Courseiva

AWS Certified Data Engineer Associate DEA-C01 (DEA-C01) — Questions 1276–1350

1711 questions total · 23pages · All types, answers revealed

Take a mock examExam hub
Page 17

Page 18 of 23

Page 19
1276
MCQhard

A company uses AWS Glue to run ETL jobs that process data from Amazon S3 and load into Amazon Redshift. The jobs have recently started failing with 'Out of Memory' errors. The data volume has increased 3x in the past month. Which is the MOST effective solution to resolve this issue without redesigning the job?

A.Use Amazon Athena instead of Glue for the transformation.
B.Increase the number of Glue workers (DPUs) for the job.
C.Rewrite the job to use Spark SQL instead of PySpark.
D.Increase the number of partitions in the input S3 data.
AnswerB

More workers provide more memory and CPU to handle increased data volume.

Why this answer

To increase the number of Glue workers (DPUs). This provides more memory and processing capacity to handle the increased data volume, directly resolving the 'Out of Memory' errors. Increasing S3 partitions (option D) may improve parallelism but does not directly increase memory for the Glue job.

Using Spark SQL (option C) instead of PySpark does not necessarily address memory issues. Switching to Athena (option A) would change the architecture and is not a fix for the existing Glue job.

Full explanation →
1277
MCQhard

A data engineer runs the above DDL statement in Amazon Athena. The query returns an error. What is the most likely cause?

A.The SerDe is not compatible with Parquet files.
B.The INPUTFORMAT is incorrect for Parquet files.
C.The S3 bucket location does not exist.
D.The table name contains underscores.
AnswerB

TextInputFormat is for text files, not Parquet. Should use Parquet input format.

Why this answer

The DDL statement uses the default INPUTFORMAT 'org.apache.hadoop.mapred.TextInputFormat', which is designed for text-based files like CSV or JSON, not for binary columnar formats like Parquet. Parquet requires 'org.apache.hadoop.hive.ql.io.parquet.MapredParquetInputFormat' to correctly read the file's metadata and compressed column chunks. Using the wrong INPUTFORMAT causes Athena to fail when attempting to parse the Parquet file, resulting in an error.

Exam trap

The DEA-C01 exam often tests the distinction between SerDe and InputFormat, leading candidates to incorrectly blame the SerDe (Option A) when the actual issue is the InputFormat, which controls how the file is physically read from storage.

How to eliminate wrong answers

Option A is wrong because the SerDe 'org.apache.hadoop.hive.ql.io.parquet.serde.ParquetHiveSerDe' is specifically designed for Parquet files and is fully compatible; the error stems from the INPUTFORMAT, not the SerDe. Option C is wrong because if the S3 bucket location did not exist, Athena would return a 'Path not found' or 'Access denied' error, not a parsing error related to file format. Option D is wrong because table names in Athena can contain underscores without causing errors; underscores are valid characters in Hive/Athena table identifiers.

Full explanation →
1278
MCQmedium

A data engineer needs to load data from an on-premises Oracle database to Amazon S3 daily. The table is 500 GB and grows by 50 MB per day. The load must capture only new and changed rows since the last run. Which solution is MOST cost-effective and requires the least maintenance?

A.Write a custom Python script on EC2 to query the Oracle redo logs and upload to S3
B.Export the entire table to CSV daily using a script and upload to S3
C.Use AWS Glue ETL job with a JDBC connection and a timestamp filter
D.Use AWS Database Migration Service (DMS) with ongoing replication (CDC)
AnswerD

DMS supports CDC and can capture only changes, minimizing cost and effort.

Why this answer

AWS DMS with ongoing replication (CDC) is the most cost-effective and low-maintenance solution because it continuously captures only new and changed rows from the Oracle source using its built-in CDC mechanism (reading redo logs), without requiring custom scripting or full table exports. It automatically handles schema changes, resumability, and incremental loading to S3, minimizing operational overhead and data transfer costs.

Exam trap

The trap here is that candidates often choose AWS Glue with a timestamp filter (Option C) because it seems simpler, but they overlook that Glue still performs a full table scan via JDBC to apply the filter, which is inefficient for large tables and does not provide true CDC from redo logs, unlike DMS's native log-based replication.

How to eliminate wrong answers

Option A is wrong because writing a custom Python script on EC2 to parse Oracle redo logs is complex to implement, requires deep Oracle internals knowledge, and demands ongoing maintenance for log format changes and error handling, making it neither cost-effective nor low-maintenance. Option B is wrong because exporting the entire 500 GB table daily to CSV is extremely inefficient, wastes significant compute and network resources, and incurs high S3 storage costs for unchanged data, failing the 'only new and changed rows' requirement. Option C is wrong because while AWS Glue with a timestamp filter can capture incremental changes, it requires the source table to have a reliable, monotonically increasing timestamp column and still performs a full JDBC scan of the table to filter rows, which is inefficient for a 500 GB table and does not natively support change data capture from redo logs.

Full explanation →
1279
MCQhard

Refer to the exhibit. A CloudFormation stack outputs the Glue job name and S3 bucket names. The Glue job transforms CSV files from the raw bucket to Parquet in the processed bucket. However, the Glue job is failing with an error that it cannot write to the processed bucket. What is the most likely cause?

A.The Glue job does not have permission to write to the processed bucket
B.The raw data bucket is in a different region
C.The Glue job is not using the correct worker type
D.The Glue job is using an incorrect file format
AnswerA

Missing s3:PutObject on processed-bucket.

Why this answer

The most likely cause is that the Glue job's IAM role lacks the necessary permissions (e.g., s3:PutObject, s3:ListBucket) on the processed bucket. AWS Glue jobs require an IAM role with policies that grant write access to the target S3 bucket; without these permissions, the job fails with a write error. This is a common misconfiguration when the role is scoped only to read from the raw bucket.

Exam trap

The DEA-C01 exam often tests the misconception that S3 write failures are caused by region mismatches or file format issues, but the actual trap is that candidates overlook the IAM permission layer and attribute the error to non-permission factors like worker type or data format.

How to eliminate wrong answers

Option B is wrong because cross-region access to S3 buckets is fully supported and does not cause a write permission error; the error message specifically indicates a write failure, not a connectivity or region mismatch. Option C is wrong because the worker type (e.g., G.1X, G.2X) affects memory and compute capacity, not S3 write permissions; an incorrect worker type would cause performance or OOM issues, not a bucket write error. Option D is wrong because using an incorrect file format (e.g., specifying Parquet when the output is CSV) would cause a format conversion error, not a permission-denied write error; the error message explicitly states it cannot write to the bucket, pointing to an access control issue.

Full explanation →
1280
Multi-Selecteasy

A company uses Amazon Kinesis Data Firehose to deliver streaming data to Amazon S3. The data must be transformed in real-time using a custom Lambda function. Which TWO steps are required to enable this? (Choose TWO)

Select 2 answers
A.Configure Kinesis Data Firehose to use a Lambda function for data transformation
B.Ensure the Lambda function returns the transformed records in the correct format
C.Create a Kinesis Data Analytics application to transform the data
D.Write the transformation logic directly in the Firehose delivery stream configuration
E.Use Kinesis Data Streams as the source for Firehose
AnswersA, B

Firehose can invoke Lambda for transformation.

Why this answer

Options A and B are correct. Amazon Kinesis Data Firehose can invoke an AWS Lambda function for data transformation. You configure Firehose to call the Lambda function (A), and the Lambda function must return the transformed records in the required format, including fields like recordId, result, and data (B).

Option C is incorrect because Kinesis Data Analytics is used for real-time analytics, not for simple record transformations within Firehose. Option D is incorrect because transformation logic cannot be written directly in the Firehose delivery stream configuration; it must be implemented in a Lambda function. Option E is incorrect because using Kinesis Data Streams as a source is optional and not required for enabling Lambda transformation.

Full explanation →
1281
Multi-Selecteasy

Which TWO features of Amazon DynamoDB help ensure high availability and durability? (Choose two.)

Select 2 answers
A.Auto-scaling adjusts provisioned capacity based on traffic.
B.Data is automatically replicated across multiple Availability Zones within an AWS Region.
C.Global tables enable active-active replication across multiple AWS Regions.
D.On-demand backup and restore provides point-in-time recovery.
E.Time to Live (TTL) automatically deletes expired items.
AnswersB, D

Provides high availability and durability.

Why this answer

DynamoDB automatically replicates data synchronously across three Availability Zones (AZs) within an AWS Region. This built-in replication ensures that even if an entire AZ fails, the data remains available and durable, providing a 99.999999999% (11 nines) durability SLA.

Exam trap

The trap here is that candidates often confuse auto-scaling (Option A) with high availability, but auto-scaling only adjusts capacity to meet demand, not data replication or fault tolerance.

Full explanation →
1282
MCQeasy

A data engineer needs to ensure that data in an S3 bucket is encrypted at rest. The bucket policy includes a condition that denies PutObject requests if the object is not encrypted. Which S3 encryption feature does this enforce?

A.S3 Object Lock
B.S3 MFA Delete
C.S3 Default Encryption
D.S3 Bucket Policy
AnswerD

Bucket policy can deny uploads if encryption is not set.

Why this answer

S3 bucket policies can require server-side encryption by denying PutObject without encryption headers. Option C (default encryption) is a bucket-level setting that automatically encrypts objects, but it does not enforce encryption via policy. Option A (object lock) prevents deletion.

Option B (MFA delete) requires multi-factor authentication.

Full explanation →
1283
Multi-Selecthard

A company is ingesting data from multiple sources into Amazon S3 using AWS Glue. The data is then transformed using Apache Spark on Amazon EMR. The data engineer wants to reduce the cost of storing and processing data by compressing the ingested files. Which THREE file formats support compression and are commonly used with Spark? (Choose THREE.)

Select 3 answers
A.ORC
B.Parquet
C.JSON
D.CSV
E.Avro
AnswersA, B, E

ORC is a columnar format that supports compression and is optimized for Hive/Spark.

Why this answer

Correct options: A, B, and E. ORC, Parquet, and Avro all support compression and are commonly used with Spark. These formats are columnar (ORC and Parquet) or row-based with efficient compression (Avro), making them suitable for analytics.

JSON and CSV support compression but are not columnar and less efficient for Spark processing; they are not the best choices for reducing storage and processing costs in this context.

Full explanation →
1284
MCQeasy

A company uses Amazon S3 to store sensitive customer data. The security policy requires that all objects in the bucket be encrypted at rest using server-side encryption with a customer-managed KMS key. The data engineer has enabled default encryption on the bucket using SSE-KMS with the required KMS key. However, a security scan reveals that some objects in the bucket are not encrypted with the KMS key. The objects were uploaded before the default encryption was enabled. The data engineer needs to ensure that all objects are encrypted with the KMS key without disrupting ongoing data access. What should the data engineer do?

A.Use the AWS CLI to copy the objects to themselves with the --sse-kms-key-id parameter.
B.Modify the bucket policy to deny access to objects not encrypted with the KMS key.
C.Delete the unencrypted objects and re-upload them with encryption.
D.Use S3 Batch Operations with a Lambda function to apply SSE-KMS encryption to all existing objects using the KMS key.
AnswerD

S3 Batch Operations with a Lambda function can re-encrypt all existing objects using SSE-KMS with the required KMS key, without disrupting data access.

Why this answer

S3 Batch Operations can apply SSE-KMS encryption to existing objects without disrupting access. It uses a Lambda function to re-encrypt each object with the specified KMS key. Option A is wrong because copying objects to themselves with the --sse-kms-key-id parameter does not work - it requires a full copy to a new location and back.

Option B is wrong because the bucket policy only prevents new unencrypted uploads, it does not fix existing objects. Option C is wrong because deleting and re-uploading disrupts access and is inefficient.

Full explanation →
1285
Multi-Selectmedium

A company uses Amazon Redshift for analytics. The data engineering team wants to improve query performance for frequently used aggregate queries. Which TWO actions would help achieve this?

Select 2 answers
A.Increase the number of WLM query queues
B.Use distribution keys to collocate data on the same node slices
C.Run the VACUUM command to reclaim space from deleted rows
D.Define appropriate sort keys on the tables
E.Increase the number of nodes in the cluster
AnswersB, D

Distribution keys reduce data movement during joins and aggregations.

Why this answer

Distribution keys determine how data is distributed across node slices in Amazon Redshift. By choosing distribution keys that align with the join and aggregation columns, the database can collocate related data on the same slice, minimizing data movement during query execution. This directly improves performance for aggregate queries by reducing network traffic and enabling local computation.

Exam trap

The trap here is that candidates often confuse VACUUM (which reclaims space) with performance optimization for queries, or assume adding nodes always improves query speed without considering the overhead of data redistribution.

Full explanation →
1286
MCQmedium

A company uses Amazon S3 to store large CSV files and runs Amazon Athena queries on them. The queries are becoming slower as data grows. A data engineer suggests converting the files to Apache Parquet format and partitioning the data. What is the primary benefit of converting to Parquet?

A.Parquet allows schema evolution without rewriting files.
B.Parquet supports nested data structures that CSV cannot.
C.Parquet stores data in a columnar format, reducing the amount of data scanned per query.
D.Parquet is compressed by default, reducing storage costs.
AnswerC

Columnar storage minimizes I/O by reading only relevant columns.

Why this answer

Parquet is a columnar storage format that stores data by columns rather than rows. When Athena queries only a subset of columns, it can read just those columns from disk, drastically reducing the amount of data scanned per query. This directly addresses the performance slowdown because Athena charges by data scanned, and less scanning means faster queries and lower costs.

Exam trap

The trap here is that candidates confuse the general benefits of Parquet (compression, schema evolution, nested data) with the primary performance benefit for Athena, which is columnar pruning reducing scanned data.

How to eliminate wrong answers

Option A is wrong because Parquet does support schema evolution (e.g., adding columns) but this is not its primary benefit for query performance; schema evolution is a feature of many formats and not unique to Parquet's columnar nature. Option B is wrong because while Parquet does support nested data structures (like structs and arrays), CSV does not, but this is a data modeling advantage, not the primary performance benefit for large-scale analytics queries. Option D is wrong because Parquet is not compressed by default; compression is configurable (e.g., Snappy, Gzip, Zstd) and while it reduces storage costs, the primary benefit for query speed is columnar pruning, not compression.

Full explanation →
1287
MCQhard

The Glue job attempts to read data from 's3://my-data-bucket/input/' and write to 's3://my-data-bucket/output/'. It also tries to update a table in the Glue Data Catalog. The job fails with an access denied error. What is the MOST likely cause?

A.The IAM role is missing the 's3:ListBucket' permission on the bucket.
B.The 'glue:UpdateTable' action is not allowed on the specific table.
C.The policy is missing a condition key for the S3 bucket.
D.The resource ARN does not include the bucket itself; it only covers objects.
AnswerA

Glue needs ListBucket to read the list of objects in the prefix.

Why this answer

The Glue job reads from 's3://my-data-bucket/input/' and writes to 's3://my-data-bucket/output/'. For S3 read/write operations, the IAM role must have 's3:ListBucket' permission on the bucket itself (my-data-bucket) to allow listing of objects, in addition to 's3:GetObject' and 's3:PutObject' on the object ARN. Without 's3:ListBucket', the job cannot enumerate objects in the input prefix, leading to an access denied error.

Exam trap

The trap here is that candidates focus on the Glue Data Catalog update action (Option B) or overly complex condition keys (Option C), but the immediate failure is due to the missing 's3:ListBucket' permission, which is a fundamental S3 permission required for any read operation that involves listing objects in a bucket.

How to eliminate wrong answers

Option B is wrong because the error is an access denied error during S3 operations, not a Data Catalog update failure; if 'glue:UpdateTable' were missing, the error would occur later and be specific to the Glue API. Option C is wrong because missing a condition key would not cause a blanket access denied error unless the condition explicitly denies access; the error here is due to missing permissions, not condition key misconfiguration. Option D is wrong because even if the resource ARN covers only objects (e.g., 'arn:aws:s3:::my-data-bucket/*'), the 's3:ListBucket' permission must be granted on the bucket ARN (e.g., 'arn:aws:s3:::my-data-bucket') to allow listing; missing this causes the access denied error.

Full explanation →
1288
Multi-Selectmedium

A company is building a data lake on AWS and must encrypt data at rest. Which services can provide server-side encryption for data stored in Amazon S3? (Choose TWO.)

Select 2 answers
A.SSE-S3
B.SSL/TLS
C.AWS SDK client-side encryption
D.AWS CloudHSM
E.SSE-KMS
AnswersA, E

Server-side encryption with S3 managed keys.

Why this answer

SSE-S3 (Option A) and SSE-KMS (Option E) are the two server-side encryption options for Amazon S3. SSE-S3 uses Amazon-managed keys, while SSE-KMS uses AWS KMS-managed keys. Option B (SSL/TLS) is encryption in transit, not at rest.

Option C (AWS SDK client-side encryption) encrypts data before it reaches S3, so it is client-side, not server-side. Option D (AWS CloudHSM) is a hardware security module for managing keys, but it is not a direct server-side encryption option for S3; S3 does not natively integrate with CloudHSM for SSE.

Full explanation →
1289
MCQhard

Refer to the exhibit. A data engineer runs a CLI command to decrypt a file and receives an access denied error. The IAM user 'DataEngineer' has the following policy attached: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "kms:Decrypt", "Resource": "*" } ] } What is the most likely cause of the error?

A.The CLI command is missing the --encryption-context parameter.
B.The key policy does not grant the IAM user permission to decrypt.
C.The key is an AWS managed key and cannot be used for decryption.
D.The IAM policy does not allow kms:Decrypt on the specific key.
AnswerB

Key policy is separate from IAM policy; it must explicitly allow the user.

Why this answer

Even though the IAM policy grants kms:Decrypt on all resources, the key policy is a separate access control mechanism. The error indicates that the key policy does not include the IAM user as a principal allowed to decrypt. Therefore, option B is correct.

Option A is incorrect because missing the --encryption-context parameter would cause a different error, not an access denied. Option C is incorrect because AWS managed keys can be used for decryption if the key policy grants permission; the key type is not the issue. Option D is incorrect because the IAM policy does allow kms:Decrypt on all keys; the problem is the key policy, not the IAM policy.

Full explanation →
1290
MCQeasy

A data engineer needs to export data from an Amazon DynamoDB table to Amazon S3 for archival purposes. The export should be a one-time operation and must not impact the read capacity of the table. Which approach meets these requirements?

A.Use a Scan operation in a script to read all items and write to S3
B.Use AWS Glue ETL with a DynamoDB connector
C.Set up a DynamoDB Stream to Lambda that writes to S3
D.Use DynamoDB on-demand backup feature to export to S3
AnswerD

Backup exports to S3 without consuming read capacity.

Why this answer

DynamoDB's on-demand backup feature can export table data directly to S3 without consuming any read capacity units, making it ideal for a one-time archival export. Option A (Scan operation) consumes read capacity and impacts table performance. Option B (AWS Glue ETL with DynamoDB connector) also uses Scan operations that consume read capacity.

Option C (DynamoDB Streams to Lambda) is designed for continuous change capture, not one-time bulk export.

Full explanation →
1291
MCQmedium

A retail company uses AWS Glue ETL jobs to process sales data from an S3 data lake. The source data is partitioned by year/month/day in CSV format. The Glue job reads the latest day's data, performs transformations (e.g., cleaning, aggregating), and writes the results to a separate S3 bucket. The job runs on a schedule every day at 2 AM. Recently, the job has been failing intermittently with the error 'AnalysisException: Path does not exist: s3://source-bucket/year=2024/month=02/day=30/'. The engineer verifies that the folder 'day=30' does not exist because February has only 28 days in 2024. The job is reading data from a hardcoded path. The company expects the job to handle variable days per month automatically. What should the engineer do to fix the issue?

A.Modify the script to use Spark SQL with manual partition pruning based on current date
B.Add a try-catch block in the script to skip missing partitions
C.Increase the job's retry count and set a timeout
D.Use a Glue crawler to populate the Data Catalog and use dynamic frame from_catalog with partition predicates
AnswerD

The crawler discovers existing partitions, and dynamic frame reads only available partitions.

Why this answer

Using a Glue crawler to populate the Data Catalog and then using dynamic frame with from_catalog allows Glue to automatically discover all existing partitions. This eliminates the need for hardcoded paths and handles variable days per month. Option A (Spark SQL with manual partition pruning) still requires manual handling of partitions.

Option B (try-catch) is a workaround but does not fix the root cause. Option C (increasing retries) does not address the missing partition issue.

Full explanation →
1292
MCQhard

A company ingests JSON data from an S3 bucket into a Glue ETL job. The data contains nested structures and arrays. The team wants to flatten the data into a tabular format for analysis in Athena. Which Glue transformation is appropriate?

A.Map
B.Relationalize
C.Filter
D.DropNullFields
AnswerB

Relationalize transforms nested JSON into relational tables suitable for querying.

Why this answer

The Relationalize transformation is specifically designed to flatten nested JSON and arrays into a tabular format suitable for Athena. Option A (Map) applies a function to each record but does not flatten structures. Option C (Filter) selects rows based on a condition.

Option D (DropNullFields) removes null fields but does not address nested structures.

Full explanation →
1293
MCQhard

A company uses Amazon Redshift for its data warehouse. The data engineering team notices that queries against a large fact table are slow. The table is distributed using DISTSTYLE EVEN and has multiple sort keys. After analyzing the query plans, they find that most queries filter on a specific column, 'customer_id'. Which change would most likely improve query performance for these filter operations?

A.Add a secondary sort key on 'customer_id'.
B.Change to DISTSTYLE KEY on the 'customer_id' column.
C.Change to DISTSTYLE EVEN with a different sort key.
D.Change to DISTSTYLE ALL for the fact table.
AnswerB

KEY distribution on the filtered column reduces data movement during queries.

Why this answer

Changing to DISTSTYLE KEY on 'customer_id' ensures that rows with the same customer_id are co-located on the same node slice. This allows the Redshift query engine to perform filter operations on a single slice rather than scanning all slices, dramatically reducing data movement and improving query performance for queries that filter on that column.

Exam trap

The trap here is that candidates often confuse sort keys (which optimize data ordering within a slice) with distribution keys (which control data placement across slices), leading them to choose a sort key change when the real bottleneck is data distribution.

How to eliminate wrong answers

Option A is wrong because adding a secondary sort key on 'customer_id' does not address the data distribution issue; sort keys only affect the order of data within each slice, not which slice holds the data, so queries still need to scan all slices. Option C is wrong because keeping DISTSTYLE EVEN with a different sort key does not co-locate rows with the same customer_id; EVEN distributes rows randomly across slices, so every query still scans all slices. Option D is wrong because DISTSTYLE ALL replicates the entire table to every node, which is inefficient for a large fact table due to excessive storage and maintenance overhead, and does not target the filter performance issue.

Full explanation →
1294
MCQmedium

A company uses AWS Glue to transform data in Amazon S3. The transformation logic is complex and involves multiple steps. The data engineer wants to implement a workflow that handles dependencies and retries on failure. Which AWS service should be used to orchestrate the Glue jobs?

A.AWS Step Functions
B.AWS Lambda
C.Amazon Managed Workflows for Apache Airflow (MWAA)
D.Amazon CloudWatch Events
AnswerA

Correct. AWS Step Functions can orchestrate multiple Glue jobs with error handling and retries.

Why this answer

AWS Step Functions is the best choice for orchestrating Glue jobs with dependencies and retries.

Full explanation →
1295
MCQhard

A data engineer notices that an Amazon Redshift cluster’s storage usage is increasing rapidly due to many UPDATE and DELETE operations. The engineer needs to reclaim storage space and improve query performance. Which action should be taken?

A.Run VACUUM command
B.UNLOAD the table to S3 and reload
C.Increase cluster node count
D.Run ANALYZE command
AnswerA

VACUUM reclaims disk space and re-sorts rows.

Why this answer

The VACUUM command in Amazon Redshift reclaims disk space occupied by deleted or updated rows and re-sorts the data according to the table's sort keys. This directly addresses the storage increase from UPDATE/DELETE operations and improves query performance by restoring the physical order of rows, which reduces the number of blocks scanned.

Exam trap

The trap here is that candidates confuse ANALYZE with VACUUM, thinking updating statistics will also reclaim storage, when in fact ANALYZE only refreshes metadata for the query optimizer and has no effect on physical storage.

How to eliminate wrong answers

Option B is wrong because unloading the table to S3 and reloading is a heavy, manual process that does not reclaim space in place and can be avoided with a simple VACUUM; it also incurs additional S3 costs and time. Option C is wrong because increasing the cluster node count adds more storage and compute capacity but does not reclaim the existing wasted space from deleted rows, and it may not improve performance if the underlying data is fragmented. Option D is wrong because the ANALYZE command only updates table statistics for the query planner, it does not reclaim storage space or physically reorganize data affected by UPDATE/DELETE operations.

Full explanation →
1296
MCQeasy

A company uses Amazon CloudWatch Logs to collect application logs from EC2 instances. The logs are exported to Amazon S3 for long-term storage. Recently, the export task failed with the error 'Access Denied'. What is the most likely cause of this failure?

A.The S3 bucket policy denies access from the CloudWatch Logs service.
B.The IAM role does not have s3:PutObject permission on the destination bucket.
C.The IAM role does not have s3:ListBucket permission.
D.The EC2 instances are in a VPC without a VPC endpoint for CloudWatch Logs.
AnswerB

Without PutObject, the export task cannot write logs to S3.

Why this answer

The export task from CloudWatch Logs to S3 uses an IAM role to write data to the destination bucket. If the role lacks the s3:PutObject permission, the S3 service will reject the request with an 'Access Denied' error. This is the most common cause because the export operation requires write access to the bucket.

Exam trap

The trap here is that candidates often confuse the permissions needed for exporting logs to S3 (which requires s3:PutObject on the IAM role) with the permissions needed for sending logs from EC2 to CloudWatch Logs (which requires CloudWatch Logs agent permissions and possibly a VPC endpoint).

How to eliminate wrong answers

Option A is wrong because the S3 bucket policy can deny access, but the question states the export task failed with 'Access Denied' from CloudWatch Logs, which typically indicates a missing permission in the IAM role rather than a bucket policy denial; a bucket policy denial would also produce an 'Access Denied' error but is less likely as the default configuration allows CloudWatch Logs to write if the role has permissions. Option C is wrong because s3:ListBucket permission is required for listing objects, not for writing new objects; the export task only needs to upload logs, so s3:PutObject is sufficient. Option D is wrong because a VPC endpoint for CloudWatch Logs is used for sending logs from EC2 to CloudWatch Logs, not for exporting logs from CloudWatch Logs to S3; the export task runs within the AWS CloudWatch Logs service, not from the EC2 instances.

Full explanation →
1297
MCQeasy

A data engineer needs to store semi-structured data (JSON logs) from thousands of IoT devices. The data must be schema-less, highly scalable, and support low-latency queries by device ID and timestamp. Which AWS service should the engineer use?

A.Amazon RDS for PostgreSQL
B.Amazon Redshift
C.Amazon DynamoDB
D.Amazon S3
AnswerC

DynamoDB supports flexible schema, high throughput, and low-latency queries on partition key and sort key.

Why this answer

Amazon DynamoDB is the correct choice because it is a fully managed NoSQL key-value and document database that natively supports semi-structured JSON data, schema-less design, and automatic scaling. Its partition key (device ID) and sort key (timestamp) enable low-latency, single-millisecond queries by device ID and timestamp, making it ideal for high-throughput IoT log ingestion.

Exam trap

The trap here is that candidates often confuse Amazon S3's ability to store JSON files with the ability to query them efficiently, overlooking that S3 lacks native indexing and low-latency query support, which DynamoDB provides through its key-value access pattern.

How to eliminate wrong answers

Option A is wrong because Amazon RDS for PostgreSQL is a relational database with a fixed schema, requiring predefined tables and indexes for JSON data, which cannot handle schema-less IoT logs at scale without manual sharding or performance tuning. Option B is wrong because Amazon Redshift is a columnar data warehouse optimized for analytical queries on structured data, not for low-latency point queries by device ID and timestamp, and its schema-on-write model conflicts with schema-less requirements. Option D is wrong because Amazon S3 is an object store that can store JSON logs but lacks native indexing and low-latency query capabilities; querying by device ID and timestamp would require scanning or external services like Athena, adding latency and complexity.

Full explanation →
1298
MCQhard

A data engineer is troubleshooting an AWS Glue ETL job that reads from Amazon S3 and writes to Amazon Redshift. The job runs successfully but writes duplicate rows into Redshift. The source data is static and does not contain duplicates. Which configuration change is most likely to resolve this issue?

A.Enable the 'upsert' feature in the Redshift connection by setting 'update' to true.
B.Modify the job to use the 'postactions' option with a SQL statement that deletes duplicates before final insert.
C.Use partition pruning on the S3 source to reduce the number of files read.
D.Increase the number of DPUs (Data Processing Units) allocated to the job.
AnswerB

Using postactions to perform a MERGE or delete duplicates after staging can ensure idempotent writes.

Why this answer

The job runs successfully but writes duplicate rows because AWS Glue's Spark-based ETL jobs can retry tasks on failure, and when writing to Redshift using the JDBC connector, the default behavior is to append data without deduplication. Using the 'postactions' option with a SQL DELETE statement that removes duplicates before the final INSERT ensures that only unique rows remain, resolving the duplication without altering the source data.

Exam trap

The trap here is that candidates often assume duplicate rows come from the source data or a misconfiguration in the write mode, but the real cause is the default append behavior combined with Spark task retries, and the solution is to use post-write deduplication rather than changing the write mode or source processing.

How to eliminate wrong answers

Option A is wrong because enabling 'upsert' with 'update' to true is used for merging data based on a key, but it does not prevent duplicate rows from being inserted; it only updates existing rows if a key matches, and the source data has no duplicates, so this would not fix the issue. Option C is wrong because partition pruning on the S3 source reduces the number of files read but does not address the duplication caused by job retries or write behavior; it optimizes performance, not data integrity. Option D is wrong because increasing the number of DPUs allocates more compute resources to the job, which can improve performance but does not prevent duplicate writes; duplication is a logic or configuration issue, not a resource constraint.

Full explanation →
1299
MCQeasy

A company uses AWS Glue to process data. The security team requires that all data in transit between AWS Glue and Amazon S3 be encrypted using TLS. Which configuration should be used?

A.Enable S3 server-side encryption and use HTTPS endpoints
B.Configure a bucket policy to require aws:SecureTransport
C.Enable default encryption on the S3 bucket using SSE-KMS
D.Use an S3 VPC endpoint
AnswerA

Glue uses HTTPS, which includes TLS.

Why this answer

AWS Glue uses TLS for data in transit by default. Option B is wrong because S3 default encryption is for at-rest. Option C is wrong because VPC endpoints use AWS PrivateLink but don't enforce encryption.

Option D is wrong because it's not required for TLS.

Full explanation →
1300
MCQmedium

A company ingests streaming data from IoT devices into Amazon Kinesis Data Streams. The data must be transformed in real-time using custom Python code before being stored in Amazon S3. Which AWS service should be used to perform this transformation?

A.Amazon EMR
B.Amazon Kinesis Data Firehose
C.AWS Glue
D.Amazon Kinesis Data Analytics for Apache Flink
AnswerD

Kinesis Data Analytics for Apache Flink allows running Flink applications that can process streaming data with custom Python code.

Why this answer

Amazon Kinesis Data Analytics for Apache Flink enables real-time stream processing with custom Python code via Apache Flink's Python API, making it suitable for complex transformations. Option A (Amazon EMR) is wrong as it requires significant setup and is not a fully managed streaming service. Option B (Amazon Kinesis Data Firehose) is wrong because although it can invoke Lambda for simple transformations, it is limited in complexity and not designed for rich Python custom logic.

Option C (AWS Glue) is wrong because it is primarily a batch ETL service and lacks native real-time stream processing capabilities.

Full explanation →
1301
MCQmedium

A company runs a Redshift cluster and notices that query performance has degraded over time. The data engineer suspects that table statistics are stale. What should the engineer do to improve query performance?

A.Rebuild the tables by using CREATE TABLE AS
B.Increase the number of slices in the cluster
C.Run the ANALYZE command on the tables
D.Run the VACUUM command on the tables
AnswerC

ANALYZE updates table statistics for the optimizer.

Why this answer

Stale table statistics cause the Redshift query optimizer to generate suboptimal execution plans, leading to degraded query performance. Running the ANALYZE command updates these statistics, allowing the optimizer to make better decisions about join order, distribution, and data scan strategies. This directly addresses the root cause of performance degradation over time.

Exam trap

The trap here is confusing the VACUUM command (which reorganizes physical storage) with the ANALYZE command (which updates query optimizer metadata), leading candidates to choose VACUUM when stale statistics are the actual culprit.

How to eliminate wrong answers

Option A is wrong because rebuilding tables with CREATE TABLE AS (CTAS) does not update statistics; it creates a new table that still requires an explicit ANALYZE to populate its statistics, and it is an unnecessarily heavy operation for fixing stale stats. Option B is wrong because increasing the number of slices in the cluster requires resizing the cluster (e.g., adding nodes or changing node types), which is a disruptive, costly operation that does not address stale statistics; query performance degradation from stale stats is not resolved by adding more slices. Option D is wrong because the VACUUM command reclaims disk space and sorts rows to maintain physical data organization, but it does not update table statistics; stale statistics persist after VACUUM, so the optimizer remains uninformed.

Full explanation →
1302
MCQhard

A company runs a daily batch ETL job using AWS Glue. The job processes 500 GB of data from Amazon RDS to Amazon S3. The job currently uses a single DPU and takes 6 hours to complete. The team wants to reduce runtime to under 1 hour without increasing costs significantly. Which approach should they use?

A.Change the job type from Python to Spark.
B.Use multiple Glue jobs triggered sequentially.
C.Increase the RDS instance size to improve read throughput.
D.Use AWS Glue Spark job with 100 workers.
AnswerD

More workers enable parallelism, reducing runtime.

Why this answer

AWS Glue Spark jobs can parallelize data processing across multiple workers, dramatically reducing runtime. With 100 workers, the job can process the 500 GB dataset in parallel, achieving sub-1-hour runtime while keeping costs relatively low since Glue charges per DPU-second and the total DPU-seconds may be similar to the original 6-hour single-DPU job.

Exam trap

The trap here is that candidates might think increasing parallelism (Option D) is too expensive, but Glue's pay-per-DPU-second model means a job with 100 workers running for 1 hour costs roughly the same as 1 worker running for 100 hours, so the total cost is similar, not significantly higher.

How to eliminate wrong answers

Option A is wrong because changing from Python to Spark alone does not add parallelism; the job still runs on a single DPU unless the number of workers is increased. Option B is wrong because running multiple Glue jobs sequentially would increase total runtime, not reduce it, as each job would still process data serially. Option C is wrong because the bottleneck is Glue's processing capacity, not RDS read throughput; increasing RDS instance size would not significantly reduce Glue job runtime since the job already reads 500 GB over 6 hours, and the read rate is not the limiting factor.

Full explanation →
1303
Multi-Selecthard

A company uses AWS DMS to replicate data from an Amazon RDS for MySQL database to Amazon S3. Which TWO configurations are required to enable continuous change data capture (CDC) from MySQL?

Select 2 answers
A.Ensure the S3 bucket is in the same AWS Region as the source database
B.Grant REPLICATION CLIENT and REPLICATION SLAVE privileges to the DMS user
C.Enable binary logging (binlog) on the MySQL source database
D.Enable versioning on the target S3 bucket
E.Configure the MySQL source to be Multi-AZ
AnswersB, C

Required for DMS to read binary logs.

Why this answer

Correct options: B and C. For AWS DMS to perform continuous change data capture (CDC) from a MySQL source, binary logging (binlog) must be enabled on the source database (option C) to capture changes. Additionally, the MySQL user used by DMS must be granted the REPLICATION CLIENT and REPLICATION SLAVE privileges (option B) to read the binlog and stream changes.

Option D (S3 bucket versioning) is not required for DMS CDC. Option A (same Region) is not a requirement. Option E (Multi-AZ) is not needed for CDC.

Therefore, B and C are the required configurations.

Full explanation →
1304
Multi-Selecthard

Which THREE factors should be considered when choosing a partition key for an Amazon DynamoDB table?

Select 3 answers
A.The partition key should be chosen to maximize the size of items in each partition.
B.If the table has a write-heavy workload, the partition key should distribute writes evenly.
C.The partition key should align with the most common query access pattern.
D.The partition key should be chosen to minimize read capacity unit consumption.
E.The partition key should have high cardinality to distribute data evenly.
AnswersB, C, E

Even write distribution prevents throttling.

Why this answer

DynamoDB distributes data and request traffic across partitions based on the partition key. For write-heavy workloads, a partition key that evenly distributes writes prevents hot partitions, which can throttle requests and degrade performance. This ensures that no single partition exceeds its write capacity limit.

Exam trap

The trap here is that candidates may think maximizing item size (Option A) or minimizing RCU consumption (Option D) are primary factors, when in fact even distribution and access pattern alignment are the critical design principles for DynamoDB partition keys.

Full explanation →
1305
MCQhard

A data engineer is using Amazon Kinesis Data Firehose to deliver streaming data to an S3 bucket. The data is delivered in 5-minute intervals. However, the engineer notices that the data in S3 is often delayed by up to 30 minutes. Which configuration change would most likely reduce the delay?

A.Decrease the 'Buffer interval' from 300 seconds to 60 seconds.
B.Enable compression (GZIP) on the Firehose delivery stream.
C.Increase the 'Buffer size' from 5 MB to 50 MB.
D.Enable 'Dynamic partitioning' on the Firehose stream.
AnswerA

Shorter buffer interval triggers more frequent deliveries.

Why this answer

The buffer interval determines the maximum time Firehose will wait before delivering data, regardless of buffer size. Decreasing it from 300 to 60 seconds forces more frequent deliveries, reducing the delay. Option B (compression) reduces data size, which could slow buffer filling and potentially increase delay if the buffer size trigger is not met.

Option C (increasing buffer size) would cause Firehose to wait longer for the buffer to fill, increasing delay. Option D (dynamic partitioning) affects data organization, not delivery frequency, so it does not reduce delay.

Full explanation →
1306
MCQeasy

A company needs to transform JSON data from an S3 bucket into a structured format for Amazon Redshift. The transformation should be done serverlessly. Which service should be used?

A.AWS Glue
B.Amazon EMR
C.Amazon Athena
D.AWS Lambda
AnswerA

Glue provides serverless ETL capabilities.

Why this answer

AWS Glue is the correct choice because it is a fully managed, serverless ETL service designed specifically for transforming and preparing data for analytics, including converting JSON to structured formats like Parquet or ORC for Amazon Redshift. It can crawl the S3 source, infer schemas, and run Spark-based transformation jobs without provisioning any infrastructure, aligning perfectly with the serverless requirement.

Exam trap

The trap here is that candidates often confuse Amazon Athena's serverless SQL querying capability with ETL transformation, but Athena cannot transform or write data into a different format for Redshift—it only reads and queries data in place.

How to eliminate wrong answers

Option B (Amazon EMR) is wrong because it requires provisioning and managing EC2 clusters, which is not serverless; it is a managed Hadoop framework but still involves underlying infrastructure. Option C (Amazon Athena) is wrong because it is a serverless query engine for analyzing data directly in S3 using SQL, not a transformation service for converting JSON to a structured format for Redshift. Option D (AWS Lambda) is wrong because it is designed for short-running, event-driven functions (max 15-minute execution time) and is not suitable for large-scale ETL transformations on big datasets, which typically require longer-running jobs.

Full explanation →
1307
MCQmedium

A financial services company uses AWS Glue ETL jobs to process sensitive customer data stored in Amazon S3. The data is encrypted at rest with SSE-KMS using a customer-managed key. Recently, the security team discovered that the Glue job's IAM role has an overly permissive policy that allows the 'kms:Decrypt' action for all KMS keys in the account. The company wants to follow the principle of least privilege. The Glue job runs on a schedule and reads from a specific S3 bucket. The security team needs to update the IAM policy to restrict KMS decryption to only the specific key used for that bucket. What should they do?

A.Update the policy to allow 'kms:Decrypt' with a resource of 'arn:aws:kms:us-east-1:123456789012:key/*' to cover all keys in the account.
B.Update the policy to allow 'kms:Decrypt' with a resource of '*' to ensure the job can always decrypt data.
C.Update the policy to allow 'kms:Decrypt' only for the specific KMS key ARN used by the S3 bucket containing the customer data.
D.Remove the 'kms:Decrypt' action from the policy and rely on S3 bucket policies to grant decryption permissions.
AnswerC

Correct. To follow least privilege, the IAM role should only have 'kms:Decrypt' permission on the exact ARN of the KMS key used to encrypt the S3 bucket.

Why this answer

To follow least privilege, the IAM role for the Glue job should only have access to decrypt using the specific KMS key that encrypts the S3 bucket containing the customer data. This is done by allowing 'kms:Decrypt' with a resource set to the exact ARN of that key, not a wildcard or all keys. Option A is incorrect because using a wildcard in the key ARN (key/*) still grants access to all keys under that key hierarchy, which is overly permissive.

Option B is incorrect because allowing 'kms:Decrypt' with resource '*' would grant access to all keys in the account, violating least privilege. Option D is incorrect because removing 'kms:Decrypt' from the IAM policy would prevent the Glue job from decrypting the data; the job's IAM role needs the permission, and relying solely on S3 bucket policies cannot grant decryption permissions cross-account or for IAM roles.

Full explanation →
1308
MCQmedium

A data engineer needs to allow an IAM user to rotate the secret in AWS Secrets Manager for an RDS database. Which IAM action should be included in the policy?

A.secretsmanager:RotateSecret
B.secretsmanager:PutSecretValue
C.secretsmanager:UpdateSecret
D.secretsmanager:GetSecretValue
AnswerA

This action allows rotating the secret.

Why this answer

The secretsmanager:RotateSecret action allows the user to initiate rotation of a secret. Option A is correct. secretsmanager:GetSecretValue only retrieves the secret value, not rotate it.

Full explanation →
1309
MCQeasy

A company is using an RDS for PostgreSQL instance and wants to minimize downtime during a major version upgrade. Which approach should be taken?

A.Create a read replica of the DB instance, upgrade the replica, and then promote it to the primary instance.
B.Use AWS Database Migration Service (DMS) to migrate data to a new upgraded instance.
C.Modify the DB instance and apply the upgrade immediately.
D.Take a snapshot of the DB instance and restore it as a new instance with the upgraded version.
AnswerA

Minimizes downtime by failing over to the upgraded replica.

Why this answer

Creating a read replica of the RDS for PostgreSQL instance, upgrading the replica to the new major version, and then promoting it to become the primary instance minimizes downtime by allowing the replica to be upgraded while the original primary remains fully operational. The promotion process is fast (typically seconds), and the only downtime is the brief cutover period when applications switch to the promoted replica. This approach leverages RDS's managed replication and avoids the longer downtime associated with direct in-place upgrades.

Exam trap

The trap here is that candidates often assume a snapshot-and-restore (Option D) is the fastest method because it seems like a simple copy, but they overlook the fact that the snapshot itself requires the instance to be operational and the restore creates a new instance that is not automatically kept in sync, leading to longer overall downtime compared to the replica promotion method.

How to eliminate wrong answers

Option B is wrong because AWS Database Migration Service (DMS) is designed for heterogeneous or homogeneous migrations with ongoing replication, but it introduces significant complexity and potential downtime during the full-load and change-data-capture phases; it is not the optimal approach for a simple major version upgrade of an existing RDS instance. Option C is wrong because modifying the DB instance and applying the upgrade immediately causes an in-place upgrade that typically results in several minutes of downtime (often 10–30 minutes or more) while the instance is stopped, upgraded, and restarted, which violates the goal of minimizing downtime. Option D is wrong because taking a snapshot and restoring it as a new instance with the upgraded version requires the source instance to be available during the snapshot (which can take time) and then the restore process creates a new instance that is not automatically synchronized with the original; this approach involves significant downtime for the snapshot creation and restore, and does not provide a seamless cutover.

Full explanation →
1310
MCQeasy

A data engineer needs to store semi-structured JSON data from IoT devices. The data is written frequently and read occasionally. Which AWS service is MOST cost-effective for this use case?

A.Amazon ElastiCache for Redis
B.Amazon DynamoDB
C.Amazon RDS for MySQL
D.Amazon Redshift
AnswerB

DynamoDB handles high write volumes efficiently.

Why this answer

Amazon DynamoDB is the most cost-effective choice because it is a fully managed NoSQL key-value and document database that natively supports semi-structured JSON data, offers single-digit millisecond latency for frequent writes, and provides a pay-per-request pricing model ideal for workloads with occasional reads. Its on-demand capacity mode automatically scales to handle high write throughput without provisioning, making it cheaper than provisioned alternatives for spiky or unpredictable IoT ingestion patterns.

Exam trap

The trap here is that candidates often choose Amazon ElastiCache for Redis due to its speed and JSON module support, but they overlook that it is not designed for durable, cost-effective long-term storage of semi-structured data, and DynamoDB's native JSON support and pay-per-request pricing make it the more economical choice for this specific write-frequent, read-occasional pattern.

How to eliminate wrong answers

Option A is wrong because Amazon ElastiCache for Redis is an in-memory cache designed for sub-millisecond read-heavy workloads and ephemeral data, not for durable storage of semi-structured JSON from IoT devices; it lacks native JSON document storage (though RedisJSON module exists, it adds cost and complexity) and is significantly more expensive per GB than DynamoDB for persistent data. Option C is wrong because Amazon RDS for MySQL is a relational database that requires schema definition, making it inefficient for semi-structured JSON data that varies in fields; it incurs higher costs due to provisioned IOPS and storage, and its write performance is limited by the underlying instance size and transaction overhead. Option D is wrong because Amazon Redshift is a columnar data warehouse optimized for complex analytical queries on large datasets, not for high-frequency writes from IoT devices; its minimum cost is high (starts at ~$0.25/hour for dc2.large), and it is overkill for occasional reads of semi-structured JSON, leading to wasted expenditure.

Full explanation →
1311
MCQeasy

A data engineer needs to ensure that an Amazon S3 bucket containing sensitive customer data is encrypted at rest. Which AWS service can be used to manage the encryption keys?

A.AWS Certificate Manager
B.AWS Secrets Manager
C.AWS CloudHSM
D.AWS Key Management Service (KMS)
AnswerD

KMS is the managed service for creating and controlling encryption keys used by S3 SSE-KMS.

Why this answer

AWS KMS is the service for managing encryption keys. S3 SSE-S3 uses S3-managed keys, while SSE-C uses customer-provided keys. CloudHSM is a hardware security module but not directly used for S3 encryption key management.

Full explanation →
1312
MCQmedium

Refer to the exhibit. The exhibit shows output from AWS CLI commands. Which key can be used to enable automatic annual rotation?

A.The second key (5678efgh-...)
B.Both keys
C.Neither key
D.The first key (1234abcd-...)
AnswerD

Customer managed keys can have automatic rotation enabled.

Why this answer

(the first key) is correct because automatic annual rotation is only configurable for customer managed keys. The first key is customer managed, allowing the user to enable or disable automatic rotation with a specified frequency (e.g., annually). The second key is AWS managed, which rotates automatically every three years without user configuration, so its rotation cannot be enabled or disabled by the user.

Options A and B are incorrect because the second key (AWS managed) does not support user-controlled automatic rotation, and both keys cannot have rotation configured independently. Option C is incorrect because the first key (customer managed) does support automatic annual rotation.

Full explanation →
1313
MCQhard

A data engineer is designing a multi-region disaster recovery solution for Amazon RDS for PostgreSQL. The primary region must have a standby in a different Availability Zone, and the secondary region must have a readable replica that can be promoted in case of failure. Which configuration meets these requirements?

A.Use a single-AZ primary and enable automatic backups
B.Enable Multi-AZ in the primary region and create a cross-region read replica
C.Use a single-AZ primary and create a cross-region read replica
D.Enable Multi-AZ in both primary and secondary regions
AnswerB

Multi-AZ provides standby; cross-region replica provides DR.

Why this answer

It meets both requirements: Multi-AZ in the primary region provides a synchronous standby in a different Availability Zone for high availability, and a cross-region read replica in the secondary region provides an asynchronous, readable copy that can be promoted to a standalone primary during a regional failure. This combination ensures both intra-region fault tolerance and inter-region disaster recovery.

Exam trap

The trap here is that candidates often confuse Multi-AZ (synchronous, for high availability within a region) with cross-region read replicas (asynchronous, for disaster recovery), and may incorrectly assume that Multi-AZ alone provides cross-region failover or that a single-AZ primary with a read replica satisfies the intra-region standby requirement.

How to eliminate wrong answers

Option A is wrong because a single-AZ primary with automatic backups does not provide a standby in a different Availability Zone, nor does it create a readable replica in a secondary region; backups are for point-in-time recovery, not for immediate failover or read scaling. Option C is wrong because a single-AZ primary lacks the required standby in a different Availability Zone within the primary region; the cross-region read replica only addresses the secondary region requirement. Option D is wrong because enabling Multi-AZ in both regions does not create a cross-region read replica; Multi-AZ in the secondary region provides a standby within that region but does not establish a readable replica that can be promoted from the primary region.

Full explanation →
1314
MCQeasy

A data engineer is designing a data lake on Amazon S3. The data includes personally identifiable information (PII) that must be encrypted at rest. Which encryption option provides the most control over encryption keys?

A.Client-side encryption using Amazon S3 Encryption Client.
B.Server-side encryption with S3 managed keys (SSE-S3).
C.Server-side encryption with AWS KMS managed keys (SSE-KMS).
D.Server-side encryption with customer-provided keys (SSE-C).
AnswerC

Allows use of customer-managed KMS keys, giving more control.

Why this answer

SSE-KMS allows you to use AWS Key Management Service (KMS) to manage your encryption keys, providing you with control over key rotation, access policies, and auditing via AWS CloudTrail. This offers more control than SSE-S3 (where AWS manages the keys entirely) and more flexibility than SSE-C (where you manage the keys yourself but lose AWS-managed key rotation and auditing). Client-side encryption (Option A) gives you control but requires you to manage the encryption process and keys outside of S3, which is not a server-side encryption option and adds complexity.

Exam trap

The trap here is that candidates often confuse 'most control' with 'customer-provided keys' (SSE-C), but SSE-C requires you to manage the keys entirely outside AWS, losing AWS-managed key rotation and auditing, whereas SSE-KMS gives you control over key policies and rotation while still leveraging AWS infrastructure.

How to eliminate wrong answers

Option A is wrong because client-side encryption using the Amazon S3 Encryption Client encrypts data before it is sent to S3, meaning the encryption keys are managed entirely by the client, not by AWS; this provides maximum control but is not a server-side encryption option and does not leverage S3's built-in encryption features. Option B is wrong because SSE-S3 uses Amazon S3-managed keys where AWS handles key management entirely, giving the data engineer no control over key rotation, access policies, or auditing. Option D is wrong because SSE-C requires the customer to provide their own encryption keys, but those keys are managed by the customer outside of AWS, and S3 does not store or manage them, meaning you lose the ability to use AWS-managed key rotation and auditing, and you must manage key distribution and lifecycle yourself.

Full explanation →
1315
MCQmedium

Refer to the exhibit. A data engineer has attached this IAM policy to a user. The user reports being unable to upload files to my-bucket from an on-premises network with a public IP of 203.0.113.5. What is the issue?

A.The resource ARN does not include the bucket itself
B.The user's IP address is not within the allowed IP range
C.The user does not have s3:PutObject permission
D.The bucket requires server-side encryption
AnswerB

The condition only allows 10.0.0.0/16.

Why this answer

The IAM policy includes a condition that restricts access to requests originating from the IP range 10.0.0.0/16 (a private range). The user's on-premises network has a public IP of 203.0.113.5, which is not within that range, so the condition fails and the upload is denied. Option A is incorrect because the resource ARN does include the bucket itself (arn:aws:s3:::my-bucket/*), so that is not the issue.

Option C is incorrect because the policy explicitly allows s3:PutObject. Option D is incorrect because there is no condition requiring server-side encryption.

Full explanation →
1316
MCQeasy

A company uses Amazon S3 to store raw data and AWS Glue to run ETL jobs. The data is partitioned by date in the format 'year=YYYY/month=MM/day=DD'. A new data source started sending data with a different date format 'YYYY-MM-DD'. The Glue crawler is configured to create a single table for the entire bucket. The crawler runs daily, but it is not detecting the new partitions from the new data source. The existing partitions are in the format 'year=2024/month=05/day=10', while the new data is stored as '2024-05-10/' without the key-value structure. How should the engineer modify the data pipeline to include the new data?

A.Run the crawler with the 'Create partition indexes' option enabled.
B.Configure the crawler to add a custom classifier for date formats.
C.Modify the new data source to store data in the same Hive-style partition format as the existing data.
D.Convert the new data to Parquet format.
AnswerC

Consistent partition structure enables the crawler to detect partitions.

Why this answer

The new data uses a flat date folder (YYYY-MM-DD) instead of the existing Hive-style partition layout (year=YYYY/month=MM/day=DD). AWS Glue crawlers expect Hive-style partitions to automatically infer partitions. To include the new data without breaking the existing pipeline, the simplest solution is to store the new data in the same Hive-style format as the existing data.

Option A is incorrect because partition indexes help with query performance, not with partition format mismatch. Option B is incorrect because custom classifiers affect schema inference, not partition structure. Option D is incorrect because converting to Parquet does not change the partition folder structure.

Full explanation →
1317
MCQhard

A company is migrating an on-premises Hadoop cluster to AWS. The data is stored in HDFS and needs to be accessible by both Amazon EMR and Amazon Redshift Spectrum. Which storage solution is most cost-effective and scalable?

A.Amazon FSx for HDFS
B.Amazon Simple Storage Service (S3)
C.Amazon Elastic Block Store (EBS)
D.Amazon Elastic File System (EFS)
AnswerB

S3 is highly scalable, durable, and can be queried by Redshift Spectrum and processed by EMR.

Why this answer

Amazon S3 is the most cost-effective and scalable storage solution for this use case because it provides native integration with both Amazon EMR (via S3A connector or EMRFS) and Amazon Redshift Spectrum (via external tables). Unlike HDFS, S3 decouples compute from storage, allowing you to pay only for the data stored and the compute resources used, with virtually unlimited scalability and 99.999999999% durability.

Exam trap

The trap here is that candidates often choose Amazon FSx for HDFS because it seems like a direct lift-and-shift of the on-premises Hadoop setup, but they fail to recognize that S3 is the recommended and more cost-effective solution for decoupled storage in AWS big data architectures.

How to eliminate wrong answers

Option A is wrong because Amazon FSx for HDFS is a managed HDFS-compatible file system that replicates the on-premises Hadoop architecture, which does not decouple compute from storage and incurs higher costs for both storage and compute, making it less cost-effective and scalable than S3. Option C is wrong because Amazon EBS is a block-level storage designed for single EC2 instance attachment, not for shared access across multiple services like EMR and Redshift Spectrum, and it lacks the scalability and cost efficiency of object storage. Option D is wrong because Amazon EFS is a POSIX-compliant file system that does not integrate natively with Redshift Spectrum (which requires S3 or external tables) and is not optimized for the high-throughput, parallel access patterns of Hadoop workloads.

Full explanation →
1318
MCQmedium

A data engineer is designing a data lake on Amazon S3. The data includes personally identifiable information (PII) that must be encrypted at rest. Which combination of actions meets the encryption requirement with the least operational overhead?

A.Apply a bucket policy that denies access to unencrypted requests
B.Enable default encryption on the S3 bucket using SSE-S3
C.Use client-side encryption with AWS KMS
D.Use server-side encryption with AWS KMS (SSE-KMS)
AnswerB

SSE-S3 is simple and automatically encrypts objects.

Why this answer

Enabling default encryption on the S3 bucket with SSE-S3 automatically encrypts all objects at rest using AES-256, managed entirely by AWS. This requires no additional configuration or key management, providing the least operational overhead while meeting the encryption requirement for PII.

Exam trap

The trap here is that candidates often confuse enforcing encryption (via bucket policies) with actually encrypting data at rest, or they overcomplicate the solution by choosing SSE-KMS or client-side encryption when SSE-S3 provides sufficient security with the least operational overhead.

How to eliminate wrong answers

Option A is wrong because a bucket policy that denies access to unencrypted requests does not encrypt data at rest; it only enforces encryption in transit or for API calls, leaving stored objects unencrypted. Option C is wrong because client-side encryption with AWS KMS requires the data engineer to manage encryption logic in the application, adding significant operational overhead and complexity. Option D is wrong because server-side encryption with AWS KMS (SSE-KMS) introduces additional overhead for managing KMS keys, key policies, and potential costs, making it less operationally efficient than SSE-S3 for this requirement.

Full explanation →
1319
Multi-Selectmedium

A company is using AWS Lake Formation to manage permissions on a data lake. Which of the following are valid ways to grant access to a user or role? (Choose THREE.)

Select 3 answers
A.Grant permissions to a SAML or SCIM group
B.Grant permissions using tag-based access control (LF-Tags)
C.Grant permissions to an IAM user or role
D.Grant permissions to an AWS Organizations unit
E.Grant permissions via an S3 bucket policy
AnswersA, B, C

Lake Formation can integrate with SAML/SCIM for group-based access.

Why this answer

Options A, B, and C are correct. Lake Formation can grant permissions directly to IAM users/roles (C), to SAML/SCIM groups (A), and via tag-based access control using LF-Tags (B). Option D is incorrect because AWS Organizations units manage accounts, not individual permissions.

Option E is incorrect because S3 bucket policies are separate from Lake Formation and cannot be used to grant Lake Formation permissions.

Exam trap

Tag-based access control (LF-Tags) is a valid method in Lake Formation, similar to IAM resource tags, but it is specific to Lake Formation.

Full explanation →
1320
MCQeasy

A company uses Amazon S3 Event Notifications to trigger a Lambda function that processes incoming files. Recently, the Lambda function has been timing out for large files (>100 MB). The data engineer wants to improve the pipeline to handle large files reliably. Which solution is the MOST scalable and cost-effective?

A.Use S3 Event Notification to send to an SQS queue, then have Lambda poll the queue
B.Use Amazon SNS to fan out the event to multiple Lambda functions
C.Use AWS Step Functions to orchestrate multiple Lambda functions for parallel processing
D.Increase the Lambda timeout to 15 minutes
AnswerA

SQS decouples and buffers events, allowing Lambda to process at a manageable rate.

Why this answer

Decoupling S3 event notifications via an SQS queue allows Lambda to poll messages at its own pace, preventing timeouts from large files. The SQS queue acts as a buffer, enabling Lambda to process files asynchronously and scale based on the queue depth without being constrained by the synchronous S3 trigger timeout (typically 15 minutes for Lambda, but large files can still cause issues with concurrent execution limits). This approach is both scalable and cost-effective, as it avoids idle wait time and allows Lambda to process files in smaller chunks or with longer execution times as needed.

Exam trap

The trap here is that candidates assume increasing Lambda timeout is the simplest fix, but the DEA-C01 exam tests understanding of decoupling patterns (SQS) to handle variable workloads and avoid synchronous invocation bottlenecks.

How to eliminate wrong answers

Option B is wrong because fanning out via SNS to multiple Lambda functions does not address the root cause of timeouts; it merely duplicates the same synchronous invocation pattern, potentially overwhelming Lambda concurrency limits and increasing costs without improving reliability for large files. Option C is wrong because AWS Step Functions orchestrate multiple Lambda functions for parallel processing, which adds complexity and cost (per state transition) without solving the timeout issue for a single large file; Step Functions are better for workflows with multiple steps, not for buffering or retry logic. Option D is wrong because simply increasing the Lambda timeout to 15 minutes does not address scalability or cost; it risks exhausting Lambda concurrency limits (e.g., 1,000 concurrent executions by default) and incurs higher costs for idle time, while still failing if the file processing exceeds 15 minutes or if multiple large files arrive simultaneously.

Full explanation →
1321
MCQmedium

A data engineer is troubleshooting an Amazon Redshift cluster that is not responding to queries. The engineer suspects that the cluster may have been accidentally deleted. Which AWS service should be used to investigate the deletion?

A.AWS Config
B.AWS CloudTrail
C.Amazon CloudWatch Logs
D.AWS Trusted Advisor
AnswerB

CloudTrail logs API calls like DeleteCluster.

Why this answer

AWS CloudTrail records API calls made to the AWS environment. To investigate if an Amazon Redshift cluster was accidentally deleted, you would use CloudTrail to review the DeleteCluster API call, including who made the call and when. AWS Config tracks resource configuration changes and can show that a cluster was deleted, but it does not directly record API calls; CloudTrail is the primary service for auditing API activity.

Amazon CloudWatch Logs stores log data from applications and services, not API calls. AWS Trusted Advisor provides best practice recommendations, not deletion history.

Full explanation →
1322
Multi-Selectmedium

A company uses Amazon DynamoDB for a gaming application. The application experiences throttling during peak hours. The table's read and write capacity is provisioned. Which TWO actions can reduce throttling?

Select 2 answers
A.Enable TTL (time to live) on the table to automatically delete old items
B.Enable DynamoDB auto scaling for the table
C.Increase the provisioned read capacity units (RCUs)
D.Implement DynamoDB Accelerator (DAX) to cache read requests
E.Add a DynamoDB Global Table for the table
AnswersB, D

Auto scaling adjusts provisioned capacity based on traffic.

Why this answer

DynamoDB auto scaling (Option B) automatically adjusts the provisioned read and write capacity based on actual traffic patterns, preventing throttling during peak hours without manual intervention. This is the correct action because it dynamically increases capacity when demand spikes and reduces it during low traffic, directly addressing the throttling issue.

Exam trap

The trap here is that candidates often confuse increasing provisioned capacity (Option C) as the only solution, but the exam tests whether you understand that auto scaling (Option B) is the correct managed approach, and that DAX (Option D) can reduce read throttling by caching, making both B and D valid together.

Full explanation →
1323
MCQmedium

A company is using Amazon Kinesis Data Streams to ingest real-time clickstream data from a website. The data is consumed by an Amazon Kinesis Data Analytics for Apache Flink application that performs real-time analytics. The Flink application writes its results to an Amazon S3 bucket. The company has noticed that the Flink application is experiencing high checkpoint failure rates, causing delays. The CloudWatch metrics show that the checkpoint size is large and increasing. The data engineer needs to reduce the checkpoint size. Which action should the data engineer take?

A.Decrease the checkpoint interval to reduce the amount of state accumulated.
B.Reduce the parallelism of the Flink application.
C.Increase the state time-to-live (TTL) configuration to retain state longer.
D.Enable incremental checkpointing in the Flink application to only write changes since the last checkpoint.
AnswerD

Incremental checkpoints reduce size and improve performance.

Why this answer

Enabling incremental checkpointing in Flink reduces the amount of data written per checkpoint by only writing changes since the last checkpoint. Option A is wrong because reducing parallelism may increase load per operator. Option B is wrong because decreasing checkpoint interval increases frequency, not size.

Option C is wrong because state TTL does not directly reduce checkpoint size.

Full explanation →
1324
MCQhard

A data engineer is troubleshooting a slow-running Amazon Redshift query. The query involves a large fact table with a distribution style of EVEN and a sort key on date. The table has 10 slices. The engineer notices that the query is performing a broadcast join with a small dimension table. Which change would most improve performance?

A.Remove the sort key and use a compound sort key on the join column
B.Change the dimension table to DISTSTYLE ALL
C.Increase the number of slices by resizing the cluster
D.Change the fact table to DISTSTYLE KEY on the join column
AnswerD

KEY distribution colocates matching rows, reducing the need for broadcast.

Why this answer

Changing the fact table’s distribution style to KEY on the join column co-locates rows from both tables on the same nodes, eliminating the need for broadcasting and reducing network traffic. This fully optimizes the join for the large fact table. Option A is incorrect: removing the sort key can degrade range queries, and a compound sort key on the join column does not address data distribution.

Option B: while setting the dimension table to DISTSTYLE ALL would avoid broadcasting by replicating the table to all nodes, it does not improve the fact table’s own data distribution, which remains EVEN and can cause skew or suboptimal joins in other queries. Option C: adding slices increases parallelism but still requires broadcasting, so it does not address the root cause of the performance issue.

Full explanation →
1325
MCQmedium

A data engineering team is troubleshooting a failing AWS Glue ETL job that processes data from an S3 bucket. The job writes output to another S3 bucket. The job fails with an AccessDenied error when writing to the output bucket. The IAM role used by the job has the following policy attached: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:GetObject","s3:ListBucket"],"Resource":["arn:aws:s3:::input-bucket/*","arn:aws:s3:::input-bucket"]}]}. What is the most likely cause of the failure?

A.The ETL job is processing more than 10 TB of data.
B.The output bucket has a bucket policy that denies access to the IAM role.
C.The IAM role does not have s3:PutObject permission on the output bucket.
D.The IAM role used by the job does not exist.
AnswerC

The policy lacks s3:PutObject for the output bucket, causing the AccessDenied error.

Why this answer

The IAM policy only grants s3:GetObject and s3:ListBucket permissions on the input bucket, but the job also needs permission to write to the output bucket. The missing s3:PutObject permission on the output bucket causes the AccessDenied error. Therefore, Option C is correct.

Option A is incorrect because there is no data size restriction. Option B is incorrect because the error is due to missing IAM permissions, not a bucket policy. Option D is incorrect because the role exists.

Full explanation →
1326
MCQeasy

A data engineer has this IAM policy attached to their user. They are trying to create an Amazon EMR cluster with a custom service role 'EMR_CustomRole'. What will happen?

A.The cluster creation will fail because elasticmapreduce:* is too broad.
B.The cluster creation will succeed because elasticmapreduce:* is allowed.
C.The cluster creation will fail with an 'Access Denied' error for iam:PassRole.
D.The cluster creation will succeed because PassRole is not required for EMR.
AnswerC

The policy restricts PassRole to only the default role, so passing a custom role is denied.

Why this answer

The IAM policy allows iam:PassRole only for the specific role 'EMR_DefaultRole'. When creating an EMR cluster with a custom service role 'EMR_CustomRole', the user needs to pass that role, but the policy does not grant iam:PassRole for 'EMR_CustomRole'. Therefore, the cluster creation fails with an 'Access Denied' error for iam:PassRole.

Other options are incorrect: A incorrectly attributes failure to elasticmapreduce:* being too broad; B incorrectly assumes success because elasticmapreduce:* is allowed, ignoring the PassRole requirement; D incorrectly states PassRole is not required.

Full explanation →
1327
MCQmedium

A company is using Amazon Kinesis Data Firehose to ingest log data from web servers into an Amazon S3 bucket. The data is then queried by Amazon Athena. The company has noticed that the Athena queries are slow and expensive. The data engineer wants to optimize the storage format to improve query performance and reduce costs. Which configuration change should the data engineer make to the Firehose delivery stream?

A.Increase the buffer interval to 600 seconds and buffer size to 128 MB to create larger files.
B.Change the output format to ORC and enable GZIP compression.
C.Enable S3 server access logs to track query patterns.
D.Enable data transformation in Firehose to convert JSON to Parquet format with Snappy compression.
AnswerD

Parquet is columnar and efficient for Athena.

Why this answer

Enable data transformation in Firehose to convert JSON to Parquet format with Snappy compression. Parquet is a columnar storage format that significantly improves query performance in Athena by reducing the amount of data scanned per query. Snappy compression provides efficient compression and decompression, reducing storage costs and improving I/O.

Option A is incorrect because increasing buffer interval and size simply creates larger files but does not change the storage format; the data remains in its original format (likely JSON or CSV), which is less efficient for columnar querying. Option B is incorrect because while ORC is also a columnar format, Parquet is more commonly used with Athena and offers better integration; additionally, GZIP compression is not as efficient as Snappy for Parquet files. Option C is incorrect because enabling S3 server access logs would track requests to the S3 bucket but does not optimize the data format or improve query performance; it adds additional cost and storage overhead.

Full explanation →
1328
MCQeasy

A company wants to ingest data from thousands of IoT devices into AWS for real-time analytics. The data is in JSON format and each device sends about 1 KB every second. Which service should be used as the primary ingestion point?

A.AWS IoT Core
B.Amazon Kinesis Data Firehose
C.Amazon SQS
D.Amazon Kinesis Data Streams
AnswerD

Handles high-volume streaming data.

Why this answer

Amazon Kinesis Data Streams (D) is the correct choice because it is designed for real-time streaming of large amounts of data from many producers, such as thousands of IoT devices. Each device sends 1 KB per second, resulting in ~1 MB/s total throughput, which Kinesis Data Streams can handle with sharding. It supports multiple consumers for real-time analytics.

AWS IoT Core (A) is for device management and MQTT messaging, not a general-purpose ingestion point for analytics. Kinesis Data Firehose (B) is for loading streaming data into storage, but it does not support multiple real-time consumers and has a minimum 60-second buffer latency. Amazon SQS (C) is a message queue for decoupled applications, not built for high-throughput streaming analytics.

Exam trap

Confusing the purpose of Kinesis Data Streams (real-time ingestion with multiple consumers) vs. Kinesis Data Firehose (delivery to storage with latency) is common. Also, remember that AWS IoT Core is a device gateway, not a data ingestion service for analytics.

Full explanation →
1329
Multi-Selectmedium

A financial services company is designing a data store for transaction records that must be immutable and auditable. The data must be stored for 7 years. Which AWS services can be combined to meet these requirements? (Choose TWO.)

Select 2 answers
A.Amazon S3 Glacier Deep Archive
B.Amazon S3 with Object Lock enabled
C.Amazon EBS volume with snapshots
D.Amazon RDS with automated backups
E.Amazon DynamoDB with point-in-time recovery
AnswersA, B

Glacier Deep Archive is cost-effective for long-term archival.

Why this answer

Amazon S3 Glacier Deep Archive is correct because it provides the lowest-cost storage for long-term retention of immutable data, with a 7-year lifecycle meeting compliance requirements. Amazon S3 with Object Lock enabled is correct because it enforces a write-once-read-many (WORM) model, preventing records from being deleted or overwritten for a specified retention period, ensuring immutability and auditability.

Exam trap

The trap here is that candidates often confuse backup solutions (like RDS automated backups or DynamoDB PITR) with immutable storage, but backups are deletable and do not enforce WORM, whereas S3 Object Lock provides true immutability required for audit compliance.

Full explanation →
1330
Multi-Selecteasy

A data engineer is migrating an on-premises Microsoft SQL Server database to Amazon RDS for SQL Server. The database is 2 TB in size and has a 4-hour maintenance window. The company needs to minimize downtime and ensure data consistency. Which TWO methods should the engineer use? (Choose TWO.)

Select 2 answers
A.Use AWS Database Migration Service (AWS DMS) with ongoing replication to minimize downtime.
B.Use SQL Server Management Studio (SSMS) export wizard to transfer data.
C.Take a native backup of the on-premises database and restore it to RDS.
D.Use AWS Schema Conversion Tool (AWS SCT) to convert the schema and migrate data.
E.Export the database to CSV files and use BULK INSERT to load into RDS.
AnswersA, C

DMS can perform a full load and then replicate changes, reducing downtime.

Why this answer

AWS DMS with ongoing replication (change data capture) is correct because it allows continuous synchronization from the on-premises SQL Server to Amazon RDS for SQL Server, minimizing downtime by keeping the target database up-to-date until the final cutover. This approach ensures data consistency by capturing and applying ongoing changes without requiring a long outage window.

Exam trap

The trap here is that candidates often assume native backup/restore alone is sufficient for minimal downtime, forgetting that it only handles the initial data load and does not capture changes made during the backup window without additional replication.

Full explanation →
1331
MCQhard

A company uses Amazon DynamoDB with on-demand capacity for a gaming leaderboard. The table has 100 GB of data and receives 10,000 write requests per second with spikes to 50,000. The application experiences throttling during spikes. Which action should be taken to reduce throttling without changing the application?

A.Write data to Amazon S3 and use S3 Select
B.Increase the provisioned read capacity units
C.Switch to provisioned capacity with Auto Scaling
D.Enable DynamoDB Accelerator (DAX)
AnswerC

Correct: Switching to provisioned capacity with Auto Scaling allows you to set a higher capacity limit that can handle the write spikes without throttling, and this change requires no application modifications.

Why this answer

Switching from on-demand to provisioned capacity with Auto Scaling allows you to set a higher minimum and maximum read/write capacity, ensuring that the table can handle spikes up to 50,000 write requests per second without throttling. This change is made at the table level via the AWS console or CLI and does not require any application code modifications. In contrast, enabling DAX (Option D) would require updating the application to use the DAX client, violating the requirement to avoid application changes.

Options A and B are ineffective or incompatible: writing data to S3 does not address DynamoDB write throttling, and increasing provisioned read capacity is not applicable for an on-demand table without switching capacity modes first.

Exam trap

The trap is that candidates may overlook that DAX requires application code changes (using DAX client), which contradicts the 'without changing the application' constraint. They might focus on DAX's caching benefits without considering the implementation cost. Switching to provisioned capacity with Auto Scaling is a configuration-only change that can directly address write throttling.

How to eliminate wrong answers

Option A is wrong because writing data to Amazon S3 and using S3 Select does not address DynamoDB write throttling; S3 is a different storage service and S3 Select is for querying data in S3, not for increasing DynamoDB write throughput. Option B is wrong because increasing provisioned read capacity units does not help with write throttling; the issue is write requests, not reads. Option C is wrong because switching to provisioned capacity with Auto Scaling could help, but the question specifies 'without changing the application' and the current setup uses on-demand capacity, which already scales automatically; the throttling during spikes suggests the spike exceeds the on-demand burst capacity, and Auto Scaling would not prevent throttling if the spike is too rapid or exceeds the maximum provisioned capacity.

Full explanation →
1332
MCQeasy

A company uses AWS Glue ETL jobs to transform data and load it into Amazon Redshift. The jobs are failing with 'Out of Memory' errors. What is the most cost-effective way to resolve this issue without changing the transformation logic?

A.Increase the number of G.1X workers in the Glue job configuration.
B.Use Amazon Redshift Spectrum to query data directly from S3 without transformation.
C.Change the worker type to G.2X and keep the same number of workers.
D.Switch the job from Python to Scala.
AnswerA

More workers increase parallelism and total memory.

Why this answer

Increasing the number of G.1X workers (DPUs) adds parallelism, allowing the job to handle more data in memory without changing logic, and is cost-effective since G.1X workers are cheaper than G.2X. Option B is wrong: Redshift Spectrum is for querying data directly from S3, not for fixing memory issues in Glue ETL jobs. Option C is wrong: Changing to G.2X workers increases memory per worker but is more expensive than adding more G.1X workers; the goal is cost-effective.

Option D is wrong: Switching to Scala does not directly address memory issues and may require code changes.

Full explanation →
1333
MCQmedium

A data engineer is ingesting streaming data from an IoT fleet into Amazon Kinesis Data Streams. The data must be transformed in real-time and loaded into an Amazon Redshift cluster. Which solution minimizes operational overhead?

A.Use Kinesis Data Firehose with a Lambda transformation function
B.Use AWS Glue ETL jobs running continuously
C.Use Kinesis Client Library (KCL) to consume and transform data, then write to Redshift using COPY
D.Use AWS Direct Connect to stream data directly into Redshift
AnswerA

Firehose handles buffering, transformation via Lambda, and direct delivery to Redshift.

Why this answer

Kinesis Data Firehose is the fully managed service for loading streaming data into Redshift with near-real-time latency. By attaching a Lambda transformation function, you can perform lightweight data transformations (e.g., JSON flattening, field masking) without managing any compute infrastructure. This combination eliminates the need to provision or tune any servers, clusters, or consumer applications, minimizing operational overhead.

Exam trap

The trap here is that candidates often confuse Kinesis Data Streams with Kinesis Data Firehose, assuming they must write a custom consumer (KCL) to transform data, when Firehose with Lambda provides a fully managed, serverless alternative that reduces operational overhead.

How to eliminate wrong answers

Option B is wrong because AWS Glue ETL jobs are designed for batch-oriented, schema-on-read transformations and are not optimized for continuous, low-latency streaming ingestion into Redshift; running them continuously would incur high cost and operational complexity. Option C is wrong because using the Kinesis Client Library (KCL) requires you to deploy, scale, and manage your own consumer application (e.g., on EC2 or ECS) to consume the stream, transform data, and issue COPY commands, which adds significant operational overhead compared to a serverless Firehose. Option D is wrong because Direct Connect is a dedicated network connection between on-premises and AWS, not a data ingestion service; it cannot stream data directly into Redshift and provides no transformation capability.

Full explanation →
1334
MCQhard

A financial services company is ingesting trade data from multiple exchanges via Amazon Kinesis Data Streams. Each shard receives data from multiple exchanges, and a consumer application (using KCL) processes the data. The company needs to ensure that trades from the same exchange are processed in order. However, the current implementation distributes records to shards using a random partition key, causing trades from the same exchange to be spread across shards and processed out of order. The team must enforce ordering per exchange without significantly reducing throughput. What should the team do?

A.Implement a custom sequence number in the application to reorder after processing.
B.Use a single shard for all data to guarantee order.
C.Use the exchange ID as the partition key when putting records into the stream.
D.Increase the number of shards to 10 per exchange.
AnswerC

Ensures same exchange goes to same shard, preserving order.

Why this answer

Using the exchange ID as the partition key ensures all trades from the same exchange go to the same shard, preserving order. Option A is wrong because increasing shard count would further spread data and break ordering. Option B is wrong because using a single shard would preserve order but reduce throughput due to shard limits.

Option D is wrong because implementing a custom sequencer is complex and unnecessary.

Full explanation →
1335
MCQhard

A company uses Amazon Kinesis Data Analytics (now Managed Service for Apache Flink) to run a Flink application on streaming data. The application fails with 'OutOfMemoryError: Java heap space'. The data volume is 10 MB/s. What is the most likely cause and solution?

A.The data contains records larger than 1 MB; split records into smaller chunks.
B.Checkpointing is enabled too frequently; reduce checkpoint interval.
C.The Flink application is not suitable for 10 MB/s throughput; use Kinesis Data Firehose instead.
D.The application's Parallelism is too low; increase the number of Parallelism and KPUs.
AnswerD

Low parallelism causes data to accumulate in operator buffers, leading to OOM.

Why this answer

The OutOfMemoryError in a Flink application on Amazon Kinesis Data Analytics (Managed Service for Apache Flink) is most likely due to insufficient parallelism to handle the 10 MB/s data volume. Increasing parallelism distributes the workload across more KPUs (Kinesis Processing Units), reducing memory pressure per operator and preventing heap exhaustion. Option D directly addresses this by scaling resources to match throughput.

Exam trap

The trap here is that candidates often misdiagnose an OOM as a record size issue (Option A) or a checkpointing problem (Option B), when in fact the root cause is insufficient parallelism to handle the sustained throughput, which is a common scaling pitfall in Flink on Kinesis Data Analytics.

How to eliminate wrong answers

Option A is wrong because Kinesis Data Analytics for Apache Flink supports records up to 1 MB, and the error is heap space, not record size; splitting records would not resolve memory exhaustion from high throughput. Option B is wrong because frequent checkpointing can increase memory usage due to state snapshots, but reducing the interval would exacerbate the problem, not fix it; the core issue is insufficient parallelism. Option C is wrong because Flink is well-suited for 10 MB/s throughput; Kinesis Data Firehose is a serverless ingestion service that cannot run custom Flink applications, so it is not a replacement for a Flink streaming job.

Full explanation →
1336
Multi-Selectmedium

A company is using AWS Glue to run ETL jobs that transform data from S3 to Redshift. The jobs are failing intermittently with out-of-memory errors. Which THREE actions can help resolve this issue? (Choose THREE.)

Select 3 answers
A.Increase the number of DPUs allocated to the Glue job
B.Use S3 Select to filter data before reading into the Glue job
C.Use Spark's 'coalesce' function to reduce the number of partitions
D.Optimize the transformation logic to use less memory, for example by filtering early
E.Use a larger worker type, such as G.2X
AnswersA, D, E

More DPUs provide more memory and compute resources.

Why this answer

Increasing the number of DPUs allocated to the Glue job provides more memory and compute resources for the Spark executors, directly addressing out-of-memory errors by allowing larger datasets to be processed without exceeding heap limits. This is a standard scaling approach for memory-intensive ETL workloads in AWS Glue.

Exam trap

The trap here is that candidates often confuse reducing data volume (S3 Select) with increasing memory capacity, or mistakenly believe coalescing partitions always reduces memory usage, when in fact it can concentrate data and exacerbate OOM errors.

Full explanation →
1337
MCQhard

A company runs a transactional database on Amazon RDS for PostgreSQL with Multi-AZ deployment. The database size is 2 TB and experiences moderate write load. The company recently enabled RDS Performance Insights and noticed a high number of 'TupleLock' wait events during peak hours. The development team reports that a batch update job runs every hour, updating millions of rows in a large table. The job takes longer than expected. The DBA suspects that excessive row-level locking is causing contention. The team wants to minimize lock contention without changing the application code. Which solution should be implemented?

A.Tune the autovacuum settings (e.g., autovacuum_vacuum_scale_factor and autovacuum_vacuum_threshold) to run more frequently and aggressively.
B.Increase the RDS instance size to a larger instance class with more vCPUs and memory.
C.Enable RDS Proxy to manage database connections and reduce connection overhead.
D.Implement table partitioning using the pg_partman extension to split the large table into smaller partitions.
AnswerA

Correct. Tuning autovacuum reduces dead tuple accumulation, minimizing row-level lock contention without application changes.

Why this answer

Tuning autovacuum settings (autovacuum_vacuum_scale_factor and autovacuum_vacuum_threshold) reduces lock contention by cleaning up dead tuples more frequently. In PostgreSQL, row-level locks on heavily updated tables can cause 'TupleLock' wait events. Frequent autovacuum prevents accumulation of dead tuples, reducing the need for lock escalation and shortening update times.

Option B (increasing instance size) may improve throughput but does not directly address lock contention. Option C (RDS Proxy) manages connections, not locks. Option D (pg_partman partitioning) reduces row contention but requires application code changes (stem prohibits code changes).

Exam trap

Candidates often assume that increasing instance size resolves all performance issues, but lock contention due to dead tuples requires database-level tuning like autovacuum.

Full explanation →
1338
MCQhard

A company has a 100 TB dataset stored on-premises in a Hadoop cluster. They want to ingest this data into Amazon S3 for processing with AWS Glue. The company has a limited time window and a slow internet connection. Which strategy is MOST appropriate?

A.Use AWS Snowball Edge to physically ship the data to AWS.
B.Use AWS DataSync over the existing internet connection.
C.Use Amazon S3 Transfer Acceleration to speed up the upload.
D.Use AWS Direct Connect to establish a high-bandwidth connection.
AnswerA

Snowball Edge can handle 100 TB offline, bypassing network limitations.

Why this answer

AWS Snowball Edge is the most appropriate strategy because the dataset is 100 TB, the time window is limited, and the internet connection is slow. Snowball Edge provides a physical storage device that can be shipped to AWS, bypassing network bandwidth constraints entirely. This approach is designed for large-scale data transfers (typically over 10 TB) where network transfer would be impractical or exceed the available time window.

Exam trap

The trap here is that candidates may overestimate the effectiveness of network acceleration techniques (like Transfer Acceleration or Direct Connect) for extremely large datasets, failing to recognize that physical shipping is the only viable option when bandwidth and time are severely constrained.

How to eliminate wrong answers

Option B is wrong because AWS DataSync relies on the existing internet connection, which is slow and would take an excessively long time to transfer 100 TB, likely exceeding the limited time window. Option C is wrong because Amazon S3 Transfer Acceleration uses edge locations and optimized network paths, but it still depends on the underlying internet connection speed; a slow connection will remain a bottleneck, and it is not designed for petabyte-scale offline transfers. Option D is wrong because AWS Direct Connect requires establishing a dedicated network connection, which involves significant lead time for setup and does not solve the immediate problem of a slow internet connection; it also still transfers data over a network, which for 100 TB would be time-consuming even at high bandwidth.

Full explanation →
1339
MCQmedium

A company runs an Amazon EMR cluster with Spark jobs that process data from Amazon S3. The data engineer receives an alert that one of the Spark jobs failed with an OutOfMemoryError. The job processes large files and uses the default Spark configurations. Which configuration change is MOST likely to resolve the issue?

A.Increase the spark.executor.memory configuration.
B.Increase the number of executors.
C.Disable dynamic resource allocation.
D.Decrease the number of cores per executor.
AnswerA

Increasing executor memory directly addresses the OutOfMemoryError.

Why this answer

Increasing spark.executor.memory allocates more memory per executor, directly addressing the OutOfMemoryError when processing large files. Option B (increasing executors) does not increase memory per executor, so each executor remains susceptible to OOM. Option C (disabling dynamic resource allocation) would prevent the cluster from adding resources dynamically, potentially worsening the situation.

Option D (decreasing cores per executor) reduces parallelism but does not increase memory per executor; the OOM occurs because each executor lacks sufficient memory, not because of too many cores.

Full explanation →
1340
MCQmedium

A company uses AWS Glue to process data from multiple sources. The data is stored in an Amazon S3 data lake. The company needs to transform the data using a custom Python library that is not available in the default Glue environment. What is the MOST efficient way to make this library available to the Glue jobs?

A.Manually install the library on each node in the Glue cluster by editing the bootstrap script.
B.Upload the library as a .whl file to Amazon S3 and reference it in the Glue job's --additional-python-modules parameter.
C.Create a custom Docker image with the library and use it in AWS Glue for Ray.
D.Use a shell command in the Glue job script to run 'pip install <library>' before the job runs.
AnswerB

This is the recommended way to add custom libraries to Glue jobs.

Why this answer

AWS Glue supports adding custom Python libraries by uploading a .whl file to Amazon S3 and referencing it via the `--additional-python-modules` job parameter. This method is the most efficient as it requires no manual node configuration, no custom Docker images, and no runtime pip installs, ensuring the library is automatically distributed to all worker nodes before the job executes.

Exam trap

The trap here is that candidates may think running 'pip install' directly in the script (Option D) is acceptable, but AWS explicitly recommends using the `--additional-python-modules` parameter for efficiency and reliability, as runtime pip installs can fail due to network timeouts or missing build dependencies.

How to eliminate wrong answers

Option A is wrong because manually editing bootstrap scripts to install the library on each node is inefficient, error-prone, and not scalable; Glue manages cluster lifecycle automatically, so manual node-level modifications are not recommended and can be lost on auto-scaling events. Option C is wrong because AWS Glue for Ray is a specific runtime for distributed Python and Ray-based workloads, not a general-purpose Glue ETL job; using a custom Docker image for Ray adds unnecessary complexity and is not the standard approach for standard Glue ETL jobs. Option D is wrong because running 'pip install' inside the Glue job script is inefficient, adds runtime overhead, may fail due to network restrictions or permissions, and is not the intended way to manage dependencies in Glue; the library must be pre-packaged and referenced via the job parameters.

Full explanation →
1341
MCQeasy

A data engineering team needs to transform CSV files stored in Amazon S3 into Parquet format using AWS Glue. The files are partitioned by date and are updated hourly. Which AWS Glue feature should be used to automatically detect the schema and partition structure?

A.AWS Glue Crawler
B.AWS Glue DataBrew
C.AWS Lake Formation
D.Amazon Athena
AnswerA

Discovers schema and partitions automatically.

Why this answer

AWS Glue Crawler is the correct choice because it automatically scans data in S3, infers the schema (including data types), and detects the partition structure (e.g., date-based partitions like year/month/day) by examining the folder hierarchy. It then populates the AWS Glue Data Catalog with metadata, enabling ETL jobs to read the data without manual schema definition.

Exam trap

AWS often tests the distinction between tools that discover metadata (Crawler) versus tools that consume or transform data (Athena, DataBrew), leading candidates to pick Athena because it can query partitioned data, but it cannot automatically detect the partition structure without a pre-existing catalog.

How to eliminate wrong answers

Option B (AWS Glue DataBrew) is wrong because it is a visual data preparation tool for cleaning and normalizing data, not for automatic schema or partition detection. Option C (AWS Lake Formation) is wrong because it provides centralized security and governance for data lakes, but it does not perform schema discovery or partition detection itself. Option D (Amazon Athena) is wrong because it is a query engine that can read data from the Glue Data Catalog, but it does not automatically detect schemas or partitions; it relies on existing catalog metadata.

Full explanation →
1342
Multi-Selecthard

A data engineer is setting up an Amazon Redshift cluster for a data warehouse. The cluster will store historical sales data and support complex analytical queries. To optimize query performance and manage storage, the engineer needs to choose appropriate distribution styles and sort keys for a large fact table 'sales' and several dimension tables. Which TWO of the following design decisions are BEST practices?

Select 2 answers
A.Use interleaved sort keys on columns that are frequently used in filter predicates (e.g., date, region, product).
B.Use EVEN distribution for the fact table 'sales' to ensure an even data distribution across all nodes.
C.Use ALL distribution for the 'sales' fact table to replicate data to every node and avoid data movement.
D.Use a compound sort key with the most frequently filtered column first.
E.Choose AUTO distribution style for all tables and let Amazon Redshift automatically assign distribution.
AnswersA, B

Interleaved sort keys improve performance for queries filtering on multiple columns.

Why this answer

Interleaved sort keys in Amazon Redshift give equal weight to each column in the sort key, making them ideal for queries with filter predicates on multiple columns (e.g., date, region, product). This design optimizes zone maps and minimizes the amount of data scanned, significantly improving query performance for complex analytical workloads on large fact tables.

Exam trap

The trap here is that candidates often confuse EVEN distribution as a universal best practice for all fact tables, overlooking that KEY distribution on the join column is superior for star schema joins, and they may also incorrectly assume ALL distribution is suitable for large fact tables due to its join performance benefits, ignoring the prohibitive storage and write costs.

Full explanation →
1343
MCQmedium

A company runs an Amazon RDS for PostgreSQL database for its e-commerce platform. The application team reports that write-intensive workloads are causing high latency and the database is experiencing storage bottlenecks. The database currently uses General Purpose SSD (gp2) storage. Which action would be MOST effective in improving write performance without changing the database instance class?

A.Create a read replica and offload writes to it.
B.Switch the storage type to Provisioned IOPS SSD (io1).
C.Enable Multi-AZ deployment for high availability.
D.Change the storage type to General Purpose SSD (gp3).
AnswerD

gp3 offers higher baseline IOPS and throughput than gp2, improving write performance.

Why this answer

D is correct because gp3 storage provides a baseline performance that is higher than gp2 for the same storage size, and it allows you to independently provision IOPS and throughput without needing to increase storage. This directly addresses the write-intensive workload's high latency and storage bottleneck by offering up to 4,000 IOPS at no additional cost (compared to gp2's 3,000 IOPS baseline for larger volumes), and you can scale IOPS up to 16,000 without changing the instance class.

Exam trap

The trap here is that candidates often assume Provisioned IOPS (io1) is always the best choice for write performance, but the question specifically tests knowledge of gp3's superior baseline performance and cost efficiency for write-intensive workloads without requiring an instance class change.

How to eliminate wrong answers

Option A is wrong because a read replica cannot offload writes; it only handles read traffic, and writes must still go to the primary database, so it does not reduce write latency or storage bottlenecks. Option B is wrong because while io1 provides consistent IOPS, it is significantly more expensive than gp3 and does not offer the same baseline performance improvements for write-heavy workloads without also increasing storage; additionally, the question asks for the most effective action without changing the instance class, and gp3 is a more cost-effective and modern choice. Option C is wrong because Multi-AZ deployment provides high availability and automatic failover, but it does not improve write performance; in fact, synchronous replication to the standby can add slight latency to writes.

Full explanation →
1344
Multi-Selecthard

A company is ingesting IoT sensor data into Amazon Kinesis Data Streams. Each sensor sends a JSON payload every second. The data must be transformed and aggregated in real-time before being stored in Amazon DynamoDB. Which THREE services should be used together in the pipeline? (Choose THREE.)

Select 3 answers
A.AWS Lambda
B.Amazon Kinesis Data Analytics
C.Amazon S3
D.Amazon Kinesis Data Streams
E.Amazon Kinesis Data Firehose
AnswersA, B, D

AWS Lambda can be used as a consumer of Kinesis Data Streams to perform lightweight, per-record transformations on the JSON payloads in real-time, but it is not sufficient alone for aggregation.

Why this answer

Amazon Kinesis Data Streams (D) is the ingestion layer that captures the JSON payloads from IoT sensors in real-time, ensuring data is available for processing. AWS Lambda (A) can be used as a consumer of the stream to perform lightweight, per-record transformations, such as filtering or enriching the JSON payloads. Amazon Kinesis Data Analytics (B) is required for real-time aggregation and complex transformations using SQL or Apache Flink, enabling calculations like averages or counts per second before storing in DynamoDB.

Together, these three services form a complete real-time pipeline: ingest with Kinesis Data Streams, transform/aggregate with Kinesis Data Analytics, and optionally further transform with Lambda before writing to DynamoDB.

Exam trap

The trap is that candidates often confuse Amazon Kinesis Data Firehose with a real-time processing service, but Firehose is a delivery service with near-real-time latency (minimum 60 seconds) and cannot perform per-second aggregations. Additionally, some might think only Lambda is needed for transformation, but Kinesis Data Analytics is better suited for real-time aggregations like sliding windows.

Full explanation →
1345
Multi-Selectmedium

A company is using AWS Glue ETL to process data from Amazon RDS for MySQL to Amazon S3. The job runs daily and takes 2 hours to complete. The engineer wants to improve performance without increasing cost significantly. Which TWO actions should the engineer take? (Choose TWO.)

Select 2 answers
A.Switch to a smaller worker type (e.g., G.1X instead of G.2X).
B.Use Spark DataFrames instead of DynamicFrames.
C.Enable 'Auto Scaling' in the Glue job configuration.
D.Add a partition column to the source table based on a date column.
E.Increase the number of Glue DPUs.
AnswersD, E

Partitioning allows Glue to read data in parallel.

Why this answer

Adding a partition column (e.g., based on a date column) to the source table enables AWS Glue to use partition pruning during the read phase. This reduces the amount of data scanned and processed by the ETL job, directly improving performance without increasing cost. Partitioning is a common optimization for large datasets in RDS or S3-based sources.

Exam trap

The trap here is that candidates often confuse 'Auto Scaling' with a performance improvement feature, but Auto Scaling only adjusts resources to match workload, not reduce runtime; the real performance gain comes from reducing data volume via partitioning.

Full explanation →
1346
Multi-Selecthard

A company is using AWS KMS with customer-managed keys to encrypt data in Amazon RDS. The security team wants to ensure that the key can be rotated automatically every year. Which THREE steps are required to achieve automatic key rotation?

Select 3 answers
A.Migrate the key to AWS CloudHSM.
B.Enable automatic key rotation in the KMS key configuration.
C.Use a symmetric KMS key.
D.Configure the RDS instance to use the KMS key for encryption.
E.Create a new KMS key and configure RDS to use it.
AnswersB, C, D

This is required to rotate the key automatically.

Why this answer

Options B, C, and D are correct. To enable automatic rotation for a customer-managed KMS key, you must enable rotation via the KMS console or API (B), ensure the key is a symmetric key (C) as asymmetric keys do not support automatic rotation, and configure the RDS instance to use the key (D) for encryption. Option A is incorrect because rotation can be enabled for existing keys.

Option E is incorrect because CloudHSM is not involved.

Full explanation →
1347
MCQhard

A data pipeline ingests JSON data from an S3 bucket using AWS Glue. The JSON files contain nested structures, and the team wants to flatten them for analysis in Amazon Athena. Which Glue transformation is most appropriate?

A.Filter
B.Join
C.Map
D.Relationalize
AnswerD

Flattens nested JSON into separate tables.

Why this answer

Relationalize is specifically designed to flatten nested JSON into relational tables. Option A (Map) applies a function to each record. Option B (Filter) removes records.

Option C (Join) combines datasets.

Full explanation →
1348
Multi-Selecthard

Which TWO are valid approaches to troubleshoot a slow Amazon Redshift query? (Choose two.)

Select 2 answers
A.Check for table locks using STV_LOCKS.
B.Enable encryption on the cluster.
C.Use the EXPLAIN command to review the query execution plan.
D.Run VACUUM on the table.
E.Alter the table to change DISTSTYLE to KEY.
AnswersA, C

Locks can cause waits.

Why this answer

Options A and C are correct. Checking for table locks using STV_LOCKS (A) helps identify concurrency issues that slow queries, and using EXPLAIN (C) reveals the query execution plan to spot inefficient operations. Option B is incorrect because enabling encryption does not affect query performance.

Option D is incorrect because VACUUM reclaims disk space and improves storage but is not a direct troubleshooting step for slow queries. Option E is incorrect because changing DISTSTYLE is a design optimization, not a troubleshooting action.

Full explanation →
1349
MCQmedium

A company uses Kinesis Data Streams to ingest IoT data. The data volume varies, and occasionally the shard write throughput is exceeded, causing ProvisionedThroughputExceeded exceptions. The data engineer needs to handle these spikes without losing data. Which approach is most cost-effective and requires minimal code changes?

A.Implement custom retry logic using the Kinesis Client Library with exponential backoff
B.Increase the number of shards to handle peak throughput
C.Use Kinesis Data Firehose as a consumer with retries and buffer settings
D.Send data to an SQS queue first, then have a Lambda function write to Kinesis
AnswerC

Firehose can buffer data and retry, handling spikes with minimal code changes.

Why this answer

Kinesis Data Firehose is the most cost-effective solution because it can be configured as a consumer of the Kinesis Data Stream with built-in retry logic and buffer settings (e.g., buffer size up to 128 MB or buffer interval up to 900 seconds). This handles throughput spikes by buffering data and retrying failed writes without requiring custom code, and it scales automatically without the need to manage shard counts.

Exam trap

The trap here is that candidates often assume increasing shards (Option B) is the only way to handle throughput spikes, but the question emphasizes cost-effectiveness and minimal code changes, making Firehose's buffering and retry mechanism the optimal choice without over-provisioning.

How to eliminate wrong answers

Option A is wrong because implementing custom retry logic with the Kinesis Client Library (KCL) requires significant code changes and ongoing maintenance, and it does not address the root cause of shard throughput limits—it only retries failed writes, which can still lead to data loss if retries are exhausted. Option B is wrong because increasing the number of shards to handle peak throughput is not cost-effective; it over-provisions resources for rare spikes, leading to higher costs during normal operation. Option D is wrong because sending data to an SQS queue first adds latency, complexity, and cost (SQS charges per request), and requires a Lambda function to bridge the two services, which introduces additional code changes and potential points of failure.

Full explanation →
1350
MCQeasy

A company is streaming data from an application to Amazon Kinesis Data Streams. The data must be transformed in real time and then stored in Amazon S3 in Parquet format. Which AWS service should be used for the transformation step?

A.Amazon Kinesis Data Firehose with a Lambda transformation.
B.Amazon EMR running Apache Spark Streaming.
C.Amazon Kinesis Data Analytics for Apache Flink.
D.AWS Lambda with a Kinesis trigger.
AnswerC

Amazon Kinesis Data Analytics for Apache Flink is a serverless service that can run Apache Flink applications to perform real-time transformations on streaming data and can output to Kinesis Data Firehose for delivery to S3 in Parquet format.

Why this answer

Amazon Kinesis Data Analytics for Apache Flink is a serverless service that can run Apache Flink applications to perform real-time transformations on streaming data. Option A (Amazon Kinesis Data Firehose with a Lambda transformation) is primarily for loading data and has limitations for complex transformations. Option B (Amazon EMR running Apache Spark Streaming) can work but adds management overhead and is not the simplest managed service.

Option D (AWS Lambda with a Kinesis trigger) is suitable for lightweight transformations but may hit execution time limits for complex or long-running transformations.

Full explanation →
Page 17

Page 18 of 23

Page 19

All pages

1234567891011121314151617181920212223

Practice DEA-C01 by domain

Target a specific domain to shore up weak areas.

Data Ingestion and TransformationData Operations and SupportData Security and GovernanceData Store Management
See all domains with question counts →