Knowledge + Practice

AWS Certified Data Engineer Associate DEA-C01 (DEA-C01) — Questions 1201–1275

1711 questions total · 23pages · All types, answers revealed

Take a mock exam Exam hub

Page 17 of 23

1201

MCQmedium

A company is using Amazon Athena to query data stored in S3. Queries are failing with 'HIVE_INVALID_PARTITION' errors. What is the most likely cause?

A.The S3 bucket is configured with a bucket policy that denies access to the Athena service.

B.A partition folder in S3 has been deleted or moved, but the table metadata still references it.

C.The data is compressed with gzip, but the table definition expects uncompressed data.

D.The data files are in CSV format but the table definition expects Parquet.

AnswerB

Athena expects all partitions to exist.

Why this answer

The 'HIVE_INVALID_PARTITION' error in Amazon Athena occurs when the table's partition metadata in the AWS Glue Data Catalog (or Hive metastore) references a partition folder that no longer exists in the S3 bucket. Athena relies on the metadata to locate data files; if a partition folder is deleted or moved without updating the metadata, queries fail because Athena cannot find the expected data location.

Exam trap

The trap here is that candidates confuse permission errors (like S3 bucket policies) with metadata consistency errors, or assume compression or format mismatches cause partition-specific errors, when in reality 'HIVE_INVALID_PARTITION' is a direct indicator of a stale or missing partition folder in the catalog.

How to eliminate wrong answers

Option A is wrong because a bucket policy denying Athena access would cause an 'Access Denied' error, not a 'HIVE_INVALID_PARTITION' error, which is specific to partition metadata mismatch. Option C is wrong because Athena supports reading gzip-compressed data transparently, and compression mismatch does not produce partition-related errors. Option D is wrong because a schema mismatch between CSV and Parquet would cause a 'HIVE_CANNOT_OPEN_SPLIT' or data type conversion error, not a partition validation error.

Full explanation →

1202

MCQhard

A company is using Amazon DynamoDB for a gaming application with high read and write throughput. The data engineer notices that the read latency is high during peak hours. The table has a partition key only (no sort key). The engineer wants to improve read performance by distributing reads across partitions more evenly. Which action should the engineer take?

A.Increase the read capacity units of the table.

B.Add a sort key to the table.

C.Enable DynamoDB Accelerator (DAX).

D.Enable DynamoDB global tables.

AnswerC

DAX provides a write-through cache, reducing read latency.

Why this answer

DynamoDB Accelerator (DAX) is an in-memory cache that reduces read latency from single-digit milliseconds to microseconds by caching frequently accessed items. Since the issue is high read latency during peak hours and the table has only a partition key, DAX offloads reads from the underlying table, distributing the read load and improving response times without changing the table's key structure.

Exam trap

The trap here is that candidates often confuse increasing capacity (Option A) with improving read distribution, not realizing that latency issues from hot partitions require caching or key redesign, not just more RCUs.

How to eliminate wrong answers

Option A is wrong because increasing read capacity units (RCUs) only raises the provisioned throughput limit, but does not inherently distribute reads more evenly across partitions; high latency during peak hours is often due to hot partitions or throttling, not insufficient capacity. Option B is wrong because adding a sort key to an existing table is not possible without recreating the table, and a sort key does not directly improve read distribution across partitions; it only enables more flexible query patterns within a partition. Option D is wrong because enabling DynamoDB global tables provides multi-region replication for disaster recovery and low-latency reads from multiple regions, but it does not improve read distribution across partitions within a single table or reduce latency for a single-region workload.

Full explanation →

1203

MCQmedium

A company uses Amazon EMR to process large datasets stored in Amazon S3. The data is encrypted at rest using SSE-S3. The security team now requires that all data at rest be encrypted with customer-managed KMS keys (SSE-KMS). The data engineer needs to migrate existing data to use SSE-KMS without downtime. The engineer plans to use S3 Batch Operations to copy objects in place. However, the Batch Operations job fails with a KMS access denied error. The engineer has confirmed that the Batch Operations service role has the necessary KMS permissions. What is the most likely cause?

A.The KMS key policy does not allow the S3 service to use the key.

B.The Batch Operations job is using the wrong IAM role.

C.The source objects are encrypted with SSE-S3, which cannot be copied to SSE-KMS.

D.The Batch Operations service role is missing the kms:GenerateDataKey permission for the destination KMS key.

AnswerD

Batch Operations needs to generate a new data key for the destination.

Why this answer

Batch Operations uses a service role that must have kms:Decrypt permission for the source objects and kms:GenerateDataKey for the destination. The source objects are encrypted with SSE-S3, which does not use KMS, so the service role does not need kms:Decrypt for source. However, the error indicates KMS access denied, likely because the service role does not have kms:GenerateDataKey for the destination KMS key.

Option A is wrong because the service role is used. Option B is wrong because the source objects are SSE-S3. Option C is wrong because KMS key policy is for the destination key.

Full explanation →

1204

MCQmedium

A data engineer needs to implement a data pipeline that ingests data from an on-premises database using AWS DMS and loads it into Amazon S3 in Parquet format. The data should be encrypted at rest in S3 using a customer-managed KMS key. Which combination of actions should the engineer take? (Choose the correct course of action.)

A.Configure the DMS task to write to S3 in Parquet format, and specify the KMS key ID in the S3 endpoint settings.

B.Set up an EC2 instance to run a script that reads from the source and writes Parquet to S3 with KMS encryption.

C.Use DMS to write JSON to S3, then use an AWS Glue job to convert to Parquet and enable KMS encryption on the Glue job.

D.Configure the S3 bucket policy to require KMS encryption for all objects, and use DMS with default settings.

AnswerA

DMS S3 endpoint supports KMS encryption and Parquet format.

Why this answer

AWS DMS can directly write data to Amazon S3 in Parquet format when configuring the DMS task. To encrypt data at rest with a customer-managed KMS key, you specify the KMS key ID in the S3 endpoint settings. This allows DMS to encrypt objects with the specified KMS key as they are written to S3.

Option B is incorrect because it introduces an unnecessary EC2 instance; DMS can write Parquet directly without an intermediate conversion step. Option C is incorrect because DMS can write Parquet directly; converting JSON to Parquet with Glue adds complexity and is not required. Option D is incorrect because a bucket policy requiring KMS encryption does not automatically encrypt data written by DMS; the encryption must be configured in the DMS task or endpoint settings.

Full explanation →

1205

MCQmedium

The IAM policy shown in the exhibit is attached to a user. The user tries to upload an object to my-bucket using the AWS CLI without specifying encryption. What will happen?

A.The upload will succeed because the bucket has default encryption

B.The upload will succeed but the object will not be encrypted

C.The upload will fail because a KMS key is required

D.The upload will fail with an access denied error

AnswerD

The condition requires the encryption header to be present.

Why this answer

The IAM policy allows s3:PutObject only if the request includes the encryption header x-amz-server-side-encryption with value AES256. Since the user does not specify any encryption, the condition is not met, and the request is denied with an access denied error. Option A is wrong because the condition is not optional.

Option B is wrong because default encryption applies only when the policy does not explicitly require a header; here the policy enforces the header. Option C is wrong because the policy does not require a KMS key; it requires AES256 encryption, which is SSE-S3.

Full explanation →

1206

MCQeasy

A data engineer needs to ingest JSON files from an S3 bucket into a DynamoDB table. The files are updated hourly and contain new records. Which AWS service should be used to trigger a Lambda function for each new object?

A.Kinesis Data Firehose

B.Amazon EventBridge

C.S3 Event Notifications

D.Amazon SQS

AnswerC

S3 can send events to Lambda on object creation.

Why this answer

S3 Event Notifications are the correct choice because they are designed to trigger AWS Lambda functions directly in response to object creation events (e.g., `s3:ObjectCreated:*`) in an S3 bucket. This allows the data engineer to automatically invoke a Lambda function for each new JSON file as it is uploaded, enabling ingestion into DynamoDB without polling or additional infrastructure.

Exam trap

The trap here is that candidates may confuse Amazon EventBridge with S3 Event Notifications, but EventBridge is not the native S3 event trigger—S3 Event Notifications are the direct, service-integrated mechanism for invoking Lambda on object creation.

How to eliminate wrong answers

Option A is wrong because Kinesis Data Firehose is a streaming ingestion service that loads data into destinations like S3, Redshift, or Elasticsearch, but it cannot directly trigger a Lambda function for each new object; it is not an event source for Lambda. Option B is wrong because Amazon EventBridge can schedule or react to events from various AWS services, but it is not the native, direct integration for S3 object creation events—S3 Event Notifications are the simpler and more appropriate mechanism. Option D is wrong because Amazon SQS is a message queue service that decouples components, but it does not natively trigger Lambda from S3 events without additional configuration (e.g., S3 Event Notification to SQS, then Lambda polling SQS), which adds unnecessary complexity for this use case.

Full explanation →

1207

MCQmedium

A data engineering team uses AWS Glue ETL jobs to process data from Amazon S3. The jobs recently started failing with 'Access Denied' errors when writing to the output S3 bucket. What is the most likely cause?

A.The KMS key used for server-side encryption is not accessible to the Glue job.

B.The S3 bucket does not have default encryption enabled.

C.The job ran out of memory due to large data volume.

D.The S3 bucket policy was modified to deny write access to the Glue job's IAM role.

AnswerD

An explicit deny in the bucket policy overrides any allow in the IAM role policy.

Why this answer

AWS Glue ETL jobs use an IAM role for permissions. If the S3 bucket policy was modified to explicitly deny write access to that role, the job would fail with 'Access Denied' errors. Option A is incorrect because KMS key access issues would cause encryption-related errors, not generic access denied.

Option B is incorrect because default encryption is not required for write access; it only affects encryption at rest. Option C is incorrect because out-of-memory errors would manifest as runtime errors, not access denied.

Full explanation →

1208

MCQmedium

A company uses Amazon S3 to store sensitive data. The security team wants to ensure that all objects uploaded to a specific S3 bucket are automatically encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). Which bucket policy statement should be added to enforce this requirement?

A.Deny put requests where 's3:x-amz-server-side-encryption' is 'aws:kms'

B.Deny put requests where 's3:x-amz-server-side-encryption' is not 'aws:kms'

C.Deny put requests where 's3:x-amz-server-side-encryption' is not 'AES256'

D.Deny put requests where 's3:x-amz-server-side-encryption' is not set

AnswerB

This enforces SSE-KMS encryption.

Why this answer

It denies any S3 PUT request that does not include the `x-amz-server-side-encryption` header set to `aws:kms`, thereby enforcing SSE-KMS encryption for all objects uploaded to the bucket. This bucket policy condition ensures that only requests specifying AWS KMS-managed keys are allowed, meeting the security team's requirement for automatic encryption at rest with SSE-KMS.

Exam trap

The DEA-C01 exam often tests the distinction between enforcing a specific encryption type (SSE-KMS) versus simply requiring encryption (any type), so candidates may incorrectly choose Option D (deny if not set) or Option C (deny if not AES256) because they confuse 'encryption at rest' with 'SSE-KMS specifically'.

How to eliminate wrong answers

Option A is wrong because it denies PUT requests where `s3:x-amz-server-side-encryption` is `aws:kms`, which would block the very encryption method required, making it impossible to upload objects with SSE-KMS. Option C is wrong because it denies PUT requests where encryption is not `AES256`, which would enforce SSE-S3 (AES256) instead of SSE-KMS, failing the requirement for KMS-managed keys. Option D is wrong because it denies PUT requests where the encryption header is not set, which would block unencrypted uploads but does not specifically enforce SSE-KMS; it would also allow SSE-S3 or other encryption types if the header is present, missing the specific KMS requirement.

Full explanation →

1209

MCQeasy

A data engineer needs to ensure that data stored in Amazon S3 is automatically deleted after 30 days. Which S3 feature should be used?

A.S3 Lifecycle policy

B.S3 MFA Delete

C.S3 Versioning

D.S3 Object Lock

AnswerA

Lifecycle policies can expire objects after 30 days.

Why this answer

S3 Lifecycle policies can automatically delete objects after a specified time period, such as 30 days. Option B (MFA Delete) requires multi-factor authentication for deletion but does not automate deletion. Option C (Versioning) keeps multiple versions but does not delete.

Option D (Object Lock) prevents deletion or modification but does not schedule automatic deletion.

Full explanation →

1210

MCQeasy

A data engineer is troubleshooting an AWS Glue ETL job that fails with the error: 'An error occurred while calling o137.pyWriteDynamicFrame. No such file or directory: s3://bucket/output/part-00000.parquet'. The job reads from a JDBC source and writes to S3. What is the most likely cause?

A.The schema of the source data has changed, causing a mismatch during write

B.The output S3 path does not exist and the Glue job does not have permission to create it

C.The Glue job ran out of memory during the transformation phase

D.The IAM role attached to the Glue job lacks permissions to read from the JDBC source

AnswerB

The error message indicates missing directory; Glue may not auto-create if permissions are insufficient.

Why this answer

The error 'No such file or directory: s3://bucket/output/part-00000.parquet' indicates that the Glue job is trying to write to an S3 path that does not exist. By default, AWS Glue does not automatically create the target S3 bucket or prefix; it requires the path to already exist or the IAM role to have s3:PutObject permissions that allow the S3 service to create the object. Since the error occurs at the write stage (pyWriteDynamicFrame) and not during read, the most likely cause is that the output S3 path does not exist and the Glue job lacks the necessary permissions to create it.

Exam trap

The trap here is that candidates often confuse a missing S3 path with a permissions issue, but the error message explicitly states 'No such file or directory', which points to the path not existing rather than a generic access denied, and the exam expects you to recognize that Glue does not auto-create the output S3 prefix.

How to eliminate wrong answers

Option A is wrong because a schema mismatch during write would typically cause a different error, such as a schema compatibility or type conversion error, not a 'No such file or directory' file system error. Option C is wrong because an out-of-memory error would manifest as a Java heap space or memory limit exception, not a missing file error on S3. Option D is wrong because the error occurs during the write phase (pyWriteDynamicFrame) and not during the JDBC read; if the IAM role lacked JDBC read permissions, the job would fail earlier with a connection or authentication error.

Full explanation →

1211

MCQhard

A company runs a critical transactional database on Amazon RDS for PostgreSQL. They need to achieve high availability with automatic failover to a different AWS Region in case of a regional outage. Which solution meets these requirements?

A.Create a cross-Region Read Replica and promote it during a disaster.

B.Take daily automated snapshots and restore them in another Region.

C.Deploy the RDS instance in a Multi-AZ configuration.

D.Use Amazon Aurora Global Database with a primary cluster in one Region and a secondary in another.

AnswerD

Aurora Global Database supports automatic failover across Regions with RPO of 1 second.

Why this answer

Amazon Aurora Global Database is designed for cross-Region disaster recovery, replicating data with a typical latency of under one second and providing automatic failover from the primary Region to a secondary Region. This meets the requirement of high availability with automatic failover during a regional outage, unlike standard RDS options which lack built-in cross-Region automatic failover.

Exam trap

The trap here is that candidates often confuse Multi-AZ (which is intra-Region) with cross-Region disaster recovery, or assume that a cross-Region Read Replica provides automatic failover, when in fact it requires manual intervention and does not meet the 'automatic failover' requirement.

How to eliminate wrong answers

Option A is wrong because a cross-Region Read Replica requires manual promotion to become the primary, which is not automatic failover and introduces downtime during the promotion process. Option B is wrong because restoring from daily automated snapshots in another Region is a manual, point-in-time recovery process that can lose up to 24 hours of data and does not provide automatic failover. Option C is wrong because Multi-AZ only provides high availability within a single AWS Region, not across different Regions, and cannot protect against a regional outage.

Full explanation →

1212

MCQeasy

A data engineer needs to ensure that a Redshift cluster can recover from a failure with minimal data loss. The cluster is used for reporting and can tolerate a few minutes of downtime. Which feature should the engineer enable?

A.Configure cross-region snapshot copy.

B.Take manual snapshots every hour.

C.Enable Multi-AZ deployment.

D.Enable automated snapshots with a retention period of 1 day.

AnswerD

Automated snapshots allow recovery to any point within the retention period.

Why this answer

Automated snapshots in Amazon Redshift are taken at regular intervals (default every 8 hours or 5 GB of data changes) and retained for a specified period. Enabling automated snapshots with a retention period of 1 day ensures that, in the event of a failure, the cluster can be restored to the most recent snapshot, minimizing data loss to at most the snapshot interval. This aligns with the requirement for minimal data loss and tolerance for a few minutes of downtime, as restoring from a snapshot takes time but preserves recent data.

Exam trap

The trap here is that candidates often confuse Multi-AZ (a feature for RDS, not Redshift) with high availability, or assume manual snapshots are more reliable than automated ones, when in fact automated snapshots with a short retention period provide the best balance of minimal data loss and operational simplicity for Redshift.

How to eliminate wrong answers

Option A is wrong because cross-region snapshot copy provides disaster recovery across AWS regions but does not directly reduce data loss for a single-region failure; it adds latency and cost without improving recovery point objective (RPO) within the primary region. Option B is wrong because manual snapshots every hour require manual intervention and do not guarantee consistent, automated recovery; they also lack the automated scheduling and retention management that Redshift provides, making them less reliable for minimal data loss. Option C is wrong because Redshift does not support Multi-AZ deployment; it is a single-AZ service by design, and enabling Multi-AZ is not a valid feature for Redshift clusters.

Full explanation →

1213

Multi-Selectmedium

A data engineer is designing a data lake on S3 with fine-grained access control using AWS Lake Formation. Which FOUR permissions can be managed by Lake Formation?

Select 4 answers

A.SELECT on a table

B.INSERT on a table

C.DESCRIBE on a table

D.ALTER TABLE on a table

E.DELETE on a table

AnswersA, B, C, E

Correct: Lake Formation supports SELECT permission on tables.

Why this answer

AWS Lake Formation supports fine-grained permissions including SELECT, INSERT, DESCRIBE, and DELETE on tables. ALTER TABLE is not a Lake Formation permission; it is managed by other services like IAM. Therefore, the correct answers are A, B, C, and E.

Exam trap

Candidates often assume DELETE is not managed by Lake Formation, but DELETE is indeed a supported permission for data lake tables.

Full explanation →

1214

MCQhard

A company stores PII in an S3 bucket. The security team wants to use Amazon Macie to discover sensitive data. After enabling Macie, they notice that no sensitive data findings are generated. The S3 bucket is in the same account. What is the most likely reason?

A.The bucket policy blocks access from Macie's service principal.

B.Macie is not configured with cross-account access to the bucket.

C.The S3 bucket is in a different AWS Region than the Macie session.

D.The S3 objects have private ACLs that prevent Macie from reading them.

AnswerC

Macie only analyzes data in the same Region.

Why this answer

Macie only scans buckets in the same AWS Region as the Macie session. If the bucket is in a different region, Macie cannot discover sensitive data in it. Option A is incorrect because Macie uses service-linked roles, not the bucket policy, to access buckets in the same account.

Option B is incorrect because Macie does not require cross-account access for buckets in the same account. Option D is incorrect because Macie can read objects regardless of ACLs as long as the appropriate IAM permissions are granted.

Full explanation →

1215

MCQeasy

A company uses S3 to store sensitive customer data. To prevent accidental public access, a data engineer needs to ensure that all S3 buckets block public access at the account level. Which AWS service should be used to enforce this policy?

A.Enable S3 Block Public Access at the account level in the management account

B.Create an IAM policy that denies s3:PutBucketPolicy

C.Use an SCP in AWS Organizations to deny s3:PutBucketPublicAccessBlock

D.Set up AWS Config rules to automatically remediate public buckets

AnswerC

SCPs can enforce that no account can disable block public access, covering all accounts.

Why this answer

AWS Organizations with SCPs can centrally control permissions across all accounts, including blocking public access to S3 buckets. Option A is wrong because IAM policies are per-identity and not account-wide. Option B is wrong because S3 Block Public Access settings exist per bucket or account, but to enforce across all accounts, Organizations is needed.

Option D is wrong because AWS Config can detect non-compliance but not enforce. Option C is correct.

Full explanation →

1216

MCQeasy

A company is using Amazon DynamoDB for a gaming application. They want to store player session data that expires after 24 hours. Which DynamoDB feature should be used?

A.Time to Live (TTL)

B.DynamoDB Streams

C.Global Tables

D.Point-in-Time Recovery

AnswerA

TTL deletes items automatically after a defined expiration time.

Why this answer

Amazon DynamoDB Time to Live (TTL) allows you to define a per-item timestamp attribute that automatically deletes items after a specified duration. For the gaming session data that must expire after 24 hours, you can set the TTL attribute to the current time plus 24 hours, and DynamoDB will asynchronously delete expired items without any additional cost or write operations.

Exam trap

The trap here is that candidates may confuse DynamoDB Streams (which can react to deletions) with the actual mechanism that performs the deletion, or assume Point-in-Time Recovery can be used to 'roll back' expired data, neither of which addresses automatic expiration.

How to eliminate wrong answers

Option B (DynamoDB Streams) is wrong because it captures a time-ordered sequence of item-level changes (inserts, updates, deletes) in a DynamoDB table, but it does not automatically expire or delete data; it is used for event-driven processing or replication, not for scheduled data removal. Option C (Global Tables) is wrong because it provides multi-region, fully replicated tables for low-latency access and disaster recovery, but it has no built-in mechanism to expire or delete items based on time. Option D (Point-in-Time Recovery) is wrong because it enables continuous backups of DynamoDB table data to restore to any point within the last 35 days, but it does not delete or manage the lifecycle of individual items.

Full explanation →

1217

Multi-Selectmedium

Which TWO actions can reduce the cost of an Amazon S3 bucket that stores infrequently accessed data? (Choose 2.)

Select 2 answers

A.Enable cross-region replication

B.Enable versioning to keep multiple versions

C.Use lifecycle policies to expire objects after a certain period

D.Enable MFA Delete for extra security

E.Transition objects to S3 Standard-IA after 30 days

AnswersC, E

Expiration deletes unneeded objects.

Why this answer

Lifecycle policies allow you to define rules that automatically expire (delete) objects after a specified period, which directly reduces storage costs by removing data that is no longer needed. For infrequently accessed data, deleting obsolete objects prevents paying for unnecessary storage over time.

Exam trap

The DEA-C01 exam often tests the misconception that enabling versioning or replication reduces costs, when in fact both increase storage and transfer costs, while lifecycle policies and storage class transitions are the correct cost-saving mechanisms.

Full explanation →

1218

Multi-Selecteasy

A data engineer is setting up Amazon S3 event notifications to trigger an AWS Lambda function when new objects are uploaded. Which TWO actions are required to enable this?

Select 2 answers

A.Add a resource-based policy to the Lambda function to allow S3 to invoke it.

B.Enable S3 versioning on the bucket.

C.Create an S3 bucket policy that grants S3 permission to invoke Lambda.

D.Configure an event notification on the S3 bucket for s3:ObjectCreated:* events.

E.Set up an Amazon CloudWatch Events rule to detect S3 uploads.

AnswersA, D

Necessary for S3 to trigger Lambda.

Why this answer

Lambda functions use a resource-based policy (also known as a function policy) to grant permissions to other AWS services, such as S3, to invoke the function. Without this policy, S3 will receive an access denied error when trying to trigger the Lambda function. Option D is correct because you must configure an S3 event notification on the bucket for the `s3:ObjectCreated:*` event type to instruct S3 to send a notification to the Lambda function when new objects are uploaded.

Exam trap

The trap here is that candidates often think an S3 bucket policy is needed to allow S3 to invoke Lambda, but in reality, the permission must be granted on the Lambda function's resource-based policy, not on the bucket.

Full explanation →

1219

MCQmedium

A data engineer is troubleshooting a failed AWS Glue ETL job that reads from an S3 bucket and writes to an Amazon Redshift table. The job fails with a permission error. Which IAM policy addition is MOST likely required for the Glue job's role?

A.Add redshift:DataAPI

B.Add redshift:ModifyCluster

C.Add redshift:DescribeStatement

D.Add redshift:GetClusterCredentials

AnswerD

redshift:GetClusterCredentials is required when AWS Glue uses the JDBC driver with IAM authentication to obtain temporary credentials for connecting to Amazon Redshift. This is the correct permission in this scenario.

Why this answer

Redshift:GetClusterCredentials. When AWS Glue writes to Amazon Redshift using the JDBC driver with IAM authentication, the Glue job's IAM role needs the redshift:GetClusterCredentials permission to obtain temporary credentials for the Redshift database. Option A (redshift:DataAPI) is not a valid IAM action; the actual Data API action is redshift:ExecuteStatement.

Options B and C are unrelated to executing queries. Therefore, D is the correct permission required when using the JDBC connection method commonly used by Glue jobs.

Full explanation →

1220

MCQhard

A company uses AWS Glue to transform data in Amazon S3. The transformation logic is written in Python and references several libraries that are not included in the default Glue environment. Which approach should the data engineer use to make these libraries available?

A.Include a requirements.txt file in the Glue job script and run pip install during job initialization.

B.Package the libraries in an AWS Lambda layer and attach it to the Glue job.

C.Upload the libraries as a .zip file to an S3 bucket and reference them in the Glue job's Python library path.

D.Use the --additional-python-modules parameter in the Glue job.

AnswerC

Glue Python shell jobs allow adding custom Python modules from S3.

Why this answer

AWS Glue allows you to provide custom Python libraries by uploading them as a .zip file to an S3 bucket and referencing the S3 path in the 'Python library path' field of the job. This method is supported for both Glue ETL and Python shell jobs, making custom libraries available at runtime. Option A is incorrect because Glue does not execute arbitrary shell commands like 'pip install' during job initialization; the job script runs in a controlled environment.

Option B is incorrect because AWS Lambda layers are specific to Lambda functions and cannot be attached to Glue jobs. Option D is incorrect because the --additional-python-modules parameter, while valid in Glue 3.0 and later, only supports installing packages from PyPI, not custom libraries not published on PyPI.

Full explanation →

1221

MCQmedium

A company wants to ingest streaming data from thousands of IoT devices into AWS for real-time analytics. The data volume is variable and can spike unpredictably. The solution must be serverless and minimize operational overhead. Which AWS service should be used for ingestion?

A.Use Amazon Kinesis Data Firehose to load streaming data directly into Amazon S3.

B.Use Amazon SQS to queue messages and process them in batches.

C.Use Amazon Kinesis Data Streams to ingest and process data in real time.

D.Use AWS IoT Core to ingest data and route it to Amazon DynamoDB.

AnswerC

Amazon Kinesis Data Streams is a serverless streaming data service that can handle variable and high-throughput data from many sources, making it ideal for IoT data ingestion.

Why this answer

Amazon Kinesis Data Streams is the correct choice because it is a serverless, real-time data ingestion service designed to handle variable and unpredictable data volumes from thousands of sources. It provides durable, low-latency streaming with the ability to process data in real time using consumers like Lambda or Kinesis Data Analytics, meeting the requirements for real-time analytics and minimal operational overhead.

Exam trap

The trap here is that candidates often confuse Kinesis Data Firehose (near-real-time, batch delivery) with Kinesis Data Streams (real-time, sub-second processing), assuming Firehose is sufficient for real-time analytics when it actually introduces latency due to its buffering and batching behavior.

How to eliminate wrong answers

Option A is wrong because Amazon Kinesis Data Firehose is a near-real-time delivery service that batches data before loading it into destinations like S3, which introduces latency and does not support sub-second real-time analytics; it also lacks the ability to process data in real time without additional services. Option B is wrong because Amazon SQS is a message queue service designed for decoupling and asynchronous processing, not for real-time streaming ingestion; it does not support ordered, replayable, or high-throughput streaming from thousands of IoT devices, and batch processing adds latency. Option D is wrong because AWS IoT Core is a managed IoT platform that can ingest data from devices but is primarily for device management and MQTT/HTTP communication, not optimized for high-volume, variable streaming data ingestion for real-time analytics; routing to DynamoDB is a specific use case and does not provide the flexible, scalable streaming ingestion needed for real-time analytics.

Full explanation →

1222

Multi-Selecthard

A company has an S3 bucket with versioning enabled that stores critical data. The security team requires that once an object is deleted, it cannot be recovered by anyone, including the root user. Additionally, the company wants to ensure that objects cannot be overwritten for a specified period. Which THREE actions should the data engineer take to meet these requirements? (Choose THREE.)

Select 3 answers

A.Enable S3 Object Lock in compliance mode.

B.Set a retention period on the bucket using Object Lock.

C.Enable S3 Versioning on the bucket.

D.Enable MFA Delete on the bucket.

E.Configure a lifecycle policy to expire noncurrent versions after 1 day.

AnswersA, B, C

Compliance mode prevents deletion by any user, including root.

Why this answer

S3 Object Lock in compliance mode prevents objects from being deleted or overwritten by any user, including the root user, for the duration of the retention period. This meets the requirement that once an object is deleted, it cannot be recovered, because compliance mode locks are immutable and cannot be removed or shortened by anyone. Setting a retention period on the bucket using Object Lock ensures that objects cannot be overwritten for the specified period.

Enabling S3 Versioning is necessary because Object Lock requires versioning to be enabled on the bucket to track object versions and enforce retention settings.

Exam trap

The trap here is that candidates often confuse MFA Delete with Object Lock, thinking MFA Delete provides the same immutability guarantee, but MFA Delete only adds an authentication step and does not prevent deletion by the root user or enforce a retention period.

Full explanation →

1223

MCQhard

Refer to the exhibit. A data engineer attached this S3 bucket policy to the bucket 'example-bucket'. What is the effect of this policy?

A.It allows all PutObject requests that do not use encryption

B.It denies PutObject requests that do not use SSE-S3

C.It denies all PutObject requests unless they use SSE-KMS

D.It denies all PutObject requests from anonymous users

AnswerB

Ly states that the policy denies PutObject requests that do not use SSE-S3. This matches the policy's condition.

Why this answer

The bucket policy denies PutObject requests that do not include the x-amz-server-side-encryption header with value AES256 (SSE-S3). This means any PutObject request without SSE-S3 encryption is denied. Therefore, the correct answer is B.

Full explanation →

1224

Multi-Selecteasy

A data engineer needs to ingest data from a SaaS application (Salesforce) into Amazon S3 on a daily basis. Which TWO AWS services can be used for this purpose? (Choose TWO.)

Select 2 answers

A.AWS DataSync

B.Amazon Kinesis Data Streams

C.AWS Transfer Family

D.AWS Glue

E.Amazon AppFlow

AnswersD, E

Glue can connect to Salesforce via JDBC and write to S3.

Why this answer

AWS Glue is correct because it provides a fully managed ETL service that can connect to Salesforce via JDBC and extract data into Amazon S3 on a scheduled basis. Glue's crawlers and jobs can handle incremental loads and schema evolution, making it suitable for daily ingestion from SaaS sources.

Exam trap

The trap here is that candidates may confuse AWS DataSync's ability to sync from cloud sources (like EFS) with SaaS applications, but DataSync does not support Salesforce or other SaaS APIs natively.

Full explanation →

1225

MCQhard

A company is using AWS Lake Formation to manage permissions on data in Amazon S3. They need to ingest data from an external source into a new database 'sales_db' and a table 'transactions' using AWS Glue. The IAM role used by Glue must have the minimal permissions to create the database and table in the Data Catalog and write data to the S3 location. Which combination of permissions should be granted?

A.IAM policy with `glue:CreateDatabase`, `glue:CreateTable`, and `s3:PutObject`

B.IAM policy with `lakeformation:GrantPermissions` on the database and table

C.IAM policy with `s3:GetObject` and `s3:PutObject` on the target location

D.Lake Formation permissions: `CREATE_DATABASE` on the catalog, `CREATE_TABLE` on `sales_db`, and S3 location permission

AnswerD

Lake Formation controls Data Catalog operations; S3 write is also needed.

Why this answer

AWS Lake Formation manages permissions on the Data Catalog. To create a database and table, the Glue IAM role must have Lake Formation `CREATE_DATABASE` on the catalog and `CREATE_TABLE` on the `sales_db` database. Additionally, to write data to the S3 location, the role needs S3 write permissions (either via an IAM policy or Lake Formation data location permissions).

Option A lacks Lake Formation permissions. Option B grants overly broad `lakeformation:GrantPermissions` which is not needed for creation. Option C provides only S3 permissions, missing Data Catalog permissions.

Thus, D is the minimal combination.

Full explanation →

1226

MCQhard

A healthcare company stores patient records in an S3 bucket encrypted with SSE-S3. The data engineering team uses AWS Glue ETL jobs to process this data and load it into an Amazon Redshift cluster for analytics. Recently, the security team mandated that all sensitive data must be encrypted at rest using customer-managed keys (CMK) in AWS KMS, and that the keys must be rotated automatically every year. The team updated the S3 bucket to use SSE-KMS with a CMK and enabled automatic key rotation. However, after the change, the Glue ETL jobs that read from the S3 bucket started failing with 'Access Denied' errors. The Glue job uses an IAM role named 'GlueETLRole' that has the following permissions: s3:GetObject on the bucket, kms:Decrypt and kms:GenerateDataKey on the CMK, and all necessary Glue permissions. The Redshift cluster is also encrypted with a different CMK, and the Glue role has kms:Decrypt on that key as well. What is the most likely cause of the failure?

A.The KMS key policy for the CMK used for S3 encryption does not grant 'GlueETLRole' permission to use the key.

B.The IAM role 'GlueETLRole' does not have kms:Decrypt permission on the CMK used for S3 encryption.

C.The Glue job requires kms:Encrypt permission to read encrypted data from S3.

D.The S3 VPC endpoint policy does not allow the Glue job to access the KMS key.

AnswerA

The key policy must allow the IAM role to use the key.

Why this answer

The issue is that while the IAM role 'GlueETLRole' has the necessary KMS permissions (kms:Decrypt and kms:GenerateDataKey) via IAM policies, the key policy for the CMK used for S3 encryption must also explicitly grant the role (or the principal) permission to use the key. Without this key policy grant, the role's IAM permissions are insufficient, resulting in 'Access Denied' errors. Option A correctly identifies this as the most likely cause.

Full explanation →

1227

MCQmedium

A company needs to automate the detection of sensitive data in Amazon S3 and generate reports. Which AWS service should be used?

A.Amazon Macie

B.Amazon Inspector

C.Amazon GuardDuty

D.AWS Config

AnswerA

Macie discovers sensitive data in S3.

Why this answer

Amazon Macie is the correct service for automating detection of sensitive data in S3 and generating reports. It uses machine learning to discover and classify sensitive data. Amazon Inspector is for vulnerability management, not sensitive data detection.

Amazon GuardDuty is for threat detection. AWS Config is for resource compliance and configuration auditing.

Full explanation →

1228

MCQmedium

A company uses Amazon S3 to store sensitive customer data. The security team requires that all objects uploaded to a specific bucket be encrypted at rest using AWS KMS with a customer managed key. Which bucket policy statement should be applied to enforce this requirement?

A.Deny s3:PutObject unless s3:x-amz-server-side-encryption is present

B.Allow s3:PutObject only if s3:x-amz-server-side-encryption is present

C.Deny s3:PutObject unless s3:x-amz-server-side-encryption-aws-kms-key-id equals the specific KMS key ARN

D.Deny s3:PutObject unless s3:x-amz-server-side-encryption equals AES256

AnswerC

This condition ensures only the specified KMS key is used for encryption.

Why this answer

The security team requires encryption at rest using AWS KMS with a customer managed key. The bucket policy must deny any s3:PutObject request that does not include the s3:x-amz-server-side-encryption-aws-kms-key-id condition key set to the specific KMS key ARN. This ensures that only objects encrypted with the designated customer managed key are allowed, enforcing the encryption requirement at the bucket policy level.

Exam trap

The trap here is that candidates often confuse the condition key s3:x-amz-server-side-encryption (which only checks for SSE-S3 or SSE-KMS) with s3:x-amz-server-side-encryption-aws-kms-key-id (which checks for a specific KMS key), leading them to pick Option A or D instead of C.

How to eliminate wrong answers

Option A is wrong because it only checks for the presence of any server-side encryption header (s3:x-amz-server-side-encryption), which could be AES256 (SSE-S3) or aws:kms (SSE-KMS), but does not enforce the use of a customer managed KMS key. Option B is wrong because using an Allow effect with a condition does not override a default implicit deny; to enforce a restriction, you must use an explicit Deny statement. Option D is wrong because it requires the encryption header to equal AES256, which enforces SSE-S3, not SSE-KMS with a customer managed key.

Full explanation →

1229

MCQhard

Refer to the exhibit. A data engineer has configured an S3 event notification to send an event to an SQS queue when objects are created in the 'incoming/' prefix. The engineer wants to trigger an AWS Lambda function to process the object. However, the Lambda function is not being invoked. What is the most likely cause?

A.The Lambda function lacks permission to read from the S3 bucket.

B.Lambda is not configured as an event source for the SQS queue.

C.The SQS queue does not exist or is in a different account.

D.The S3 event notification filter prefix is incorrect.

AnswerB

Lambda must poll the SQS queue to be triggered.

Why this answer

The Lambda function is not being invoked because the SQS queue is not configured as an event source for Lambda. Even though S3 sends events to SQS, Lambda will only poll and process messages from the queue if an event source mapping (e.g., via CreateEventSourceMapping) is established. Without this mapping, the messages sit in the queue and Lambda remains idle.

Exam trap

The DEA-C01 exam often tests the distinction between sending events to a queue (S3 → SQS) and actually consuming them (SQS → Lambda), so candidates mistakenly assume that simply having S3 send to SQS will automatically trigger Lambda without an explicit event source mapping.

How to eliminate wrong answers

Option A is wrong because the Lambda function does not need permission to read from the S3 bucket directly; it only needs permission to read from the SQS queue (via the event source mapping) and to access the object in S3 once triggered. Option C is wrong because if the SQS queue did not exist or was in a different account, the S3 event notification would fail immediately (S3 would log an error), but the question states the event is sent to SQS, implying the queue exists and is accessible. Option D is wrong because the S3 event notification filter prefix 'incoming/' is correctly configured to match objects created under that prefix; if it were incorrect, no events would be sent to SQS at all.

Full explanation →

1230

MCQhard

A company uses AWS DMS to migrate an on-premises Oracle database to Amazon RDS for PostgreSQL. The migration completes, but the target table has more rows than the source. Which is the MOST likely cause?

A.DMS used binary replication which included extra metadata rows.

B.Oracle and PostgreSQL handle case sensitivity differently.

C.DMS performed a full load instead of ongoing replication.

D.Target tables lack unique constraints, causing DMS to insert duplicate rows.

AnswerD

Without unique constraints, DMS may re-apply changes and create duplicates.

Why this answer

When target tables lack unique constraints (like primary keys or unique indexes), AWS DMS cannot identify duplicate records during change data capture (CDC). If the same change is applied multiple times (e.g., due to recovery after a failure), DMS may insert duplicate rows, causing the target to have more rows than the source. Option A is incorrect because binary replication is not used; DMS uses logical replication.

Option B is incorrect because case sensitivity differences could lead to missing rows, not extra rows. Option C is incorrect because a full load alone would not cause duplicates; the issue arises during ongoing replication without unique constraints.

Full explanation →

1231

MCQeasy

A data engineer needs to store a large number of small files (each a few KB) from IoT sensors. The data is written once and never modified. The primary requirement is high write throughput and low latency for writes. Which storage solution is most suitable?

A.Amazon DynamoDB with on-demand capacity

B.Amazon RDS for MySQL with InnoDB

C.Amazon S3 with standard storage class

D.Amazon Elastic Block Store (EBS) volumes

AnswerA

DynamoDB provides single-digit millisecond latency and high throughput for writes.

Why this answer

Amazon DynamoDB with on-demand capacity is the most suitable because it is a NoSQL key-value and document database designed for single-digit millisecond latency at any scale. It supports high write throughput by automatically distributing data across multiple partitions, and on-demand capacity eliminates the need for provisioning, allowing it to absorb unpredictable write spikes from many IoT sensors without throttling.

Exam trap

The trap here is that candidates often choose Amazon S3 for storing small files because of its durability and cost, but they overlook the fact that S3's PUT request latency and eventual consistency model make it unsuitable for high-frequency, low-latency write workloads, whereas DynamoDB is purpose-built for such patterns.

How to eliminate wrong answers

Option B (Amazon RDS for MySQL with InnoDB) is wrong because relational databases are optimized for complex queries and ACID transactions, not for high-throughput ingestion of many small, immutable writes; they incur overhead from indexing, locking, and transaction logs that limit write throughput. Option C (Amazon S3 with standard storage class) is wrong because S3 is an object store optimized for durability and high read throughput, but it has a minimum object size of 0 bytes and a write latency of tens to hundreds of milliseconds per PUT request, making it unsuitable for low-latency, high-frequency writes of many small files. Option D (Amazon Elastic Block Store volumes) is wrong because EBS provides block-level storage volumes attached to a single EC2 instance, which creates a bottleneck for distributed write workloads and does not natively support the high concurrency needed for thousands of simultaneous sensor writes.

Full explanation →

1232

MCQeasy

A data engineer needs to back up an Amazon DynamoDB table daily. The backup must be restorable to a specific point in time within the last 24 hours. Which solution meets these requirements with the LEAST operational overhead?

A.Create an on-demand backup of the table every 24 hours.

B.Use DynamoDB Streams to replicate data to another table.

C.Enable point-in-time recovery (PITR) on the table.

D.Export the table data to Amazon S3 every 6 hours using a Lambda function.

AnswerC

Point-in-time recovery allows restoring to any second within the last 35 days with no operational overhead, meeting the requirement exactly.

Why this answer

DynamoDB's point-in-time recovery (PITR) provides continuous backups that allow restoration to any point within the last 35 days with no manual scheduling. Option A is incorrect because on-demand backups are manual and not continuous. Option B is incorrect because DynamoDB Streams captures changes in near-real time but does not provide a backup mechanism; it is used for event-driven processing and replication, not for point-in-time restoration.

Option D is incorrect because exporting to S3 requires manual scheduling and is not a backup feature.

Full explanation →

1233

MCQmedium

Refer to the exhibit. A data engineer runs this AWS CLI command to execute an Athena query. What is the purpose of the EncryptionConfiguration parameter?

A.It encrypts the query string in transit

B.It encrypts the data in the source table

C.It enables client-side encryption for the query output

D.It encrypts the query results stored in Amazon S3 at rest

AnswerD

The parameter defines encryption for the result set in S3.

Why this answer

The EncryptionConfiguration parameter in Athena specifies how the query results stored in S3 are encrypted at rest. SSE_S3 means server-side encryption with S3-managed keys. It does not encrypt the query itself, data in transit, or the source data.

Full explanation →

1234

MCQmedium

A media company stores video files in an S3 bucket. The files are processed by a fleet of EC2 instances that read the files, add watermarks, and write the output back to the same bucket. Recently, the processing jobs have been failing with '500 Internal Server Error' and '503 Slow Down' errors. The data engineer checks the S3 bucket metrics and sees that the PUT/GET request rate is consistently above 5,500 requests per second for a single prefix. The engineer needs to resolve the errors with minimal changes to the application code. Which course of action should the engineer take?

A.Use S3 Batch Operations to process the files.

B.Increase the number of EC2 instances to process files in parallel.

C.Enable S3 Transfer Acceleration on the bucket to improve throughput.

D.Modify the application to add a random hash prefix to the object keys to distribute load across multiple prefixes.

AnswerD

Spreading requests across many prefixes increases the aggregate request rate limit.

Why this answer

S3 supports up to 5,500 GET/HEAD requests per second per prefix (and 3,500 PUT requests). By adding a random hash prefix to object keys, the load is distributed across multiple prefixes, effectively increasing the aggregate request rate limit. Option A (S3 Batch Operations) is designed for large-scale batch operations, not for real-time processing, and would not resolve the immediate request rate errors.

Option B (increasing EC2 instances) would increase the request rate, potentially worsening the problem. Option C (S3 Transfer Acceleration) improves transfer speed over long distances but does not affect the per-prefix request rate limits.

Full explanation →

1235

MCQeasy

A data engineer is troubleshooting an AWS Glue job that reads from an Apache Kafka topic using a Glue connector. The job fails with 'TimeoutException'. The Kafka cluster is in a VPC. Which step should the engineer take FIRST?

A.Check the security group and network ACLs associated with the Glue job's VPC.

B.Increase the Kafka consumer session timeout.

C.Update the Glue connector to the latest version.

D.Change the Glue job type from Spark to Python Shell.

AnswerA

Network configuration is the most common cause of timeouts.

Why this answer

A 'TimeoutException' when reading from Kafka in a VPC typically indicates a network connectivity issue. The first step should be to verify that the security group and network ACLs allow traffic between the Glue job's VPC and the Kafka cluster. Option B (increasing consumer timeout) may be considered after confirming network connectivity, but it is not the first step.

Option C (updating the connector) is unrelated to network timeouts. Option D (changing job type) does not address the root cause.

Full explanation →

1236

MCQmedium

A data engineer notices that an AWS Glue ETL job that processes streaming data from Amazon Kinesis Data Streams is failing intermittently with a 'ResourceNotFoundException' error for the Kinesis stream. The job has been running successfully for weeks. Which action should the engineer take to resolve the issue?

A.Increase the number of shards in the Kinesis data stream to handle higher throughput.

B.Rename the Kinesis data stream to match the stream name used in the Glue job exactly, including case.

C.Add the 'kinesis:DescribeStream' permission to the IAM role used by the Glue job.

D.Increase the timeout for the Glue job in the job configuration.

AnswerC

Missing DescribeStream permission causes intermittent resource not found errors.

Why this answer

The most common cause of intermittent 'ResourceNotFoundException' for a Kinesis stream is that the IAM role used by the Glue job does not have the kinesis:DescribeStream permission, which is required for the job to check stream details. Option A is incorrect because increasing the Kinesis shard count would not resolve a permissions issue. Option B is incorrect because the Kinesis stream name must match exactly; case sensitivity would cause a consistent error, not intermittent.

Option D is incorrect because the timeout setting on the Glue job would not cause a resource not found error.

Full explanation →

1237

MCQhard

A company uses Amazon EMR to process data stored in S3 with server-side encryption using AWS KMS. The EMR cluster fails with a "403 Access Denied" error when reading data from S3. The IAM role for the EMR cluster has s3:GetObject and kms:Decrypt permissions. What is the most likely issue?

A.The EC2 instance profile does not have kms:Decrypt permission

B.The S3 bucket policy denies access to the EMR cluster's IAM role

C.The EMRFS consistent view is not enabled

D.The EMR cluster is using an incorrect KMS key ID

AnswerA

The instance profile must have KMS decrypt permission.

Why this answer

Although the IAM role assigned to the EMR cluster has s3:GetObject and kms:Decrypt permissions, the EC2 instances themselves run under an instance profile (an IAM role for EC2). For S3 objects encrypted with SSE-KMS, the EC2 instance performing the read must have kms:Decrypt permission. If the instance profile lacks this permission, the request is denied with a 403 error.

Option B is less likely because a bucket policy denying access would be explicit and typically not the first thing to check. Option C (EMRFS consistent view) does not affect S3 access permissions. Option D (incorrect KMS key ID) would cause a different error (e.g., 400 Bad Request or access denied for specific keys), but the primary cause is the missing kms:Decrypt on the instance profile.

Full explanation →

1238

Multi-Selecteasy

A company is using AWS Glue to process data stored in Amazon S3. The Glue job runs successfully but takes longer than expected. Which TWO actions can reduce the job runtime?

Select 2 answers

A.Disable job bookmarking

B.Increase the number of DPUs allocated to the job

C.Reduce the number of workers

D.Change the job type from Spark to Python shell

E.Partition the input data in S3

AnswersB, E

More DPUs enable parallel processing, reducing runtime.

Why this answer

Increasing DPUs (Data Processing Units) allocates more compute resources to the Glue job, allowing it to process data faster, thus reducing runtime. Option E is correct: Partitioning the input data in S3 allows Glue to use partition pruning, reading only the necessary partitions instead of scanning the entire dataset, which reduces I/O and processing time. Option A is incorrect: Disabling job bookmarking does not reduce runtime; it only affects how Glue tracks processed data and might cause reprocessing.

Option C is incorrect: Reducing the number of workers would decrease parallelism, likely increasing runtime. Option D is incorrect: Changing from Spark to Python Shell would likely increase runtime because Python Shell is single-threaded and not designed for large-scale data processing compared to Spark.

Full explanation →

1239

MCQhard

A company is using Amazon Kinesis Data Streams with a Lambda consumer to process real-time events. The Lambda function is triggered by a DynamoDB stream to update a counter. Recently, the counter has been inaccurate due to duplicate processing. What is the most likely cause?

A.The DynamoDB stream is configured with 'TRIM_HORIZON' iterator type

B.The Lambda function's reserved concurrency is too low

C.The Lambda function is not idempotent and is being retried on failures

D.The Kinesis stream has undergone a shard rebalance

AnswerC

Retries cause duplicate updates if the function is not idempotent.

Why this answer

The Lambda function is invoked at least once per record in the DynamoDB stream. If the function fails or times out, it may be retried, processing the same record again. If the function is not idempotent, this retry leads to duplicate updates to the counter.

Option A is incorrect because TRIM_HORIZON is a Kinesis iterator type, not relevant to DynamoDB streams. Option B is incorrect because low reserved concurrency would cause throttling, not duplicate processing. Option D is incorrect because shard rebalancing occurs in Kinesis, not DynamoDB streams, and does not cause duplicates.

Full explanation →

1240

MCQhard

A data engineer runs a weekly AWS Glue ETL job that processes data from Amazon DynamoDB to Amazon S3. The job reads the entire table every time, which is slow and expensive. The job needs to process only items that changed since the last run. Which solution should the engineer implement?

A.Use DynamoDB Scan with a LastEvaluatedKey to paginate and store the last scanned key to resume next time

B.Enable DynamoDB Streams and process change events with AWS Lambda to write to S3

C.Add a Global Secondary Index (GSI) on a timestamp attribute and query only new records

D.Use AWS Database Migration Service (DMS) with ongoing replication from DynamoDB to S3

AnswerB

Streams capture item-level changes, enabling incremental loads.

Why this answer

DynamoDB Streams captures item-level changes (inserts, updates, deletes) in near real-time. An AWS Lambda function can process these change events and write only the incremental data to Amazon S3, eliminating the need to scan the entire DynamoDB table. This approach is both cost-effective and efficient for incremental data ingestion.

Exam trap

The trap here is that candidates may think a GSI on a timestamp (Option C) is sufficient for incremental processing, but it fails to capture updates to existing items that do not change the timestamp, and it still requires a full scan of the index to find new records.

How to eliminate wrong answers

Option A is wrong because using DynamoDB Scan with LastEvaluatedKey still reads the entire table every time; it only paginates the results, not reduces the data read. Option C is wrong because a Global Secondary Index (GSI) on a timestamp attribute does not automatically track changes; you would still need to query for new records based on a timestamp, which requires storing the last processed timestamp and can miss updates to existing items. Option D is wrong because AWS Database Migration Service (DMS) with ongoing replication is designed for continuous database migration and can be complex to set up for simple incremental loads; it is overkill compared to using DynamoDB Streams with Lambda, and DMS does not natively write to S3 in a format optimized for analytics without additional transformation.

Full explanation →

1241

MCQhard

A company has an S3 bucket policy that allows access to a specific IAM role. However, an administrator notices that requests from that role are being denied. The bucket is encrypted with AES-256. What is the MOST likely reason for the denial?

A.The IAM role does not have s3:Decrypt permission on the bucket.

B.The bucket policy has an explicit deny statement that overrides the allow.

C.The bucket policy allows access, but the VPC endpoint policy denies the action.

D.The S3 Block Public Access settings are blocking the request.

AnswerC

A VPC endpoint policy can restrict actions even if the bucket policy allows them.

Why this answer

The most likely reason for the denial is that the VPC endpoint policy denies the action. Even if the bucket policy allows access to the IAM role, the VPC endpoint policy can explicitly deny the action, which overrides the bucket policy. Option A is incorrect because AES-256 encryption does not require additional permissions like s3:Decrypt.

Option B is incorrect because the question indicates the bucket policy allows access, not denies. Option D is incorrect because S3 Block Public Access settings only apply to public access, not to requests from an IAM role.

Full explanation →

1242

MCQeasy

The exhibit shows a build log from AWS CodeBuild. The build fails with a permission error when trying to open the downloaded file. What is the most likely cause?

A.The S3 bucket policy denies access to the object.

B.The python script is not in the PATH.

C.The downloaded file has restrictive permissions that the python process cannot read.

D.The file is encrypted and cannot be decrypted.

AnswerC

Permission denied suggests file ownership/permissions issue.

Why this answer

The build log shows a permission error when the Python script attempts to open the downloaded file. This typically occurs because the file was downloaded with restrictive permissions (e.g., 600 or 700) that only allow the file owner (likely root) to read it. In AWS CodeBuild, if the Python script runs as a non-root user (or even as root but the file is owned by another user with no read permissions), it cannot access the file.

Option C correctly identifies this scenario, while other options are less likely: the S3 bucket policy would affect the download itself, not the open operation; PATH issues relate to command execution, not file reading; encryption would likely produce a different error message.

Full explanation →

1243

MCQeasy

A data engineer needs to encrypt data in transit between an Amazon RDS for MySQL instance and an application. Which solution should be used?

A.Enable encryption at rest using AWS KMS

B.Use SSL/TLS to connect to the RDS instance

C.Store the data in Amazon S3 with server-side encryption

D.Use AWS CloudHSM to generate and store encryption keys

AnswerB

SSL/TLS encrypts data in transit between client and database.

Why this answer

SSL/TLS is used to encrypt data in transit between clients and RDS. Option A is wrong because KMS encrypts data at rest, not in transit. Option C is wrong because S3 is not involved in this scenario.

Option D is wrong because CloudHSM provides hardware security modules for key storage, not encryption in transit.

Full explanation →

1244

MCQmedium

A data engineer needs to transform JSON data into Parquet format using AWS Glue. The input data has nested fields. Which Glue feature should be used to flatten the nested structure?

A.Relationalize transform

B.DropNullFields transform

C.FindMatches transform

D.Map transform

AnswerA

Relationalize transforms nested JSON into flat tables.

Why this answer

The Relationalize transform is the correct choice because it is specifically designed to flatten nested JSON structures (such as arrays and structs) into a set of related tables (DataFrames) that can be written as Parquet. This transform recursively extracts nested fields, creating separate DataFrames for each level of nesting, which is essential for converting complex JSON into a flat, columnar Parquet format suitable for analytics.

Exam trap

The trap here is that candidates may confuse the Map transform (which can flatten JSON with custom code) with a built-in flattening feature, but AWS Glue's Relationalize is the dedicated, no-code solution for this specific task, and the exam expects you to know the exact purpose of each transform.

How to eliminate wrong answers

Option B (DropNullFields transform) is wrong because it only removes fields with null values from the schema, not flattening nested structures. Option C (FindMatches transform) is wrong because it is used for fuzzy matching and deduplication of records, not for schema transformation. Option D (Map transform) is wrong because it applies a custom function to each row or column but does not inherently flatten nested JSON; it requires manual coding to handle nesting, whereas Relationalize automates the process.

Full explanation →

1245

MCQmedium

A data engineering team uses Amazon S3 to store raw data files. They have an AWS Glue ETL job that reads from an S3 bucket, transforms the data, and writes to a Redshift cluster. The job runs daily and has been failing intermittently with the error: 'An error occurred while calling o143.pyWriteDynamicFrame. S3 Access Denied'. The team has confirmed that the IAM role used by the Glue job has s3:GetObject and s3:PutObject permissions on the bucket and all objects. The Redshift cluster is in the same VPC and the Glue connection is configured correctly. What is the most likely cause of the failure?

A.The Redshift cluster is not publicly accessible and the Glue job does not have a VPC endpoint to Redshift.

B.The Glue job has exceeded the maximum execution time and is being killed by AWS.

C.The Glue job is using the wrong JDBC driver version for Redshift.

D.The Glue job's IAM role lacks permission to write to the Glue temporary file bucket (aws-glue-*).

AnswerD

Glue uses a temporary S3 bucket for staging; the role must have s3:PutObject on that bucket.

Why this answer

Glue jobs use a special S3 bucket for bookkeeping and temporary data. The job's IAM role must have s3:PutObject permission on the bucket used for temporary files, which is often 'aws-glue-*' for the same region. If this permission is missing, the job fails with access denied.

Option A is wrong because the error is an S3 access issue, not a network timeout. Option B is wrong because the error is not related to schema mismatch. Option C is wrong because the error is an S3 access issue, not a Glue job timeout.

Full explanation →

1246

Multi-Selecthard

A company is designing a multi-Region disaster recovery solution for Amazon DynamoDB. They need to ensure that data is replicated across Regions with minimal latency and that applications can read from any Region. Which THREE steps should be taken? (Choose THREE.)

Select 3 answers

A.Configure application to read from any Region using the DynamoDB endpoint.

B.Configure Time to Live (TTL) to automatically expire old data.

C.Enable DynamoDB Global Tables.

D.Enable DynamoDB Streams on the table.

E.Deploy DynamoDB Accelerator (DAX) in each Region.

AnswersA, C, D

Global Tables allow reads from any Region.

Why this answer

DynamoDB Global Tables provide multi-Region, multi-master replication, allowing applications to read from any Region by simply pointing to the local DynamoDB endpoint. This ensures low-latency reads by serving data from the closest Region, and the replication is fully managed by DynamoDB.

Exam trap

The trap here is that candidates may confuse DAX (a single-Region cache) with a multi-Region replication solution, or mistakenly think TTL can be used for data synchronization, when in fact only Global Tables combined with Streams provide the required cross-Region replication and read capability.

Full explanation →

1247

MCQeasy

A data engineer needs to schedule an AWS Glue ETL job to run every hour and process new data that arrives in an S3 bucket. The job should only process files that have been added since the last run. Which approach should the engineer use to track which files have been processed?

A.Configure S3 Event Notifications to trigger the Glue job on each new object creation.

B.Enable job bookmarks in the Glue ETL job.

C.Store the last processed timestamp in a DynamoDB table and query it at the start of the job.

D.Use S3 Inventory to list all objects and filter by last modified date in the job.

AnswerB

Glue job bookmarks automatically track the state of data processed and only process new data.

Why this answer

AWS Glue job bookmarks automatically track the last processed data, allowing the job to incrementally process only new files since the last run. This is the native, built-in mechanism for stateful incremental processing in Glue ETL, eliminating the need for external tracking.

Exam trap

The trap here is that candidates often choose Option A (S3 Event Notifications) because it seems like a direct trigger for new files, but they overlook that the requirement is for an hourly batch job that tracks processed files across runs, not a per-file event-driven trigger.

How to eliminate wrong answers

Option A is wrong because S3 Event Notifications trigger the job per object creation, which can lead to duplicate processing if multiple files arrive within the hour and does not inherently track which files have been processed across runs. Option C is wrong because storing the last processed timestamp in DynamoDB requires custom implementation and maintenance, and it does not handle edge cases like file overwrites or partitions as reliably as Glue bookmarks. Option D is wrong because S3 Inventory provides periodic snapshots (daily or weekly) and is not designed for real-time or hourly incremental processing; filtering by last modified date in the job would require full scans and manual state management.

Full explanation →

1248

MCQeasy

A company wants to schedule a nightly batch job to copy data from an on-premises PostgreSQL database to Amazon S3. The solution must minimize operational overhead. Which AWS service should be used?

A.AWS Glue

B.AWS Data Pipeline

C.Amazon EMR

D.AWS Database Migration Service (AWS DMS) with ongoing replication

AnswerA

AWS Glue can run scheduled ETL jobs to read from PostgreSQL and write to S3 with minimal overhead.

Why this answer

AWS Glue is the correct choice because it provides a fully managed ETL service that can connect to on-premises PostgreSQL via JDBC, extract data, and write it to Amazon S3 with minimal configuration. Glue's built-in scheduler can run the job nightly, eliminating the need to manage servers or orchestration infrastructure, which directly meets the requirement to minimize operational overhead.

Exam trap

The trap here is that candidates often confuse AWS DMS (designed for continuous replication) with batch data movement, overlooking that DMS's ongoing replication feature is not intended for scheduled batch jobs and adds unnecessary overhead for a simple nightly copy.

How to eliminate wrong answers

Option B (AWS Data Pipeline) is wrong because, while it can copy data from on-premises databases to S3, it requires managing a task runner on-premises and has higher operational overhead compared to Glue's serverless model. Option C (Amazon EMR) is wrong because it is designed for big data processing using Hadoop/Spark clusters and introduces significant overhead for cluster management, making it overkill for a simple nightly batch copy job. Option D (AWS DMS with ongoing replication) is wrong because it is primarily intended for database migration and continuous replication, not for scheduled batch jobs; using it for nightly batch copies would incur unnecessary complexity and cost for ongoing change data capture.

Full explanation →

1249

Multi-Selectmedium

A company runs a data pipeline that ingests clickstream data from a web application into Amazon Kinesis Data Streams. A Lambda function processes records from the stream and writes them to an Amazon S3 bucket in JSON format. The pipeline has been running smoothly, but for the past hour, the Lambda function has been failing with 'Rate exceeded' errors, and the Kinesis stream shows elevated 'IteratorAgeMilliseconds' metrics. The Lambda function has a reserved concurrency of 100, and the Kinesis stream has 10 shards. The average record size is 5 KB, and the data rate is approximately 15 MB per second. Which combination of actions should a data engineer take to resolve the issue and prevent recurrence? (Choose TWO.)

Select 2 answers

A.Increase the Lambda function's reserved concurrency to 200.

B.Increase the number of Kinesis shards to 20.

C.Decrease the Lambda function's batch size from 100 to 50.

D.Enable S3 multipart upload for the Lambda function.

E.Replace the Lambda function with Amazon Kinesis Data Firehose to write directly to S3.

AnswersA, B

More concurrency allows more parallel invocations to process records faster.

Why this answer

The 'Rate exceeded' errors indicate that the Lambda function's concurrency is insufficient to keep up with the incoming data rate from Kinesis. With 10 shards and a 15 MB/s data rate, each shard processes ~1.5 MB/s, and with 5 KB records, that's ~300 records per second per shard. Increasing reserved concurrency to 200 allows more parallel invocations to handle the load, reducing the iterator age.

Exam trap

The trap here is that candidates often focus only on Lambda concurrency (Option A) and overlook the Kinesis shard count (Option B), not realizing that both the consumer (Lambda) and the stream capacity must be scaled together to resolve throughput bottlenecks.

Full explanation →

1250

MCQeasy

A company uses AWS Kinesis Data Firehose to deliver streaming data to an Amazon S3 bucket. Recently, the delivery stream has been failing with the error 'S3 bucket does not exist'. The S3 bucket exists and the Firehose IAM role has s3:PutObject permissions. What is the most likely cause?

A.The S3 bucket name is misspelled in the Firehose configuration.

B.The S3 bucket has default encryption enabled.

C.The S3 bucket is in a different AWS Region than the Firehose stream.

D.The IAM role does not have s3:ListBucket permission.

AnswerC

Firehose can only deliver to S3 buckets in the same region.

Why this answer

The most likely cause is that the S3 bucket is in a different AWS Region than the Firehose stream. AWS Kinesis Data Firehose requires the destination S3 bucket to be in the same region as the delivery stream. If the bucket is in a different region, Firehose will fail with a 'S3 bucket does not exist' error even though the bucket exists.

Option A is incorrect because a misspelled bucket name would cause a similar error, but the error message specifically says the bucket does not exist, which can also happen if the bucket is in a different region. Option B is incorrect because default encryption does not affect the bucket's existence; Firehose can write to encrypted buckets with the proper permissions. Option D is incorrect because s3:ListBucket permission is not required for Firehose to deliver data; s3:PutObject is sufficient.

Full explanation →

1251

Multi-Selectmedium

A company uses Amazon DynamoDB for a gaming leaderboard. The table has a primary key of GameId (partition key) and Score (sort key). The application needs to retrieve the top 10 scores for a given game. Which strategies can improve query performance? (Choose TWO.)

Select 2 answers

A.Change the primary key to a single attribute

B.Create a global secondary index with Score as sort key

C.Use a Scan operation with a limit

D.Increase the write capacity units

E.Use DynamoDB Accelerator (DAX) for caching

AnswersB, E

Allows efficient sorted queries.

Why this answer

Creating a global secondary index (GSI) with Score as the sort key allows efficient range queries on scores for a given GameId. DynamoDB can then use the GSI to retrieve the top 10 scores in sorted order without scanning the entire table, leveraging the index's sort key to fetch only the highest values.

Exam trap

The trap here is that candidates may think a Scan with a limit is efficient for top-N queries, but DynamoDB Scans always read the entire dataset up to the limit, making them unsuitable for sorted retrieval without additional processing.

Full explanation →

1252

MCQmedium

A company uses Amazon Redshift for data warehousing. The data engineering team notices that queries are slow due to high disk I/O. The team wants to improve query performance without changing the cluster configuration. Which action should the team take?

A.Increase the number of nodes in the cluster.

B.Redesign tables with appropriate sort keys and distribution styles.

C.Run the ANALYZE command to update table statistics.

D.Run the VACUUM command to reclaim disk space.

AnswerB

Proper sort keys and distribution can minimize data scanning and reduce I/O.

Why this answer

Redesigning tables with appropriate sort keys and distribution styles directly addresses high disk I/O by minimizing data scanning and reducing data movement across nodes. Sort keys enable Redshift to skip irrelevant blocks via zone maps, while distribution styles (KEY, ALL, EVEN) optimize data locality for joins and aggregations, reducing I/O without changing cluster configuration.

Exam trap

The trap here is that candidates confuse maintenance commands (ANALYZE, VACUUM) with design changes, or think scaling out (adding nodes) is allowed when the question explicitly forbids changing cluster configuration.

How to eliminate wrong answers

Option A is wrong because increasing the number of nodes changes the cluster configuration, which the question explicitly prohibits. Option C is wrong because ANALYZE updates table statistics for the query planner but does not reduce disk I/O caused by poor data layout or data movement. Option D is wrong because VACUUM reclaims disk space from deleted rows and sorts data, but it does not fundamentally redesign tables to reduce I/O; it only maintains existing design.

Full explanation →

1253

MCQeasy

A company wants to store historical financial data for 7 years with immediate access for the first year and then infrequent access. After 7 years, the data must be automatically deleted. Which S3 lifecycle policy should be configured?

A.Transition to S3 Standard-IA after 30 days, expire after 2555 days

B.Transition to S3 Glacier Flexible Retrieval after 365 days, expire after 2555 days

C.Transition to S3 One Zone-IA after 90 days, expire after 365 days

D.Transition to S3 Glacier Deep Archive after 365 days, expire after 2555 days

AnswerD

This is cost-effective: immediate access for 1 year, then low-cost storage, delete after 7 years.

Why this answer

It meets all requirements: immediate access for the first year (no transition before 365 days), then transition to S3 Glacier Deep Archive for infrequent access and cost savings, with automatic deletion after 7 years (2555 days). S3 Glacier Deep Archive is the most cost-effective storage class for long-term archival data that is rarely accessed, and the 2555-day expiration ensures compliance with the 7-year retention policy.

Exam trap

The trap is that candidates may think Option B is correct because it transitions to Glacier Flexible Retrieval after 365 days and expires after 2555 days, but this option provides immediate access for only the first year? Actually, Standard-IA (Option A) and One Zone-IA (Option C) are not suitable for long-term archival. Option D is correct because Glacier Deep Archive offers the lowest cost for infrequent access after year one, with deletion after 7 years. The key mistake is choosing a storage class that is too expensive or not durable enough for the full 7-year retention.

How to eliminate wrong answers

Option A is wrong because transitioning to S3 Standard-IA after 30 days would move data too early, incurring unnecessary costs for the first year when immediate access is needed, and the 2555-day expiration is correct but the storage class is not suitable for infrequent access after year one. Option B is wrong because transitioning to S3 Glacier Flexible Retrieval after 365 days is acceptable, but this option lacks an expiration action, so data would not be automatically deleted after 7 years, violating the requirement. Option C is wrong because transitioning to S3 One Zone-IA after 90 days is too early and does not provide the durability needed for financial data (single AZ risk), and the 365-day expiration is far too short for a 7-year retention requirement.

Full explanation →

1254

Multi-Selecthard

A financial services company needs to share sensitive customer data with a third-party analytics firm. The data resides in an S3 bucket encrypted with an AWS KMS customer managed key. The third party has their own AWS account. Which combination of steps is required to securely share the data? (Choose TWO.)

Select 2 answers

A.Share the KMS key material with the third party

B.Update the KMS key policy to include the third-party account as a principal with kms:Decrypt permission

C.Create an IAM role in the third-party account that can be assumed by the data owner

D.Grant the third-party account access to the KMS key management

E.Configure an S3 bucket policy that grants the third-party account access to the objects

AnswersB, E

Correct. The KMS key policy must include the third-party account as a principal with kms:Decrypt permission to enable decryption of the data.

Why this answer

To share encrypted data cross-account, you must grant the third-party account access to both the S3 objects and the KMS key. Option B is correct: the KMS key policy must include the third-party account as a principal with kms:Decrypt permission to allow decryption. Option E is correct: the S3 bucket policy must grant the third-party account access to the objects (e.g., s3:GetObject).

Option A is wrong because sharing the key material is insecure and not necessary; instead, you grant decrypt permissions via the key policy. Option C is wrong: the IAM role should be created in the data owner's account, not the third-party's, and the third-party would assume that role; however, this alone does not provide KMS decrypt access. Option D is wrong because the third party does not need key management permissions (e.g., kms:PutKeyPolicy); only decrypt is needed.

Full explanation →

1255

MCQeasy

A data engineer needs to ensure that all data in an S3 bucket is encrypted at rest. The bucket contains objects uploaded by various applications. What is the simplest method to enforce encryption for all new objects?

A.Enable S3 Block Public Access to block public access to the bucket.

B.Enable default encryption on the S3 bucket using S3-Managed Keys (SSE-S3).

C.Enable S3 Object Lock on the bucket.

D.Configure an S3 bucket policy that denies PutObject requests without the x-amz-server-side-encryption header.

AnswerD

A bucket policy can conditionally deny uploads that lack the required encryption header, enforcing encryption for all new objects.

Why this answer

An S3 bucket policy can deny PutObject requests that do not include the x-amz-server-side-encryption header, thereby enforcing encryption for all new objects. Option A is wrong because S3 Block Public Access does not enforce encryption. Option B is wrong because default encryption applies only if the upload request does not specify encryption headers; it does not enforce encryption for requests that specify 'None'.

Option C is wrong because S3 Object Lock prevents deletion but does not enforce encryption.

Full explanation →

1256

MCQhard

A company has an AWS Glue ETL job that reads from an RDS MySQL instance and writes to S3. The security team requires that the connection to RDS be encrypted and that credentials be rotated automatically. Which configuration should be used?

A.Store the database password in an encrypted parameter in Systems Manager Parameter Store and enable SSL for the connection.

B.Use IAM database authentication for RDS and store credentials in Glue connection properties.

C.Store the password in a text file in an encrypted S3 bucket and use SSL.

D.Store the password in AWS Secrets Manager with automatic rotation enabled and configure Glue to use SSL for the connection.

AnswerD

Secrets Manager supports rotation and Glue can use SSL.

Why this answer

AWS Secrets Manager provides automatic rotation of RDS credentials, and AWS Glue can be configured to use SSL for an encrypted connection to RDS MySQL. Option A (Systems Manager Parameter Store) stores encrypted parameters but does not natively support automatic rotation of RDS credentials. Option B (IAM database authentication) provides authentication but does not encrypt the connection itself; SSL is still required for encryption.

Option C (encrypted S3 bucket) is not a service designed for dynamic credential management and lacks automatic rotation.

Full explanation →

1257

Multi-Selecthard

A data engineer is troubleshooting an AWS Glue job that reads from Amazon S3 and writes to Amazon Redshift. The job runs successfully but 5% of records are missing after the load. The engineer suspects data consistency issues. Which THREE actions could help diagnose and resolve the problem? (Choose THREE.)

Select 3 answers

A.Use the Redshift COPY command with a manifest file to load data.

B.Increase the number of DPUs for the Glue job.

C.Enable Glue job bookmarks to track processed files.

D.Use a staging table in Redshift with a transaction to commit.

E.Review the job's CloudWatch Logs for any error messages.

AnswersA, C, E

Manifest file ensures all files are loaded.

Why this answer

Using the Redshift COPY command with a manifest file ensures that only the exact files listed in the manifest are loaded, eliminating the risk of partial or duplicate reads from S3. This is a common pattern to guarantee data consistency when the Glue job may not reliably track which files have been processed, especially in scenarios with concurrent writes or retries.

Exam trap

The trap here is that candidates often assume performance tuning (increasing DPUs) or database-level transactions (staging tables) can fix data ingestion gaps, when the actual problem is incomplete or inconsistent file discovery from the source (S3).

Full explanation →

1258

MCQhard

A company uses Amazon S3 to store large datasets. The data engineering team needs to provide access to specific objects in the bucket to external partners using presigned URLs. Each URL should expire after 12 hours. The team wants to ensure that the presigned URLs cannot be used to access other objects in the bucket. Which approach should be taken?

A.Create an IAM role for each partner and attach a policy that grants access to specific objects.

B.Generate presigned URLs using the AWS SDK, specifying the exact object key and expiration time.

C.Use a bucket policy that allows access only from the partner's IP address range.

D.Use CloudFront signed URLs with a custom policy that restricts access to specific objects.

AnswerB

Presigned URLs grant access only to the specified object and expire after the set time.

Why this answer

Presigned URLs generated via the AWS SDK allow you to specify the exact object key and expiration time, ensuring that the URL grants access only to that specific object for the defined 12-hour period. This approach uses the secret key of the IAM user or role to sign the URL, and the signature is tied to the object key, so the URL cannot be reused to access other objects in the bucket.

Exam trap

The DEA-C01 exam often tests the distinction between presigned URLs (which are tied to a specific object key and expiration) and bucket policies or IAM roles (which grant broader access), leading candidates to overcomplicate the solution with CloudFront or IP-based restrictions when a simple SDK-generated presigned URL is sufficient.

How to eliminate wrong answers

Option A is wrong because creating an IAM role for each partner and attaching a policy that grants access to specific objects does not inherently enforce time-limited access; the role would need additional mechanisms like STS to generate temporary credentials, and it does not provide the simplicity of a single URL. Option C is wrong because a bucket policy that allows access only from the partner's IP address range would grant access to all objects in the bucket (or a broader set) rather than restricting to specific objects, and it does not provide time-limited access. Option D is wrong because CloudFront signed URLs require CloudFront distribution and custom origin setup, which adds unnecessary complexity and cost; while they can restrict access to specific objects, they are not the simplest or most direct solution for S3 presigned URLs, and the question specifically asks for presigned URLs.

Full explanation →

1259

MCQhard

Refer to the exhibit. A CloudFormation template is used to create a DynamoDB table. After creation, a data engineer wants to restore the table to a point in time from 3 hours ago. Which action is required?

A.Create a manual backup of the table first.

B.Enable AWS Backup to schedule automatic backups.

C.Ensure the table has at least one on-demand backup.

D.Use the AWS CLI or Console to initiate a point-in-time restore specifying the desired timestamp.

AnswerD

PITR is enabled, so restore is straightforward.

Why this answer

To restore a DynamoDB table to a point in time, the table must have point-in-time recovery (PITR) enabled. If it is enabled, you can use the AWS CLI or Console to initiate a point-in-time restore by specifying the desired timestamp. Option A is incorrect because a manual backup is not required; PITR uses continuous backups.

Option B is incorrect because AWS Backup is not necessary; DynamoDB PITR is sufficient. Option C is incorrect because PITR does not require any on-demand backups; it relies on continuous backups.

Full explanation →

1260

MCQeasy

A data engineer needs to store JSON documents that are accessed by a serverless application using AWS Lambda. The documents are frequently updated and need low latency (single-digit milliseconds) for read and write operations. Which AWS service should the engineer use?

A.Amazon DynamoDB

B.Amazon ElastiCache for Redis

C.Amazon S3 (with S3 Select)

D.Amazon RDS for MySQL

AnswerA

DynamoDB offers single-digit millisecond latency for reads and writes and supports JSON documents natively.

Why this answer

Amazon DynamoDB is a fully managed NoSQL key-value and document database that provides single-digit millisecond latency for read and write operations at any scale. It natively supports JSON documents, integrates directly with AWS Lambda via the AWS SDK, and handles frequent updates efficiently through its auto-scaling and on-demand capacity modes, making it ideal for serverless applications requiring low-latency data access.

Exam trap

The trap here is that candidates often confuse ElastiCache for Redis as a primary data store due to its low latency, overlooking that it is an in-memory cache with no built-in persistence guarantees, whereas DynamoDB provides both low latency and durable, persistent storage for JSON documents.

How to eliminate wrong answers

Option B is wrong because Amazon ElastiCache for Redis is an in-memory cache, not a durable data store; while it offers sub-millisecond latency, it is typically used for caching or session management and requires a separate persistent database to avoid data loss on node failure, making it unsuitable as the primary store for frequently updated JSON documents that must persist. Option C is wrong because Amazon S3 is an object storage service with eventual consistency for overwrite PUTS and higher latency (typically tens to hundreds of milliseconds) for read operations, and S3 Select is a server-side filtering feature that does not reduce latency for individual document reads or writes; it is not designed for frequent, low-latency updates. Option D is wrong because Amazon RDS for MySQL is a relational database that requires schema definition, does not natively store JSON as a first-class document model (though it supports JSON data type, it lacks the flexible schema and single-digit millisecond read/write performance of DynamoDB for key-value access patterns), and incurs higher operational overhead for scaling and connection management in a serverless architecture.

Full explanation →

1261

Multi-Selecteasy

A data engineer is designing a data ingestion pipeline for streaming social media data. The data must be ingested with low latency (seconds) and stored in Amazon S3 for long-term analytics. The engineer also needs to perform real-time aggregations. Which TWO services should the engineer use? (Choose two.)

Select 2 answers

A.Amazon Kinesis Data Firehose

B.AWS Glue ETL

C.Amazon S3

D.Amazon Kinesis Data Analytics

E.Amazon Kinesis Data Streams

AnswersD, E

Performs real-time analytics on streaming data.

Why this answer

Amazon Kinesis Data Analytics is correct because it enables real-time processing and aggregation of streaming data using SQL or Apache Flink, allowing the engineer to compute metrics like counts or averages on the fly. Combined with Kinesis Data Streams as the ingestion layer, it provides sub-second latency for both ingestion and analytics, meeting the low-latency requirement.

Exam trap

The trap here is that candidates often confuse Amazon Kinesis Data Firehose with Kinesis Data Streams, assuming Firehose can achieve sub-second latency, but Firehose's minimum buffer interval of 60 seconds makes it unsuitable for true real-time ingestion, while Data Streams provides the necessary low-latency ingestion.

Full explanation →

1262

MCQmedium

A data engineer is using AWS Glue ETL to transform a large dataset in S3. The job processes 2 TB of data daily and currently runs for 6 hours. The engineer wants to reduce runtime without changing the transformation logic. What is the best approach?

A.Reduce the number of DPUs to minimize overhead.

B.Use the Spark UI to analyze bottlenecks and rewrite code.

C.Increase the number of Glue DPUs or enable auto-scaling.

D.Switch from Spark to Python shell.

AnswerC

More DPUs provide parallel processing and reduce runtime.

Why this answer

Increasing the number of DPUs or enabling auto-scaling directly allocates more distributed processing capacity to the AWS Glue job, which reduces runtime for large datasets by parallelizing the workload across more resources. Since the transformation logic is fixed and the job is already running on Spark, adding compute capacity is the most straightforward way to speed up processing without code changes.

Exam trap

The trap here is that candidates may think reducing DPUs reduces overhead and speeds up the job, but in distributed systems, more parallelism (more DPUs) reduces runtime for large datasets, while reducing DPUs increases it.

How to eliminate wrong answers

Option A is wrong because reducing DPUs would decrease parallelism and likely increase runtime, not reduce it, as the job already takes 6 hours on 2 TB of data. Option B is wrong because using the Spark UI to analyze bottlenecks and rewriting code would change the transformation logic, which the question explicitly prohibits. Option D is wrong because switching from Spark to Python shell would remove distributed processing entirely, making the job unable to handle 2 TB of data efficiently and likely causing it to fail or run far longer.

Full explanation →

1263

MCQhard

A company uses AWS KMS to encrypt data in Amazon S3 and RDS. They need to ensure that encryption keys are automatically rotated every year. Which KMS key type supports automatic annual rotation?

A.AWS owned keys

B.AWS managed keys (aws/xxx)

C.Customer managed keys

D.Custom key stores

AnswerB

Correct. AWS managed keys have automatic annual rotation enabled by default, providing seamless compliance with rotation policies.

Why this answer

AWS managed keys (AWS-managed KMS keys) have automatic rotation enabled by default every year, making option B correct. AWS owned keys are not visible to the customer and cannot be managed. Customer managed keys require explicit enabling of rotation, so they are not automatically rotated.

Custom key stores do not support automatic rotation. Therefore, only AWS managed keys provide automatic annual rotation without additional configuration.

Exam trap

Candidates may confuse customer managed keys with AWS managed keys and think that all KMS keys support automatic rotation equally. However, only AWS managed keys have automatic rotation enabled by default; customer managed keys require manual activation.

Full explanation →

1264

MCQeasy

A data engineer needs to ingest data from an on-premises Oracle database into Amazon S3. The data volume is about 500 GB initially, with daily incremental updates of 10 GB. The pipeline must minimize operational overhead. Which AWS service should be used for the initial and incremental loads?

A.AWS Database Migration Service (DMS) with change data capture (CDC) to Amazon S3.

B.AWS Glue with a JDBC connection and incremental crawl.

C.Amazon Kinesis Data Firehose with a custom producer.

D.AWS Data Pipeline with a SQL activity and HiveCopyActivity.

AnswerA

DMS supports full load and CDC with low overhead.

Why this answer

AWS DMS with CDC is the correct choice because it supports continuous replication from Oracle to Amazon S3 with minimal overhead. It handles both the initial 500 GB full load and ongoing 10 GB daily increments via change data capture, without requiring custom code or complex pipeline management.

Exam trap

The trap here is that candidates often choose AWS Glue for its serverless nature, but Glue's incremental crawl only updates the Data Catalog, not the data itself, and it cannot capture row-level changes from a database without full reloads.

How to eliminate wrong answers

Option B is wrong because AWS Glue with an incremental crawl is designed for cataloging schema changes, not for capturing row-level changes from a database; it would require full table scans for each incremental load, which is inefficient for 10 GB daily updates. Option C is wrong because Amazon Kinesis Data Firehose requires a custom producer to stream data from Oracle, which adds operational overhead and does not natively support CDC or initial bulk loads from a database. Option D is wrong because AWS Data Pipeline with a SQL activity and HiveCopyActivity is a legacy service that lacks native CDC support for Oracle, requiring custom scripting for incremental loads and increasing operational complexity.

Full explanation →

1265

Multi-Selectmedium

A data engineer is using Amazon EMR to process large datasets. The cluster uses a mix of Spot Instances and On-Demand Instances. The engineer wants to reduce costs while ensuring the job can complete even if Spot Instances are reclaimed. Which TWO actions should the engineer take? (Choose two.)

Select 2 answers

A.Enable Instance Fleets to use multiple instance types for Spot Instances.

B.Use only On-Demand Instances for all nodes.

C.Use Spot Instances for core nodes to reduce cost.

D.Enable termination protection for the cluster.

E.Use a task instance group with Spot Instances for non-critical processing tasks.

AnswersA, E

Instance Fleets reduce the impact of Spot interruptions by diversifying instance types.

Why this answer

Enabling Instance Fleets allows EMR to use multiple instance types for Spot Instances, reducing the risk of interruption by diversifying across instance pools. Option E is correct because using a task instance group with Spot Instances for non-critical tasks ensures that if Spot Instances are reclaimed, only those non-critical tasks are affected, while core and master nodes running on On-Demand continue processing. Option B is incorrect because using only On-Demand increases costs.

Option C is incorrect because using Spot Instances for core nodes risks data loss or job failure if they are reclaimed, as HDFS data is stored on core nodes. Option D is incorrect because termination protection prevents accidental termination, but does not address Spot Instance interruptions.

Full explanation →

1266

MCQhard

A data pipeline uses AWS DMS to replicate data from an on-premises Oracle database to Amazon S3 in Parquet format. The pipeline has been running successfully for months, but recently the DMS task status shows 'failed' with the error: 'The source database is running out of archive log space.' Which action should the engineer take to prevent this error?

A.Configure multiple target S3 buckets to distribute the load.

B.Increase the amount of archive log space or reduce the log retention period on the source Oracle database.

C.Enable automatic log archiving on the DMS replication instance.

D.Increase the memory allocation for the DMS replication instance.

AnswerB

More space or shorter retention prevents log space exhaustion.

Why this answer

The error 'source database is running out of archive log space' indicates that the Oracle database's archive log area is full. AWS DMS uses Change Data Capture (CDC) which reads from archive logs to replicate changes. Increasing archive log space or reducing log retention prevents this error.

Option A is incorrect because distributing load across multiple S3 buckets does not address source log space. Option C is incorrect because DMS does not manage archiving; it only reads logs. Option D is incorrect because memory on the replication instance does not affect source archive log space.

Full explanation →

1267

MCQmedium

A data engineer is troubleshooting a nightly ETL job that reads data from an RDS MySQL instance and writes to an S3 bucket in Parquet format. The job runs on an EMR cluster and uses PySpark. Recently, the job started failing with 'OutOfMemoryError' in the executor logs. The data volume has grown 30% in the last month. Which is the MOST efficient solution to resolve this issue without changing the code?

A.Change the RDS instance to a larger size to reduce load.

B.Switch the ETL job to use AWS Glue with a larger WorkerType.

C.Increase the executor memory and memoryOverhead in the Spark configuration.

D.Increase the number of core nodes in the EMR cluster.

AnswerC

Increasing executor memory and memoryOverhead directly addresses the OutOfMemoryError by providing more heap and off-heap memory to executors.

Why this answer

The OutOfMemoryError in executors indicates insufficient memory per executor to handle the increased data volume. Increasing 'spark.executor.memory' and 'spark.executor.memoryOverhead' directly addresses this by providing more heap and off-heap memory without any code changes. Option A is wrong because the RDS instance size does not affect executor memory; the bottleneck is in Spark processing.

Option B is wrong because switching to AWS Glue would require code changes and may still need memory tuning, making it less efficient. Option D is wrong because adding core nodes increases parallelism but does not increase memory per executor, so the OOM could still occur.

Full explanation →

1268

MCQeasy

A company needs to transform JSON data from Amazon Kinesis Data Streams into Parquet format and store it in Amazon S3. The transformation includes simple field mappings and type conversions. Which approach is most cost-effective and serverless?

A.Use Amazon EC2 instances running Apache Spark Streaming

B.Use Amazon Kinesis Data Firehose with an AWS Lambda function for transformation and output to Parquet

C.Use Amazon SageMaker for transformation

D.Use an AWS Glue ETL job triggered by a Kinesis stream

AnswerB

Firehose can invoke Lambda per record and convert to Parquet.

Why this answer

Amazon Kinesis Data Firehose can directly deliver streaming data to Amazon S3 in Parquet format. By attaching an AWS Lambda function for simple field mappings and type conversions, you achieve a fully serverless, cost-effective solution without managing any infrastructure. This approach minimizes costs because you pay only for the data volume processed by Firehose and the Lambda invocations, avoiding the overhead of always-on compute resources.

Exam trap

The trap here is that candidates often overestimate the need for full ETL engines like Glue or Spark for simple transformations, overlooking that Kinesis Data Firehose with Lambda is the most cost-effective and serverless option for lightweight field mappings and format conversions.

How to eliminate wrong answers

Option A is wrong because using Amazon EC2 instances running Apache Spark Streaming requires provisioning and managing servers, incurring continuous compute costs even when idle, and is not serverless. Option C is wrong because Amazon SageMaker is designed for machine learning model training and inference, not for lightweight streaming data transformations like field mappings and type conversions. Option D is wrong because an AWS Glue ETL job triggered by a Kinesis stream introduces additional complexity and cost from Glue's Spark-based processing, which is overkill for simple transformations and is not as cost-effective as Firehose with Lambda.

Full explanation →

1269

Multi-Selecthard

Which THREE factors should be considered when choosing between Amazon Kinesis Data Streams and Amazon Kinesis Data Firehose for real-time data ingestion? (Choose three.)

Select 3 answers

A.The need for a fully managed delivery destination

B.Whether the application requires custom data processing logic

C.The ability to compress data before storage

D.The latency requirements for data delivery

E.The maximum throughput supported per shard

AnswersA, B, D

Firehose can directly deliver to S3, Redshift, etc., while Streams requires a consumer.

Why this answer

Amazon Kinesis Data Firehose is a fully managed service that automatically delivers streaming data to destinations like Amazon S3, Amazon Redshift, Amazon OpenSearch Service, and Splunk, making it ideal when you need a fully managed delivery destination without managing the ingestion pipeline. In contrast, Amazon Kinesis Data Streams requires you to build and manage consumers to process and deliver data, so if you need a fully managed destination, Firehose is the correct choice.

Exam trap

The trap here is that candidates often assume compression or throughput limits are unique to one service, but both services support compression and throughput is a scaling detail of Streams, not a direct comparison factor for choosing between the two.

Full explanation →

1270

MCQhard

A data engineer is building a real-time data pipeline using Amazon Kinesis Data Streams with a Lambda consumer. The data volume is 2 MB/s with average record size of 5 KB. The Lambda function processes records and writes to DynamoDB. Occasionally, the Lambda function fails with 'ProvisionedThroughputExceededException' on DynamoDB. What is the best way to handle this?

A.Replace Lambda with the Kinesis Client Library (KCL) running on EC2.

B.Increase the Lambda function's reserved concurrency to process more records in parallel.

C.Use DynamoDB Streams to capture the records and process them asynchronously.

D.Configure a Lambda destination on failure to send records to an SQS dead-letter queue, and implement retry logic in Lambda.

AnswerD

This handles transient failures without data loss.

Why this answer

Configuring a Lambda destination on failure to send unprocessed records to an SQS dead-letter queue, combined with retry logic in the Lambda function, provides a robust mechanism to handle DynamoDB throttling exceptions. This approach decouples the retry handling from the Kinesis stream, preventing the Lambda function from blocking the shard iterator and allowing the pipeline to continue processing other records while failed records are retried or investigated.

Exam trap

The trap here is that candidates often assume increasing concurrency or switching to KCL will solve throughput issues, but the real problem is handling DynamoDB throttling gracefully without blocking the Kinesis stream, which requires a decoupled retry mechanism like a dead-letter queue.

How to eliminate wrong answers

Option A is wrong because replacing Lambda with KCL on EC2 does not inherently solve DynamoDB throttling; it shifts compute but still requires managing write capacity and retry logic, adding operational overhead without addressing the root cause. Option B is wrong because increasing Lambda reserved concurrency would increase the number of concurrent invocations, potentially exacerbating DynamoDB throttling by sending more write requests simultaneously, not reducing failures. Option C is wrong because DynamoDB Streams capture changes after writes to DynamoDB, not before; they cannot help handle write failures from the Lambda function, as the exception occurs during the write attempt, not after.

Full explanation →

1271

MCQhard

A company runs a critical PostgreSQL database on Amazon RDS. The database experiences high read latency during peak hours. The data engineer needs to reduce read latency with minimal changes to the application. Which solution is MOST effective?

A.Delete unused indexes to improve query performance.

B.Enable Multi-AZ deployment for automatic failover.

C.Increase the DB instance class to a larger size with more memory.

D.Create a read replica of the RDS instance and redirect read queries to it.

AnswerD

Read replicas distribute read load, reducing latency.

Why this answer

Creating a read replica offloads read queries from the primary instance, reducing read latency with minimal application changes. The application simply needs to direct read-only queries to the replica endpoint. Option A is incorrect because deleting unused indexes may help write performance but does not directly address high read latency during peak hours.

Option B is incorrect because enabling Multi-AZ is for high availability and failover, not for improving read performance. Option C is incorrect because increasing the DB instance class can improve performance but is more disruptive and costly compared to adding a read replica, and may require downtime for resizing.

Full explanation →

1272

MCQhard

A company uses Amazon DynamoDB to store metadata for a document management system. The table has a partition key of document_id and a sort key of version. The application frequently queries for the latest version of a document by document_id. The data engineer notices that these queries are consuming a lot of read capacity. How can the engineer optimize the read performance and reduce read capacity consumption?

A.Change the sort key to store version in descending order.

B.Enable DynamoDB Streams and use a read replica.

C.Decrease the ReadCapacityUnits of the table to force caching.

D.Create a global secondary index (GSI) and use DynamoDB Accelerator (DAX).

AnswerD

A GSI can support efficient queries, and DAX caches results, reducing read capacity.

Why this answer

Creating a Global Secondary Index (GSI) with document_id as the partition key and version as the sort key, combined with DynamoDB Accelerator (DAX), allows the application to query the latest version efficiently. The GSI can be configured to project only the necessary attributes, reducing read capacity consumption, while DAX provides an in-memory cache that offloads repeated read requests from the DynamoDB table, significantly lowering read capacity units (RCUs) consumed.

Exam trap

The trap here is that candidates may think changing sort key order (Option A) reduces read capacity, but DynamoDB charges RCUs based on item size and read consistency, not sort order; the real optimization lies in indexing and caching strategies like GSI and DAX.

How to eliminate wrong answers

Option A is wrong because changing the sort key to descending order does not reduce read capacity consumption; it only affects the order of results, not the number of items read or the RCUs consumed. Option B is wrong because DynamoDB Streams are used for change data capture and triggering downstream processes, not for read performance optimization; read replicas are not a feature of DynamoDB. Option C is wrong because decreasing ReadCapacityUnits does not force caching; it throttles read requests, leading to ProvisionedThroughputExceededException errors and degraded performance, not optimization.

Full explanation →

1273

MCQhard

A data engineer is troubleshooting an ETL job that reads from an S3 bucket encrypted with SSE-KMS. The job is failing with an error indicating that the IAM role does not have permission to decrypt the data. What is the most likely missing permission?

A.kms:GenerateDataKey

B.s3:ListBucket

C.kms:Decrypt

D.s3:GetObject

AnswerC

To read SSE-KMS encrypted objects, the role must have kms:Decrypt permission on the KMS key.

Why this answer

Kms:Decrypt. When an S3 object is encrypted with SSE-KMS, the IAM role must have the kms:Decrypt permission to decrypt the object before reading it. Option A (kms:GenerateDataKey) is used for encryption, not decryption, so it is incorrect.

Option B (s3:ListBucket) only allows listing objects in the bucket, not reading or decrypting them. Option D (s3:GetObject) allows reading the object, but without kms:Decrypt, the encrypted object cannot be decrypted, so the read fails.

Full explanation →

1274

MCQeasy

A company wants to audit all changes to IAM policies in their AWS account. Which AWS service should be used to record these changes for compliance purposes?

A.Amazon CloudWatch Logs

B.AWS Config

C.AWS CloudTrail

D.Amazon S3

AnswerC

CloudTrail records API calls made in the account, including IAM policy changes.

Why this answer

AWS CloudTrail records API calls, including IAM policy changes. AWS Config records resource configurations but not all API calls. CloudWatch Logs can store logs but does not record API calls itself.

S3 is the destination for logs, not the recording service.

Full explanation →

1275

MCQeasy

A data engineer needs to audit all changes to IAM policies in an AWS account. Which AWS service should be used?

A.AWS CloudTrail

B.AWS Config

C.AWS Organizations

D.Amazon CloudWatch Logs

AnswerA

CloudTrail records all API activity for auditing.

Why this answer

WS CloudTrail because it records API calls made in the account, including changes to IAM policies. AWS Config tracks resource configuration changes, not API calls. AWS Organizations is for multi-account management.

Amazon CloudWatch Logs is for log storage and monitoring, not auditing API calls.

Full explanation →

Page 17 of 23

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23

Practice DEA-C01 by domain

Target a specific domain to shore up weak areas.

Data Ingestion and Transformation Data Operations and Support Data Security and Governance Data Store Management

See all domains with question counts →