Courseiva

AWS Certified Data Engineer Associate DEA-C01 (DEA-C01) — Questions 1351–1425

1711 questions total · 23pages · All types, answers revealed

Take a mock examExam hub
Page 18

Page 19 of 23

Page 20
1351
MCQhard

A data engineer is troubleshooting an AWS Lake Formation permissions issue. A user is able to query an Amazon Athena table but cannot see the underlying S3 data in the AWS Glue Data Catalog. The user has been granted SELECT permission on the table in Lake Formation. What is the most likely cause?

A.The user does not have DESCRIBE permission on the table in Lake Formation.
B.The data location is not registered with Lake Formation.
C.The S3 bucket policy does not grant the user access.
D.The user does not have the aws:SourceArn condition in the IAM policy.
AnswerA

SELECT permission allows querying but not viewing the table metadata; DESCRIBE is needed to see the table in the catalog.

Why this answer

In AWS Lake Formation, the ability to query a table via Athena (which requires SELECT permission) is separate from the ability to view the table's metadata in the Glue Data Catalog. To see the underlying S3 data location or table properties in the catalog, a user needs DESCRIBE permission on the table. Without DESCRIBE, the table appears invisible in the Glue console or API, even though SELECT queries succeed.

Exam trap

The trap here is that candidates assume SELECT permission is sufficient for all table interactions, overlooking that Lake Formation separates metadata visibility (DESCRIBE) from data access (SELECT).

How to eliminate wrong answers

Option B is wrong because registering the data location with Lake Formation is a prerequisite for granting permissions, but the user can already query the table, so the location must be registered. Option C is wrong because if the S3 bucket policy were blocking access, the Athena query would fail, not just the catalog visibility. Option D is wrong because the aws:SourceArn condition is a security best practice for cross-account access, but its absence does not cause the described symptom of a missing table in the catalog.

Full explanation →
1352
MCQeasy

A data engineer needs to store JSON documents that are frequently read and written by a web application. The data has a flexible schema and requires low-latency queries on primary key lookups. Which AWS service is MOST suitable?

A.Amazon Redshift
B.Amazon S3
C.Amazon DynamoDB
D.Amazon RDS for MySQL
AnswerC

DynamoDB provides single-digit millisecond performance for key-value lookups and supports flexible schemas.

Why this answer

Amazon DynamoDB is the most suitable service because it is a NoSQL key-value and document database that provides single-digit millisecond latency for primary key lookups, supports flexible schemas for JSON documents, and is designed for high-throughput read/write workloads from web applications. Its fully managed nature and auto-scaling capabilities align with the requirement for frequent, low-latency queries on a flexible schema.

Exam trap

The trap here is that candidates may confuse Amazon S3's ability to store JSON documents with the need for low-latency primary key lookups, overlooking that S3 is not a database and lacks the indexing and query performance required for frequent, transactional reads and writes.

How to eliminate wrong answers

Option A is wrong because Amazon Redshift is a columnar data warehouse optimized for complex analytical queries on structured data, not for low-latency primary key lookups on JSON documents with frequent writes. Option B is wrong because Amazon S3 is an object storage service that does not support low-latency primary key lookups or native querying without additional services like Athena or S3 Select, and it is not designed for frequent, transactional read/write operations. Option D is wrong because Amazon RDS for MySQL is a relational database with a fixed schema, requiring schema changes for flexible JSON documents, and while it can handle JSON, it does not match DynamoDB's single-digit millisecond latency for primary key lookups at scale.

Full explanation →
1353
MCQmedium

An AWS Glue job that processes streaming data from Amazon Kinesis Data Streams is failing intermittently with 'Failed to checkpoint' errors. The job uses checkpointing to an Amazon S3 bucket every 60 seconds. Which action should the engineer take to resolve the issue?

A.Increase the checkpoint interval to 120 seconds.
B.Move the checkpoint location to an Amazon DynamoDB table.
C.Decrease the Kinesis shard count to reduce throughput.
D.Disable checkpointing and rely on Kinesis iterator age.
AnswerA

Reduces the frequency of checkpoint writes, mitigating contention.

Why this answer

The 'Failed to checkpoint' error in AWS Glue streaming jobs typically occurs when the checkpoint operation exceeds the 60-second interval due to high throughput or large state size. Increasing the checkpoint interval to 120 seconds provides more time for the checkpoint to complete, reducing the likelihood of timeouts and allowing the job to stabilize without losing progress.

Exam trap

The trap here is that candidates may assume DynamoDB is always faster for checkpoints (Option B), but AWS Glue streaming jobs natively support only S3 for checkpointing, and DynamoDB is not a valid checkpoint location—this distracts from the simple fix of adjusting the interval.

How to eliminate wrong answers

Option B is wrong because moving the checkpoint location to DynamoDB does not address the root cause of checkpoint timeouts; DynamoDB has its own throughput limits and latency, which could introduce similar or worse failures. Option C is wrong because decreasing the Kinesis shard count reduces throughput capacity, which may cause data loss or increased iterator age, but does not fix the checkpoint timeout issue—it could even worsen it by increasing processing pressure on fewer shards. Option D is wrong because disabling checkpointing removes fault tolerance entirely; relying solely on Kinesis iterator age does not provide recovery from failures and can lead to data reprocessing or loss, violating the job's reliability requirements.

Full explanation →
1354
MCQmedium

A data engineer runs an AWS Glue ETL job that transforms data in Amazon S3. The job fails with the error shown in the exhibit. Which action will MOST likely fix the issue?

A.Decrease the number of workers from 2 to 1.
B.Add an IAM policy that grants the Glue job permission to write to S3.
C.Increase the number of workers from 2 to 4.
D.Change the worker type from G.1X to G.2X.
AnswerD

G.2X provides more memory per worker, addressing the OOM error.

Why this answer

The error indicates an out-of-memory error in the Spark executor. This occurs when the executor memory is insufficient for the data being processed. Option D, changing the worker type from G.1X to G.2X, doubles the memory per worker (from 4 GB to 8 GB for Spark executors), addressing the memory issue directly.

Option A is incorrect because decreasing the number of workers reduces the total memory and parallelism, worsening the problem. Option B is incorrect because the error is not related to IAM permissions; an IAM policy for S3 write access would resolve a different error (e.g., AccessDenied). Option C is incorrect because increasing the number of workers from 2 to 4 adds more executors but does not increase memory per executor, and the error is likely due to insufficient per-executor memory.

Full explanation →
1355
MCQeasy

A data engineer needs to transfer 50 TB of data from an on-premises HDFS cluster to Amazon S3. The on-premises network has a 1 Gbps link to AWS. Which AWS service should be used to perform the transfer efficiently?

A.AWS DataSync
B.Amazon S3 Transfer Acceleration
C.AWS Snowball Edge
D.AWS Direct Connect
AnswerA

DataSync can transfer large datasets over the network efficiently.

Why this answer

AWS DataSync is the correct choice because it is designed for large-scale data transfers over the network, handling 50 TB efficiently over a 1 Gbps link by parallelizing transfers and automating scheduling. Amazon S3 Transfer Acceleration only improves upload speed over long distances but is not a dedicated transfer service. AWS Snowball Edge would be slower due to shipping and is unnecessary since the network link is sufficient.

AWS Direct Connect provides a dedicated network connection but is not a data transfer service.

Full explanation →
1356
MCQmedium

A data engineer needs to ingest streaming data from thousands of devices sending JSON messages via HTTP POST. The data should be stored in Amazon S3 with minimal latency and also be available for real-time analytics. Which combination of services is MOST appropriate?

A.Amazon DynamoDB with DynamoDB Streams and Lambda.
B.Amazon SQS and AWS Lambda to write to S3.
C.AWS Lambda directly writing to S3 via API Gateway.
D.Amazon API Gateway, Amazon Kinesis Data Streams, and Kinesis Data Firehose.
AnswerD

API Gateway receives POST, sends to Kinesis for real-time analytics, and Firehose batches to S3.

Why this answer

It combines Amazon API Gateway to ingest HTTP POST messages, Amazon Kinesis Data Streams for real-time analytics, and Kinesis Data Firehose to deliver the data to Amazon S3 with minimal latency. Option A (DynamoDB with Streams) is meant for database change tracking, not direct HTTP streaming. Option B (SQS + Lambda) introduces latency and lacks native streaming analytics.

Option C (Lambda directly via API Gateway) does not provide the buffering and streaming analytics capabilities needed.

Full explanation →
1357
MCQmedium

A data engineer needs to store and analyze time-series data from IoT devices. The data volume is 10 GB per day, and the queries are mostly on the most recent 7 days of data. The engineer wants to minimize storage costs while retaining historical data for 1 year. Which combination of AWS services is most cost-effective?

A.Amazon Timestream
B.Amazon DynamoDB with TTL and S3 for archival
C.Amazon Redshift
D.Amazon RDS with MySQL
AnswerA

Timestream is cost-effective for time-series data with automatic storage tiering.

Why this answer

Amazon Timestream is purpose-built for time-series data, offering automatic tiering between in-memory (for recent 7 days) and magnetic stores (for historical data up to 1 year). This matches the query pattern (mostly recent 7 days) and retention requirement (1 year) while minimizing storage costs through its serverless, pay-per-query model. Timestream also supports time-series-specific functions like interpolation and smoothing, making it more efficient than general-purpose databases for this workload.

Exam trap

The trap here is that candidates often choose DynamoDB with TTL and S3 for archival (Option B) because it seems cost-effective, but they overlook the operational complexity and query latency of accessing historical data in S3, which violates the 'minimize storage costs while retaining historical data for 1 year' requirement without considering query patterns.

How to eliminate wrong answers

Option B (DynamoDB with TTL and S3 for archival) is wrong because DynamoDB is optimized for key-value and document workloads, not time-series analytics; TTL only deletes old data, but querying historical data from S3 requires additional services like Athena or Glue, increasing complexity and latency. Option C (Amazon Redshift) is wrong because Redshift is a columnar data warehouse designed for large-scale analytical queries on structured data, but it is over-provisioned and costly for 10 GB/day of time-series data, and its storage and compute are not optimized for time-series-specific operations like downsampling or retention policies. Option D (Amazon RDS with MySQL) is wrong because RDS is a relational database with fixed storage and compute, leading to higher costs for storing 3.65 TB of historical data (10 GB/day × 365 days) and poor query performance on time-series data without built-in time-series features like automatic retention or partitioning.

Full explanation →
1358
MCQeasy

A company is using Amazon S3 for data lake storage. They need to query the data directly using SQL without loading it into a database. Which AWS service should be used?

A.Amazon Redshift Spectrum
B.Amazon Athena
C.Amazon EMR
D.AWS Glue
AnswerB

Athena is a serverless query service for S3 data using SQL.

Why this answer

Amazon Athena is the correct choice because it is a serverless, interactive query service that allows you to analyze data directly in Amazon S3 using standard SQL, without needing to load or transform the data into a database. Athena uses Presto under the hood and supports querying structured, semi-structured, and unstructured data formats (e.g., CSV, JSON, Parquet, ORC) stored in S3, making it ideal for ad-hoc SQL queries on a data lake.

Exam trap

The trap here is that candidates often confuse AWS Glue's data cataloging and ETL capabilities with direct SQL querying, or they assume Redshift Spectrum is a standalone service rather than a feature requiring an existing Redshift cluster, leading them to pick a wrong answer that requires additional infrastructure or is not a query engine.

How to eliminate wrong answers

Option A is wrong because Amazon Redshift Spectrum is a feature of Amazon Redshift that allows querying data in S3 from within a Redshift data warehouse, but it requires an existing Redshift cluster and is not a standalone service for directly querying S3 data without a database. Option C is wrong because Amazon EMR is a big data platform that uses frameworks like Apache Spark, Hive, or Presto for querying S3 data, but it requires provisioning and managing clusters, which adds complexity and is not a serverless SQL-only solution. Option D is wrong because AWS Glue is a serverless data integration service primarily used for ETL (extract, transform, load) jobs and data cataloging, not for directly querying S3 data with SQL; while it can prepare data for Athena, it is not a query engine itself.

Full explanation →
1359
Multi-Selectmedium

A company ingests IoT sensor data into Kinesis Data Streams. The data is then processed by a Lambda function that aggregates readings and writes to DynamoDB. The Lambda function is experiencing high error rates due to throttling. Which TWO actions would reduce throttling?

Select 2 answers
A.Increase the number of shards in the Kinesis stream.
B.Increase the batch size in the Lambda event source mapping.
C.Decrease the batch window in the Lambda event source mapping.
D.Configure DynamoDB to use on-demand capacity mode.
E.Increase the Lambda reserved concurrency to 1000.
AnswersB, D

Larger batches mean fewer invocations, reducing throttling.

Why this answer

Increasing the batch size in the Lambda event source mapping allows each invocation to process more records from the Kinesis stream, reducing the number of concurrent Lambda invocations and thus lowering the risk of throttling. Option D is correct because switching DynamoDB to on-demand capacity mode eliminates write capacity limits, preventing throttling on the DynamoDB side that can cause Lambda retries and backpressure.

Exam trap

The trap here is that candidates often assume increasing shards (Option A) always improves throughput, but in a Lambda-integrated Kinesis stream, more shards mean more concurrent invocations, which can actually increase throttling risk.

Full explanation →
1360
Multi-Selecthard

A company uses AWS Glue to transform data stored in S3. The Glue job runs daily and processes data in the range of hundreds of GB. The data engineer wants to optimize the job for cost and performance. Which THREE actions should be taken? (Choose THREE.)

Select 3 answers
A.Store intermediate data in HDFS on Amazon EMR
B.Increase the number of DPUs for the job
C.Reduce the number of DPUs to save cost
D.Use columnar data formats such as Parquet
E.Partition the data by date or other high-cardinality columns
AnswersB, D, E

More DPUs can reduce runtime, improving cost if job runs shorter.

Why this answer

Increasing the number of DPUs (Data Processing Units) for an AWS Glue job can improve performance by enabling parallel processing of large datasets (hundreds of GB). AWS Glue allocates resources in increments of DPUs, where each DPU provides 4 vCPU and 16 GB of memory; scaling out DPUs reduces execution time, which can lower overall cost if the job runs fewer minutes, balancing cost and performance.

Exam trap

The trap here is that candidates mistakenly think reducing DPUs always saves cost, but AWS Glue bills by DPU-hour, so longer runtimes from fewer DPUs can actually increase cost, and the question explicitly asks for both cost and performance optimization.

Full explanation →
1361
MCQeasy

A company wants to use Amazon Redshift Spectrum to query data in Amazon S3. The data is in Parquet format and partitioned by date. Which step is required to enable Redshift Spectrum?

A.Load the data into Redshift tables using the COPY command.
B.Create an external schema and external table in the AWS Glue Data Catalog.
C.Create a separate Redshift Spectrum cluster.
D.Copy the data from S3 to Redshift-managed storage.
AnswerB

Redshift Spectrum uses the Glue Data Catalog to query data in S3.

Why this answer

Redshift Spectrum allows querying data directly in Amazon S3 without loading it into Redshift. To use Spectrum, you must define an external schema and external table in the AWS Glue Data Catalog (or an external Hive metastore) that points to the S3 location and specifies the Parquet format and partition structure. This enables Redshift to read the data in place using the Spectrum engine.

Exam trap

The trap here is that candidates assume Redshift Spectrum requires a separate cluster or that data must be loaded into Redshift, confusing Spectrum with traditional Redshift ingestion methods like COPY or CTAS.

How to eliminate wrong answers

Option A is wrong because the COPY command loads data into Redshift-managed storage, which bypasses Spectrum's external query capability and incurs storage costs; Spectrum queries data directly from S3 without loading. Option C is wrong because Redshift Spectrum does not require a separate cluster; it runs on the existing Redshift cluster's compute nodes, leveraging the Spectrum layer to access S3. Option D is wrong because copying data from S3 to Redshift-managed storage defeats the purpose of Spectrum, which is to query data in place without moving it.

Full explanation →
1362
MCQmedium

A data engineer needs to share an S3 bucket with another AWS account. They want to ensure that the objects in the bucket remain encrypted with SSE-KMS using a customer managed key. What additional step is required for cross-account access?

A.Modify the KMS key policy to grant the target account kms:Decrypt permission
B.Add an IAM policy in the target account to allow kms:Decrypt
C.Disable SSE-KMS encryption on the bucket
D.Add a bucket policy that grants the target account s3:GetObject
AnswerA

The KMS key policy must allow the target account to use the key for decryption.

Why this answer

When using SSE-KMS with a customer managed key, cross-account access requires the KMS key policy to grant the target account's IAM role or user the necessary KMS permissions (kms:Decrypt, and optionally kms:GenerateDataKey). The S3 bucket policy must also grant s3:GetObject, and the target account's IAM policy must allow kms:Decrypt. However, the key policy is the additional step specific to KMS that is not covered by S3 policies alone.

Without it, the target account cannot use the key. Option A is correct because modifying the key policy is essential. Option B is insufficient because the target account's IAM policy cannot override the key policy.

Option C is unnecessary and breaks encryption. Option D provides S3 access but not KMS access.

Full explanation →
1363
Multi-Selectmedium

Which TWO options are valid methods to ingest on-premises relational database data into Amazon S3 for analytics? (Choose 2.)

Select 2 answers
A.AWS Snowball Edge
B.AWS Glue ETL job with JDBC connection to source
C.Amazon Kinesis Data Streams with Direct Put
D.AWS Database Migration Service (DMS) with S3 target
E.Amazon AppFlow
AnswersB, D

Glue can read from JDBC and write to S3.

Why this answer

AWS Glue ETL jobs can connect to on-premises relational databases via JDBC, extract data, and write it directly to Amazon S3 in formats like Parquet or ORC. This is a fully managed, serverless approach suitable for batch ingestion and transformation of structured data for analytics.

Exam trap

The trap here is that candidates confuse AWS Glue ETL (which uses JDBC for batch extraction) with Amazon Kinesis (which is for streaming), or they overlook that AWS DMS is a dedicated service for database migration and replication to S3, while Snowball Edge is for offline bulk transfer, not live ingestion.

Full explanation →
1364
MCQeasy

A company needs to store files that are accessed by multiple EC2 instances in a VPC. The files must be concurrently accessible and durable. Which storage solution should the data engineer choose?

A.Amazon EC2 instance store
B.Amazon Simple Storage Service (Amazon S3)
C.Amazon Elastic Block Store (Amazon EBS)
D.Amazon Elastic File System (Amazon EFS)
AnswerD

EFS provides a shared, durable file system for EC2 instances.

Why this answer

Amazon EFS provides a fully managed, scalable, and elastic NFS file system that can be concurrently accessed by multiple EC2 instances across multiple Availability Zones. It is designed for high durability (11 nines of durability) and automatically replicates data across multiple AZs within a region, meeting the requirements for concurrent access and durability.

Exam trap

The trap here is that candidates often confuse Amazon EBS Multi-Attach with a general-purpose shared file system, but EBS Multi-Attach is limited to specific io1/io2 volumes, requires cluster-aware applications, and does not provide the POSIX file system semantics or cross-AZ durability that EFS offers.

How to eliminate wrong answers

Option A is wrong because EC2 instance store provides ephemeral block storage that is physically attached to the host; it is not durable (data is lost on instance stop/termination) and cannot be shared concurrently across multiple EC2 instances. Option B is wrong because Amazon S3 is an object storage service, not a file system; it does not support standard file-level locking or NFS/SMB protocols required for concurrent file access from multiple EC2 instances without additional gateways or software. Option C is wrong because Amazon EBS provides block-level storage volumes that can only be attached to a single EC2 instance at a time (except for multi-attach EBS io1/io2 volumes, which are limited to specific instance types and have strict constraints, not a general solution for concurrent file access).

Full explanation →
1365
MCQmedium

The exhibit shows an AWS CLI command and its output. A data engineer wants to copy only objects larger than 10 MB from the S3 bucket to another bucket for processing. Which approach should be used to automate this task?

A.Use S3 replication rules to replicate objects above 10 MB
B.Use AWS CLI with a script to filter and copy objects
C.Use S3 Inventory to generate a list and then copy
D.Use AWS Lambda with S3 event notifications
AnswerB

The CLI can filter by size and copy objects using a script.

Why this answer

The command lists objects larger than 10 MB. To automate copying, a script using AWS CLI with the --query parameter can filter and copy. Using S3 Batch Operations allows performing actions on a list of objects.

The correct approach is to use AWS CLI with a script that iterates over the filtered list and uses aws s3 cp. S3 replication is for continuous sync, not one-time copy. Lambda with S3 events triggers only on new objects, not existing ones.

S3 Inventory provides metadata but not direct copy.

Full explanation →
1366
MCQhard

A company runs a data pipeline that ingests user activity logs from an API gateway into an Amazon Kinesis Data Firehose delivery stream. The Firehose stream writes data to an S3 bucket. The data is then processed by a scheduled AWS Glue job that runs every hour. Recently, the company noticed that the data in S3 is incomplete: some logs from the API are missing. The Glue job processes all files in the S3 bucket. The Firehose stream has a buffer size of 5 MB and a buffer interval of 60 seconds. The API sends data at a rate of approximately 2 MB per minute. What should the company do to reduce data loss?

A.Decrease the buffer interval to 30 seconds.
B.Increase the Firehose buffer size to 10 MB.
C.Configure a Dead Letter Queue (DLQ) for the Firehose stream.
D.Enable data transformation with AWS Lambda to compress data.
AnswerC

A DLQ captures failed deliveries so data can be reprocessed.

Why this answer

Configuring a Dead Letter Queue (DLQ) for the Kinesis Data Firehose delivery stream allows failed records to be captured and stored for later analysis and reprocessing. While Firehose automatically retries delivery, persistent failures can lead to data loss. A DLQ (or error backup destination) ensures that records that cannot be delivered are preserved.

Option A: Decreasing the buffer interval from 60 to 30 seconds would cause more frequent deliveries, increasing the likelihood of transient failures affecting smaller batches and not reducing overall data loss. Option B: Increasing the buffer size to 10 MB does not prevent data loss; it only changes the threshold for flushing data. Since the data rate is 2 MB/min, the buffer size is rarely the trigger (interval is more likely).

Option D: Enabling data transformation with AWS Lambda to compress data reduces the size of records but does not address delivery failures; it could even introduce additional failure points from the Lambda function. Thus, only C directly addresses data loss by capturing failed records.

Full explanation →
1367
MCQeasy

A data engineer needs to ingest streaming data from thousands of IoT devices into AWS for real-time processing. The data volume peaks at 5 GB/min. Which AWS service should be used as the ingestion endpoint?

A.Amazon Kinesis Data Streams
B.AWS Glue
C.Amazon S3
D.AWS Lambda
AnswerA

Kinesis Data Streams is built for real-time streaming data ingestion.

Why this answer

Amazon Kinesis Data Streams is designed for real-time data ingestion at scale, supporting throughput of up to 1 MB/s or 1,000 records/s per shard. With a peak of 5 GB/min (~83 MB/s), you can horizontally scale by adding shards to meet the required throughput, making it the ideal ingestion endpoint for high-volume streaming IoT data.

Exam trap

The trap here is that candidates often confuse AWS Glue's streaming ETL capability (which reads from a stream but does not ingest) with a direct ingestion endpoint, or they assume S3's high durability makes it suitable for real-time ingestion, ignoring its lack of streaming semantics and low-latency write guarantees.

How to eliminate wrong answers

Option B (AWS Glue) is wrong because it is a serverless ETL service for batch data processing and cataloging, not a real-time streaming ingestion endpoint; it cannot handle continuous, high-velocity data streams. Option C (Amazon S3) is wrong because it is an object storage service that does not provide real-time ingestion or streaming capabilities; data must be written via API calls or batch uploads, and it lacks the low-latency, ordered replay features needed for streaming. Option D (AWS Lambda) is wrong because it is a compute service for running code in response to events, not a dedicated ingestion endpoint; it has a maximum invocation payload limit of 256 KB and is not designed to buffer or scale for sustained 5 GB/min throughput.

Full explanation →
1368
Multi-Selectmedium

A company is building a data lake on Amazon S3 and needs to ingest data from multiple sources. Which of the following AWS services can be used to ingest and transform data in near real-time? (Select TWO.)

Select 2 answers
A.AWS Glue
B.Amazon Kinesis Data Firehose
C.Amazon Athena
D.AWS Step Functions
E.Amazon Simple Queue Service (SQS)
AnswersA, B

Can be used for ETL jobs triggered by S3 events.

Why this answer

AWS Glue is correct because it provides a serverless ETL (Extract, Transform, Load) service that can ingest data from various sources and transform it in near real-time using its streaming ETL capabilities. Glue can consume data from Amazon Kinesis Data Streams or Apache Kafka, apply transformations using Apache Spark, and write the results to Amazon S3 or other destinations, making it suitable for near real-time data ingestion and transformation.

Exam trap

The trap here is that candidates often confuse Amazon Athena (a query engine) with an ingestion service, or assume SQS alone can perform transformations, when neither service is designed for near real-time data ingestion and transformation into a data lake.

Full explanation →
1369
MCQeasy

A data engineer needs to store log files from multiple applications in a central S3 bucket. The logs must be stored cost-effectively for long-term retention (7 years). The logs are accessed infrequently after the first 30 days. Which storage class should the engineer use for objects older than 30 days?

A.S3 Glacier Deep Archive
B.S3 Standard
C.S3 One Zone-IA
D.S3 Standard-IA
AnswerD

Standard-IA is for infrequently accessed data with lower storage cost.

Why this answer

D is correct because S3 Standard-IA (Infrequent Access) is designed for data accessed less frequently but requires rapid access when needed, with a lower storage cost than S3 Standard and a 30-day minimum storage duration charge. After the first 30 days, logs are infrequently accessed, making Standard-IA the most cost-effective option that still provides millisecond first-byte latency for occasional retrieval needs over the 7-year retention period.

Exam trap

AWS often tests the misconception that any 'infrequent access' scenario automatically requires Glacier or Deep Archive, but the trap here is that the logs still need millisecond retrieval latency for occasional access, which Standard-IA provides while Glacier classes do not.

How to eliminate wrong answers

Option A is wrong because S3 Glacier Deep Archive is intended for data accessed at most once or twice per year with retrieval times of 12–48 hours, which is too slow for logs that may need occasional access within minutes after the first 30 days. Option B is wrong because S3 Standard is designed for frequently accessed data with no minimum storage duration, leading to higher costs for long-term retention of infrequently accessed logs. Option C is wrong because S3 One Zone-IA stores data in a single Availability Zone, which does not provide the durability and availability needed for critical log files that must survive an AZ failure, and it also has a 30-day minimum storage charge.

Full explanation →
1370
MCQmedium

A company stores financial data in Amazon RDS for MySQL. They need to retain backups for 7 years to meet compliance. Which backup strategy meets this requirement?

A.Use read replicas to retain data
B.Take daily manual snapshots and delete after 7 years
C.Enable automated backups with a retention period of 7 years
D.Use the AWS Backup service with a 7-year retention policy
AnswerD

AWS Backup can manage snapshots with long retention.

Why this answer

AWS Backup is the correct service for long-term retention of RDS snapshots beyond the 35-day limit of automated backups. It allows you to create backup plans with retention policies up to 100 years, making it suitable for the 7-year compliance requirement. Manual snapshots can also be retained indefinitely, but AWS Backup provides centralized management and lifecycle policies.

Exam trap

The trap here is that candidates may assume automated backups can be configured for long retention periods, but AWS enforces a hard 35-day limit, making AWS Backup the only viable option for multi-year retention.

How to eliminate wrong answers

Option A is wrong because read replicas are used for read scaling and disaster recovery, not for backup retention; they do not provide point-in-time recovery or long-term retention. Option B is wrong because while manual snapshots can be retained indefinitely, taking daily manual snapshots is operationally inefficient and error-prone, and AWS Backup offers a more automated and managed solution with lifecycle policies. Option C is wrong because Amazon RDS automated backups have a maximum retention period of 35 days, which cannot be extended to 7 years.

Full explanation →
1371
MCQhard

A company runs a production Amazon Redshift cluster with a 5-node ra3.4xlarge configuration. The data engineer observes that write operations are failing with 'Disk Full' errors on some nodes. The cluster has not reached its total capacity. What should the engineer do to resolve this issue?

A.Recreate the table with a different distribution style to avoid data skew.
B.Change the sort keys to distribute data evenly.
C.Enable compression on all tables.
D.Add more nodes to the cluster.
AnswerA

Choosing an appropriate DISTKEY distributes data evenly across nodes.

Why this answer

The 'Disk Full' errors on some nodes, despite the cluster not reaching total capacity, indicate data skew caused by an inappropriate distribution style. Recreating the table with a different distribution style (e.g., DISTKEY on a high-cardinality column or DISTSTYLE EVEN) redistributes data evenly across all nodes, eliminating the hot spots that exhaust local disk space.

Exam trap

The DEA-C01 exam often tests the misconception that disk full errors always mean the cluster is at capacity, leading candidates to add nodes (Option D) instead of diagnosing data skew; the trap here is that local node disk exhaustion can occur even when the cluster's total storage is underutilized.

How to eliminate wrong answers

Option B is wrong because sort keys control the physical order of data on disk for query performance, not the distribution of data across nodes; they cannot resolve disk space imbalances. Option C is wrong because compression reduces the storage footprint of data on disk but does not address the uneven distribution of data that causes some nodes to fill up while others remain underutilized. Option D is wrong because adding more nodes increases total cluster capacity but does not fix the underlying data skew; the new nodes would also experience uneven data loads if the distribution style remains unchanged.

Full explanation →
1372
MCQeasy

A data engineering team is using AWS Glue to catalog data in an S3 data lake. They have a Glue crawler that runs daily to update the Data Catalog. Recently, they noticed that the crawler is taking longer to run and sometimes fails because of a timeout. The team suspects the issue is due to the large number of small files in the S3 bucket. They need to improve crawler performance and reliability. Which solution should they implement?

A.Configure the crawler to use a different classifier.
B.Use AWS Glue ETL to consolidate small files into larger ones before crawling.
C.Increase the crawler timeout to 24 hours.
D.Schedule the crawler to run more frequently to avoid large data accumulation.
AnswerB

Reduces number of files to scan.

Why this answer

Consolidating small files into larger ones (e.g., using AWS Glue ETL with a groupFiles or groupSize option, or a separate compaction job) reduces the number of objects the crawler must list and sample. This directly addresses the root cause: a high volume of small files increases metadata operations and can cause crawler timeouts. By reducing file count, the crawler can complete within the default 24-hour timeout and avoid failures.

Exam trap

The trap here is that candidates assume increasing the timeout or running the crawler more frequently will fix performance issues, but the real bottleneck is the sheer number of small files, which requires data compaction to resolve.

How to eliminate wrong answers

Option A is wrong because changing the classifier affects how the crawler interprets data format (e.g., JSON vs. Parquet), not the number of files or the performance bottleneck caused by small files. Option C is wrong because increasing the timeout to 24 hours does not solve the underlying issue of excessive small files; the crawler may still fail due to resource limits or S3 request throttling, and the default timeout is already 24 hours.

Option D is wrong because running the crawler more frequently would only accumulate more small files over time, worsening the problem and increasing the likelihood of timeouts.

Full explanation →
1373
MCQhard

A company runs an Amazon RDS for MySQL database. The database experiences high write latency during peak hours. The data engineer notices that the WriteIOPS metric is consistently at the provisioned limit. Which action would most effectively reduce write latency without increasing costs?

A.Enable Multi-AZ deployment
B.Increase the provisioned IOPS on the existing RDS instance
C.Add a read replica to offload read traffic
D.Migrate to Amazon Aurora MySQL with appropriate instance size
AnswerD

Aurora's distributed storage can handle higher write throughput with lower latency and cost.

Why this answer

Migrating to Amazon Aurora MySQL with an appropriate instance size reduces write latency because Aurora’s distributed storage architecture provides up to 20 times the write throughput of standard MySQL on RDS, without requiring additional IOPS provisioning. Aurora automatically scales storage I/O and uses a 6-replica quorum-based write model, which eliminates the bottleneck of hitting a fixed IOPS limit while keeping costs comparable to or lower than provisioned IOPS on RDS.

Exam trap

The trap here is that candidates often assume increasing provisioned IOPS (Option B) is the only way to fix write latency, overlooking that Aurora’s pay-per-request I/O model can provide higher throughput without a fixed cost increase, and that Multi-AZ (Option A) is a common distractor because it sounds like it improves performance but actually targets availability.

How to eliminate wrong answers

Option A is wrong because enabling Multi-AZ deployment provides high availability through synchronous standby replication, but it does not increase write throughput or reduce write latency; in fact, it can slightly increase write latency due to the synchronous commit to the standby. Option B is wrong because increasing provisioned IOPS directly increases costs, as you pay for the provisioned IOPS regardless of usage, and the question explicitly asks to reduce write latency without increasing costs. Option C is wrong because adding a read replica offloads read traffic, which does nothing to address write latency caused by hitting the WriteIOPS limit; write operations still hit the same primary instance with the same IOPS ceiling.

Full explanation →
1374
Multi-Selecteasy

A data engineer is setting up Amazon S3 bucket policies for a data lake. Which TWO statements are true regarding S3 bucket policies? (Choose TWO.)

Select 2 answers
A.Bucket policies can grant access to accounts in other AWS Organizations
B.Bucket policies are the only way to control access to S3
C.Bucket policies can be applied to individual objects
D.The Principal element in a bucket policy is optional
E.Bucket policies are written in JSON format
AnswersA, E

Cross-account access can be granted via bucket policies.

Why this answer

S3 bucket policies can grant cross-account access to principals in other AWS accounts, including those in different AWS Organizations, by specifying the target account ID or organization ID in the Principal element. This enables centralized data lake access management across organizational boundaries without requiring IAM roles or resource-based policies in each account.

Exam trap

The trap here is that candidates often confuse bucket policies with IAM policies, mistakenly thinking the Principal element is optional in bucket policies (it is required), or that bucket policies can target individual objects (they cannot; they use prefix or tag conditions instead).

Full explanation →
1375
Multi-Selecthard

A company is migrating on-premises Apache Kafka clusters to Amazon MSK. The migration must be seamless with no data loss. The team is using MirrorMaker 2 to replicate data from on-premises Kafka to MSK. Which THREE configurations are necessary to ensure exactly-once semantics and minimal downtime? (Choose three.)

Select 3 answers
A.Set auto.create.topics.enable to false to prevent automatic topic creation.
B.Set offsets.topic.replication.factor to 3 for the consumer offsets topic.
C.Set replication.factor to 3 on the MSK cluster.
D.Enable TLS encryption between on-premises and MSK.
E.Configure MirrorMaker 2 to use exactly-once semantics.
AnswersB, C, E

Ensures offset data is durable and replicated.

Why this answer

To ensure exactly-once semantics and minimal downtime when migrating on-premises Kafka to Amazon MSK using MirrorMaker 2, three configurations are essential. First, setting `offsets.topic.replication.factor` to 3 (option B) ensures that consumer offsets are replicated across multiple brokers, preventing loss of offset information during broker failures, which supports exactly-once semantics by maintaining accurate consumer state. Second, setting `replication.factor` to 3 on the MSK cluster (option C) increases data durability and availability, reducing the risk of data loss during the migration.

Third, configuring MirrorMaker 2 to use exactly-once semantics (option E) prevents duplicate message delivery by enabling idempotent producers and transactional semantics in the replication flow. Options A and D are not required: `auto.create.topics.enable` should typically be left as default (true) to allow dynamic topic creation, and TLS encryption (option D) is a security measure but not necessary for exactly-once semantics or minimal downtime.

Full explanation →
1376
Multi-Selecteasy

A data engineering team is migrating a MySQL database to Amazon RDS for MySQL. They need to ensure high availability and automated failover. Which THREE configurations should they implement?

Select 3 answers
A.Enable Enhanced Monitoring.
B.Enable automated backups with a retention period.
C.Enable Multi-AZ deployment.
D.Configure a DB subnet group with subnets in at least two Availability Zones.
E.Create a read replica in a different region.
AnswersB, C, D

Automated backups enable recovery to any point within retention.

Why this answer

Automated backups with a retention period enable point-in-time recovery (PITR) and are required for Multi-AZ failover to function properly. RDS uses automated backups to keep the standby instance synchronized and to support recovery after a failover event.

Exam trap

The trap here is that candidates often confuse read replicas (which are for read scaling and manual promotion) with Multi-AZ standby instances (which provide automatic failover), leading them to incorrectly select a cross-region read replica as a high-availability solution.

Full explanation →
1377
MCQhard

A company uses Amazon Kinesis Data Streams to ingest clickstream data. The data is then processed by a Kinesis Data Analytics application running SQL queries. The analytics application is falling behind and processing records with increasing latency. The stream has 4 shards, and the average record size is 5 KB. What is the MOST effective way to improve processing latency?

A.Increase the number of shards in the Kinesis stream to 8.
B.Enable enhanced fan-out on the Kinesis stream for the analytics application.
C.Increase the parallelism of the Kinesis Data Analytics application.
D.Increase the retention period of the Kinesis stream to 7 days.
AnswerC

More parallelism allows the application to process more records per unit time.

Why this answer

Increasing the parallelism of the Kinesis Data Analytics application (e.g., by increasing the number of in-application streams or ParallelismPerKPU) allows it to consume from the stream faster, reducing latency. Option A is wrong because 5 KB is well below the 1 MB/s shard limit, so increasing shards is unnecessary. Option B is wrong because enhanced fan-out is for consumers that need low latency, but does not help if the application is CPU-bound.

Option D is wrong because increasing the retention period does not affect processing speed; it only keeps data longer.

Full explanation →
1378
MCQeasy

A data engineer is monitoring an Amazon Kinesis Data Stream with a shard count of 10. The stream receives 5 MB/s of write traffic and 10 MB/s of read traffic. The engineer notices that writes are throttled with ProvisionedThroughputExceededException errors. Which action should the engineer take to resolve the throttling?

A.Increase the shard count to 20.
B.Decrease the shard count to 5.
C.Enable enhanced fan-out on the stream.
D.Configure auto-scaling on the stream.
AnswerD

Correct. Configuring auto-scaling, such as switching to on-demand mode, allows Kinesis Data Streams to automatically adjust capacity based on traffic, mitigating hot shards and eliminating ProvisionedThroughputExceededException.

Why this answer

ProvisionedThroughputExceededException occurs when a shard's write throughput exceeds 1 MB/s, often due to hot shards from uneven partition key distribution. While increasing shard count (Option A) can help spread the load, it does not automatically fix the root cause if partition keys remain skewed. The best action is to configure auto-scaling (Option D), which in Amazon Kinesis Data Streams can be achieved by switching to on-demand mode.

On-demand mode automatically scales capacity based on traffic patterns, eliminating throttling without manual intervention. Option B decreases write capacity, worsening the issue. Option C only improves read throughput, not write.

Exam trap

Candidates may think that because total write capacity (10 MB/s) exceeds write traffic (5 MB/s), throttling should not occur. However, uneven partition key distribution creates hot shards that exceed the 1 MB/s per shard limit. The trap is to assume increasing shard count is the only fix, but auto-scaling (on-demand mode) automatically handles such imbalances.

Full explanation →
1379
MCQeasy

A company wants to move data from an Amazon RDS for MySQL database to Amazon Redshift for analytics. The data needs to be refreshed daily. Which AWS service is best suited for this?

A.AWS Database Migration Service (DMS)
B.AWS Glue
C.Amazon EMR
D.Amazon Athena
AnswerB

Can extract from RDS and load to Redshift with scheduling.

Why this answer

(AWS Glue) is correct because it is a fully managed ETL service that can connect to RDS for MySQL as a source and Amazon Redshift as a target, and it supports scheduling for daily refreshes. Option A (AWS DMS) is designed for database migration and continuous replication, not for scheduled batch loads. Option C (Amazon EMR) is for big data processing using Hadoop/Spark, which is overkill for this simple transfer.

Option D (Amazon Athena) is an interactive query service for data in Amazon S3, not for moving data between databases.

Full explanation →
1380
Multi-Selecteasy

A company needs to ingest data from an on-premises Oracle database into Amazon S3 for analytics. The data volume is about 1 TB initially, with daily incremental updates of about 10 GB. Which TWO services can be combined to achieve this with minimal custom code?

Select 2 answers
A.AWS Glue
B.Amazon Kinesis Data Streams
C.Amazon Athena
D.Amazon S3
E.AWS Database Migration Service (DMS)
AnswersD, E

Target for the ingested data.

Why this answer

The correct combination is AWS DMS (Database Migration Service) for migration and Amazon S3 as the target. DMS can perform full load and ongoing replication with minimal custom code, making it suitable for the initial 1 TB load and daily 10 GB increments. AWS Glue (option A) could be used but often requires more custom code for change data capture (CDC) compared to DMS.

Amazon Kinesis Data Streams (option B) is designed for real-time streaming data, not database migration. Amazon Athena (option C) is a query service, not a data movement service. Therefore, the correct answers are D (Amazon S3) and E (AWS DMS).

Full explanation →
1381
MCQmedium

A data engineer is designing a data pipeline that ingests streaming data from an IoT fleet using Kinesis Data Streams and processes it with a Lambda function. The Lambda function often times out when the data volume spikes. What is the most scalable solution?

A.Reduce the batch size in the event source mapping.
B.Increase the Lambda function timeout to 15 minutes.
C.Increase the Lambda function memory and set reserved concurrency.
D.Increase the number of shards and use a Kinesis Data Analytics application for windowed aggregation before Lambda.
AnswerD

More shards increase parallelism, and pre-aggregation reduces Lambda load.

Why this answer

Increasing the number of shards increases the parallelism of the stream, allowing higher throughput. Using Kinesis Data Analytics for windowed aggregation reduces the volume of data sent to Lambda, preventing timeouts during spikes. Option A is wrong because reducing batch size decreases the number of records per invocation, which can increase the number of Lambda invocations and overhead, but does not address the root cause of timeouts due to volume.

Option B is wrong because increasing the Lambda timeout to 15 minutes allows the function to run longer, but it does not increase throughput or handle spikes efficiently; it only delays failures and is not scalable. Option C is wrong because increasing memory can improve performance, but setting reserved concurrency limits the maximum number of concurrent executions, which can throttle processing during spikes and reduce scalability.

Full explanation →
1382
MCQeasy

A company uses Amazon S3 as its data lake. A data engineer needs to enforce encryption of data at rest using server-side encryption with AWS KMS. Which S3 bucket property should be configured?

A.Default encryption
B.Server access logging
C.Versioning
D.Bucket policy
AnswerA

Default encryption enforces SSE-KMS on all objects.

Why this answer

Configuring default encryption on an S3 bucket ensures that all objects stored in the bucket are encrypted at rest using server-side encryption. When AWS KMS is specified as the encryption type, S3 automatically encrypts objects with a KMS key (SSE-KMS) upon upload, even if the upload request does not include encryption headers. This enforces encryption at rest without requiring changes to client applications.

Exam trap

The trap here is that candidates often confuse bucket policies (which can enforce encryption conditions) with default encryption (which actually applies encryption), leading them to select bucket policy as the answer when the question asks for the property that enforces encryption of data at rest.

How to eliminate wrong answers

Option B is wrong because server access logging records requests made to the bucket for auditing purposes, but it does not enforce or configure encryption of data at rest. Option C is wrong because versioning preserves, retrieves, and restores every version of every object in the bucket, but it has no effect on encryption settings. Option D is wrong because a bucket policy can deny unencrypted uploads using a condition key like `s3:x-amz-server-side-encryption`, but it does not itself configure the encryption mechanism; it only enforces a policy requirement, whereas default encryption directly applies encryption to all objects.

Full explanation →
1383
MCQeasy

Refer to the exhibit. A data engineer creates an Amazon Redshift table with the above DDL. The engineer runs a query to find all orders for a specific customer within a date range. Which statement about query performance is correct?

A.The query will be inefficient because the distribution key is not the same as the sort key.
B.The table should use DISTSTYLE EVEN to improve performance.
C.The query will benefit from both the distribution key and the sort key to minimize data scanned.
D.The sort key will not help because the query filters on customer_id first.
AnswerC

Distribution reduces data movement, sort key reduces data scanned.

Why this answer

The DDL defines customer_id as the distribution key and order_date as the sort key. When the query filters on both customer_id (distribution key) and order_date (sort key), Redshift can use partition pruning via the sort key to skip blocks that don't match the date range, and the distribution key ensures that data for the same customer is co-located on the same node slice, minimizing data movement. This combination reduces the amount of data scanned and improves query performance.

Exam trap

The trap here is that candidates assume the sort key is useless if the filter does not start with the sort key column, but Redshift's zone map pruning works on any column in the sort key, and the distribution key filter can still leverage co-location to reduce data movement.

How to eliminate wrong answers

Option A is wrong because the distribution key and sort key do not need to be the same; they serve different purposes—distribution key optimizes data locality for joins and aggregations, while sort key optimizes range-restricted scans. Option B is wrong because DISTSTYLE EVEN distributes rows randomly across slices, which would scatter a single customer's data across all nodes, increasing network traffic and reducing the benefit of the sort key for range scans. Option D is wrong because the sort key on order_date still helps even though the query filters on customer_id first; Redshift can apply predicate-based block pruning on the sort key after the distribution key filter narrows the relevant slices, and the sort key order (customer_id, order_date) means the date filter can still be used efficiently within each customer's data.

Full explanation →
1384
Multi-Selectmedium

A data engineer is optimizing an Amazon RDS for MySQL database that experiences high write throughput. The engineer wants to improve write performance and reduce latency. Which TWO database-level configuration changes can help achieve this?

Select 2 answers
A.Use Provisioned IOPS (io1 or io2) storage.
B.Reduce the backup retention period to 1 day.
C.Increase the DB instance class to a larger size.
D.Create a Read Replica to offload writes.
E.Enable Multi-AZ for high availability.
AnswersA, C

Provisioned IOPS provides consistent low-latency writes.

Why this answer

Provisioned IOPS (io1 or io2) storage delivers consistent and predictable I/O performance by guaranteeing a specified number of I/O operations per second, which directly reduces latency and improves write throughput for high-write workloads. This is the most effective storage-level change for write-intensive RDS for MySQL databases.

Exam trap

The trap here is that candidates often confuse Multi-AZ with performance improvement, but Multi-AZ is designed for durability and failover, not for speeding up writes.

Full explanation →
1385
Multi-Selectmedium

A company is ingesting real-time clickstream data into Amazon S3 using Amazon Kinesis Data Firehose. The data is semi-structured and the company wants to transform the data into Parquet format and partition it by year, month, day, and hour. Which TWO steps should be taken to achieve this? (Choose TWO.)

Select 2 answers
A.Set up an Amazon S3 event notification to trigger an AWS Lambda function that partitions the data after delivery.
B.Enable dynamic partitioning in Kinesis Data Firehose and specify the partition keys as year, month, day, hour extracted from the data.
C.Use an AWS Glue Crawler to infer the schema and automatically partition the data in S3.
D.Create an AWS Lambda function that transforms incoming records to Parquet and attach it to the Firehose delivery stream as a data transformation.
E.Configure Kinesis Data Firehose to convert the data to Parquet format using a schema from the AWS Glue Data Catalog.
AnswersB, D

Correct. Dynamic partitioning extracts partition keys from the data and creates S3 prefixes accordingly.

Why this answer

Kinesis Data Firehose's dynamic partitioning feature allows you to specify partition keys (year, month, day, hour) extracted from the incoming data, and Firehose will automatically create the corresponding S3 prefix structure (e.g., year=2024/month=01/day=15/hour=10/) during delivery. Option D is correct because to convert semi-structured data to Parquet format, you can attach an AWS Lambda function as a data transformation to Firehose, which converts each record to Parquet before delivery to S3. Option E is incorrect because while Kinesis Data Firehose does support converting data to Parquet format using a schema from the AWS Glue Data Catalog, this approach requires a pre-defined Glue schema and is less flexible for semi-structured data.

Moreover, the question does not mention any existing Glue Data Catalog, and the Lambda transformation in option D is a more direct and customizable method for the transformation needed.

Exam trap

AWS often tests the misconception that dynamic partitioning alone handles format conversion, but in reality, dynamic partitioning only manages the S3 prefix structure, while Parquet conversion requires a separate Lambda transformation or the use of Firehose's built-in Parquet conversion with a compatible input format.

Full explanation →
1386
Multi-Selecteasy

A data engineer needs to ingest data from an on-premises Oracle database into Amazon S3 for analytics. The data changes frequently and the engineer wants to capture both initial load and incremental changes with minimal latency. Which TWO AWS services should be used together? (Choose TWO.)

Select 2 answers
A.AWS Database Migration Service (DMS)
B.AWS Lambda
C.AWS Glue
D.AWS Transfer Family
E.Amazon Kinesis Data Streams
AnswersA, E

DMS can perform ongoing replication from Oracle to S3.

Why this answer

AWS DMS (Option A) is correct because it can perform an initial load of data from an on-premises Oracle database to Amazon S3 and then continuously replicate incremental changes using change data capture (CDC) with minimal latency. Amazon Kinesis Data Streams (Option E) complements DMS by enabling near-real-time streaming of data changes, which can be further processed or stored in S3. Option B (Lambda) is not a direct replacement for database replication; it can process events but does not natively capture database changes.

Option C (Glue) is an ETL service, not designed for real-time replication. Option D (Transfer Family) is for file transfers, not database replication.

Full explanation →
1387
MCQmedium

A company stores sensitive customer data in Amazon S3. The security team requires that all objects be encrypted at rest using server-side encryption with customer-provided keys (SSE-C). Which bucket policy condition will enforce this requirement?

A.s3:x-amz-server-side-encryption-aws-kms-key-id
B.s3:x-amz-server-side-encryption
C.s3:x-amz-server-side-encryption-customer-key
D.s3:x-amz-server-side-encryption-customer-algorithm
AnswerC

This condition key enforces the use of a customer-provided encryption key.

Why this answer

The condition key `s3:x-amz-server-side-encryption-customer-key` is specifically used to enforce that objects uploaded to S3 must use server-side encryption with customer-provided keys (SSE-C). This condition key checks for the presence of the `x-amz-server-side-encryption-customer-key` header in the request, which is required for SSE-C encryption. Without this header, the request is denied, ensuring all objects are encrypted at rest using customer-provided keys.

Exam trap

AWS often tests the distinction between condition keys that enforce the encryption method (SSE-S3, SSE-KMS, SSE-C) versus those that enforce specific parameters like the key ID or algorithm, leading candidates to confuse `s3:x-amz-server-side-encryption-customer-algorithm` with the key requirement.

How to eliminate wrong answers

Option A is wrong because `s3:x-amz-server-side-encryption-aws-kms-key-id` is used to enforce the use of a specific AWS KMS key ID for SSE-KMS, not SSE-C. Option B is wrong because `s3:x-amz-server-side-encryption` is used to enforce the encryption mode (e.g., AES256 or aws:kms) for SSE-S3 or SSE-KMS, but it does not enforce the use of customer-provided keys required for SSE-C. Option D is wrong because `s3:x-amz-server-side-encryption-customer-algorithm` enforces the algorithm (e.g., AES256) used with SSE-C, but it does not enforce the presence of the customer-provided key itself, which is the core requirement for SSE-C.

Full explanation →
1388
Multi-Selecthard

Which THREE factors should a data engineer consider when choosing between AWS Glue and Amazon EMR for a data transformation job? (Choose three.)

Select 3 answers
A.The ability to output results to Amazon S3
B.The support for Apache Spark
C.The level of control over the execution environment and dependencies
D.The need for a serverless vs. cluster-based environment
E.The cost model: pay per DPU for Glue vs. per instance for EMR
AnswersC, D, E

EMR offers more control; Glue is less customizable.

Why this answer

When choosing between AWS Glue and Amazon EMR for a data transformation job, key considerations include: the level of control over the execution environment (EMR offers more customization, while Glue is managed), the deployment model (Glue is serverless, EMR is cluster-based), and the cost structure (Glue charges per DPU, EMR charges per EC2 instance). Options A and B are not differentiating factors because both services support Apache Spark and can output to S3.

Full explanation →
1389
MCQhard

A company has an Amazon DynamoDB table with a provisioned write capacity of 1000 WCU. During a flash sale, the write traffic spikes to 5000 WCU for 10 minutes. The table is not auto-scaled. Which action should the data engineer take to handle the spike without throttling?

A.Convert the table to on-demand capacity mode before the sale.
B.Set a CloudWatch alarm to increase provisioned capacity when write throttling occurs.
C.Use DynamoDB Accelerator (DAX) to cache writes.
D.Enable auto-scaling with a target utilization of 70% and a maximum capacity of 5000 WCU.
AnswerA

Correct. By converting to on-demand capacity mode, the table automatically scales to handle any write traffic without throttling. This is the most reliable way to handle a temporary spike.

Why this answer

The table is currently provisioned with 1000 WCU and cannot handle a spike to 5000 WCU. Converting to on-demand mode before the sale allows DynamoDB to automatically handle varying traffic without throttling, as on-demand capacity scales instantly to meet demand. Option D (auto-scaling) might not react quickly enough for a short 10-minute spike, and the table is not currently auto-scaled.

Option C is incorrect because DAX is a read cache and does not buffer or improve write capacity. Option B is reactive and would not prevent initial throttling.

Exam trap

Candidates often assume DAX can handle write spikes because it is a cache, but DAX only caches reads and does not buffer writes. The correct approach is to use on-demand capacity for unpredictable traffic spikes.

How to eliminate wrong answers

Option A is wrong because converting to on-demand capacity mode before the sale would handle the spike without throttling, as on-demand scales instantly to any traffic, but the question's answer key incorrectly marks C as correct. Option B is wrong because setting a CloudWatch alarm to increase provisioned capacity when write throttling occurs is reactive and will cause throttling before the alarm triggers and capacity increases. Option D is wrong because enabling auto-scaling with a target utilization of 70% and a maximum capacity of 5000 WCU would work if configured in advance, but the table is not auto-scaled and the spike is sudden; auto-scaling has a cooldown period and cannot react instantly to a 10-minute spike.

Full explanation →
1390
MCQhard

A company uses AWS DMS to migrate a 2 TB Oracle database to Amazon RDS for PostgreSQL. The migration is taking longer than expected. The task status shows 'Full load in progress' with a low 'Table throughput (rows/s)'. Which action would MOST improve throughput?

A.Enable Multi-AZ on the DMS replication instance
B.Change the target table preparation mode to 'Do nothing'
C.Increase the number of parallel tasks in the DMS task settings
D.Increase the number of shards in the source database
AnswerC

Parallel tasks allow concurrent loading of tables, increasing throughput.

Why this answer

The low 'Table throughput (rows/s)' during the full load phase indicates that the DMS task is not processing tables with enough parallelism. Increasing the number of parallel tasks in the DMS task settings allows the replication instance to load multiple tables concurrently, which directly improves throughput by utilizing available CPU and memory resources more efficiently.

Exam trap

The trap here is that candidates confuse 'parallel tasks' with 'Multi-AZ' or 'target table preparation mode', assuming that high availability or skipping table preparation will speed up data transfer, when in fact only increasing parallelism directly addresses low row throughput during full load.

How to eliminate wrong answers

Option A is wrong because enabling Multi-AZ on the DMS replication instance provides high availability and failover support, but does not increase throughput during full load; it may even reduce performance due to synchronous replication overhead. Option B is wrong because changing the target table preparation mode to 'Do nothing' only affects how DMS handles existing tables (e.g., truncate or drop), not the speed of data transfer; it does not address low row throughput. Option D is wrong because increasing the number of shards in the source database is a source-side change that does not directly affect DMS's ability to read and load data faster; DMS's throughput is limited by its own parallelism settings, not the source shard count.

Full explanation →
1391
MCQmedium

A data engineer needs to set up a data pipeline that ingests CSV files from an S3 bucket, transforms them using AWS Glue, and loads the results into Amazon Redshift. The pipeline must handle schema evolution and data quality checks. Which combination of services is most appropriate?

A.Use S3 Events to trigger an AWS Lambda function that writes directly to Redshift
B.Use Amazon Athena to query data in S3 and insert results into Redshift via CTAS
C.Use Amazon Kinesis Data Firehose to transform and load data into Redshift
D.Use AWS Glue ETL jobs with Glue DataBrew for data quality and write to Redshift
AnswerD

Glue supports schema evolution and DataBrew provides data quality checks.

Why this answer

AWS Glue ETL jobs can handle schema evolution through the use of Glue DynamicFrames, and Glue DataBrew provides built-in data quality checks (profiling, validation) that integrate seamlessly. Option A is incorrect because Lambda has timeout and memory limits, making it unsuitable for large-scale transformations. Option B is incorrect because Athena cannot write directly to Redshift; CTAS only writes to S3.

Option C is incorrect because Kinesis Data Firehose is designed for streaming data, not batch CSV ingestion from S3.

Full explanation →
1392
MCQmedium

A company uses AWS Glue ETL to transform data from Amazon RDS for MySQL to Amazon S3. The Glue job reads from a JDBC connection. The job runs once daily and processes all records, but the data volume is growing. Which change would improve performance and reduce costs?

A.Increase the number of DPUs for the Glue job
B.Switch to a Glue Python shell job
C.Use a higher JDBC fetch size
D.Enable Glue job bookmarking and set the job to process only new data
AnswerD

Bookmarking enables incremental loads.

Why this answer

Enabling Glue job bookmarking allows the job to process only new or changed data since the last run, rather than reprocessing the entire dataset. This reduces both the data volume read from the JDBC source and the transformation time, directly improving performance and lowering costs by minimizing DPU usage.

Exam trap

The trap here is that candidates often assume increasing parallelism (Option A) is the universal fix for performance, overlooking the fact that reducing the data volume processed (Option D) is a more fundamental and cost-effective optimization.

How to eliminate wrong answers

Option A is wrong because increasing the number of DPUs for the Glue job would increase parallelism and potentially speed up execution, but it does not address the root cause of reprocessing all records daily; it would only scale the cost linearly without reducing the data volume processed. Option B is wrong because a Glue Python shell job is designed for lightweight, single-node Python scripts and cannot handle JDBC connections or large-scale data transformations; it lacks the distributed processing capabilities of a full Glue ETL job. Option C is wrong because using a higher JDBC fetch size can improve the efficiency of reading rows from MySQL by reducing round trips, but it still processes all records every run and does not eliminate the overhead of scanning the entire table daily.

Full explanation →
1393
MCQeasy

A company needs to ingest real-time clickstream data from a web application into Amazon S3 for analytics. The data must be available within minutes of generation. Which AWS service should be used to capture and deliver this streaming data?

A.Amazon RDS
B.Amazon Kinesis Data Firehose
C.AWS Glue
D.Amazon Simple Queue Service (SQS)
AnswerB

Correct: Kinesis Data Firehose captures streaming data and delivers it to S3 with low latency.

Why this answer

Amazon Kinesis Data Firehose is the correct choice because it is a fully managed service designed to capture, transform, and load streaming data into Amazon S3, Redshift, Elasticsearch, or Splunk in near real-time (typically within 60 seconds). It directly addresses the requirement for ingesting real-time clickstream data and delivering it to S3 within minutes, without requiring custom code or manual scaling.

Exam trap

The trap here is confusing Amazon Kinesis Data Streams (which requires custom consumers and is not directly integrated with S3) with Amazon Kinesis Data Firehose (which is purpose-built for automated delivery to destinations like S3), leading candidates to overlook the 'within minutes' requirement and choose a service that needs additional components.

How to eliminate wrong answers

Option A (Amazon RDS) is wrong because it is a relational database service for transactional workloads, not designed for streaming data ingestion or direct delivery to S3; it would require additional ETL processes to move data to S3. Option C (AWS Glue) is wrong because it is a serverless ETL service for batch data processing and cataloging, not for real-time streaming capture; it can process data from S3 but does not ingest streaming data directly. Option D (Amazon Simple Queue Service (SQS)) is wrong because it is a message queue service for decoupling application components, not a streaming data delivery service; it does not automatically write data to S3 and requires custom consumers to do so.

Full explanation →
1394
MCQmedium

A data engineer needs to monitor the number of records processed by an Amazon Kinesis Data Analytics application and trigger an alarm if the count drops below a threshold over 5 minutes. Which CloudWatch metric should be used?

A.millisBehindLatest (from KinesisDataAnalytics)
B.IncomingRecords (from Kinesis Streams)
C.DPUCount (from Glue)
D.IncomingBytes (from Kinesis Firehose)
AnswerA

This metric indicates how far behind the application is; a drop in processing can be inferred.

Why this answer

'millisBehindLatest' is a metric published by KinesisDataAnalytics that indicates how far behind the application is in processing records. Monitoring this metric allows the engineer to set an alarm when the number of records processed drops, as a high millisBehindLatest value indicates the application is falling behind. Option B (IncomingRecords) is from Kinesis Streams, not KinesisDataAnalytics.

Option C (DPUCount) is a Glue metric. Option D (IncomingBytes) is a Kinesis Firehose metric.

Full explanation →
1395
MCQhard

Refer to the exhibit. This IAM policy is attached to a user who is trying to read the object s3://data-bucket/confidential/report.csv. The user's principal tag 'role' is set to 'analyst'. What will happen when the user attempts to read the object?

A.Denied because the Deny statement covers all actions under confidential
B.Allowed because there is an explicit Allow and no explicit Deny that matches
C.Denied because the condition in the Deny statement evaluates to true
D.Allowed because of the Allow statement for s3:GetObject
AnswerC

The condition StringNotEquals 'admin' is true for 'analyst', so Deny is applied.

Why this answer

The Deny statement applies when the role tag is not 'admin'. The user's tag is 'analyst', so the condition matches and access is denied. Option A is wrong because the Allow statement is overridden by the explicit Deny.

Option B is wrong because the Deny applies to all actions in the confidential prefix. Option D is wrong because Deny overrides Allow.

Full explanation →
1396
MCQmedium

A data pipeline using AWS Glue jobs is failing with 'Insufficient capacity' errors for Spark executors. Which action should the data engineer take to resolve this?

A.Reduce the number of workers in the Glue job configuration.
B.Increase the job timeout value.
C.Disable Spark UI logging.
D.Increase the number of workers (DPUs) in the Glue job configuration.
AnswerD

Increasing workers adds more computing capacity, resolving the 'Insufficient capacity' error.

Why this answer

The 'Insufficient capacity' error for Spark executors indicates that the Glue job is running out of resources (DPUs). Increasing the number of workers (DPUs) provides more compute capacity, allowing the job to allocate sufficient executors. Option A (reducing workers) would worsen the issue.

Option B (increasing timeout) does not add resources. Option C (disabling Spark UI) does not affect capacity. Therefore, increasing the number of workers (DPUs) is the correct resolution.

Full explanation →
1397
Multi-Selecthard

A company is experiencing high costs from Amazon Redshift. The data engineer wants to optimize costs. Which THREE actions should the engineer take? (Choose THREE.)

Select 3 answers
A.Increase the frequency of automated snapshots.
B.Right-size the cluster based on workload analysis.
C.Increase the number of nodes to improve performance.
D.Purchase Reserved Instances for steady-state workloads.
E.Enable Concurrency Scaling and set up a usage limit.
AnswersB, D, E

Right-sizing ensures you only pay for needed resources.

Why this answer

Right-sizing the cluster based on workload analysis ensures that the provisioned resources (number and type of nodes) match the actual compute and storage demands. Over-provisioned clusters waste money on unused capacity, while under-provisioned clusters cause performance issues. Analyzing metrics like CPU utilization, disk usage, and query queue wait times helps identify the optimal node count and instance type, directly reducing costs.

Exam trap

The trap here is that candidates confuse cost optimization with performance improvement, leading them to select 'Increase the number of nodes' (Option C) thinking it will reduce costs by improving efficiency, when in fact it increases costs.

Full explanation →
1398
MCQhard

A data engineer needs to ingest data from an on-premises Oracle database into Amazon S3 using AWS DMS. The change data capture (CDC) must be enabled to capture ongoing changes. Which additional AWS service is required to store the transaction logs for CDC?

A.Amazon RDS
B.Amazon S3
C.Amazon EBS
D.Amazon CloudWatch Logs
AnswerB

Amazon S3 is not required; DMS reads redo logs directly from the source database.

Why this answer

AWS DMS change data capture (CDC) for Oracle databases does not require an additional AWS service to store transaction logs. DMS reads the redo logs directly from the source Oracle database, either using LogMiner or binary reader. Therefore, none of the listed services are needed for storing transaction logs.

As none of the provided options are correct, this question contains no valid answer.

Full explanation →
1399
MCQhard

A data engineer is designing a streaming ingestion pipeline using Amazon Kinesis Data Streams. The stream has 10 shards, and the data volume is expected to grow by 50% over the next month. The engineer needs to ensure that the pipeline can scale without manual intervention. Which approach should be used?

A.Set up a CloudWatch Alarm to trigger a Lambda function to add shards
B.Use an Auto Scaling group to add more shards
C.Switch the Kinesis stream to on-demand capacity mode
D.Configure the stream to use a Lambda function that scales shards
AnswerC

On-demand mode automatically scales shards based on ingestion throughput.

Why this answer

Kinesis Data Streams on-demand capacity mode automatically scales the number of shards based on the incoming traffic pattern, eliminating the need for manual intervention. Option A is incorrect because CloudWatch Alarms can trigger a Lambda function to add shards via the UpdateShardCount API, but this approach requires custom code and does not provide automatic scaling without manual setup. Option B is incorrect because Auto Scaling groups are used for EC2 instances, not for Kinesis stream shards.

Option D is incorrect because Lambda functions can be used to scale shards programmatically, but this still requires custom implementation and is not a native automatic scaling feature.

Full explanation →
1400
Multi-Selecteasy

A data engineer needs to ingest data from multiple on-premises relational databases into Amazon S3 for analytics. The data must be transformed and loaded daily. Which THREE AWS services should the engineer use together to build this pipeline? (Choose THREE.)

Select 3 answers
A.AWS Glue
B.AWS Glue Data Catalog
C.Amazon Athena
D.AWS Database Migration Service (DMS)
E.Amazon Kinesis Data Streams
AnswersA, B, D

Performs ETL transformations on the data.

Why this answer

AWS Glue is correct because it provides a serverless ETL (Extract, Transform, Load) service that can read data from Amazon S3, apply transformations (e.g., using PySpark or Scala), and write the transformed data back to S3. In this pipeline, AWS Glue jobs can be scheduled to run daily to perform the required transformations on the ingested data.

Exam trap

The DEA-C01 exam often tests the distinction between batch and streaming services; the trap here is that candidates might confuse Amazon Kinesis Data Streams (real-time) with a batch ingestion tool, or think Amazon Athena can perform ETL transformations when it is only a query engine.

Full explanation →
1401
MCQeasy

A company wants to migrate on-premises data to Amazon S3 using AWS DataSync. The data is stored on an NFS file server and the total volume is 50 TB. The network bandwidth between the on-premises data center and AWS is 1 Gbps (gigabit per second). What is the primary factor that will determine the total time required for the initial data transfer?

A.The available network bandwidth between on-premises and AWS
B.The number of S3 buckets used as the destination
C.The average file size in the dataset
D.The IOPS (I/O operations per second) of the on-premises NFS server
AnswerA

With 50 TB and 1 Gbps, the theoretical minimum time is ~4.7 days; network bandwidth is the key constraint.

Why this answer

AWS DataSync transfers data over the network, so the primary constraint is the available bandwidth between the on-premises NFS server and AWS. With 50 TB of data and a 1 Gbps link, the theoretical minimum transfer time is approximately 50 TB * 8 / 1 Gbps = 400,000 seconds (~111 hours), but real-world throughput is lower due to protocol overhead, latency, and competing traffic. The network bandwidth directly dictates the maximum data transfer rate, making it the dominant factor for the initial transfer duration.

Exam trap

The trap here is that candidates may focus on the NFS server's IOPS or file size, assuming storage performance is the bottleneck, but the question explicitly provides a 1 Gbps bandwidth figure, signaling that network throughput is the key limiting factor for the initial transfer.

How to eliminate wrong answers

Option B is wrong because the number of S3 buckets does not affect transfer speed; DataSync can write to multiple buckets, but the throughput is still limited by the network pipe. Option C is wrong because while average file size can impact the number of file operations, DataSync uses parallel streams and can handle small files efficiently; the total data volume and bandwidth are the primary drivers, not file size. Option D is wrong because the NFS server's IOPS is rarely the bottleneck for a bulk transfer over a 1 Gbps link; DataSync reads files sequentially and the network bandwidth is typically the limiting factor, not the storage I/O performance.

Full explanation →
1402
MCQmedium

A company uses Amazon Kinesis Data Firehose to deliver streaming data to an Amazon S3 bucket. The delivery occasionally fails due to 'ThrottlingException' from S3. What should the team do to resolve this issue without losing data?

A.Enable S3 Transfer Acceleration on the destination bucket.
B.Disable error logging in Firehose to reduce API calls.
C.Configure Firehose to deliver data to Amazon DynamoDB instead.
D.Increase the Firehose buffer size and buffer interval to reduce the number of S3 PUT requests.
AnswerD

Larger buffers mean fewer writes, reducing throttling risk.

Why this answer

The ThrottlingException from S3 indicates that Kinesis Data Firehose is sending too many PUT requests to S3. Increasing the buffer size or buffer interval causes Firehose to accumulate more records before writing, reducing the number of PUT requests and preventing throttling. Option A (S3 Transfer Acceleration) improves transfer speed, not request rate limits.

Option B (disabling error logging) does not reduce API calls and hides issues. Option C (deliver to DynamoDB) is not supported by Kinesis Data Firehose. Therefore, option D is correct.

Full explanation →
1403
MCQmedium

A company uses Amazon Redshift for analytics. The data engineer notices that some queries are slow and the EXPLAIN plan shows a 'Seq Scan' on a large table. Which data store management action would most likely improve query performance?

A.Run the ANALYZE command to update table statistics.
B.Enable automatic compression on the table.
C.Define appropriate sort keys and distribution styles.
D.Run the VACUUM command to reclaim space.
AnswerC

Sort keys and distribution styles can reduce data scanning and improve join performance.

Why this answer

A Seq Scan indicates that Redshift is scanning the entire table because it lacks efficient data organization. Defining appropriate sort keys and distribution styles organizes data on disk and across nodes, enabling Redshift to use zone maps to skip large portions of data and to execute parallel, co-located joins, which directly reduces the need for full table scans.

Exam trap

The trap here is that candidates often confuse ANALYZE or VACUUM with physical data organization, but neither command creates sort keys or distribution styles, which are the only mechanisms to avoid full table scans in Redshift.

How to eliminate wrong answers

Option A is wrong because ANALYZE updates table statistics for the query planner but does not change the physical layout of data; a Seq Scan can still occur if the table lacks proper sort keys. Option B is wrong because automatic compression is applied during data loading (COPY or INSERT) to reduce storage and I/O, but it does not affect the scan method or data ordering to avoid Seq Scans. Option D is wrong because VACUUM reclaims space from deleted rows and re-sorts data only if sort keys are already defined; without sort keys, VACUUM cannot eliminate Seq Scans.

Full explanation →
1404
Multi-Selectmedium

A company uses Amazon S3 to store raw data and runs AWS Glue ETL jobs to transform it into Parquet. The data is then queried using Amazon Athena. Queries are slow and expensive due to high scan volumes. Which THREE design changes can improve query performance and reduce costs? (Select THREE.)

Select 3 answers
A.Increase the number of files by reducing file size to 1 MB
B.Convert the data to a columnar format like Parquet or ORC if not already
C.Compress the data using a splittable compression format like Snappy
D.Use bucketing on high-cardinality columns
E.Partition the data by commonly filtered columns such as date or region
AnswersB, C, E

Columnar formats store data by column, reducing I/O for queries that select few columns.

Why this answer

Columnar formats like Parquet or ORC store data by column rather than by row, allowing Athena to read only the columns needed for a query. This drastically reduces the amount of data scanned per query, directly lowering both latency and cost since Athena charges based on the volume of data read.

Exam trap

The trap here is that candidates may confuse bucketing with partitioning, or assume that increasing file count always improves parallelism, when in fact small files harm performance in distributed query engines like Athena.

Full explanation →
1405
MCQhard

A company uses AWS Glue ETL jobs to transform data in Amazon S3. The data is partitioned by date and hour. The job reads the latest hour's data, performs aggregations, and writes results to a separate S3 bucket. The job runs every hour and processes approximately 500 MB of input data. The team notices that the job takes longer than expected, often exceeding the 1-hour window. Which action would most effectively reduce the job's runtime?

A.Use a Python shell job instead of a Spark job.
B.Switch from using DynamicFrame to using Spark SQL for transformations.
C.Repartition the input data into more partitions before reading.
D.Increase the number of workers (DPUs) for the Glue job.
AnswerD

More workers increase parallelism, reducing runtime for the given data size.

Why this answer

Increasing the number of workers (DPUs) for the Glue job directly addresses the root cause: the job is CPU- or memory-bound due to insufficient parallelism for the 500 MB hourly workload. By allocating more DPUs, AWS Glue can distribute the aggregation and write operations across more executors, reducing wall-clock time and keeping the job within the 1-hour window. This is the most effective action because the job's bottleneck is compute capacity, not data format or processing framework.

Exam trap

The trap here is that candidates confuse 'repartitioning' (Option C) with 'increasing parallelism' — but without more workers, more partitions simply create scheduling overhead and do not reduce runtime.

How to eliminate wrong answers

Option A is wrong because a Python shell job runs on a single node with limited memory and no distributed processing, which would likely increase runtime for a 500 MB aggregation workload. Option B is wrong because switching from DynamicFrame to Spark SQL does not inherently improve performance; both use the same underlying Spark engine, and the bottleneck is parallelism, not the API abstraction. Option C is wrong because repartitioning the input data into more partitions before reading does not reduce the total data volume or computation; it only changes how data is distributed, and if the job already has insufficient workers, more partitions can actually increase overhead without improving runtime.

Full explanation →
1406
MCQeasy

A data engineer runs the command shown to check the encryption configuration of an S3 bucket. The output shows SSEAlgorithm: AES256. What does this mean?

A.The bucket uses SSE-S3 with Amazon S3-managed keys
B.The bucket uses SSE-KMS with a customer-managed key
C.The bucket uses SSE-C with customer-provided keys
D.The bucket does not have encryption enabled
AnswerA

AES256 indicates SSE-S3.

Why this answer

AES256 refers to SSE-S3, where Amazon S3 manages the encryption keys using AES-256. Option B (SSE-KMS) would show 'aws:kms'. Option C (SSE-C) would require the customer to provide keys.

Option D (no encryption) is incorrect because encryption is enabled.

Full explanation →
1407
MCQmedium

A company is using Amazon Athena to query data in an S3 bucket. Queries are failing with the error 'HIVE_PATH_ALREADY_EXISTS'. The data is partitioned by year, month, day. What is the MOST likely cause?

A.A partition was manually added to the Glue Data Catalog that already exists
B.The data format in the partition is inconsistent with the table schema
C.The S3 location for the partition is empty
D.The IAM role used by Athena lacks s3:ListBucket permission on the bucket
AnswerA

Correct. The error indicates that the partition path is already registered in the Glue Data Catalog.

Why this answer

The error 'HIVE_PATH_ALREADY_EXISTS' occurs in Athena when attempting to add a partition (via ALTER TABLE ADD PARTITION or MSCK REPAIR TABLE) that already exists in the Glue Data Catalog. Option B (inconsistent data format) would cause schema mismatch errors like 'HIVE_PARTITION_SCHEMA_MISMATCH', not this error. Option C (empty S3 location) would not cause this error; queries might succeed but return no results.

Option D (lack of s3:ListBucket permission) would cause permission errors like 'Access Denied'.

Full explanation →
1408
MCQmedium

Refer to the exhibit. A data engineer queries AWS CloudTrail to investigate a PutObject event. What does the exhibit reveal about the object sensitive.csv?

A.The upload failed due to encryption mismatch.
B.The object was uploaded with server-side encryption using AWS KMS.
C.The object was not encrypted at rest.
D.The object was encrypted with SSE-S3.
AnswerB

x-amz-server-side-encryption: aws:kms indicates SSE-KMS.

Why this answer

The CloudTrail event contains `x-amz-server-side-encryption: aws:kms`, which confirms the object was uploaded with server-side encryption using AWS KMS (SSE-KMS). Option A is incorrect because the event shows a successful upload, not a failure. Option C is incorrect because the event indicates encryption was applied.

Option D is incorrect because SSE-S3 would show `AES256`, not `aws:kms`.

Full explanation →
1409
Multi-Selectmedium

A data engineer is migrating a large Oracle data warehouse to Amazon Redshift. The engineer needs to ensure optimal performance. Which TWO practices should the engineer follow?

Select 2 answers
A.Choose appropriate sort keys based on common query patterns.
B.Design the schema as a normalized star schema with row-based storage.
C.Manually define compression encodings for each column.
D.Stage data in Amazon S3 before loading into Redshift.
E.Use DISTKEY to distribute data evenly across nodes.
AnswersA, E

Sort keys reduce the amount of data scanned.

Why this answer

Amazon Redshift uses sort keys to physically order data on disk, which allows the query optimizer to skip large blocks of data during scans via zone maps. Choosing sort keys based on common query patterns (e.g., range filters or frequent GROUP BY columns) dramatically reduces I/O and improves query performance, especially for large tables.

Exam trap

The trap here is that candidates often confuse Redshift's columnar storage with row-based storage and assume a normalized star schema is optimal, when in fact Redshift is designed for denormalized, columnar tables with explicit sort and distribution keys.

Full explanation →
1410
MCQmedium

A data engineer is configuring an S3 bucket for storing sensitive customer data. The bucket must be encrypted at rest using an AWS Key Management Service (KMS) key that is managed by the data engineering team. The team wants to ensure that only users with explicit permission can decrypt the data. Which S3 encryption option should be used?

A.SSE-KMS
B.Client-side encryption
C.SSE-S3
D.SSE-C
AnswerA

SSE-KMS uses a customer-managed KMS key, allowing fine-grained access control.

Why this answer

SSE-KMS is the correct option because it uses a customer-managed AWS KMS key, allowing the data engineering team to control access and permissions for decryption. Client-side encryption is not an S3 server-side encryption option and does not use KMS. SSE-S3 uses Amazon S3-managed keys, which do not provide customer-controlled access.

SSE-C requires the customer to manage their own encryption keys and does not use KMS, nor does it allow the same level of access control as a CMK.

Full explanation →
1411
MCQeasy

A data engineer needs to ingest log files from multiple EC2 instances into Amazon S3. The logs are written to local disk on each instance. The engineer wants a simple agent-based solution that can collect, compress, and upload logs to S3 with minimal configuration. The solution must support incremental uploads (only new log lines) and handle log rotation. What should the engineer use?

A.Install and configure Amazon CloudWatch Agent to collect logs and send them to Amazon CloudWatch Logs, then use a subscription filter to export logs to S3.
B.Use AWS CLI cp command with --recursive in a cron job to copy logs to S3 every minute.
C.Install AWS DataSync agent on each EC2 instance to sync logs to S3 daily.
D.Use an S3 sync command from the AWS CLI scheduled every hour.
AnswerA

Kinesis Agent tails log files, compresses, and sends to CloudWatch Logs; export to S3 can be automated.

Why this answer

Amazon CloudWatch Agent is a lightweight agent that can tail log files, compress them on the fly, and send them to CloudWatch Logs. From CloudWatch Logs, a subscription filter can export the logs to Amazon S3, supporting incremental uploads and log rotation. Option B (AWS CLI cp) is manual and does not handle incremental uploads efficiently.

Option C (AWS DataSync) is designed for bulk data transfers, not real-time log ingestion. Option D (S3 sync) is also not real-time and lacks agent-based tailing and compression.

Full explanation →
1412
MCQmedium

A company uses Amazon Kinesis Data Streams to ingest clickstream data from web applications. The data is consumed by a Kinesis Data Analytics application that runs SQL queries. Recently, the data analytics application has been falling behind, and the 'MillisBehindLatest' metric for the consumer has been increasing steadily. The shard count is 4, and the average records per second per shard is 200, with an average record size of 1 KB. The provisioned shard limit for the account is 10. Which action will resolve the issue?

A.Enable enhanced fan-out on the Kinesis stream and subscribe the analytics application to it.
B.Reduce the checkpoint interval on the Kinesis Client Library (KCL) consumer to commit offsets more frequently.
C.Increase the number of shards in the Kinesis stream to 8.
D.Increase the provisioned write capacity of the Kinesis stream by requesting a shard limit increase.
AnswerC

More shards increase total read capacity, allowing the consumer to process data faster.

Why this answer

The consumer is falling behind due to insufficient read capacity. Increasing the number of shards increases the total read capacity and allows the consumer to keep up. Option A is wrong because the write capacity is not the issue; the consumer is behind.

Option B is wrong because switching to enhanced fan-out does not address the shard count limitation; it improves dedicated throughput per consumer but the total throughput is still limited by shard count. Option D is wrong because the consumer is already using KCL, and the issue is not related to checkpointing.

Full explanation →
1413
MCQmedium

A data engineer is designing a data lake on S3 with sensitive data. The security policy mandates that data must be encrypted at rest and in transit, and that an inventory of all objects must be maintained for compliance. Which actions should be taken?

A.Enforce HTTPS via bucket policy, enable default SSE-S3 encryption, and enable S3 Inventory.
B.Use SSE-KMS encryption and enable CloudTrail for S3 events.
C.Enable S3 default encryption using SSE-S3 and enable S3 Inventory.
D.Enforce HTTPS using bucket policy and enable S3 Server Access Logging.
AnswerA

Covers in-transit, at-rest encryption, and inventory.

Why this answer

It covers all requirements: encryption in transit (HTTPS enforcement via bucket policy), encryption at rest (default SSE-S3), and compliance inventory (S3 Inventory). Option B uses SSE-KMS which is not required and lacks inventory. Option C includes at-rest encryption and inventory but misses in-transit encryption.

Option D includes in-transit encryption but lacks at-rest encryption and compliance inventory.

Full explanation →
1414
MCQmedium

A company uses Amazon RDS for MySQL to store application data. The security team requires that all database credentials be rotated automatically every 90 days. The data engineer needs to implement a solution that minimizes operational overhead. The database credentials are stored in AWS Secrets Manager. The application retrieves the credentials at startup and caches them for the duration of the session. The application is deployed on Amazon ECS with Fargate. Which solution should the data engineer implement to meet the rotation requirement with minimal overhead?

A.Store the credentials in AWS Systems Manager Parameter Store and use a scheduled job to update the password.
B.Use Secrets Manager's automatic rotation feature with a custom Lambda function that updates the RDS password.
C.Create a scheduled Lambda function that updates the password in Secrets Manager and manually updates the application configuration.
D.Configure IAM database authentication for the RDS instance and update the application to use IAM credentials.
AnswerB

Secrets Manager can rotate secrets automatically with a Lambda.

Why this answer

Secrets Manager's automatic rotation feature, combined with a custom Lambda function to update the RDS password, provides a fully automated, low-overhead solution. Option A is incorrect because Parameter Store does not natively support automatic rotation and would require additional automation. Option C is incorrect because it involves manual steps to update the application configuration, increasing operational overhead.

Option D is incorrect because IAM database authentication does not rotate credentials automatically and would require significant application changes.

Full explanation →
1415
Multi-Selectmedium

Which THREE storage classes in Amazon S3 are designed for infrequently accessed data with millisecond retrieval times? (Select THREE.)

Select 3 answers
A.S3 Glacier Flexible Retrieval
B.S3 One Zone-IA
C.S3 Glacier Deep Archive
D.S3 Intelligent-Tiering
E.S3 Standard-IA
AnswersB, D, E

One Zone-IA also provides millisecond retrieval for infrequently accessed data.

Why this answer

S3 One Zone-IA is designed for infrequently accessed data that requires millisecond retrieval times, but does not require the resilience of multiple Availability Zones. It stores data in a single AZ and offers the same low-latency performance as S3 Standard, making it suitable for non-critical, infrequently accessed data.

Exam trap

The trap here is that candidates often confuse S3 Glacier Flexible Retrieval or S3 Glacier Deep Archive as having millisecond retrieval times, but these classes are designed for archival access with retrieval times measured in minutes or hours, not milliseconds.

Full explanation →
1416
MCQmedium

A company is using Amazon RDS for MySQL with Multi-AZ deployment. The primary DB instance experiences a hardware failure, causing automatic failover to the standby. After the failover, the application reports that the database endpoint is unreachable for about 60 seconds. What is the MOST likely cause?

A.The standby instance took longer than expected to promote to primary.
B.The standby instance was not in a synchronized state and required a manual promotion.
C.The application was using the wrong endpoint and needed to be reconfigured.
D.The DNS record for the DB instance endpoint needed to update to point to the new primary.
AnswerD

DNS propagation causes the 60-second delay.

Why this answer

After an automatic failover in Amazon RDS Multi-AZ, the DNS record for the DB instance endpoint is updated to point to the new primary. This DNS change can take up to 60 seconds to propagate, during which the application may receive 'unreachable' errors if it caches the old DNS resolution. The 60-second outage aligns with the typical TTL (Time To Live) of 30 seconds for RDS DNS records plus propagation delays.

Exam trap

The trap here is that candidates assume the standby promotion itself causes the delay, but AWS specifically designs the promotion to be fast, and the real bottleneck is DNS propagation and client caching.

How to eliminate wrong answers

Option A is wrong because the standby promotion itself is nearly instantaneous in RDS Multi-AZ; the delay is not due to promotion time but DNS propagation. Option B is wrong because RDS Multi-AZ automatically synchronizes the standby synchronously, and no manual promotion is required—the failover is fully automated. Option C is wrong because the application uses the same RDS endpoint (CNAME) before and after failover; no reconfiguration is needed.

Full explanation →
1417
MCQhard

A company uses Amazon Kinesis Data Firehose to deliver data to Amazon S3. The Firehose delivery stream has a buffer size of 64 MB and a buffer interval of 300 seconds. The data volume is 1 GB per minute, and the average record size is 1 KB. The data must be delivered to S3 within 5 minutes of ingestion. The engineer notices that some files are being delivered after 10 minutes. What is the most likely cause?

A.The buffer size of 64 MB is too small for the data volume
B.The data is not compressed, causing larger file sizes
C.The buffer interval of 300 seconds is too long
D.The S3 bucket is throttling PUT requests due to high throughput
AnswerD

High PUT request rates can cause throttling, leading to retries and increased delivery time.

Why this answer

Amazon S3 buckets have a default limit of 3,500 PUT requests per second per prefix. With a data volume of 1 GB per minute and an average record size of 1 KB, Firehose generates approximately 1,000,000 records per minute, resulting in roughly 16,667 PUT requests per second (since each 64 MB buffer yields about 65,536 records, and 1 GB/min ÷ 64 MB = ~15.6 buffers per minute, each requiring a PUT). This far exceeds the S3 PUT request limit, causing throttling (HTTP 503 Slow Down errors) and delivery delays beyond the 5-minute target.

Exam trap

The trap here is that candidates often focus on buffer size or interval settings, overlooking the S3 PUT request rate limit, which is a common cause of delivery delays in high-throughput Firehose-to-S3 pipelines.

How to eliminate wrong answers

Option A is wrong because a 64 MB buffer size is actually appropriate for this data volume; increasing it would reduce the number of PUT requests but the core issue is S3 throttling, not buffer size. Option B is wrong because compression reduces file size and thus the number of PUT requests, but the problem is caused by excessive PUT request rate, not file size; compression would help but its absence is not the root cause. Option C is wrong because a 300-second buffer interval is within the 5-minute delivery requirement; the delay occurs due to S3 throttling, not because the interval is too long.

Full explanation →
1418
MCQeasy

A company needs to ingest data from multiple SaaS applications (Salesforce, Marketo) and load it into Amazon Redshift. The data must be transformed before loading. Which AWS service should be used to build the ingestion pipelines?

A.AWS Database Migration Service (DMS)
B.AWS Data Pipeline
C.Amazon AppFlow
D.AWS Glue (crawlers and ETL jobs)
AnswerD

AWS Glue can connect to SaaS sources via JDBC and perform complex transformations.

Why this answer

AWS Glue is the correct choice because it provides a fully managed ETL service that can connect to various data sources (including SaaS applications via JDBC or custom connectors), transform the data using Apache Spark or Python scripts, and load it into Amazon Redshift. Glue crawlers can catalog the source schemas, and Glue ETL jobs handle the transformation logic required before loading into Redshift, making it ideal for building ingestion pipelines from multiple SaaS sources.

Exam trap

The trap here is that candidates often confuse Amazon AppFlow's simplicity for ETL capability, but AppFlow lacks the advanced transformation and orchestration features needed for complex data pipelines, making Glue the correct choice despite AppFlow's direct Redshift integration.

How to eliminate wrong answers

Option A is wrong because AWS DMS is designed for database migration and continuous replication between databases, not for ingesting data from SaaS applications like Salesforce or Marketo, and it lacks built-in transformation capabilities beyond basic data type conversions. Option B is wrong because AWS Data Pipeline is a legacy orchestration service that requires managing EC2 instances and has limited native support for SaaS sources; it is less flexible and more complex than Glue for ETL workloads. Option C is wrong because Amazon AppFlow is optimized for simple, no-code data transfers between SaaS applications and AWS services (like S3 or Redshift) but does not support complex transformations or custom ETL logic, which is required in this scenario.

Full explanation →
1419
MCQeasy

A data engineer needs to ingest streaming data from an IoT fleet into Amazon S3 for near-real-time analytics. The data volume is approximately 5 GB per hour, and each event is less than 1 KB. Which AWS service should be used as the ingestion endpoint?

A.AWS IoT Core
B.AWS DataSync
C.Amazon AppFlow
D.Amazon Kinesis Data Streams
AnswerA

Designed for IoT device ingestion.

Why this answer

AWS IoT Core is purpose-built for ingesting data from IoT devices, supporting MQTT, HTTP, and WebSocket protocols. It can handle millions of devices and high-throughput, small-message payloads (each event <1 KB) and integrates directly with Amazon S3 via IoT Core rules, making it the ideal ingestion endpoint for near-real-time analytics on streaming IoT data.

Exam trap

The trap here is that candidates often default to Amazon Kinesis Data Streams for any streaming workload, overlooking that AWS IoT Core is the specialized, fully managed service designed specifically for IoT device ingestion, with native MQTT support and direct S3 integration via rules.

How to eliminate wrong answers

Option B (AWS DataSync) is wrong because it is designed for one-time or scheduled bulk data transfers between on-premises storage and AWS, not for continuous, near-real-time streaming ingestion from IoT devices. Option C (Amazon AppFlow) is wrong because it is a fully managed integration service for transferring data between SaaS applications (e.g., Salesforce, Slack) and AWS, not for ingesting IoT device telemetry streams. Option D (Amazon Kinesis Data Streams) is wrong because while it can ingest streaming data, it is a generic stream processing service that requires additional configuration (e.g., Kinesis Data Firehose) to write to S3, and it is not the dedicated IoT ingestion endpoint; AWS IoT Core is the recommended first-hop for IoT data.

Full explanation →
1420
MCQhard

A data engineer is designing a data lake on Amazon S3. The data is ingested from multiple sources and stored in a partitioned structure under the 'landing' prefix. The engineer needs to ensure that only authorized applications can write to the 'landing' zone, while all AWS accounts in the organization can read the data. Which combination of S3 bucket policies and IAM policies should be used?

A.Use bucket ACLs to grant write access to the authorized IAM roles and read access to all authenticated users.
B.Use S3 Object Ownership to enforce bucket owner enforced. Grant write access via IAM roles.
C.Create a bucket policy with a Deny for all principals except the authorized IAM roles on the 'landing' prefix. Add a separate statement allowing read access to the organization.
D.Create an IAM policy that allows s3:PutObject only for the 'landing' prefix and attach it to the authorized roles. Allow read access via an S3 Access Point.
AnswerC

This explicitly restricts write access while allowing reads.

Why this answer

It uses a bucket policy with an explicit Deny on the 'landing' prefix for all principals except the authorized IAM roles, ensuring only those roles can write. A separate Allow statement grants read access to the entire organization (e.g., via the `aws:PrincipalOrgID` condition key), which satisfies the requirement that all AWS accounts in the organization can read the data. This approach leverages S3 bucket policies for cross-account access control without relying on ACLs or IAM policies alone.

Exam trap

The trap here is that candidates often confuse IAM policies (which are identity-based and only apply within the same account) with resource-based policies (like S3 bucket policies) that are required for cross-account access, leading them to choose Option D or A without realizing the need for an explicit Deny or organization-wide condition key.

How to eliminate wrong answers

Option A is wrong because bucket ACLs do not support condition keys like `aws:PrincipalOrgID` and cannot restrict write access to specific IAM roles across accounts; they also grant read access to 'all authenticated users' (a deprecated concept that includes any authenticated AWS user, not just the organization). Option B is wrong because S3 Object Ownership with 'bucket owner enforced' only ensures the bucket owner retains object ownership, but does not by itself restrict write access to authorized roles or grant read access to the organization; it must be combined with a bucket policy. Option D is wrong because an IAM policy attached to roles only controls permissions within the same account and cannot grant cross-account read access to the entire organization; an S3 Access Point can simplify access but does not inherently allow all organization accounts to read without additional bucket policies or resource-based policies.

Full explanation →
1421
Multi-Selectmedium

A data engineer is designing a data ingestion pipeline for clickstream data. The data arrives in batches of 10-50 MB every 5 seconds. The engineer needs to buffer the data, perform simple transformations (e.g., add timestamp, remove PII), and land it in S3 within 10 minutes. Which TWO services should be combined? (Choose TWO.)

Select 2 answers
A.Amazon Simple Queue Service (SQS)
B.Amazon Kinesis Data Firehose
C.AWS Lambda
D.AWS Glue ETL
E.Amazon Kinesis Data Streams
AnswersB, C

Firehose can buffer and invoke Lambda for transformation, then deliver to S3.

Why this answer

Amazon Kinesis Data Firehose is the correct choice because it is a fully managed service designed to ingest streaming data, buffer it, perform simple transformations (such as adding timestamps or removing PII) via built-in Lambda functions, and automatically deliver the data to S3. It can handle the 10-50 MB batches every 5 seconds and meet the 10-minute delivery window without requiring custom code for buffering or delivery.

Exam trap

The DEA-C01 exam often tests the distinction between Kinesis Data Streams (raw streaming, custom consumers) and Kinesis Data Firehose (managed ingestion with built-in transformation and delivery), leading candidates to mistakenly choose Data Streams when Firehose is the simpler, correct choice for this pipeline.

Full explanation →
1422
MCQmedium

A data engineer runs the command shown. The consumer application is unable to read data older than 24 hours. What is the most likely cause?

A.The shard has reached its maximum sequence number.
B.The stream is encrypted with KMS, preventing access.
C.The retention period is set to 24 hours, so data older than 24 hours is deleted.
D.The stream is in ACTIVE status but not processing data.
AnswerC

Data retention is 24 hours; data beyond that is expired.

Why this answer

The stream's retention period is 24 hours, meaning data is automatically deleted after 24 hours. The consumer tries to read data older than 24 hours, which is no longer available.

Full explanation →
1423
MCQeasy

A company has an S3 bucket that stores logs for compliance. The compliance team requires that objects are retained for 7 years and cannot be deleted or overwritten. Which S3 feature should be used?

A.Enable S3 Object Lock with retention mode COMPLIANCE and a retention period of 7 years
B.Enable MFA Delete on the bucket
C.Configure an S3 bucket policy that denies delete and overwrite actions
D.Enable S3 Versioning and configure a lifecycle policy to expire objects after 7 years
AnswerA

Object Lock with COMPLIANCE mode ensures objects cannot be deleted or overwritten for the retention period.

Why this answer

S3 Object Lock with retention mode COMPLIANCE prevents objects from being deleted or overwritten for the specified retention period. Versioning alone does not prevent deletion. MFA Delete prevents accidental deletion but not overwrite.

Lifecycle policies can expire objects but do not prevent deletion.

Full explanation →
1424
MCQeasy

A data engineer needs to store large amounts of data that is accessed infrequently but must be retrieved immediately when needed. Which Amazon S3 storage class is most cost-effective?

A.S3 Intelligent-Tiering
B.S3 One Zone-IA
C.S3 Standard-IA
D.S3 Glacier Deep Archive
AnswerC

S3 Standard-IA is designed for infrequent access with millisecond retrieval.

Why this answer

S3 Standard-IA (Infrequent Access) is the most cost-effective choice because it offers low per-GB storage costs for data accessed infrequently, while still providing millisecond retrieval latency for immediate access when needed. This matches the requirement of storing large amounts of data that is rarely accessed but must be available instantly.

Exam trap

The DEA-C01 exam often tests the misconception that S3 One Zone-IA is a cheaper alternative for infrequent access, but the trap is that it sacrifices durability by storing data in a single Availability Zone, which is not suitable for data that must be reliably retrieved immediately.

How to eliminate wrong answers

Option A is wrong because S3 Intelligent-Tiering automatically moves data between access tiers based on usage patterns, but it incurs a monthly monitoring and automation fee per object, making it less cost-effective for purely infrequent access patterns with no variable usage. Option B is wrong because S3 One Zone-IA stores data in a single Availability Zone, which risks data loss if that AZ fails, and it does not meet the implied durability requirement for data that must be retrievable immediately. Option D is wrong because S3 Glacier Deep Archive is designed for archival data with retrieval times of 12 to 48 hours, not immediate retrieval, and thus fails the 'retrieved immediately' requirement.

Full explanation →
1425
MCQmedium

Refer to the exhibit. A data engineer is troubleshooting a Glue job that reads objects from this S3 bucket. The job runs successfully but produces no output. The Glue catalog table points to the same S3 path. What is the most likely cause?

A.The S3 key does not follow Hive-style partitioning (e.g., year=2024/month=01).
B.The object metadata is too large.
C.The StorageClass is not supported by Glue.
D.The ContentType is not supported by Glue.
AnswerA

AWS Glue Data Catalog relies on Hive-style partitioning (e.g., year=2024/month=01) to automatically discover and register partitions. Partition projection is a separate Athena feature, not a Glue feature.

Why this answer

AWS Glue Data Catalog relies on Hive-style partitioning (e.g., year=2024/month=01) to automatically discover and register partitions. The S3 key in the exhibit does not follow this pattern, so Glue cannot identify the partitions, resulting in no data being read even though the job runs. Option B is incorrect because object metadata size does not affect Glue's ability to read data.

Option C is incorrect because the STANDARD storage class is fully supported by Glue. Option D is incorrect because ContentType is not a factor in Glue catalog table definitions.

Full explanation →
Page 18

Page 19 of 23

Page 20

All pages

1234567891011121314151617181920212223

Practice DEA-C01 by domain

Target a specific domain to shore up weak areas.

Data Ingestion and TransformationData Operations and SupportData Security and GovernanceData Store Management
See all domains with question counts →