AWS Certified Data Engineer Associate DEA-C01 (DEA-C01) — Questions 1201–1275

Options A, C, and E are correct. Option A enables continuous replication using CDC. Option C uses a transformation to convert to Parquet.

Option E uses a target endpoint for S3 with parquet format. Option B is wrong because SCT is for schema conversion, not for DMS replication. Option D is wrong because a full load only is not continuous replication.

Option C is correct because KMS encryption context is used as additional authenticated data (AAD) and must be provided for decryption. Option A is wrong because the key is not disabled. Option B is wrong because key policy does not affect decryption with the same key.

Option D is wrong because the command did not fail.

Option A is correct because increasing the DPU count allocates more memory per worker. Option B is wrong because Glue supports Python and Scala, not Java. Option C is wrong because repartitioning may or may not help; memory is the immediate issue.

Option D is wrong because using Apache Spark is already the default; switching to Python shell would not handle the volume.

To restrict to specific instance types, you need Effect (Allow), Action (ec2:RunInstances), and Condition (to specify instance type). Resource could be used but is not strictly required if you use Condition. Option A is needed to allow.

Option C is needed for the action. Option D is needed to restrict. Option B is not required; you can use Condition to specify instance type instead of Resource.

Option E is optional. Correct: A, C, D.

Option D is correct because enabling RDS encryption with KMS and using automatic key rotation (annually) and manual rotation every 90 days meets the requirement. Option A is wrong because RDS does not support Transparent Data Encryption. Option B is wrong because CloudHSM is not integrated with RDS.

Option C is wrong because KMS automatic rotation is yearly, not 90 days.

Option B is correct because S3 events can trigger a Lambda function directly. Option A is incorrect because SQS is not triggered by S3 events without a separate setup. Option C is incorrect because EventBridge cannot directly trigger Lambda from S3 events; S3 events go to Lambda via S3 notification.

Option D is incorrect because Step Functions would need an event source; Lambda is simpler.

Option D is correct. AWS Snowball Edge is a physical device that can transfer large volumes quickly, bypassing network limitations. Option A is wrong because 1 Gbps would take ~111 hours for 50 TB, and with overhead it may exceed 10 days.

Option B is wrong because DataSync also uses network and would be too slow. Option C is wrong because S3 Transfer Acceleration is for existing internet transfers, not bulk offline.

Option C is correct because Lake Formation integrates with Athena for fine-grained access control. The analysts need both Lake Formation permissions and IAM permissions to use Athena. Option A is wrong because S3 bucket policy is not the issue if Lake Formation is managing permissions.

Option B is wrong because Workgroup settings are not likely the cause. Option D is wrong because the table is registered with Lake Formation.

Option D is correct because if the partition filter is not pushed down, Athena scans all partitions. Option A is wrong because the data is partitioned. Option B is wrong because partition pruning should reduce data scanned.

Option C is wrong because the table is partitioned.

The policy allows s3:PutObject on my-data-lake/*, but if the output bucket is different (e.g., my-output-bucket), the policy does not cover it. The error is due to missing permissions on the output bucket. The Glue service role may not have permissions to write to the output bucket.

The policy does not restrict resource to only one bucket, but the ARN specifies my-data-lake. The job might be trying to write to a different bucket. There is no issue with Glue actions.

A is correct because enabling partition indexing in the Glue Data Catalog allows partition pruning and automatic updates. C is correct because configuring a Glue crawler with a schedule will automatically discover new partitions. B is wrong because setting up an S3 event notification to trigger Lambda for manual updates is not as efficient as crawler scheduling.

D is wrong because using AWS Glue ETL jobs to update the catalog is not automatic. E is wrong because Amazon Athena does not update the catalog.

Option A is correct because the policy allows GetObject and PutObject only when the request uses HTTPS (secure transport), and explicitly denies all S3 actions when the request uses HTTP. Option B is wrong because the policy does not allow anonymous access; it allows only secure transport. Option C is wrong because the policy allows both Get and Put.

Option D is wrong because the policy allows access from any IP as long as transport is secure.

Option D is correct because using 'coalesce' or 'repartition' with a number based on the target file size (e.g., 128 MB) reduces files without a single partition bottleneck. Option A is wrong because lowering shuffle partitions reduces parallelism and may cause OOM. Option B is wrong because increasing shuffle partitions increases files.

Option C is wrong because S3 multipart upload is automatic and does not affect file count.

Options A, B, and D are correct. Increasing DPUs provides more parallelism. Using pushdown predicates reduces data scanned.

Using JDBC fetch size reduces round trips. Option C is wrong because using a single connection per partition is the default and may cause contention; increasing connections can help but the default is fine. Option E is wrong because Parquet is already efficient; converting to CSV would make it worse.

Option D is correct because dynamic partitioning requires a separate configuration (enabling dynamic partitioning and specifying the partitioning keys). The prefix with timestamp expressions is used for S3 prefix customization but not for dynamic partitioning. Option A (time zone) could cause wrong hour but not single partition.

Option B (buffer size) affects file size. Option C (IAM) would cause errors, not mispartitioning. The key is that dynamic partitioning must be explicitly enabled.

Amazon Kinesis Data Firehose can directly ingest streaming data and deliver to S3. Amazon Kinesis Data Streams can also ingest data, but requires a consumer to write to S3. AWS Glue is for batch ETL.

Amazon SQS is for message queuing. Amazon DynamoDB Streams captures changes in DynamoDB, not from mobile apps.

Option C is correct because Glue jobs need an IAM role that has Lake Formation permissions to access the table; the error indicates the job's IAM role lacks necessary permissions. Option A is wrong because S3 permissions are managed by Lake Formation, but access is granted via Lake Formation, not direct S3 bucket policies. Option B is wrong because the table already exists; there is no need to register.

Option D is wrong because Lake Formation does not require a VPC endpoint.

Option C is correct because a schema change (e.g., new column or changed data type) can cause partition metadata to be inconsistent with actual data, leading to split errors. Option A is wrong because S3 permissions would cause access denied. Option B is wrong because the crawler can handle partitions.

Option D is wrong because concurrent queries do not cause split errors.

Options C and D are correct. Increasing the YARN memory overhead allows containers to allocate more memory, and increasing the maximum Java heap size reduces out-of-memory errors. Option A is wrong because increasing container count without increasing total memory may not help.

Option B is wrong because reducing container count may cause resource underutilization. Option E is wrong because EMRFS consistent view does not affect memory.

Options A, C, and E are correct. Increasing parallelism allows more concurrent processing. Using a larger Kinesis stream with more shards increases ingestion throughput.

Increasing the Flink parallelism parameter distributes workload. Option B is incorrect because decreasing the checkpoint interval increases latency. Option D is incorrect because decreasing the buffer time may cause more frequent micro-batches, increasing overhead.

Option C is correct because implementing exponential backoff with jitter is a best practice to handle throttling. Option A is wrong because increasing Lambda concurrency would increase the write rate, worsening the issue. Option B is wrong because Kinesis shard count does not affect DynamoDB.

Option D is wrong because reducing batch size would increase the number of concurrent Lambda invocations.

Options A and C are correct because KEY and ALL are valid distribution styles. Option B is wrong because HASH is not a distribution style (it's a synonym for KEY). Option D is wrong because RANDOM is not a distribution style.

Option E is wrong because AUTO is not a distribution style.

Options A, C, and D are correct. BatchApply reduces apply time, tuning transaction size reduces memory pressure, and increasing the TLog size helps capture changes. Option B is wrong because parallel threads on source may increase CPU.

Option E is wrong because switching to full load only is not a replication solution.

Option A (use coalesce) reduces the number of output files by merging partitions. Option C (enable partition pruning) helps queries skip irrelevant partitions, improving performance. Option B is wrong because increasing the number of workers may increase the number of output files.

Option D is wrong because disabling compression increases file size. Option E is wrong because using dynamic frame with larger partition size does not directly minimize file count.

Option A is correct because SSL/TLS encryption secures data in transit between the application and the RDS database. Option B (storage encryption at rest) does not protect data in transit. Option C (VPC peering) is a network connectivity option, not encryption.

Option D (IAM database authentication) is for access control, not encryption in transit.

Option A (Use CloudWatch Logs subscription filter with Kinesis Data Firehose to deliver to S3) is correct because Firehose can deliver to S3 with low latency (typically <1 minute). Option B (CloudWatch Logs export to S3) is a batch process that can take hours. Option C (Use a Lambda function to read from CloudWatch Logs and write to S3) is slower and less reliable.

Option D (Use CloudWatch Logs Insights) is for querying, not delivery.

Option C is correct because bucket default encryption automatically encrypts new objects. Option A is wrong because it only encrypts objects during upload, not after. Option B is wrong because S3 Batch Operations is more complex.

Option D is wrong because it's not automatic.

Option B is correct. Increasing the number of shards increases the number of Lambda consumers, allowing more parallel processing and reducing the iterator age. Option A is wrong because increasing Lambda memory may not improve throughput if the function is CPU-bound; also, the issue is concurrency, not memory.

Option C is wrong because decreasing batch size may increase overhead; the function is already maxing concurrency. Option D is wrong because reducing memory would likely make the function slower.

AWS Backup is a fully managed backup service that can automate backups of RDS databases. Option B is wrong because CloudWatch is for monitoring. Option C is wrong because S3 is storage.

Option D is wrong because Lambda can be used but is not the primary managed service for backup scheduling.

Option B is correct because AWS DMS CDC requires supplemental logging on the source Oracle database to capture changes. The error indicates that DMS cannot enable it automatically, so the engineer must enable it manually. Option A is incorrect because increasing the task log interval does not affect supplemental logging.

Option C is incorrect because changing the target engine version is unrelated. Option D is incorrect because the error is not about source connectivity.

Option C is correct. If the function times out, increasing the timeout gives it more time to complete. Option A is wrong because the event is correct.

Option B is wrong because the function can access DynamoDB with the right permissions. Option D is wrong because the event is from S3.

Option C is correct because the Lambda function needs permission to list the bucket (s3:ListBucket) to verify the bucket exists and possibly to check for existing objects. The 's3:PutObject' action is allowed, but without 's3:ListBucket', the function may fail when trying to write if the key does not exist or for bucket-level operations. Option A is wrong because 's3:GetObject' is already present.

Option B is wrong because 's3:DeleteObject' is not needed. Option D is wrong because 's3:PutObjectAcl' is not required.

Option C is correct because if no data is written to the stream, Firehose has nothing to deliver. Option A is wrong because delivery streams typically use S3 as a destination, not Kinesis Data Streams. Option B is wrong because insufficient permissions would cause an access denied error.

Option D is wrong because CloudWatch Logs is for monitoring, not for storing delivery data.

A and C are correct. A: Step Functions can orchestrate Glue, Lambda, etc. C: Managed Workflows for Apache Airflow (MWAA) is designed for orchestration.

B (Data Pipeline) is an older service, but not as common. D (Batch) is for batch computing, not orchestration. E (Lambda) is for individual functions.

Option D is correct because enabling auto-termination and using a mix of On-Demand and Spot instances for core and task nodes ensures job completion. Specifically, using On-Demand for core nodes and Spot for task nodes with a diversified allocation strategy reduces interruption impact. Option A is incorrect because increasing core nodes with On-Demand increases cost.

Option B is incorrect because using only Spot instances increases failure risk. Option C is incorrect because instance fleets with only Spot do not help.

Option B is correct because aws:SecureTransport checks if the request is sent over SSL/TLS. Option A is wrong because aws:SourceIp checks IP address. Option C is wrong because s3:x-amz-server-side-encryption checks encryption at rest.

Option D is wrong because s3:signatureversion checks the signature version, not encryption in transit.

Option B is correct because the Deny statement denies PutObject if the encryption header is not AES256. Since the user did not specify encryption, the condition StringNotEquals evaluates to true, and the request is denied. Option A is wrong because the Deny overrides the Allow.

Option C is wrong because the Deny is specific. Option D is wrong because the bucket policy does not require encryption for GetObject.

Options A and B are correct. AWS Secrets Manager can rotate secrets automatically. AWS Systems Manager Parameter Store can store secrets securely, but automatic rotation requires custom logic or integration.

Option C is wrong because IAM stores certificates, not secrets. Option D is wrong because KMS is for encryption keys, not secrets. Option E is wrong because CloudHSM is for hardware security modules.

The most likely cause is that the data files are not in the specified S3 location. When an AWS Glue table is defined in the Data Catalog, Athena reads the table's metadata (including the S3 location) and then attempts to read the underlying data files from that exact path. If the files are missing, misnamed, or in a different prefix, Athena returns zero rows because there is no data to scan.

This is a common misconfiguration when the S3 path in the table definition does not match the actual data storage.

Option D is correct because AWS DMS can write directly to S3 in Parquet format, and you can specify a KMS key for server-side encryption. Option A is incorrect because DMS does not support writing to S3 in JSON format without conversion, and encryption is handled by DMS settings. Option B is incorrect because DMS can write Parquet directly without an intermediate EC2 instance.

Option C is incorrect because KMS encryption is set at the DMS task level, not via a bucket policy.

Option C is correct because the policy allows s3:PutObject only if the request includes the header x-amz-server-side-encryption: AES256. Without that header, the condition is not met and the request is denied. Option A is wrong because the condition is not optional.

Option B is wrong because default encryption applies to objects uploaded without encryption headers, but the policy explicitly requires the header. Option D is wrong because the policy does not require a specific KMS key.

Option A is correct because S3 Event Notifications can invoke Lambda on PutObject events. Option B is wrong because Kinesis is for streaming, not event-based S3 triggers. Option C is wrong because SQS would require polling.

Option D is wrong because EventBridge is more complex for simple S3 object creation triggers.

Option C is correct because AWS Glue ETL jobs require an IAM role with permissions to write to the S3 bucket. If the bucket policy was inadvertently changed to deny access to that role, the job would fail. Option A is wrong because insufficient memory would cause out-of-memory errors, not access denied.

Option B is wrong because separate encryption permissions are not the primary cause; S3 access permissions are. Option D is wrong because KMS key permissions would cause encryption-related errors, not general access denied.

Option C is correct because the condition 's3:x-amz-server-side-encryption': 'aws:kms' enforces SSE-KMS. Option A denies requests with SSE-S3 but allows unencrypted uploads. Option B denies without encryption but allows SSE-S3.

Option D denies SSE-KMS, which is the opposite of what is needed.

Option C is correct because S3 Lifecycle policies can automatically transition objects to different storage classes or expire them after a specified time. Option A (versioning) keeps multiple versions of objects. Option B (object lock) prevents deletion.

Option D (MFA delete) requires multi-factor authentication for deletion.

Option A is correct because the error indicates the output path does not exist; the Glue job may not have permission to create the directory if the bucket or prefix does not exist. Option B (IAM role) would cause a permissions error, not 'No such file or directory'. Option C (schema mismatch) would cause a different error.

Option D (memory) would cause out-of-memory or timeout errors.

Option D is correct because Amazon Aurora Global Database provides cross-region replication with failover capabilities. Option A is wrong because Multi-AZ only protects against AZ failures, not regional. Option B is wrong because Read Replicas are for read scaling, not automatic failover.

Option C is wrong because manual snapshot restore takes too long for high availability.

Options A, B, and D are correct. Lake Formation manages SELECT, INSERT, and DESCRIBE permissions. Option C is wrong because DELETE is not supported for S3 data lakes? Actually Lake Formation supports DELETE on tables? For data lakes, DELETE is not typically managed.

Option E is wrong because ALTER TABLE is not managed by Lake Formation.

Option D is correct because Macie requires the bucket to be in the same AWS Region as the Macie session. Option A is incorrect because Macie can access buckets in the same account without cross-account roles. Option B is incorrect because Macie uses service-linked roles, not object ACLs.

Option C is incorrect because Macie does not require public access; it reads objects via IAM.

AWS Organizations with SCPs can centrally control permissions across all accounts, including blocking public access to S3 buckets. Option A is wrong because IAM policies are per-identity and not account-wide. Option B is wrong because S3 Block Public Access settings exist per bucket or account, but to enforce across all accounts, Organizations is needed.

Option D is wrong because AWS Config can detect non-compliance but not enforce. Option C is correct.

Options A and C are correct because transitioning to S3 Standard-IA reduces cost for infrequent access, and lifecycle policies automatically transition objects. Option B is wrong because enabling versioning increases storage costs. Option D is wrong because MFA Delete does not affect storage cost.

Option E is wrong because cross-region replication incurs additional costs.

Lambda function must have resource policy allowing S3 to invoke it. S3 bucket must have notification configuration. S3 bucket policy is not required if Lambda resource policy allows.

CloudWatch Events are not used for S3 notifications.

Option B is correct because the Glue job needs to write to Redshift; the role requires redshift:DataAPI access to use the Redshift Data API, which is the recommended method for Glue to write to Redshift. Option A is for Redshift Spectrum, not needed here. Option C is for Redshift cluster management.

Option D is for reading from Redshift.