increase the aggregate write rate and worsen ProvisionedThroughputExceededException. Option C is wrong because increasing the batch size to 200 would cause each Lambda invocation to attempt writing more records at once, creating larger spikes in write demand that exceed the 1000 WCU limit.

Full explanation →

1179

Multi-Selectmedium

A company uses Amazon RDS for MySQL as a source for AWS DMS. The replication tasks are failing due to large transactions on the source. The team wants to reduce the impact of large transactions on DMS. Which THREE actions should the team take?

Select 3 answers

A.Increase the number of parallel threads on the source.

B.Increase the size of the source RDS instance and enable binary logging with ROW format.

C.Enable BatchApply in the DMS task settings.

D.Use the 'full load only' migration type.

E.Tune the DMS task to use a larger memory limit and adjust the transaction size.

AnswersB, C, E

Larger instance and proper logging help DMS capture changes.

Why this answer

To reduce the impact of large transactions on AWS DMS when using Amazon RDS for MySQL as a source, the recommended actions are: increasing the source RDS instance size and enabling binary logging with ROW format (option B) to better handle large transactions and support CDC; enabling BatchApply (option C) to reduce the time to apply changes by batching them; and tuning the DMS task to use a larger memory limit while adjusting the transaction size (option E) to improve memory management. Option A is incorrect because increasing parallel threads on the source does not directly mitigate large transaction impact; DMS manages parallelism internally. Option D is incorrect because using 'full load only' would stop CDC, making it unsuitable for ongoing replication.

Full explanation →

1180

Multi-Selecteasy

A data engineer needs to transform data in an S3 data lake using AWS Glue ETL. The data is in CSV format and needs to be converted to Parquet with partitioning by date. The engineer wants to minimize the number of files written to S3 to improve query performance. Which TWO configuration options should the engineer use? (Select TWO.)

Select 2 answers

A.Increase the number of workers in the Glue job to increase parallelism.

B.Use the coalesce method to reduce the number of output partitions.

C.Disable compression in the Parquet output.

D.Enable partition pruning in the Glue job by setting the 'partitionKeys' parameter.

E.Set the 'groupFiles' option to 'inPartition' in the DynamicFrame writer.

AnswersB, D

Coalesce reduces the number of partitions before writing, resulting in fewer files.

Why this answer

Using `coalesce` reduces the number of output partitions, which directly minimizes the number of files written to S3. Fewer, larger Parquet files improve query performance by reducing the overhead of file listing and metadata operations in engines like Amazon Athena or Redshift Spectrum.

Exam trap

The trap here is that candidates often confuse increasing parallelism (Option A) with improving performance, but in this context, more parallelism leads to more small files, which degrades query performance; the correct approach is to reduce file count via coalesce and enable partition pruning.

Full explanation →

1181

MCQhard

A company uses DynamoDB with provisioned capacity and experiences throttling on a table during peak hours. The data engineer notices that the table has a partition key with high cardinality and the workload is read-heavy. Which action would best resolve the throttling?

A.Enable DynamoDB Auto Scaling for the table.

B.Switch the table to on-demand capacity mode.

C.Increase the provisioned write capacity units.

D.Add a global secondary index (GSI) to distribute reads.

AnswerA

Auto Scaling adjusts capacity based on traffic, preventing throttling efficiently.

Why this answer

DynamoDB Auto Scaling adjusts the provisioned read capacity units (RCUs) based on actual traffic patterns, preventing throttling during peak hours without manual intervention. Since the table has high-cardinality partition keys and is read-heavy, throttling is likely due to insufficient RCUs, which Auto Scaling dynamically increases to match demand.

Exam trap

AWS often tests the misconception that adding a GSI or switching to on-demand is the default fix for throttling, but the correct answer requires identifying that the read-heavy workload needs RCU adjustments, not structural changes or mode switches.

How to eliminate wrong answers

Option B is wrong because switching to on-demand capacity mode would eliminate throttling but at a significantly higher cost for a read-heavy workload, and it does not leverage the existing provisioned capacity setup. Option C is wrong because increasing provisioned write capacity units (WCUs) does not address read throttling; the issue is read-heavy, so RCUs need adjustment, not WCUs. Option D is wrong because adding a GSI distributes reads across partitions but does not increase the table's total provisioned read capacity; it could even worsen throttling if the GSI's write capacity is not properly provisioned.

Full explanation →

1182

MCQeasy

A data engineer needs to ensure that data in transit between an Amazon RDS for PostgreSQL database and an application is encrypted. Which configuration should be used?

A.Use VPC peering to connect the application to the database

B.Enable SSL/TLS for the database connection

C.Enable encryption at rest for the RDS instance

D.Use IAM database authentication

AnswerB

Enabling SSL/TLS encrypts the connection between the application and the database, securing data in transit.

Why this answer

Enabling SSL/TLS for the database connection encrypts the data in transit between the application and the RDS PostgreSQL instance, ensuring confidentiality. Option A (VPC peering) provides network connectivity but does not encrypt traffic. Option C (encryption at rest) protects data stored on disk, not in transit.

Option D (IAM database authentication) controls access but does not encrypt the connection.

Full explanation →

1183

MCQmedium

A company is ingesting log files from EC2 instances into CloudWatch Logs and then wants to deliver them to S3 for long-term storage and analysis. The data engineer needs to ensure the logs are delivered to S3 within 5 minutes of being generated. Which approach meets this requirement?

A.Configure a CloudWatch Logs metric filter and invoke a Lambda function to write to S3

B.Use CloudWatch Logs Insights to query logs and save results to S3

C.Use CloudWatch Logs subscription filter with Kinesis Data Firehose to deliver to S3

D.Use the CloudWatch Logs export to S3 feature

AnswerC

Firehose can deliver to S3 within minutes.

Why this answer

CloudWatch Logs subscription filters can stream log data in near real-time to Kinesis Data Firehose, which then delivers the data to S3 with a buffer interval configurable down to 60 seconds, easily meeting the 5-minute requirement. This approach provides the lowest latency for automated, continuous delivery without custom code.

Exam trap

The trap here is that candidates often confuse the batch export feature (which has a 12-hour latency) with a real-time solution, or assume a Lambda-based approach is simpler without considering the latency and management overhead of custom code.

How to eliminate wrong answers

Option A is wrong because CloudWatch Logs metric filters are designed to extract metric data from logs, not to trigger Lambda functions for each log event; while you could use a subscription filter with Lambda, the metric filter itself cannot invoke Lambda, and Lambda-based delivery would add latency and complexity. Option B is wrong because CloudWatch Logs Insights is an interactive query engine for ad-hoc analysis, not a mechanism for automated, continuous delivery to S3; it requires manual intervention to save results. Option D is wrong because the CloudWatch Logs export to S3 feature is a batch export operation that can take up to 12 hours to complete, far exceeding the 5-minute requirement.

Full explanation →

1184

MCQmedium

A company wants to enable automatic encryption for all new objects written to an S3 bucket. The bucket has existing objects that are unencrypted. Which solution meets these requirements with the least operational overhead?

A.Configure a lifecycle policy to transition objects to a new bucket with encryption

B.Enable default encryption on the bucket using SSE-S3

C.Use S3 server-side encryption with S3 managed keys (SSE-S3) and apply a bucket policy that denies writes without encryption

D.Use S3 Batch Operations to copy existing objects with SSE-S3

AnswerB

Correct: Bucket default encryption using SSE-S3 automatically encrypts all new objects without any extra configuration or overhead.

Why this answer

Enabling default encryption on the bucket using SSE-S3 automatically encrypts all new objects written to the bucket, with minimal operational overhead. Option A is incorrect because lifecycle policies do not encrypt objects; they manage transitions and deletions. Option C is redundant since bucket default encryption already denies unencrypted writes via policy, but the policy itself is additional overhead and not automatic.

Option D is incorrect because S3 Batch Operations require manual initiation and only encrypt existing objects, not new ones automatically.

Full explanation →

1185

MCQhard

A financial services company ingests real-time stock trade data using Amazon Kinesis Data Streams with 10 shards. Each shard receives about 500 records per second, each record approximately 1 KB. The data is consumed by a single AWS Lambda function that transforms the data and writes to Amazon S3. The Lambda function is configured with 1024 MB memory and a timeout of 5 minutes. The company notices that the Lambda function is frequently throttled, and data ingestion lags behind. The Lambda function's CloudWatch metrics show that the iterator age is increasing, and the function's concurrency is maxed out at 1000. The data engineer needs to resolve the throttling issue without changing the Lambda function code. What should the data engineer do?

A.Increase the number of shards in the Kinesis data stream to increase parallelism.

B.Reduce the Lambda function memory to 512 MB to increase concurrency limit.

C.Decrease the batch size to 10 records to reduce processing time per invocation.

D.Increase the Lambda function memory to 2048 MB to improve processing speed.

AnswerA

More shards allow more Lambda concurrent executions, reducing iterator age.

Why this answer

Increasing the number of shards increases the number of Kinesis Data Streams processing units, which directly increases the concurrency limit for Lambda consumers. With more shards, more Lambda function instances can process records in parallel, reducing the iterator age and alleviating throttling. Option B is wrong because reducing memory would likely degrade performance and not increase concurrency limit (concurrency limit is independent of memory).

Option C is wrong because decreasing batch size increases the number of invocations, potentially worsening throttling and overhead. Option D is wrong because increasing memory may improve per-record processing speed, but the core issue is concurrency limit being maxed out; increasing memory does not increase concurrency limit and may not resolve throttling if CPU is not the bottleneck.

Full explanation →

1186

MCQeasy

A data engineer needs to automate the backup of an Amazon RDS for PostgreSQL database. Which AWS service can be used to schedule and manage the backups?

A.Amazon S3

B.AWS Lambda

C.AWS Backup

D.Amazon CloudWatch

AnswerC

AWS Backup provides centralized backup management for RDS.

Why this answer

AWS Backup is a fully managed backup service that can automate backups of RDS databases. Option A (Amazon S3) is incorrect because S3 is an object storage service, not a backup scheduling service. Option B (AWS Lambda) is incorrect because while Lambda can be used for custom automation, it is not the primary managed service for backup scheduling.

Option D (Amazon CloudWatch) is incorrect because CloudWatch is for monitoring and observability, not backup management.

Full explanation →

1187

MCQeasy

A company uses AWS DMS to replicate data from an on-premises Oracle database to Amazon RDS for MySQL. The full load completes successfully, but ongoing replication (CDC) is failing with a 'Failed to add supplemental logging' error. What should the data engineer do to resolve this issue?

A.Enable supplemental logging on the source Oracle database manually.

B.Recreate the DMS endpoint for the source database with a new connection.

C.Modify the target MySQL database to use a different engine version.

D.Increase the task log interval in the DMS task settings.

AnswerA

DMS requires supplemental logging for CDC.

Why this answer

The 'Failed to add supplemental logging' error occurs because AWS DMS requires supplemental logging on the source Oracle database for CDC to capture changes. DMS typically attempts to add supplemental logging automatically, but if it fails (e.g., due to insufficient privileges), the engineer must enable it manually. Option A is correct: enabling supplemental logging manually resolves the issue.

Option B is incorrect because recreating the endpoint does not address the missing supplemental logging. Option C is incorrect because the target MySQL engine version is unrelated to the source Oracle logging requirement. Option D is incorrect because increasing the task log interval only affects log output frequency, not the underlying logging configuration.

Full explanation →

1188

Multi-Selecteasy

A company needs to store log files from multiple applications in a centralized location. The logs are written once and accessed rarely after 30 days. The company must retain logs for 5 years. Which TWO actions meet these requirements cost-effectively?

Select 2 answers

A.Configure a lifecycle policy to transition objects to S3 Glacier Deep Archive after 30 days

B.Configure a lifecycle policy to transition objects to S3 Glacier Flexible Retrieval after 30 days

C.Use S3 Intelligent-Tiering for automatic cost optimization

D.Use S3 One Zone-IA for the first 30 days, then delete

E.Store all logs in S3 Standard

AnswersA, C

Deep Archive is the lowest-cost storage class for long-term retention.

Why this answer

S3 Glacier Deep Archive is the lowest-cost storage class for data that is accessed rarely, with retrieval times of 12 hours or more, making it ideal for logs that are rarely accessed after 30 days. A lifecycle policy transitions objects from a higher-cost class (e.g., S3 Standard) to S3 Glacier Deep Archive after 30 days, meeting the 5-year retention requirement cost-effectively.

Exam trap

AWS often tests the distinction between S3 Glacier Flexible Retrieval and S3 Glacier Deep Archive, where candidates mistakenly choose the former for rarely accessed data due to familiarity, ignoring the cost savings of the latter for deep archival use cases.

Full explanation →

1189

MCQhard

A data engineer is ingesting XML data from an external API into Amazon S3. The engineer needs to transform the XML to JSON using AWS Glue. The XML structure is deeply nested. Which Apache Spark method should be used in the Glue ETL script?

A.Use the built-in AWS Glue 'xml' data source

B.Use Hadoop's XmlInputFormat

C.Use spark.read.format('xml') with Databricks XML library

D.Use the Spark SQL function from_xml()

AnswerC

This is the standard way to parse XML in Spark.

Why this answer

The Databricks XML library (spark.read.format('xml')) provides native support for parsing deeply nested XML into a DataFrame, which is essential for AWS Glue ETL scripts running on Spark. AWS Glue does not have a built-in 'xml' data source, and the Databricks library handles complex nested structures, attributes, and arrays automatically, making it the standard approach for XML-to-JSON transformation in Spark.

Exam trap

The DEA-C01 exam often tests the misconception that AWS Glue has a built-in 'xml' data source (Option A), when in fact Glue relies on external Spark libraries like Databricks XML for XML processing, and candidates confuse the Spark SQL function from_xml() with a file-level reader.

How to eliminate wrong answers

Option A is wrong because AWS Glue does not have a built-in 'xml' data source; Glue's native formats are JSON, Parquet, ORC, Avro, and CSV, and using 'xml' would throw an error. Option B is wrong because Hadoop's XmlInputFormat is designed for MapReduce jobs, not Spark DataFrames, and it outputs key-value pairs of XML fragments, requiring manual parsing and lacking schema inference for deeply nested XML. Option D is wrong because from_xml() is a Spark SQL function that parses a single string column containing XML into struct columns, but it cannot read an entire XML file or dataset; it requires the XML to already be loaded as a string, making it unsuitable for ingesting raw XML files from S3.

Full explanation →

1190

MCQeasy

Refer to the exhibit. An S3 event notification is configured to trigger an AWS Lambda function when objects are created in 'my-bucket'. The Lambda function processes the JSON file and writes results to Amazon DynamoDB. The function fails with a timeout error. Which action should the engineer take to resolve the issue?

A.Modify the S3 event notification to use a different event type

B.Grant the Lambda function permission to access DynamoDB

C.Change the trigger to Amazon SQS instead of S3

D.Increase the Lambda function timeout

AnswerD

Timeout error indicates the function needs more time.

Why this answer

The Lambda function is failing with a timeout error, which indicates that the function is taking longer to execute than the default timeout of 3 seconds. Increasing the Lambda function timeout allows the function to run longer and complete its processing of the JSON file and DynamoDB write operation without being prematurely terminated.

Exam trap

The DEA-C01 exam often tests the distinction between timeout errors and permission errors, leading candidates to incorrectly choose a permissions fix (Option B) when the error message explicitly states 'timeout'.

How to eliminate wrong answers

Option A is wrong because changing the S3 event notification to a different event type (e.g., from s3:ObjectCreated:* to s3:ObjectCreated:Put) does not address the timeout issue; the function still fails due to execution duration, not the trigger event. Option B is wrong because a timeout error is not a permissions issue; if the Lambda function lacked DynamoDB permissions, it would fail with an access denied error (e.g., 403), not a timeout. Option C is wrong because changing the trigger to Amazon SQS instead of S3 does not resolve the timeout; the Lambda function would still have the same execution duration limit and would timeout regardless of the trigger source.

Full explanation →

1191

MCQmedium

Refer to the exhibit. A data engineer created this IAM policy for a Lambda function that reads from a Kinesis stream and writes to an S3 bucket. The Lambda function fails with an 'AccessDenied' error when trying to write to S3. What is the missing permission?

A.s3:ListBucket on the bucket

B.s3:GetObject on the bucket

C.s3:PutObjectAcl on the bucket

D.s3:DeleteObject on the bucket

AnswerC

If the bucket policy requires object ACLs, s3:PutObjectAcl may be necessary alongside PutObject. This is the most plausible missing permission from the given options.

Why this answer

The IAM policy includes s3:PutObject, which is sufficient for writing objects to S3. The AccessDenied error indicates the bucket policy or the resource ARN in the policy is misconfigured. Among the given options, s3:PutObjectAcl might be required if the bucket is configured to require ACLs on write operations.

Full explanation →

1192

MCQeasy

A data engineer notices that an Amazon Kinesis Data Firehose delivery stream is failing to deliver data to an Amazon S3 bucket. The engineer verifies that the S3 bucket exists and that the IAM role attached to the delivery stream has the necessary permissions. What is the MOST likely cause of the failure?

A.The delivery stream is configured to deliver to Amazon CloudWatch Logs.

B.The IAM role does not have permissions to write to the S3 bucket.

C.No data is being written to the Kinesis Data Firehose delivery stream.

D.The delivery stream is configured to deliver to Amazon Kinesis Data Streams instead of S3.

AnswerC

If no data is put into the stream, it cannot deliver to S3.

Why this answer

If no data is written to the stream, Firehose has nothing to deliver. Option A is wrong because CloudWatch Logs is for monitoring, not for storing delivery data. Option B is wrong because insufficient permissions would cause an access denied error.

Option D is wrong because delivery streams typically use S3 as a destination, not Kinesis Data Streams.

Full explanation →

1193

MCQmedium

A company has an Amazon RDS for MySQL DB instance with read replicas. The primary DB instance fails. What is the correct procedure to promote a read replica to become the new primary?

A.Modify the read replica to be a Multi-AZ deployment and failover will occur.

B.RDS automatically fails over to the read replica within 5 minutes.

C.Manually promote the read replica to a standalone DB instance.

D.Delete the primary and the read replica will automatically become the primary.

AnswerC

This is the correct procedure to make the read replica the new primary.

Why this answer

When an Amazon RDS for MySQL primary DB instance fails, read replicas do not automatically become the new primary. The correct procedure is to manually promote the read replica using the AWS Management Console, CLI, or API, which converts it into a standalone DB instance. After promotion, you must update your application endpoints to point to the new primary, as RDS does not handle this automatically.

Exam trap

The trap here is that candidates confuse read replicas with Multi-AZ standby instances, assuming automatic failover applies to both, but RDS read replicas require manual promotion and do not provide automatic failover.

How to eliminate wrong answers

Option A is wrong because modifying a read replica to be Multi-AZ does not trigger a failover; Multi-AZ is a separate feature for high availability within a single region, and read replicas are not part of the Multi-AZ failover mechanism. Option B is wrong because RDS does not automatically fail over to a read replica; automatic failover only occurs with Multi-AZ deployments, not with read replicas. Option D is wrong because deleting the primary DB instance does not cause the read replica to automatically become the primary; the read replica remains a read-only copy until manually promoted.

Full explanation →

1194

Multi-Selecteasy

Which TWO AWS services can be used to schedule and orchestrate ETL workflows that involve multiple steps and dependencies? (Choose 2.)

Select 2 answers

A.AWS Batch

B.AWS Lambda

C.AWS Data Pipeline

D.AWS Step Functions

E.Amazon Managed Workflows for Apache Airflow (MWAA)

AnswersD, E

Step Functions can coordinate multiple AWS services into workflows.

Why this answer

The correct answers are D (AWS Step Functions) and E (Amazon Managed Workflows for Apache Airflow). AWS Step Functions is a serverless orchestration service that lets you coordinate multiple AWS services into flexible, multi-step workflows. It is ideal for ETL pipelines that require sequential steps, branching, and error handling.

Amazon MWAA is a managed service for Apache Airflow, an open-source platform used to programmatically author, schedule, and monitor workflows. MWAA simplifies setting up and operating Airflow, making it suitable for complex ETL orchestration with dependencies. In contrast, AWS Batch (A) is designed for batch computing jobs, not workflow orchestration.

AWS Lambda (B) is for individual serverless functions, not multi-step orchestration. AWS Data Pipeline (C) is an older ETL orchestration service that is less flexible and less commonly used compared to Step Functions and MWAA.

Full explanation →

1195

MCQmedium

A data engineering team is using Amazon EMR to process large datasets stored in Amazon S3. The cluster uses Spot Instances for cost savings. During processing, the team notices that tasks are failing due to Spot Instance interruptions. The team needs to make the EMR job resilient to Spot interruptions without increasing costs significantly. Which solution should they implement?

A.Use EMR instance fleets with a mix of Spot and On-Demand, but set the allocation strategy to 'lowest price'.

B.Increase the number of core nodes using On-Demand instances.

C.Use only Spot Instances but enable automatic termination and checkpointing.

D.Use EMR instance fleets with a mix of Spot and On-Demand, setting the allocation strategy to 'diversified' and using On-Demand for core nodes.

AnswerD

Diversified spreads risk; On-Demand core ensures stability.

Why this answer

Using EMR instance fleets with a mix of Spot and On-Demand, setting the allocation strategy to 'diversified', and using On-Demand for core nodes ensures resilience to Spot interruptions without significant cost increase. On-Demand core nodes provide stability for HDFS and critical processing, while diversified allocation for Spot task nodes reduces the risk of simultaneous interruptions. Option A is incorrect because the 'lowest price' allocation strategy prioritizes the cheapest Spot instances, which often have higher interruption rates, and does not protect core nodes.

Option B is incorrect because increasing core nodes with On-Demand instances raises costs significantly. Option C is incorrect because using only Spot Instances with automatic termination and checkpointing does not prevent job failures during interruptions; automatic termination would terminate the job, and checkpointing only helps with recovery, not resilience.

Full explanation →

1196

MCQeasy

A company wants to ensure that only encrypted connections are used when data is transferred to S3. Which policy condition should be used in an S3 bucket policy?

A.Condition: { Null: { s3:x-amz-server-side-encryption: true } }

B.Condition: { StringEquals: { s3:signatureversion: ["AWS4-HMAC-SHA256"] } }

C.Condition: { StringNotEquals: { aws:SourceIp: ["0.0.0.0/0"] } }

D.Condition: { Bool: { aws:SecureTransport: false } }

AnswerD

Denying requests where SecureTransport is false enforces HTTPS.

Why this answer

The condition `aws:SecureTransport: false` is used to deny requests that are not sent over SSL/TLS, ensuring encrypted connections for data transfer to S3. Option A (`s3:x-amz-server-side-encryption`) controls encryption at rest, not in transit. Option B (`s3:signatureversion`) checks the signature version used for request authentication, not encryption.

Option C (`aws:SourceIp`) filters by source IP address, which is unrelated to encryption.

Full explanation →

1197

MCQmedium

Refer to the exhibit. The S3 bucket policy above is applied to the bucket "example-bucket". An IAM user attempts to upload an object to the bucket without specifying any encryption header. What is the outcome?

A.The upload succeeds but the object is not encrypted

B.The upload fails because GetObject requires encryption

C.The object is uploaded successfully with SSE-S3 encryption by default

D.The upload fails with an Access Denied error

AnswerD

The Deny statement blocks the upload.

Why this answer

The Deny statement in the bucket policy denies PutObject if the encryption header is not AES256. Since the user did not specify any encryption header, the condition StringNotEquals 'AES256' evaluates to true, causing the request to be denied with an Access Denied error. Option A is wrong because the Deny overrides the Allow.

Option B is wrong because the Deny applies to PutObject, not GetObject. Option C is wrong because the Deny is conditional on encryption header, not default encryption.

Full explanation →

1198

MCQmedium

A company is migrating an on-premises Apache Cassandra database to Amazon Keyspaces. The database has a table with a partition key of 'user_id' and a clustering column of 'timestamp'. The application frequently queries the last 10 records for a given user. Which table design in Keyspaces would provide the BEST query performance for this access pattern?

A.Partition key: random column, clustering column: none.

B.Partition key: timestamp, clustering column: user_id.

C.Partition key: user_id, clustering column: none.

D.Partition key: user_id, clustering column: timestamp (descending order).

AnswerD

This design groups all records for a user in one partition and sorts by timestamp descending, enabling efficient retrieval of the last 10 records.

Why this answer

It preserves the original Cassandra table design with 'user_id' as the partition key and 'timestamp' as the clustering column in descending order. This allows Keyspaces to efficiently retrieve the last 10 records for a given user by performing a range query on the clustering column within a single partition, avoiding full table scans or cross-partition queries.

Exam trap

The trap here is that candidates may think a random partition key (Option A) or timestamp-based partition key (Option B) improves write distribution, but they overlook that the query pattern requires efficient reads within a single partition, which is best achieved by using the query filter column as the partition key and the sort column as the clustering key with the appropriate order.

How to eliminate wrong answers

Option A is wrong because using a random partition key with no clustering column would scatter data across partitions, requiring a full scan to find records for a specific user, which is highly inefficient. Option B is wrong because using 'timestamp' as the partition key would place each timestamp in a separate partition, making it impossible to query all records for a user without scanning multiple partitions, and the clustering column 'user_id' would not help retrieve the last 10 records per user efficiently. Option C is wrong because while 'user_id' as the partition key correctly groups data by user, having no clustering column means you cannot order records by timestamp, so retrieving the last 10 records would require fetching all records for that user and sorting them in application code, which is suboptimal.

Full explanation →

1199

Multi-Selectmedium

A company needs to securely store and manage database credentials used by a data pipeline. Which AWS services can be used to store and rotate secrets automatically? (Choose TWO.)

Select 2 answers

A.AWS Systems Manager Parameter Store

B.AWS IAM

C.AWS Key Management Service (AWS KMS)

D.AWS CloudHSM

E.AWS Secrets Manager

AnswersA, E

Correct. Systems Manager Parameter Store can store secrets and, with the Advanced tier, can automate rotation via custom Lambda functions.

Why this answer

AWS Systems Manager Parameter Store (A) can securely store secrets and, when using the Advanced tier, supports automatic rotation via AWS Lambda. AWS Secrets Manager (E) provides native automatic rotation for database credentials and other secrets. B (IAM) is for identity and access management, not secret storage.

C (KMS) manages encryption keys, not secrets. D (CloudHSM) provides hardware security modules for key management, not secret storage. Therefore, the correct answers are A and E.

Full explanation →

1200

MCQmedium

A data engineer sees this AWS Glue table definition in the Data Catalog. The engineer wants to query this table with Amazon Athena, but the query returns zero rows. What is the MOST likely cause?

A.The data files are not in the specified S3 location.

B.The SerDe library is incorrect for CSV files.

C.The table format CSV is not supported by Athena.

D.Athena cannot read tables from the Glue Data Catalog.

AnswerA

If no files exist at s3://data-lake/sales/, query returns zero rows.

Why this answer

The most likely cause is that the data files are not in the specified S3 location. When an AWS Glue table is defined in the Data Catalog, Athena reads the table's metadata (including the S3 location) and then attempts to read the underlying data files from that exact path. If the files are missing, misnamed, or in a different prefix, Athena returns zero rows because there is no data to scan.

This is a common misconfiguration when the S3 path in the table definition does not match the actual data storage.

Exam trap

The trap here is that candidates often assume the issue is with the SerDe or format compatibility, but the most common real-world cause is simply that the data files are not present at the specified S3 location, leading to zero rows returned.

How to eliminate wrong answers

Option B is wrong because the SerDe library is not incorrect for CSV files; Athena uses the LazySimpleSerDe by default for CSV, which is fully supported and does not cause zero rows. Option C is wrong because CSV is a widely supported table format in Athena, and Athena can query CSV files natively. Option D is wrong because Athena is designed to read tables from the Glue Data Catalog; in fact, Athena and Glue Data Catalog are tightly integrated, and this is a standard use case.

Full explanation →

Page 16 of 23

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23

Practice DEA-C01 by domain

Target a specific domain to shore up weak areas.

Data Ingestion and Transformation Data Operations and Support Data Security and Governance Data Store Management

See all domains with question counts →