Courseiva

AWS Certified Data Engineer Associate DEA-C01 (DEA-C01) — Questions 76–150

1711 questions total · 23pages · All types, answers revealed

Take a mock examExam hub
Page 1

Page 2 of 23

Page 3
76
MCQhard

A data engineer is troubleshooting an Amazon Redshift cluster that is not allowing connections from a specific IP range. The engineer verified that the cluster's security group allows inbound traffic from the IP range. What is the next step to resolve the issue?

A.Modify the Redshift cluster parameter group to enable public accessibility.
B.Verify that the cluster's security group is attached to the Redshift cluster.
C.Check the IAM role associated with the Redshift cluster.
D.Check the network ACL (NACL) associated with the Redshift cluster's subnet.
AnswerD

Network ACLs operate at the subnet level and can block inbound traffic even if security groups allow it, making this the correct next step.

Why this answer

Even if the security group allows inbound traffic from a specific IP range, the network ACL (NACL) associated with the Redshift cluster's subnet can block traffic at the subnet level. NACLs are stateless and can override security group rules. Option A is incorrect because modifying the cluster parameter group does not control network-level access; public accessibility is a separate setting.

Option B is incorrect because the engineer already verified the security group, but even if it is correctly attached, the NACL could still block traffic. Option C is incorrect because IAM roles control authentication and authorization, not network connectivity.

Full explanation →
77
Multi-Selectmedium

A company uses Amazon Redshift to store customer data. The security team requires that all queries are logged for auditing purposes. Which step should be taken to meet this requirement? (Select ONE.)

Select 1 answer
A.Enable AWS CloudTrail database audit logging.
B.Use AWS CloudTrail to log Redshift API calls.
C.Enable logging on the Redshift security group.
D.Enable VPC Flow Logs for the Redshift cluster.
E.Enable Amazon Redshift audit logging to an S3 bucket.
AnswersE

Amazon Redshift supports native audit logging that captures query logs, connection logs, and user activity logs, which can be exported to an S3 bucket. This directly meets the requirement.

Why this answer

The requirement is to log all queries for auditing. Amazon Redshift's native audit logging captures connection logs, user activity logs, and query logs, and can be exported to an S3 bucket. This is the only step that directly logs SQL queries.

AWS CloudTrail does not log SQL queries; it logs management API calls (e.g., CreateCluster, ModifyCluster). Therefore, only Option E meets the requirement.

Exam trap

The trap is that many candidates assume AWS CloudTrail can log SQL queries, but it only logs API calls. The correct answer is solely Amazon Redshift's native audit logging.

Full explanation →
78
MCQmedium

A data engineer is responsible for a real-time data pipeline that ingests clickstream data from a website into Amazon Kinesis Data Streams, then processed by an AWS Lambda function that writes to an Amazon DynamoDB table for user session tracking. The Lambda function is idempotent and uses the DynamoDB PutItem API with a condition expression to avoid overwriting existing records. Over the past week, the engineer has observed an increase in DynamoDB write throttling (ProvisionedThroughputExceededException) during peak traffic hours. The DynamoDB table has on-demand capacity. The engineer checks the Lambda function's reserved concurrency and finds it set to 1000. The Kinesis stream has 10 shards. The Lambda function's batch size is set to 100. The engineer suspects that the retry behavior is causing duplicate writes and throttling. Which change should the engineer make to reduce throttling?

A.Increase the number of Kinesis shards to 20 to distribute the load.
B.Decrease the Lambda batch size to 10 to reduce the number of records processed per invocation.
C.Decrease the Lambda reserved concurrency to 500 to limit the number of concurrent invocations.
D.Use a DynamoDB Stream to trigger a second Lambda function that writes to the table.
AnswerB

Smaller batches reduce the number of concurrent writes to DynamoDB, lowering throttling.

Why this answer

On-demand DynamoDB can scale, but it has a per-partition throughput limit. Reducing the Lambda batch size reduces the number of concurrent writes per shard, decreasing the chance of hitting partition limits. Option A is wrong because increasing shards would increase concurrency, worsening throttling.

Option C is wrong because decreasing reserved concurrency could cause Lambda throttling but not DynamoDB throttling. Option D is wrong because using a DynamoDB stream adds complexity and does not directly reduce write throttling.

Full explanation →
79
MCQhard

A company uses Amazon DynamoDB as the primary data store for a gaming application. The application experiences sudden spikes in traffic. The data engineer notices that write requests are throttled during peak times. The partition keys are well-distributed. What should the data engineer do to reduce throttling?

A.Use DynamoDB global tables to distribute writes across regions.
B.Configure DynamoDB auto scaling to adjust write capacity automatically.
C.Increase the number of partition keys to improve write distribution.
D.Enable DynamoDB Accelerator (DAX) to cache write operations.
AnswerB

Auto scaling increases write capacity during spikes, reducing throttling.

Why this answer

DynamoDB auto scaling allows the table to automatically adjust its provisioned write capacity based on actual traffic patterns, preventing throttling during sudden spikes without manual intervention. Since the partition keys are already well-distributed, throttling is likely due to insufficient write capacity units, which auto scaling can dynamically increase.

Exam trap

The trap here is that candidates may confuse throttling due to hot partitions (uneven key distribution) with throttling due to insufficient overall capacity, leading them to incorrectly choose option C even when the question explicitly states partition keys are well-distributed.

How to eliminate wrong answers

Option A is wrong because DynamoDB global tables replicate data across regions for disaster recovery and low-latency reads, but they do not increase write capacity within a single region; writes are still subject to the same per-table capacity limits. Option C is wrong because the partition keys are already well-distributed, so adding more partition keys would not resolve throttling caused by insufficient provisioned write capacity; throttling occurs when write requests exceed the table's write capacity units, not due to partition key distribution. Option D is wrong because DynamoDB Accelerator (DAX) is an in-memory cache for read operations only, not writes; it cannot reduce write throttling.

Full explanation →
80
Multi-Selectmedium

A company uses Amazon DynamoDB as the primary data store for a web application. The application experiences high read latency. Which TWO actions can improve read performance?

Select 2 answers
A.Add a Global Secondary Index (GSI)
B.Enable DynamoDB Global Tables
C.Enable DynamoDB Accelerator (DAX)
D.Enable DynamoDB Streams
E.Increase the write capacity units
AnswersB, C

Global Tables allow reads from local regions, reducing latency.

Why this answer

(Enable DynamoDB Global Tables) is correct because Global Tables provide local read replicas in multiple AWS Regions, reducing read latency for users accessing from different geographic locations. Option C (Enable DynamoDB Accelerator (DAX)) is correct because DAX is an in-memory cache that significantly reduces read latency for frequently accessed items. Option A is incorrect because adding a Global Secondary Index (GSI) improves query flexibility but does not directly reduce read latency for primary key lookups.

Option D is incorrect because DynamoDB Streams capture changes to the table for event-driven processing, not for reducing read latency. Option E is incorrect because increasing write capacity units only affects write throughput, not read performance.

Full explanation →
81
MCQmedium

A company uses Amazon S3 to store raw data and AWS Glue to run ETL jobs that transform the data into analytics-ready tables. The Glue job reads from a source with a schema that changes frequently (new columns added). The engineer wants the Glue job to automatically adapt to schema changes without manual intervention. Which configuration should the engineer use?

A.Schedule a Glue crawler to run after each ETL job to update the Data Catalog.
B.Set the job to use schema-on-read by storing data in Parquet format.
C.Enable the 'Update schema' option in the Glue job's output target configuration.
D.Use Glue's partition indexes to automatically detect new columns.
AnswerC

This option automatically adds new columns to the target table.

Why this answer

Enabling the 'Update schema' option in the Glue job's output target configuration allows the job to automatically add new columns to the target table in the Data Catalog when the source schema changes. This setting directly addresses the requirement for automatic adaptation to schema changes without manual intervention, as it updates the table definition during the ETL job run.

Exam trap

The trap here is that candidates often confuse schema-on-read (Parquet's flexibility) with automatic schema evolution in the Data Catalog, leading them to choose Option B, but schema-on-read does not update the target table's metadata, which is required for downstream analytics tools to query the new columns.

How to eliminate wrong answers

Option A is wrong because scheduling a Glue crawler after each ETL job updates the Data Catalog based on the output data, but it does not automatically adapt the ETL job's transformation logic to new columns; it only updates metadata post-hoc, and the job itself would still need manual changes to process new columns. Option B is wrong because schema-on-read with Parquet allows flexible reading of data with varying schemas, but it does not automatically update the Data Catalog or the target table schema; the Glue job would still need explicit handling to write new columns to the target. Option D is wrong because partition indexes are used to optimize query performance on partitioned data, not to detect or adapt to schema changes; they have no mechanism for automatic column detection.

Full explanation →
82
MCQmedium

A company uses AWS Lake Formation to manage data lake permissions. A data analyst cannot query a table in Athena, although the table appears in the catalog. The analyst has IAM permissions to run Athena. What is the MOST likely cause?

A.The Glue Data Catalog does not have the table registered.
B.The S3 bucket policy denies access to the analyst's IAM role.
C.The analyst lacks Lake Formation permissions on the table.
D.The Athena workgroup is not configured with the correct output location.
AnswerC

Lake Formation grants fine-grained permissions; the analyst needs SELECT.

Why this answer

Lake Formation permissions are separate from IAM; even if the analyst has IAM permissions to run Athena, they also need specific Lake Formation permissions (e.g., SELECT) on the table to query it. The table appears in the catalog because the analyst has DESCRIBE permission on the database or table, but querying requires additional data access permissions. Option A is incorrect because the table appears in the catalog, so it is registered.

Option B is incorrect because the S3 bucket policy might allow access, but Lake Formation can override it. Option D is incorrect because the workgroup output location affects where query results are stored, not the ability to query a specific table.

Full explanation →
83
MCQmedium

A company runs a data pipeline that uses AWS Glue to process data from an Amazon DynamoDB table and write results to Amazon S3. The Glue job runs on a schedule every hour. Recently, the job started failing intermittently with 'ProvisionedThroughputExceededException' errors from DynamoDB. What is the BEST solution?

A.Use DynamoDB Accelerator (DAX) to reduce read latency.
B.Change the Glue job schedule to run every 2 hours.
C.Implement exponential backoff and retries in the Glue job for DynamoDB operations.
D.Increase the read capacity units of the DynamoDB table.
AnswerC

Exponential backoff handles throttling gracefully.

Why this answer

Implementing exponential backoff and retries in the Glue job is a best practice to handle transient throttling errors from DynamoDB such as ProvisionedThroughputExceededException. This approach allows the job to automatically retry failed operations with increasing delays, reducing the likelihood of sustained failures without requiring changes to the DynamoDB table's provisioned capacity. Option A is incorrect because DynamoDB Accelerator (DAX) is an in-memory cache that can reduce read traffic for cached items, but it does not guarantee elimination of ProvisionedThroughputExceeded exceptions, especially for read operations that are not cached or when the underlying issue is read throughput limits.

Option B is incorrect because running the job less frequently does not address the intermittent throttling; the job may still encounter the same error when it runs. Option D is incorrect because, although increasing read capacity units could directly address read throttling, it is not the most cost-effective or best practice for dealing with occasional throttling. The recommended approach is to first implement exponential backoff and retries, only increasing provisioned capacity if throttling persists.

Moreover, the ProvisionedThroughputExceededException in this scenario is due to read throughput limits, and increasing write capacity would not help.

Full explanation →
84
Multi-Selectmedium

A company is designing a data lake on Amazon S3. The security policy requires that all data be encrypted at rest using AWS KMS with automatic key rotation. Which encryption option meets these requirements? (Select THREE.)

Select 3 answers
A.Enable automatic key rotation on the KMS key.
B.Use SSE-KMS with an AWS managed key.
C.Set the default encryption on the S3 bucket to SSE-KMS with the CMK.
D.Use SSE-KMS with a customer-managed key (CMK).
E.Use SSE-C with a customer-provided key.
AnswersA, C, D

This is a requirement.

Why this answer

AWS KMS customer-managed keys (CMKs) support automatic key rotation, which can be enabled to rotate the key material annually. This satisfies the security policy requirement for automatic key rotation. SSE-KMS with a CMK (Option D) is also required because AWS managed keys (Option B) do not support automatic key rotation, and SSE-C (Option E) does not use KMS at all.

Setting default encryption on the S3 bucket to SSE-KMS with the CMK (Option C) ensures all objects are encrypted with that key, meeting the encryption-at-rest requirement.

Exam trap

The trap here is that candidates often assume AWS managed keys (aws/s3) support automatic key rotation, but they do not; only customer-managed CMKs allow you to enable automatic rotation, and the question requires selecting three correct options that together meet both the KMS and automatic rotation requirements.

Full explanation →
85
MCQmedium

A company uses Amazon DynamoDB as a source for an AWS Glue job. The job reads a large table using a DynamoDB export to S3 feature. The job is failing with 'ThrottlingException' from DynamoDB. What should the data engineer do to resolve this issue WITHOUT changing the job's logic?

A.Use DynamoDB Streams to capture changes and process them incrementally
B.Reduce the number of DynamoDB read segments in the Glue job
C.Use the DynamoDB export to S3 feature and read the exported data from S3
D.Increase the read capacity units (RCU) of the DynamoDB table
AnswerC

Export to S3 reads from the table without consuming RCU, avoiding throttling entirely.

Why this answer

The DynamoDB export to S3 feature creates a point-in-time snapshot of the table data in S3 without consuming any read capacity units (RCUs) from the DynamoDB table. By reading the exported data from S3 instead of directly scanning the DynamoDB table, the Glue job avoids triggering ThrottlingException entirely, as the export operation uses the table's backup and restore mechanism, not the read path. This resolves the issue without altering the job's logic, as the job can be reconfigured to read from the S3 export location.

Exam trap

The trap here is that candidates often assume the only way to resolve DynamoDB throttling is to increase RCUs (Option D) or reduce parallelism (Option B), missing the fact that the export-to-S3 feature completely eliminates the need to read from DynamoDB during the Glue job, which is the most efficient and cost-effective solution without altering job logic.

How to eliminate wrong answers

Option A is wrong because using DynamoDB Streams to capture changes and process them incrementally changes the job's logic from a full scan to a streaming/incremental approach, which violates the requirement to not change the job's logic; additionally, streams consume read capacity and could still cause throttling if not properly managed. Option B is wrong because reducing the number of DynamoDB read segments in the Glue job would decrease parallelism and potentially reduce the throttling, but it does not eliminate the root cause—the job still reads directly from DynamoDB, consuming RCUs and risking ThrottlingException; it also changes the job's configuration, which may alter performance. Option D is wrong because increasing the read capacity units (RCU) of the DynamoDB table addresses throttling by raising the throughput limit, but it incurs additional cost and does not leverage the export-to-S3 feature; it also changes the table's provisioned capacity, which is a modification outside the job's logic but still a change to the infrastructure, and the question asks to resolve the issue without changing the job's logic, which increasing RCU does not technically violate, but it is not the best practice and does not avoid the underlying scan overhead.

Full explanation →
86
Multi-Selectmedium

A data engineer is designing a data lake on Amazon S3 that will be used for both batch processing with Amazon EMR and interactive queries with Amazon Athena. The data includes sensitive personally identifiable information (PII) that must be encrypted at rest. The company requires that the encryption keys be managed by the company and rotated every 90 days. Which TWO options should the engineer implement to meet these requirements? (Choose TWO.)

Select 2 answers
A.Use customer-provided keys (SSE-C) and store the keys in AWS Secrets Manager.
B.Configure a bucket policy to deny uploads that are not encrypted.
C.Enable S3 default encryption using SSE-KMS with the customer managed key.
D.Use AWS Key Management Service (KMS) to create a customer managed key with automatic yearly rotation.
E.Use S3 managed keys (SSE-S3) for server-side encryption.
AnswersC, D

It enables S3 default encryption using SSE-KMS with a customer managed key, ensuring all objects are encrypted at rest with keys managed by the company.

Why this answer

The correct answers are C and D. Option C enables S3 default encryption using SSE-KMS with a customer managed key, ensuring all objects are encrypted at rest with keys managed by the company. Option D creates a customer managed key in AWS KMS with automatic yearly rotation, which satisfies the requirement for key rotation; the company can also perform manual rotations every 90 days if needed.

Option A is incorrect because SSE-C requires the customer to manage the keys themselves, including storing them in Secrets Manager, and does not provide automatic rotation. Option B is incorrect because a bucket policy can enforce encryption but does not manage keys. Option E is incorrect because SSE-S3 uses Amazon-managed keys, not customer-managed keys.

Full explanation →
87
Multi-Selectmedium

A data engineer is designing a streaming pipeline using Amazon Kinesis Data Streams. The data must be transformed in real-time and then stored in Amazon S3 for long-term retention. Which THREE services can be used together to achieve this?

Select 3 answers
A.Amazon Kinesis Data Analytics
B.Amazon Kinesis Data Firehose
C.AWS Glue
D.Amazon Athena
E.Amazon Kinesis Data Streams
AnswersA, B, E

Performs real-time transformations.

Why this answer

Options A, B, and E are correct: Kinesis Data Streams ingests data, Kinesis Data Analytics performs real-time transformations, and Kinesis Data Firehose delivers the transformed data to S3. Option C (AWS Glue) is a batch ETL service, not suitable for real-time streaming. Option D (Amazon Athena) is a query service, not for data ingestion or transformation in a streaming pipeline.

Full explanation →
88
MCQhard

A company is using Amazon MSK (Managed Streaming for Apache Kafka) to ingest real-time data. They need to transform the data using custom Java code before writing to Amazon S3. The transformation must be fault-tolerant and exactly-once semantics are required. Which AWS service should be used?

A.Amazon EMR with Spark Streaming
B.AWS Lambda consumer for MSK
C.Kafka Connect with S3 Sink Connector
D.Kinesis Data Analytics for Apache Flink
AnswerC

Supports exactly-once and custom transformations.

Why this answer

Kafka Connect with S3 Sink Connector supports exactly-once semantics and custom transformations via Single Message Transforms (SMTs) or custom connectors. Option A (Amazon EMR with Spark Streaming) is for batch processing, not real-time exactly-once from MSK. Option B (AWS Lambda) does not provide exactly-once semantics from MSK.

Option D (Kinesis Data Analytics for Apache Flink) is for Flink, not Kafka.

Full explanation →
89
MCQmedium

Refer to the exhibit. A data engineer is troubleshooting an AWS Lambda function that processes data from Amazon S3. The function is triggered by S3 events, but no logs appear in CloudWatch Logs. The engineer runs the AWS CLI command shown. What is the MOST likely reason for the missing logs?

A.The Lambda execution role does not have permissions to create log groups and write logs.
B.The Lambda function is configured to log to a different log group.
C.The Lambda function is not being invoked by S3 events.
D.The log retention policy is set to 7 days, causing logs to expire immediately.
AnswerA

Missing logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents.

Why this answer

The CLI command output shows the log group exists but `storedBytes: 0`, meaning no logs have been written. The most common cause is that the Lambda execution role lacks the required permissions (`logs:CreateLogStream`, `logs:PutLogEvents`). Option B is incorrect because even if the function logged to a different group, logs for this group would still be written if permissions allowed.

Option C is incorrect because the function could be invoked but unable to write logs. Option D is incorrect because a retention policy does not prevent logs from being written; it only determines how long they are kept.

Full explanation →
90
MCQmedium

A company uses AWS KMS to encrypt sensitive data in S3. The security team requires that the KMS key must be rotated automatically every year. Which key type should be used?

A.Asymmetric customer managed key
B.AWS managed key (aws/s3)
C.Custom key store backed by CloudHSM
D.Customer managed key with automatic rotation enabled
AnswerD

Customer managed keys can have automatic rotation enabled with a yearly frequency, which aligns with the requirement.

Why this answer

Customer managed keys can be configured with automatic rotation every year, meeting the security team's requirement. Option B is incorrect because AWS managed keys (aws/s3) rotate automatically every 3 years, not annually. Option A is incorrect because asymmetric keys do not support automatic rotation.

Option C is incorrect because custom key stores backed by CloudHSM do not offer automatic rotation.

Full explanation →
91
MCQmedium

A data pipeline uses AWS Glue to process data from Amazon S3. The job fails with an 'OutOfMemoryError' during the transformation phase. Which action should the data engineer take to resolve this issue?

A.Enable S3 server-side encryption.
B.Increase the number of partitions in the input data.
C.Change the data format from CSV to Parquet.
D.Increase the number of DPUs (Data Processing Units) for the Glue job.
AnswerD

More DPUs provide additional memory and compute resources to handle large transformations.

Why this answer

The OutOfMemoryError occurs because the Glue job does not have enough memory allocated. Increasing the number of DPUs (Data Processing Units) increases both memory and processing capacity, directly resolving the issue. Option A (S3 server-side encryption) affects data security, not memory.

Option B (increasing data partitions) may help parallelism but does not directly increase memory per executor. Option C (changing to Parquet) can reduce data volume but does not guarantee sufficient memory for transformation.

Full explanation →
92
MCQhard

A data engineer is designing a data pipeline that uses AWS Glue to process data from an RDS MySQL database. The pipeline must capture only incremental changes (inserts and updates) and run every hour. Which approach is most cost-effective and reliable?

A.Use Glue job bookmarks to track and process only new and updated records
B.Use AWS DMS with change data capture (CDC) to replicate changes to S3
C.Add a timestamp column and query rows where timestamp > last run
D.Perform a full table scan each hour and compare with previous snapshot
AnswerA

Bookmarks efficiently handle incremental loads.

Why this answer

AWS Glue job bookmarks track processed data and enable incremental processing by automatically storing state information about previously processed data, so only new and updated records are processed in subsequent runs. This approach is cost-effective because it avoids full table scans and reduces data processing. Option B is not optimal because AWS DMS with CDC adds extra cost and operational overhead for a simple hourly incremental load, and it is not directly integrated with Glue.

Option C can work but is less reliable if timestamps are not updated on changes or if there are late-arriving records, and it may require additional indexing. Option D is inefficient because full table scans each hour are costly and slow, especially for large tables.

Full explanation →
93
MCQeasy

A data engineer ran the above CLI command to describe an Amazon DynamoDB table named 'Orders'. The table has a key schema with 'OrderID' as the partition key and 'CustomerID' as the sort key. The table currently has no items. The engineer wants to add a new attribute 'OrderDate' and then query all orders for a specific customer within a date range. Which of the following actions is the MOST efficient approach to support this query pattern?

A.Modify the table's primary key to include 'OrderDate' as an additional sort key.
B.Use a Scan operation with a filter expression on 'CustomerID' and 'OrderDate' to retrieve the data.
C.Create a Local Secondary Index (LSI) with 'CustomerID' as partition key and 'OrderDate' as sort key.
D.Create a Global Secondary Index (GSI) with 'CustomerID' as partition key and 'OrderDate' as sort key.
AnswerD

GSI can be added at any time and supports efficient queries on CustomerID and OrderDate.

Why this answer

A Global Secondary Index (GSI) allows querying on a different partition key ('CustomerID') and sort key ('OrderDate') without altering the base table's key schema. This supports efficient range queries on 'OrderDate' for a specific customer, as GSIs provide a separate index with its own provisioned throughput and can be created on existing tables with items. The base table's primary key remains unchanged, and the GSI enables the desired query pattern with low latency.

Exam trap

AWS often tests the distinction between LSIs and GSIs, specifically that LSIs require the same partition key as the base table, while GSIs allow a different partition key, which is a common point of confusion for candidates.

How to eliminate wrong answers

Option A is wrong because DynamoDB does not support modifying an existing table's primary key schema; you cannot add a sort key after table creation without recreating the table. Option B is wrong because a Scan operation reads every item in the table and then applies a filter, which is inefficient and costly for large tables, and does not leverage DynamoDB's indexing capabilities for range queries. Option C is wrong because a Local Secondary Index (LSI) must have the same partition key as the base table (here 'OrderID'), so it cannot use 'CustomerID' as the partition key; LSIs only allow querying with the base table's partition key and an alternate sort key.

Full explanation →
94
Multi-Selecteasy

A data engineer is setting up an AWS Glue job to process data from an Amazon S3 bucket. The job fails with an 'Access Denied' error. Which TWO IAM permissions are MOST likely missing from the Glue job's IAM role?

Select 2 answers
A.s3:PutObject
B.kms:Decrypt
C.dynamodb:GetItem
D.glue:StartJobRun
E.s3:GetObject
AnswersA, E

Required to write output to S3.

Why this answer

Options A and E are correct. A Glue job requires s3:GetObject to read input data from S3 and s3:PutObject to write output data to S3. Option B (kms:Decrypt) is only needed if the S3 objects are encrypted with KMS.

Option C (dynamodb:GetItem) is not relevant unless the job accesses DynamoDB. Option D (glue:StartJobRun) is not needed for the job's execution itself; it is used to start a job run.

Full explanation →
95
MCQhard

A company is using AWS Glue to run ETL jobs that write data to an Amazon S3 data lake. The jobs are failing with '503 Slow Down' errors. The data engineering team has already implemented retries. What is the BEST long-term solution?

A.Enable S3 Transfer Acceleration.
B.Use S3 multipart upload for all objects.
C.Increase the number of retries in the Glue job.
D.Implement a backoff strategy to reduce the request rate.
AnswerD

Reducing request rate helps avoid S3 503 errors.

Why this answer

The '503 Slow Down' error from Amazon S3 indicates that the request rate is too high and S3 is throttling the requests. The best long-term solution is to implement a backoff strategy (exponential backoff) to reduce the request rate, which allows the Glue job to automatically slow down and retry with increasing delays, aligning with S3's request rate limits and avoiding sustained throttling.

Exam trap

The trap here is that candidates often confuse '503 Slow Down' with a network or throughput issue and choose S3 Transfer Acceleration or multipart upload, when in fact the error is a throttling response from S3 that requires reducing the request rate via backoff, not increasing speed or parallelism.

How to eliminate wrong answers

Option A is wrong because S3 Transfer Acceleration is designed to speed up uploads over long distances using edge locations, but it does not reduce the request rate or resolve throttling caused by high request volumes. Option B is wrong because S3 multipart upload is a mechanism for uploading large objects in parts, which can improve throughput but does not address the root cause of excessive request rate leading to '503 Slow Down' errors. Option C is wrong because increasing the number of retries without reducing the request rate will likely continue to trigger throttling, as the same high request rate will persist after each retry, leading to repeated failures.

Full explanation →
96
Multi-Selecteasy

A company is ingesting large volumes of sensor data into Amazon S3. The data must be encrypted at rest using an AWS KMS customer managed key. Which TWO actions are required to enable server-side encryption with AWS KMS (SSE-KMS) on the S3 bucket?

Select 2 answers
A.Enable S3 Versioning on the bucket
B.Set the default encryption on the S3 bucket to AWS-KMS and specify the KMS key
C.Enable Amazon CloudWatch Logs for the bucket
D.Add a bucket policy that denies uploads without encryption
E.Ensure the IAM role/user has kms:Encrypt permission on the KMS key
AnswersB, E

This configures SSE-KMS for all objects.

Why this answer

Setting the default encryption on the S3 bucket to AWS-KMS and specifying the KMS key ensures that all objects uploaded to the bucket are automatically encrypted with SSE-KMS using that customer managed key. This is the primary configuration step to enforce server-side encryption at rest with a customer managed key.

Exam trap

The trap here is that candidates often think a bucket policy denying unencrypted uploads alone is sufficient to enable SSE-KMS, but it only enforces that uploads must include encryption headers—it does not automatically apply encryption, so the default encryption setting is also required.

Full explanation →
97
MCQmedium

A company is migrating an on-premises MongoDB database to Amazon DocumentDB. The migration must have minimal downtime. Which service should be used to perform the migration?

A.AWS Glue
B.AWS DataSync
C.AWS Database Migration Service (DMS)
D.Amazon S3 Transfer Acceleration
AnswerC

DMS supports MongoDB to DocumentDB migration with minimal downtime using change data capture.

Why this answer

AWS Database Migration Service (DMS) is the correct choice because it supports continuous replication from MongoDB to Amazon DocumentDB using change data capture (CDC), enabling near-zero downtime migrations. DMS can perform a full load of existing data and then apply ongoing changes from the source MongoDB oplog, keeping the target DocumentDB synchronized until the cutover.

Exam trap

The trap here is that candidates may confuse AWS DMS with AWS DataSync or AWS Glue, assuming any 'migration' or 'data transfer' service can handle live database replication, but only DMS provides the necessary CDC engine for heterogeneous database migrations with minimal downtime.

How to eliminate wrong answers

Option A is wrong because AWS Glue is a serverless data integration service for ETL (extract, transform, load) jobs, not designed for live database migration with minimal downtime; it lacks native CDC support for MongoDB to DocumentDB replication. Option B is wrong because AWS DataSync is optimized for moving large volumes of file data (e.g., NFS, SMB) to AWS storage services like S3 or EFS, not for heterogeneous database migrations or ongoing replication. Option D is wrong because Amazon S3 Transfer Acceleration is a feature that speeds up uploads to S3 buckets over long distances using edge locations; it has no capability to migrate or replicate a MongoDB database to DocumentDB.

Full explanation →
98
Multi-Selecthard

A data engineer is designing a data lake on Amazon S3. The data must be immutable and support high-throughput streaming ingestion. Which THREE features should the engineer consider? (Select THREE.)

Select 3 answers
A.S3 Transfer Acceleration
B.S3 Lifecycle policies to transition data to Amazon S3 Glacier
C.S3 Multipart Upload API
D.S3 Object Lock in governance mode
E.S3 Cross-Region Replication (CRR)
AnswersB, C, D

Lifecycle policies automate data movement, cost-effectively managing the data lifecycle.

Why this answer

S3 Object Lock in governance mode (Option D) is correct because it enforces immutability by preventing objects from being deleted or overwritten for a specified retention period, which is essential for a data lake requiring immutable data. S3 Multipart Upload API (Option C) is correct because it enables high-throughput streaming ingestion by allowing large objects to be uploaded in parallel parts, improving throughput and resilience. S3 Lifecycle policies to transition data to Amazon S3 Glacier (Option B) is correct because it supports cost-effective storage management for immutable data that is rarely accessed, aligning with the data lake's lifecycle needs.

Exam trap

The trap here is that candidates often confuse S3 Transfer Acceleration (a speed optimization) with a feature that provides immutability or streaming support, leading them to select it incorrectly, while overlooking that S3 Object Lock and Multipart Upload directly address the core requirements of immutability and high-throughput ingestion.

Full explanation →
99
MCQhard

A data engineer uses AWS Database Migration Service (DMS) to migrate an on-premises Oracle database to Amazon Aurora MySQL. The migration is successful, but the engineer notices that the target Aurora cluster has a higher CPU utilization than expected during the full load phase. What is the MOST likely cause?

A.The DMS task has LOB mode set to 'Full LOB mode', causing additional processing.
B.DMS is performing data validation during the full load phase.
C.DMS is reading from an Amazon Aurora read replica instead of the primary instance.
D.The DMS task is configured to use multiple parallel threads to load data, overwhelming the target instance.
AnswerD

Parallel threads increase throughput but also increase CPU usage.

Why this answer

During full load, DMS uses multiple parallel threads (by default up to 4 or more) to maximize throughput, which can overwhelm the target Aurora cluster's CPU. Option A is incorrect: 'Full LOB mode' affects how large objects are handled and may increase latency, but it is not the primary cause of high CPU utilization. Option B is incorrect: DMS performs data validation after the full load phase, not during it.

Option C is incorrect: DMS reads from the source (on-premises Oracle), not from an Aurora read replica; moreover, read replicas are not used for writing.

Full explanation →
100
MCQmedium

A company needs to transform JSON data from an Amazon S3 bucket into Parquet format and load it into an Amazon Redshift cluster. The transformation includes joining with a reference table stored in Amazon RDS. Which AWS service is BEST suited for this task?

A.AWS Data Pipeline
B.AWS Glue ETL job
C.Amazon Athena
D.Amazon EMR with Spark
AnswerB

Glue ETL jobs can read from S3, connect to RDS via JDBC, transform, and write to Redshift efficiently.

Why this answer

(AWS Glue ETL job) is the best choice because it natively integrates with S3, RDS, and Redshift. Glue can read JSON from S3, connect to RDS via JDBC to join with the reference table, transform the data to Parquet using its built-in converter, and write directly to Redshift. Option A (AWS Data Pipeline) is older and less integrated for this purpose.

Option C (Amazon Athena) can query S3 and convert to Parquet but cannot natively join with RDS without additional services. Option D (Amazon EMR with Spark) is possible but requires more setup and maintenance.

Full explanation →
101
MCQmedium

A company uses Amazon Kinesis Data Firehose to ingest application logs into an Amazon S3 bucket. The logs are in JSON format. The data engineering team wants to convert the logs from JSON to Parquet format before landing in S3. What is the most cost-effective way to achieve this?

A.Use Amazon Athena to query the JSON data and write results in Parquet format.
B.Configure the Firehose delivery stream to convert the data to Parquet using a schema from AWS Glue.
C.Use an AWS Lambda function to transform each record to Parquet and send to Firehose.
D.Use an AWS Glue ETL job to run on a schedule and convert JSON to Parquet in S3.
AnswerB

Configure the Firehose delivery stream to convert the data to Parquet using a schema from AWS Glue. This is the most cost-effective because Firehose handles the conversion natively without additional compute services.

Why this answer

Kinesis Data Firehose can convert the input data format to Parquet using a schema from AWS Glue. Option A is incorrect because Athena queries raw data and would not help with ingestion. Option C is incorrect because Lambda can do this but would incur additional compute cost.

Option D is incorrect because Glue ETL would add cost and latency.

Full explanation →
102
MCQhard

A data engineer is designing a data pipeline that ingests millions of small JSON files (1-10 KB each) from an S3 bucket into Amazon Redshift. The current approach uses a Lambda function triggered by S3 events to call the Redshift COPY command for each file. This is causing high latency and throttling. Which alternative is MOST cost-effective and efficient?

A.Use Amazon Kinesis Data Streams and a consumer to batch files before COPY
B.Use Amazon Kinesis Data Firehose to buffer and write larger files to S3, then use a scheduled COPY command
C.Increase the Lambda concurrency limit and memory
D.Use AWS Glue to merge files into larger Parquet files before loading
AnswerB

Firehose buffers small files into larger ones, reducing COPY frequency and cost.

Why this answer

Amazon Kinesis Data Firehose can buffer the incoming small JSON files from S3 (via S3 event notifications) and write larger aggregated files to S3. A scheduled COPY command then efficiently loads these larger files into Amazon Redshift, reducing the number of COPY operations and avoiding Lambda throttling. This approach is cost-effective as Firehose charges only for data volume processed, and it eliminates the need for custom batching logic.

Other options either process files individually (A, C) or incur higher costs with AWS Glue (D).

Full explanation →
103
MCQeasy

A company is storing large amounts of log data in Amazon S3. The data is accessed frequently for the first 30 days, then rarely after that. The company wants to automatically transition the data to a lower-cost storage class after 30 days. Which S3 feature should the data engineer use?

A.S3 Intelligent-Tiering
B.S3 Lifecycle policies
C.S3 Cross-Region Replication
D.S3 Batch Operations
AnswerB

Lifecycle policies can transition objects after a specified number of days.

Why this answer

S3 Lifecycle policies allow you to define rules that automatically transition objects between storage classes based on age or other criteria. In this scenario, a lifecycle rule can be configured to transition objects from S3 Standard to a lower-cost class like S3 Glacier Deep Archive after 30 days, directly meeting the requirement for automated cost optimization.

Exam trap

The trap here is that candidates confuse S3 Intelligent-Tiering's automatic cost optimization with the ability to enforce a fixed time-based transition, when in fact Intelligent-Tiering monitors access patterns and may not align with a strict 30-day policy.

How to eliminate wrong answers

Option A is wrong because S3 Intelligent-Tiering automatically moves data between access tiers based on changing access patterns, but it does not allow you to set a fixed 30-day transition rule; it monitors usage and may not transition data that is rarely accessed after exactly 30 days. Option C is wrong because S3 Cross-Region Replication is used to copy objects to a different AWS region for disaster recovery or compliance, not to transition objects to a lower-cost storage class within the same region. Option D is wrong because S3 Batch Operations is designed for bulk actions like copying, tagging, or restoring objects, not for automating storage class transitions based on time.

Full explanation →
104
MCQmedium

A company is using Amazon Kinesis Data Analytics for Apache Flink to process streaming data. The application reads from a Kinesis data stream and writes results to an Amazon S3 bucket. The team notices that the application is experiencing high latency during peak hours. The stream has 8 shards, and the application is configured with a parallelism of 4. Which action would most likely reduce the latency?

A.Decrease the batch size in the S3 sink.
B.Use a larger Kinesis Data Analytics application instance type.
C.Increase the parallelism of the Flink application to 8.
D.Increase the checkpointing interval to reduce overhead.
AnswerC

Matching parallelism to shard count ensures each shard is processed concurrently, reducing backpressure.

Why this answer

The application has 8 shards but only a parallelism of 4, meaning each Flink subtask must process data from 2 shards. This creates a bottleneck because a single subtask cannot process data from multiple shards faster than the slowest shard's throughput. Increasing parallelism to 8 matches the shard count, allowing each subtask to read from exactly one shard, eliminating the contention and reducing latency.

Exam trap

The DEA-C01 exam often tests the misconception that increasing instance size (Option B) or tuning sink parameters (Option A) will fix latency, when the root cause is a parallelism-to-shard mismatch that only increasing parallelism can resolve.

How to eliminate wrong answers

Option A is wrong because decreasing the batch size in the S3 sink would increase the number of small writes, causing more overhead and potentially higher latency, not lower. Option B is wrong because the bottleneck is parallelism, not compute resources; a larger instance type would not resolve the mismatch between shard count and parallelism, and could even increase cost without benefit. Option D is wrong because increasing the checkpointing interval reduces checkpointing overhead but does not address the fundamental parallelism bottleneck; it may actually increase recovery time and does not improve throughput during peak hours.

Full explanation →
105
Multi-Selecteasy

A data engineer is monitoring an AWS Glue ETL job that processes data from Amazon DynamoDB to Amazon S3. The job is taking longer than expected. The engineer suspects that the job's parallelism is not optimal. Which THREE actions can improve the job's performance? (Choose THREE.)

Select 3 answers
A.Enable the 'groupFiles' option in the S3 sink to coalesce small files.
B.Decrease the 'dynamodb.splits' parameter to reduce the number of parallel readers.
C.Increase the 'MaxCapacity' (DPU) setting for the Glue job.
D.Disable job bookmark to avoid storing metadata.
E.Increase the 'dynamodb.throughput.read.percentage' parameter to allocate more read capacity.
AnswersA, C, E

Coalescing small files reduces the number of output files and improves write performance.

Why this answer

Enabling 'groupFiles' in the S3 sink coalesces small files into larger ones, reducing the number of write operations and improving write performance. Option C is correct because increasing MaxCapacity (DPU) allocates more processing units, increasing parallelism and processing speed. Option E is correct because increasing 'dynamodb.throughput.read.percentage' allocates a higher percentage of the table's provisioned read capacity to the Glue job, allowing more parallel reads from DynamoDB.

Option B is incorrect because decreasing 'dynamodb.splits' reduces the number of parallel readers, which can lower parallelism and slow down the job. Option D is incorrect because disabling job bookmarks results in reprocessing all data each run, which increases processing time and does not improve performance.

Full explanation →
106
MCQmedium

A data engineer is designing a data lake on S3 and needs to ensure that data is encrypted at rest using customer-managed KMS keys. The engineer also needs to audit all access to the KMS keys. Which combination of services should be used?

A.SSE-KMS with AWS CloudTrail
B.SSE-C with CloudWatch Logs
C.SSE-KMS with S3 Inventory
D.SSE-S3 with S3 server access logs
AnswerA

SSE-KMS uses customer-managed KMS keys; CloudTrail records KMS API calls for auditing.

Why this answer

SSE-KMS allows customer-managed KMS keys, and AWS CloudTrail logs all KMS API calls (e.g., Decrypt, GenerateDataKey), enabling auditing. Option B is incorrect because SSE-C uses customer-provided encryption keys, not KMS, and CloudWatch Logs is for application logs, not KMS access. Option C is incorrect because S3 Inventory provides object metadata but does not audit KMS access.

Option D is incorrect because SSE-S3 uses AWS-managed keys, not customer-managed, and S3 server access logs do not capture KMS API calls.

Full explanation →
107
MCQeasy

Refer to the exhibit. A data engineer runs the command on an Amazon S3 bucket used for data lake storage. The engineer is concerned about accidental overwrites of objects. What does the output indicate?

A.Versioning is enabled, so previous versions of objects are preserved.
B.Old versions will be automatically deleted after a retention period.
C.Objects are encrypted at rest by default.
D.MFA Delete is disabled, meaning anyone can delete objects permanently.
AnswerA

Correct. The Status 'Enabled' indicates versioning is turned on for the bucket. With versioning enabled, if an object is overwritten, a new version is created and the previous version is preserved, preventing accidental permanent loss of the overwritten data.

Why this answer

The Status 'Enabled' indicates versioning is turned on for the bucket, preserving previous versions. Option B is wrong because versioning does not automatically delete old versions; they are retained until explicitly deleted. Option C is wrong because versioning does not enable encryption; encryption is a separate setting.

Option D is wrong because MFA Delete is not displayed in this status output; it is a different bucket property.

Full explanation →
108
MCQhard

Refer to the exhibit. A data engineer is using a Kinesis Data Stream with 2 shards. The producer uses a partition key that is the user ID (a UUID). The consumer is falling behind. Which change would improve throughput?

A.Switch to Kinesis Data Firehose
B.Increase the number of shards
C.Increase the retention period
D.Change the partition key to a constant value
AnswerB

More shards increase the read capacity for consumers.

Why this answer

The consumer is falling behind because the total throughput of the stream (1 MB/s or 1,000 records/s per shard for writes, and 2 MB/s per shard for reads) is insufficient for the incoming data volume. Increasing the number of shards scales both the write and read capacity linearly, allowing the consumer to process records faster and catch up. Changing the partition key or retention period does not increase throughput, and switching to Firehose changes the delivery model but does not inherently solve the consumer lag.

Exam trap

The trap here is that candidates may think changing the partition key to a constant value would simplify processing, but it actually destroys parallelism and reduces throughput to a single shard, making the lag worse.

How to eliminate wrong answers

Option A is wrong because Kinesis Data Firehose is a fully managed delivery service that buffers and loads data into destinations like S3 or Redshift; it does not increase the read throughput for a consumer that is falling behind, and it removes the ability for custom consumers to process records in real time. Option C is wrong because increasing the retention period (default 24 hours, max 365 days) only keeps records longer in the stream; it does not increase the ingestion or consumption rate, so the consumer will still lag. Option D is wrong because changing the partition key to a constant value would cause all records to go to a single shard, drastically reducing throughput and making the lag worse, as the other shard would be idle.

Full explanation →
109
MCQmedium

A company runs an e-commerce platform that generates clickstream data from millions of users. The data is ingested into Amazon Kinesis Data Streams with a shard count of 10. The data is then consumed by a Kinesis Data Analytics application that runs SQL queries to aggregate metrics in real time. Recently, the application has been falling behind, and the stream's iterator age metric is increasing. The data volume has doubled over the past month. The application currently uses a single Kinesis Data Analytics application with parallelism of 1. Which action should the data engineer take to improve the processing rate and reduce the iterator age without losing data or causing duplicates?

A.Change the Kinesis Data Analytics application to use a Kinesis Data Firehose delivery stream as the source.
B.Reduce the retention period of the Kinesis Data Streams to 24 hours.
C.Increase the number of shards in the Kinesis Data Streams to 20.
D.Increase the parallelism of the Kinesis Data Analytics application to match the number of shards.
AnswerD

Higher parallelism allows concurrent processing of multiple shards.

Why this answer

Kinesis Data Analytics (KDA) processes data from each shard in a stream using one or more parallel operators. With a parallelism of 1, the application uses only a single processing thread, which cannot keep up with the doubled data volume across 10 shards. By increasing parallelism to match the shard count (10), KDA can read from all shards concurrently, distributing the processing load and reducing the iterator age without data loss or duplicates, as KDA manages checkpointing and exactly-once semantics internally.

Exam trap

The trap here is that candidates often assume increasing shard count (Option C) is the only way to handle higher data volume, but they overlook that the processing application's parallelism must also scale to consume the additional shards, otherwise the bottleneck shifts to the consumer.

How to eliminate wrong answers

Option A is wrong because Kinesis Data Firehose is a delivery service that buffers and loads data into destinations like S3 or Redshift; it does not support real-time SQL analytics or reduce iterator age, and using it as a source would break the existing KDA SQL application. Option B is wrong because reducing the retention period from the default (24 hours or more) to 24 hours does not improve processing rate; it only causes data to expire sooner, potentially losing unprocessed records and increasing the risk of data loss without addressing the throughput bottleneck. Option C is wrong because increasing the shard count to 20 would double the stream's ingestion capacity, but the KDA application with parallelism of 1 would still process only one shard at a time, leaving the other 19 shards unprocessed and worsening the iterator age; the bottleneck is the application's parallelism, not the stream's shard count.

Full explanation →
110
Multi-Selecthard

A company needs to ingest data from a MySQL database into Amazon S3 using AWS DMS. The data changes frequently and the requirement is to capture changes in near real-time. Which THREE configurations are necessary?

Select 3 answers
A.Create a VPC endpoint for S3.
B.Create an S3 target endpoint in DMS.
C.Enable binary logging (binlog) on the MySQL source database.
D.Create an AWS DMS replication instance.
E.Configure an S3 event notification to trigger DMS.
AnswersB, C, D

Needed to specify the S3 bucket.

Why this answer

To capture near real-time changes from a MySQL database to S3 using AWS DMS, you need: B) an S3 target endpoint in DMS to write the data; C) binary logging (binlog) enabled on MySQL to capture changes; and D) a DMS replication instance to process and transfer data. Options A and E are unnecessary: a VPC endpoint for S3 is not required (DMS can use public endpoints or VPC peering), and S3 event notifications are not used to trigger DMS—they are typically for post-processing.

Full explanation →
111
Multi-Selecthard

A company uses Amazon S3 to store log files that are generated every hour. Each log file is about 1 GB. The logs must be stored for 5 years for compliance. The data engineer wants to minimize storage costs while ensuring that logs can be retrieved within 24 hours for the first year, and within 48 hours thereafter. Which TWO lifecycle actions should the engineer configure? (Choose TWO.)

Select 2 answers
A.Transition objects to S3 Standard after 30 days.
B.Transition objects to S3 Glacier Deep Archive after 1 year.
C.Set a retrieval window of 48 hours for Glacier Deep Archive.
D.Delete objects after 2 years to reduce storage costs.
E.Transition objects to S3 Standard-IA after 30 days.
AnswersB, E

Correct. Transitioning to S3 Glacier Deep Archive after 1 year minimizes storage costs for the remaining retention period, and the 48-hour retrieval window meets the compliance requirement after the first year.

Why this answer

Transitioning objects to S3 Glacier Deep Archive after 1 year provides the lowest storage cost while meeting the 5-year retention requirement. After the first year, the retrieval window of up to 48 hours for Glacier Deep Archive satisfies the compliance need. Option E is correct because after 30 days, logs are less frequently accessed but still need retrieval within 24 hours during the first year; S3 Standard-IA offers lower cost than S3 Standard for such infrequent access.

Option A is incorrect because transitioning to S3 Standard after 30 days is more expensive than Standard-IA and does not provide cost savings. Option C is incorrect because 'Set a retrieval window of 48 hours for Glacier Deep Archive' is not a lifecycle action; retrieval windows are configured during restore operations, not in lifecycle rules. Option D is incorrect because deleting objects after 2 years violates the 5-year retention policy.

Exam trap

Candidates might incorrectly think that Option C (Set a retrieval window of 48 hours for Glacier Deep Archive) is a valid lifecycle action, but retrieval windows are configured during restore operations, not in lifecycle rules. The trap is also that candidates might select Option A (S3 Standard) or Option D (delete after 2 years) due to misunderstanding access patterns or retention requirements.

Full explanation →
112
MCQmedium

A company uses Amazon Kinesis Data Streams to ingest real-time clickstream data. The consumer application is falling behind and the iterator age is increasing. Which action would most effectively improve throughput?

A.Switch from Kinesis Data Streams to Kinesis Data Firehose
B.Decrease the batch size in the consumer
C.Enable enhanced fan-out for the consumer
D.Increase the number of shards in the stream
AnswerD

More shards increase read capacity and parallelism.

Why this answer

Increasing the number of shards in a Kinesis data stream increases the level of parallelism for both ingestion and consumption, allowing the consumer to process more data concurrently and catch up. Option A is incorrect because Kinesis Data Firehose is a delivery stream, not a replacement for real-time consumption, and cannot solve a consumer lag issue. Option B is incorrect because decreasing batch size reduces the amount of data processed per poll, which can actually slow down throughput and increase iterator age.

Option C is incorrect because enhanced fan-out is useful when multiple consumers need dedicated throughput, but it does not increase the total throughput of the stream; it simply provides each consumer with its own 2 MB/sec per shard read throughput, which may not help a single consumer that is already falling behind.

Full explanation →
113
Multi-Selecteasy

A data engineer needs to monitor the performance of an RDS for PostgreSQL database. Which THREE CloudWatch metrics are most useful for this purpose?

Select 3 answers
A.CPUUtilization
B.DatabaseConnections
C.FreeStorageSpace
D.NetworkThroughput
E.ReadLatency / WriteLatency
AnswersA, B, E

Indicates compute load.

Why this answer

CPUUtilization is a critical metric for monitoring RDS for PostgreSQL because high CPU usage can indicate inefficient queries, insufficient instance size, or contention. Sustained high CPU can lead to performance degradation and increased query latency, making it essential for capacity planning and troubleshooting.

Exam trap

The trap here is that candidates often confuse storage metrics (like FreeStorageSpace) with performance metrics, or assume NetworkThroughput is a performance indicator, when in fact latency and CPU metrics directly reflect query execution health.

Full explanation →
114
MCQhard

A company uses Amazon Kinesis Data Streams with a Lambda consumer. The Lambda function is failing with 'ProvisionedThroughputExceededException' when writing to a DynamoDB table. Which action should the data engineer take to resolve this without losing data?

A.Reduce the number of Kinesis shards to lower the ingestion rate.
B.Increase the DynamoDB table's read capacity.
C.Configure a dead-letter queue (DLQ) on the Lambda function and increase the DynamoDB write capacity.
D.Disable retries on the Lambda function to avoid throttling.
AnswerC

The DLQ captures failed records, and increasing write capacity reduces throttling. Together, they prevent data loss.

Why this answer

The 'ProvisionedThroughputExceededException' occurs when the Lambda function exceeds the DynamoDB table's write capacity. To resolve this without data loss, the data engineer should both increase the DynamoDB write capacity to accommodate the throughput and configure a dead-letter queue (DLQ) on the Lambda function. The DLQ captures records that fail after all retries, preventing data loss.

Option A (reducing shards) would lower the ingestion rate but may cause data loss and does not address the root cause. Option B (increasing read capacity) is irrelevant because the issue is with writes. Option D (disabling retries) would cause data loss because failed records would not be retried.

Full explanation →
115
MCQmedium

A gaming company collects player event data from mobile devices. The data is sent to an Amazon API Gateway endpoint, which triggers an AWS Lambda function that writes the data to an Amazon DynamoDB table. The company wants to also store the data in Amazon S3 for historical analysis. The data volume is about 100 GB per day. The data engineer needs to design a solution to copy data from DynamoDB to S3 with minimal impact on the DynamoDB table. What should the data engineer do?

A.Enable DynamoDB Streams on the table and configure a Lambda function to write changes to S3.
B.Create a global secondary index on the table and export the index to S3.
C.Use AWS Glue to scan the DynamoDB table and write results to S3 every hour.
D.Use the DynamoDB Export to S3 feature to export the entire table daily.
AnswerA

Using DynamoDB Streams with a Lambda function that writes to S3 enables real-time replication with minimal impact on the DynamoDB table.

Why this answer

Using DynamoDB Streams with a Lambda function that writes to S3 enables real-time replication with minimal impact on the DynamoDB table. Option B is wrong because creating a global secondary index does not export data to S3; it is used to improve query performance. Option C is wrong because using AWS Glue to scan the DynamoDB table would consume read capacity units, potentially impacting performance.

Option D is wrong because the DynamoDB Export to S3 feature is a one-time or scheduled export, not continuous, and may not be suitable for near-real-time needs.

Full explanation →
116
MCQeasy

A data engineer needs to ensure that an S3 bucket is not publicly accessible. Which S3 block public access setting should be applied to achieve this?

A.BlockPublicAcls (both new and existing)
B.IgnorePublicAcls
C.BlockPublicAcls (new ACLs)
D.BlockPublicPolicy
AnswerD

Correct. BlockPublicPolicy prevents public bucket policies, the most common vector for public access, especially with ACLs disabled by default.

Why this answer

(BlockPublicPolicy) prevents any public bucket policies from being applied, which is the primary way to grant public access to an S3 bucket. With public ACLs disabled by default for new buckets, blocking public policies effectively ensures the bucket is not publicly accessible. Option A (BlockPublicAcls both new and existing) only blocks public ACLs, leaving the bucket vulnerable to public policies, so it is insufficient by itself.

Full explanation →
117
MCQmedium

Refer to the exhibit. A data engineer has attached this KMS key policy to a customer-managed key. The policy is intended to allow the DataEngineer role to decrypt objects in S3 only when the request comes through S3. However, the role is unable to decrypt objects stored in an S3 bucket in the us-west-2 region. What is the most likely cause?

A.The key policy does not allow the role to use GenerateDataKey
B.The role does not have an IAM policy that allows kms:Decrypt
C.The condition restricts the permission to the us-east-1 region only
D.The role does not have permission to decrypt from S3
AnswerC

The kms:ViaService condition specifies s3.us-east-1.amazonaws.com, so it only works for S3 requests in us-east-1.

Why this answer

The condition in the policy restricts the permission to requests coming through S3 in us-east-1 only (s3.us-east-1.amazonaws.com). For buckets in us-west-2, the viaService would be s3.us-west-2.amazonaws.com, so the condition fails. The key policy does not allow decrypt from other services, but the issue is region mismatch.

Full explanation →
118
MCQhard

A company uses AWS Glue ETL to transform data from Amazon RDS for PostgreSQL to Amazon S3. The transformation includes joining several tables and aggregating millions of rows. The job runs successfully but takes over 2 hours. The data engineer wants to reduce runtime. Which action is MOST effective?

A.Enable Auto Scaling for the Glue job.
B.Use AWS Glue DynamicFrames instead of DataFrames.
C.Increase the number of DPUs for the Glue job.
D.Convert the source data to Parquet format.
AnswerC

More DPUs increase parallelism and reduce execution time.

Why this answer

Increasing the number of DPUs (Data Processing Units) in AWS Glue ETL jobs allows more parallel processing of the transformation, which directly reduces runtime for CPU-bound or memory-bound tasks like joining and aggregating millions of rows. Option A: Auto Scaling adjusts DPUs based on workload but does not guarantee maximum performance; it may still be limited by the initial DPU allocation. Option B: DynamicFrames vs DataFrames performance difference is minimal for such operations; this would not significantly reduce runtime.

Option D: Converting source data to Parquet applies to data in S3, but the source is Amazon RDS, so this conversion does not help with reading from the database. Therefore, increasing DPUs is the most effective action.

Full explanation →
119
MCQhard

A company ingests streaming data from multiple sources into a single Kinesis Data Streams stream. Each source produces records with a different schema. The data must be routed to different S3 prefixes based on the source. Which approach minimizes transformation overhead?

A.Use a single Kinesis Data Firehose with a Lambda transformation that reads schema metadata from DynamoDB to determine the S3 prefix.
B.Ingest all data into S3 and use AWS Glue ETL jobs to partition and route data to different prefixes.
C.Use separate Kinesis Data Streams for each source and configure separate Firehose delivery streams.
D.Use Kinesis Data Analytics to run SQL queries that route data to different Firehose streams.
AnswerA

Using a single Kinesis Data Streams stream with a Lambda function that reads schema metadata from DynamoDB to determine the S3 prefix minimizes transformation overhead by routing data in real-time without additional storage or processing steps.

Why this answer

Using a single Kinesis Data Firehose delivery stream with a Lambda transformation that reads schema metadata from DynamoDB to determine the S3 prefix minimizes transformation overhead by routing data in real-time without additional storage or processing steps. Option B is wrong because ingesting all data into S3 first and then using AWS Glue ETL jobs to partition and route data to different prefixes adds latency and transformation overhead due to the need for batch processing. Option C is wrong because using separate Kinesis Data Streams for each source with separate Firehose delivery streams increases cost and complexity, and does not minimize transformation overhead as it requires managing multiple streams.

Option D is wrong because using Kinesis Data Analytics to run SQL queries for routing adds unnecessary complexity and overhead, as Kinesis Data Analytics is better suited for real-time analytics, not simple routing.

Full explanation →
120
MCQeasy

A company uses Amazon Kinesis Data Streams to ingest real-time clickstream data. The data is consumed by an AWS Lambda function that processes records and stores results in Amazon DynamoDB. Recently, the Lambda function has been failing with ProvisionedThroughputExceededException errors. Which action should the data engineer take to resolve this issue?

A.Enable auto scaling on the DynamoDB table to handle increased write capacity.
B.Reduce the number of shards in the Kinesis stream to lower the ingestion rate.
C.Increase the batch size in the Lambda event source mapping to process more records per invocation.
D.Configure the Lambda function to discard records that cause throttling errors.
AnswerA

Auto scaling adjusts throughput based on actual usage, preventing throttling.

Why this answer

Enabling DynamoDB auto scaling dynamically adjusts throughput to match demand. Option B is wrong because reducing the number of shards would lower the ingestion rate, which is not appropriate for handling high traffic. Option C is wrong because increasing the batch size in the Lambda event source mapping would process more records per invocation, but the underlying issue is DynamoDB throughput, not batch size.

Option D is wrong because discarding records that cause throttling would lead to data loss.

Full explanation →
121
MCQhard

A data pipeline uses Amazon Kinesis Data Firehose to deliver data to an S3 bucket. The delivery stream is configured with a buffer interval of 60 seconds and a buffer size of 5 MB. The data arrives at an average rate of 2 MB per second. What is the expected time interval between S3 writes?

A.Approximately 2.5 seconds
B.Approximately 30 seconds
C.Approximately 60 seconds
D.Approximately 10 seconds
AnswerA

The buffer size of 5 MB fills in 2.5 seconds at 2 MB/s, triggering a write.

Why this answer

Amazon Kinesis Data Firehose writes to S3 when either the buffer interval (60 seconds) or buffer size (5 MB) is reached first. With data arriving at 2 MB/s, the 5 MB buffer fills in 2.5 seconds (5 MB / 2 MB/s), triggering a write before the 60-second interval expires. Thus, the expected time between S3 writes is approximately 2.5 seconds.

Exam trap

The trap here is that candidates assume the buffer interval (60 seconds) is the primary determinant of write frequency, ignoring that the buffer size threshold triggers writes much earlier when data arrival rates are high.

How to eliminate wrong answers

Option B is wrong because 30 seconds would imply a buffer fill rate of ~0.167 MB/s, which does not match the given 2 MB/s arrival rate. Option C is wrong because 60 seconds is the buffer interval, but the buffer size threshold is reached much sooner at 2.5 seconds, making the interval the active trigger only if data arrival is slower. Option D is wrong because 10 seconds would correspond to a buffer size of 20 MB (2 MB/s * 10 s), which is not the configured 5 MB buffer size.

Full explanation →
122
MCQhard

A healthcare company is building a data pipeline to ingest electronic health records (EHR) from hospitals. The data is sent as JSON files via SFTP to an on-premises server. The company wants to move this data to AWS using AWS Transfer Family (SFTP) and then process it with AWS Glue. Data sovereignty regulations require that all data remain within the EU (Frankfurt) region. The pipeline must detect when a new file arrives and start the Glue job automatically. The engineer has set up an AWS Transfer Family server in Frankfurt, and files are uploaded to an S3 bucket in the same region. However, the Glue job is not triggering automatically. The engineer needs to implement automated triggering. What should the engineer do?

A.Configure AWS Step Functions to poll the S3 bucket every minute and start the Glue job if new files exist.
B.Configure Amazon CloudWatch Events to trigger the Glue job on a schedule that checks for new files.
C.Use Amazon Simple Queue Service (SQS) to queue file metadata and have a Lambda function poll the queue to start the Glue job.
D.Set up an S3 event notification on the bucket to invoke an AWS Lambda function that starts the Glue job.
AnswerD

S3 event notifications can invoke Lambda immediately when a new file is uploaded.

Why this answer

S3 event notifications can be configured to invoke an AWS Lambda function when a new object is created in the bucket, and the Lambda function can then start the AWS Glue job. This is the simplest and most direct method for automated triggering. Option A (Step Functions) adds unnecessary complexity and polling overhead.

Option B (CloudWatch Events) cannot directly monitor S3 object creation events; it would require additional custom logic. Option C (SQS) is an unnecessary intermediary; S3 can directly invoke Lambda without needing a queue.

Full explanation →
123
Multi-Selecteasy

A data engineer needs to enforce that all data in an Amazon S3 bucket is encrypted at rest. Which of the following can be used to achieve this? (Choose TWO.)

Select 2 answers
A.Use AWS CloudTrail to monitor for unencrypted objects
B.Use VPC endpoints to restrict access
C.Configure a bucket policy to deny PutObject if encryption headers are missing
D.Enable default encryption on the S3 bucket using SSE-S3
E.Use AWS KMS to generate encryption keys for the bucket
AnswersC, D

This policy enforces encryption on uploads.

Why this answer

Options C and D are correct. Configuring a bucket policy to deny PutObject requests that lack encryption headers (C) enforces encryption at upload time. Enabling default encryption on the S3 bucket using SSE-S3 (D) automatically encrypts objects at rest, even if uploaded without encryption headers.

Together, these ensure all data at rest is encrypted. Option A is incorrect because CloudTrail only logs API calls and does not enforce encryption. Option B is incorrect because VPC endpoints provide network isolation, not encryption.

Option E is incorrect because KMS generating keys alone does not enforce encryption on S3; the bucket must be configured to use those keys.

Full explanation →
124
MCQmedium

A company uses AWS Glue DataBrew to clean and normalize data. The data contains sensitive columns that must be masked before being written to the output. Which DataBrew action should be applied?

A.Apply a Hash transform to the sensitive columns.
B.Apply an Encrypt transform to the sensitive columns.
C.Apply a Delete transform to remove the sensitive columns.
D.Apply a Mask transform to the sensitive columns.
AnswerD

Correct. The 'Mask' transform obfuscates sensitive data by replacing characters with a mask character (e.g., 'X'), preserving the column structure and data type.

Why this answer

DataBrew provides a built-in 'Mask' transform that obfuscates sensitive data by applying masking patterns. Option A is incorrect because the Hash transform produces a hash value, which is not true masking as it can be reversed via brute force. Option B is incorrect because Encrypt is not a DataBrew transform; encryption is handled at the storage layer (e.g., S3 SSE).

Option C is incorrect because Delete removes the column entirely, which may not be desired if the column is needed for analysis but just needs sensitive data hidden.

Full explanation →
125
MCQmedium

A data engineer is setting up an Amazon S3 lifecycle policy to transition objects to S3 Glacier after 90 days and delete after 365 days. The objects are stored in the S3 Standard storage class. Which lifecycle rule configuration meets the requirements?

A.Transition to Glacier after 90 days and expire after 90 days
B.Transition to Glacier after 90 days and expire after 90 days
C.Transition to Glacier after 365 days and expire after 365 days
D.Transition to Glacier after 90 days and expire after 365 days
AnswerD

Correct timing for transition and deletion.

Why this answer

It specifies a transition action to S3 Glacier after 90 days and a separate expiration action after 365 days, which directly matches the requirements. S3 lifecycle policies allow independent transition and expiration actions, and the expiration action must be set to a value greater than the transition action to keep objects accessible in Glacier until deletion.

Exam trap

The trap here is that candidates may confuse 'expire' with 'transition' or think that setting both actions to the same number of days is valid, but AWS requires expiration to be after transition to avoid immediate deletion.

How to eliminate wrong answers

Option A is wrong because it sets both transition and expiration to 90 days, which would delete objects immediately after transitioning to Glacier, not after 365 days as required. Option B is wrong for the same reason as A — it incorrectly uses 90 days for both actions, failing to meet the 365-day deletion requirement. Option C is wrong because it transitions to Glacier after 365 days instead of 90 days, which does not meet the requirement to transition after 90 days.

Full explanation →
126
MCQhard

A company runs a batch ETL job on Amazon EMR every night. Recently, the job started failing with 'Out of Memory' errors in the Spark executors. The data volume has grown 20% in the past month. The cluster uses uniform instance groups with 5 core nodes of r5.xlarge (4 vCPU, 32 GB RAM). Which change should the data engineer implement to resolve the issue with minimal cost increase?

A.Increase the number of core nodes to 7.
B.Change instance type to r5.2xlarge (8 vCPU, 64 GB RAM) for all nodes.
C.Configure instance fleets to include r5.xlarge and r5.2xlarge instances.
D.Tune Spark memory configurations to reduce executor memory overhead.
AnswerC

Instance fleets allow cost-effective scaling by mixing types.

Why this answer

Using instance fleets allows the cluster to include both r5.xlarge and r5.2xlarge instances, enabling the Spark executors to use the larger instances for memory-intensive tasks while still leveraging the existing r5.xlarge nodes. This provides a cost-effective way to handle the 20% data growth by adding memory capacity without replacing the entire cluster or over-provisioning all nodes. Instance fleets also support Spot Instances, which can further reduce costs while addressing the Out of Memory errors.

Exam trap

The trap here is that candidates often assume increasing the number of nodes (Option A) or tuning Spark memory settings (Option D) can solve memory issues, but they fail to recognize that the root cause is insufficient memory per executor, which is best addressed by adding larger instances via instance fleets to minimize cost increase.

How to eliminate wrong answers

Option A is wrong because simply increasing the number of core nodes to 7 does not increase the memory per executor; it only adds more nodes with the same 32 GB RAM each, which may not resolve the Out of Memory errors if individual executors are hitting their limits due to data skew or large partitions. Option B is wrong because changing all nodes to r5.2xlarge (64 GB RAM) would double the memory per node but also double the cost for the entire cluster, which is not the minimal cost increase solution. Option D is wrong because tuning Spark memory configurations (e.g., reducing executor memory overhead) cannot create additional physical memory; it only reallocates existing memory, which will not resolve the Out of Memory errors if the total available memory is insufficient for the increased data volume.

Full explanation →
127
MCQeasy

A company needs to ingest data from multiple on-premises databases into Amazon S3 for analytics. The databases include Oracle, MySQL, and PostgreSQL. The data must be continuously replicated with minimal latency. Which AWS service should be used?

A.AWS Database Migration Service (AWS DMS)
B.Amazon Kinesis Data Streams
C.AWS Snowball
D.AWS Glue
AnswerA

DMS can continuously replicate from multiple source databases to S3.

Why this answer

AWS DMS supports continuous replication (change data capture, CDC) from Oracle, MySQL, and PostgreSQL to S3 as a target, enabling near-real-time data ingestion with minimal latency. It handles schema conversion and can replicate ongoing changes without interrupting source databases, making it the correct choice for this use case.

Exam trap

The trap here is that candidates may confuse Kinesis Data Streams as a general-purpose ingestion service for databases, but it lacks native CDC connectors for relational databases and is optimized for streaming data from applications, not for replicating transactional changes from databases to S3.

How to eliminate wrong answers

Option B is wrong because Amazon Kinesis Data Streams is a real-time streaming service for ingesting high-throughput data from applications or devices, not designed for continuous database replication with CDC from relational databases. Option C is wrong because AWS Snowball is a physical data transfer device for offline, bulk data migration, not suitable for continuous, low-latency replication. Option D is wrong because AWS Glue is a serverless ETL service primarily for batch data transformation and cataloging, not for continuous replication with minimal latency from live databases.

Full explanation →
128
MCQhard

A healthcare company uses Amazon RDS for PostgreSQL to store patient records. The database has a size of 1 TB and is running on a db.r5.large instance. The company requires that the database be highly available and have automated backups with point-in-time recovery (PITR) for the last 35 days. The operations team has configured Multi-AZ deployment and automated backups with a 35-day retention period. During a recent disaster simulation, the team attempted to restore the database to a point in time from 30 days ago. The restore operation failed because the backup was not available. On investigation, the team found that the automated backups were being deleted before the retention period ended. The team also noticed that the database has a large number of transaction logs generating a high volume of write activity. What is the most likely cause of the backups being deleted prematurely?

A.The RDS instance was deleted, which automatically deletes all automated backups.
B.The automated backup window was set to a time that conflicted with the database maintenance window.
C.The Multi-AZ deployment was not enabled during the backup process, causing backups to fail.
D.The database had manual snapshots that were deleted manually by the operations team.
AnswerA

When an RDS instance is deleted, automated backups are also deleted unless a final snapshot is taken.

Why this answer

When an RDS instance is deleted, all automated backups associated with that instance are automatically deleted, regardless of the configured retention period. In this scenario, the instance was not explicitly described as deleted, but the deletion of automated backups before the retention period ends is a classic symptom of instance deletion. Option B is incorrect because a conflicting backup window does not cause backups to be deleted; it only affects when backups are taken.

Option C is incorrect because Multi-AZ deployment does not affect backup retention; backups are still retained according to the retention period even if Multi-AZ is not enabled. Option D is incorrect because manual snapshots are independent of automated backups; deleting manual snapshots does not affect automated backup retention.

Full explanation →
129
MCQeasy

A company needs to ingest data from an external FTP server into AWS S3. The FTP server is not accessible from the internet. Which AWS service should be used to securely transfer the data?

A.Kinesis Data Firehose
B.AWS Transfer Family with SFTP endpoint in a VPC
C.AWS DataSync
D.AWS Snowball Edge
AnswerB

AWS Transfer Family supports SFTP and can be configured with a VPC endpoint to securely transfer data from an FTP server in a private network to S3.

Why this answer

AWS Transfer Family supports SFTP and can be configured with a VPC endpoint to securely transfer data from an FTP server in a private network to S3. Option A is wrong because Kinesis Data Firehose is designed for streaming data ingestion, not for FTP transfers. Option C is wrong because AWS DataSync requires network connectivity to the source, and the FTP server is not internet-accessible.

Option D is wrong because AWS Snowball Edge is intended for large-scale offline data transfers, not regular FTP-based transfers.

Full explanation →
130
MCQeasy

A data engineer is configuring an Amazon S3 lifecycle policy to transition objects to S3 Glacier Deep Archive after 90 days. The bucket receives new objects daily. The engineer wants to ensure that objects are not deleted before 90 days. Which lifecycle action should be used?

A.Expiration
B.Transition
C.NoncurrentVersionTransition
D.AbortIncompleteMultipartUpload
AnswerB

Transition moves objects to a different storage class.

Why this answer

(Transition) is correct because the S3 Lifecycle Transition action moves objects between storage classes over time. To ensure objects are moved to S3 Glacier Deep Archive after 90 days without deletion, a Transition rule is configured to specify the target storage class and the number of days from object creation.

Exam trap

The trap here is confusing Expiration (which deletes objects) with Transition (which moves objects to another storage class), leading candidates to select Expiration when the goal is to retain objects for a minimum period before moving them to archival storage.

How to eliminate wrong answers

Option A (Expiration) is wrong because it permanently deletes objects after a specified number of days, which would remove them before they could be transitioned to Glacier Deep Archive. Option C (NoncurrentVersionTransition) is wrong because it applies only to noncurrent versions of versioned objects, not to current objects in a non-versioned or versioned bucket. Option D (AbortIncompleteMultipartUpload) is wrong because it only aborts incomplete multipart uploads after a specified number of days, not transitioning or deleting complete objects.

Full explanation →
131
MCQeasy

A company wants to securely store database credentials used by a Lambda function. Which AWS service should be used to store and rotate the credentials automatically?

A.AWS CloudHSM
B.AWS Secrets Manager
C.AWS Key Management Service (KMS)
D.AWS Systems Manager Parameter Store
AnswerB

Secrets Manager is designed for storing secrets and supports automatic rotation of database credentials.

Why this answer

AWS Secrets Manager is designed for storing secrets and provides automatic rotation. Systems Manager Parameter Store can store secrets but does not natively support automatic rotation for database credentials. KMS is for encryption keys, not storing secrets.

CloudHSM is for hardware security modules.

Full explanation →
132
MCQhard

A data engineering team needs to ingest streaming data from thousands of IoT devices. The data must be processed in near real-time and stored in Amazon S3 in Apache Parquet format partitioned by device_id and timestamp. Which combination of services should the team use to minimize operational overhead and cost?

A.Amazon Kinesis Data Streams, Amazon EC2 for processing, and Amazon S3 with lifecycle policies.
B.Amazon MSK (Kafka), AWS Glue Streaming, and Amazon S3.
C.Amazon Kinesis Data Streams, Amazon Kinesis Data Firehose, and optionally AWS Lambda.
D.Amazon S3 Transfer Acceleration and AWS Lambda for event-driven transformation.
AnswerC

Kinesis provides serverless ingestion and Firehose handles delivery, Parquet conversion, and partitioning.

Why this answer

Amazon Kinesis Data Streams ingests streaming data from thousands of IoT devices in near real-time. Kinesis Data Firehose delivers the data directly to Amazon S3 with built-in conversion to Apache Parquet and automatic partitioning by device_id and timestamp, minimizing operational overhead. AWS Lambda can optionally be used for lightweight transformations if needed.

Option A is incorrect because using Amazon EC2 for processing adds significant operational overhead for scaling and management. Option B is incorrect because Amazon MSK (Kafka) and AWS Glue Streaming require more operational overhead and are not as cost-effective for this simple near-real-time use case. Option D is incorrect because S3 Transfer Acceleration is designed for large file transfers over long distances, not for streaming data ingestion, and AWS Lambda alone cannot handle continuous streaming without a dedicated ingestion service like Kinesis.

Full explanation →
133
MCQmedium

A company uses AWS Glue to run ETL jobs on data stored in S3. The data is encrypted with SSE-KMS. The Glue job fails with an 'AccessDenied' error when trying to read the data. What is the MOST likely cause?

A.The S3 bucket policy denies access to the Glue service role.
B.The AWS Glue Data Catalog does not have permission to the table.
C.The IAM role used by Glue does not have kms:Decrypt permission on the KMS key.
D.The Glue job's connection does not have the necessary permissions.
AnswerC

Glue needs kms:Decrypt to read SSE-KMS encrypted data.

Why this answer

When data is encrypted with SSE-KMS, the IAM role used by Glue must have kms:Decrypt permission on the KMS key to read the data. Without it, the Glue job will fail with an 'AccessDenied' error despite S3 bucket permissions. Option A is incorrect because the S3 bucket policy may allow access, but KMS permission is separate and required.

Option B is incorrect because the Glue Data Catalog permissions are for catalog operations, not for reading actual data from S3. Option D is incorrect because Glue connection permissions are for JDBC connections, not for S3 data access.

Full explanation →
134
MCQhard

Refer to the exhibit. A data engineer runs a Glue job manually and receives a ThrottlingException. The engineer checks the job run history and sees a previous failure with the same error. What is the MOST likely cause of the throttling, and which solution is MOST appropriate?

A.Increase the number of DPUs for the job to reduce runtime.
B.Implement retry logic with exponential backoff in the script that calls start-job-run.
C.Use AWS Glue reserved capacity to guarantee API throughput.
D.Delete old job runs to reduce the number of entries in the job run history.
AnswerB

Implementing retry logic with exponential backoff in the script that calls StartJobRun handles transient throttling by retrying after delays, which is the appropriate solution for exceeding API rate limits.

Why this answer

The error 'ThrottlingException' indicates the Glue API rate limit has been exceeded. The most likely cause is making too many API calls, such as multiple concurrent job starts. Implementing retry logic with exponential backoff in the script that calls StartJobRun will handle transient throttling.

Option A (increasing DPUs) does not affect API rate limits. Option C (using reserved capacity) reserves compute capacity, not API throughput, so it does not prevent throttling. Option D (deleting old job runs) does not reduce API calls; it only affects job history visibility.

Full explanation →
135
MCQhard

A data engineer is using AWS DMS to migrate a 2 TB Oracle database to Amazon Aurora PostgreSQL. The migration is running in full load mode with ongoing replication. After the full load completes, the ongoing replication task shows a 'TargetMetadata' error: 'ERROR: duplicate key value violates unique constraint'. The engineer verifies that the target table already contains the data. What should the engineer do to resolve this issue?

A.Enable 'BatchApplyEnabled' and set 'TaskRecoveryTableEnabled' to false in the task settings.
B.Disable the unique constraint on the target table.
C.Truncate the target table and restart the full load.
D.Drop the indexes on the target table and recreate them after the migration.
AnswerA

Batch apply minimizes duplicate key errors, and disabling recovery table prevents re-application of already-applied changes.

Why this answer

Enabling 'BatchApplyEnabled' allows DMS to batch changes and reduces duplicate key errors, while setting 'TaskRecoveryTableEnabled' to false prevents recovery attempts that can reapply already committed transactions. Option B is wrong because disabling constraints compromises data integrity. Option C is wrong because truncating and restarting loses existing data and does not address the ongoing replication issue.

Option D is wrong because dropping indexes does not prevent duplicate key violations.

Exam trap

A common mistake is to think that truncating the target table is necessary, but that would cause data loss and downtime. Another mistake is to disable constraints, which can lead to data integrity issues.

Full explanation →
136
Multi-Selectmedium

A data engineer is troubleshooting a slow-running Amazon Athena query on a large dataset stored in S3. The query scans many small files. Which TWO actions can improve query performance?

Select 2 answers
A.Increase the number of files to increase parallelism
B.Disable S3 server-side encryption
C.Concatenate small files into larger files
D.Partition the data by a frequently filtered column
E.Convert files from CSV to JSON
AnswersC, D

Reduces file open overhead.

Why this answer

Concatenating small files into larger files reduces the overhead of file listing and task scheduling, improving query performance. Option D is correct because partitioning the data by a frequently filtered column allows Athena to use partition pruning, scanning only relevant partitions and reducing the amount of data read. Option A is incorrect because increasing the number of small files increases overhead and worsens performance.

Option B is incorrect because disabling S3 server-side encryption does not affect query performance. Option E is incorrect because converting from CSV to JSON does not improve query performance; columnar formats like Parquet or ORC would be beneficial.

Full explanation →
137
MCQmedium

A media company ingests video files from content partners into an Amazon S3 bucket. Each video file is 10-50 GB. Upon upload, an AWS Lambda function is triggered to extract metadata (e.g., resolution, duration) and store it in DynamoDB. The company now wants to also generate a thumbnail image for each video. The thumbnail generation is CPU-intensive and can take up to 5 minutes per video. The Lambda function has a maximum execution time of 15 minutes. The company has noticed that some thumbnail generation tasks are timing out. What should the data engineer do to reliably generate thumbnails for all videos?

A.Provision an EC2 instance to run a script that polls S3 for new videos and generates thumbnails
B.Use AWS Glue with a Python shell job to generate thumbnails
C.Increase the Lambda timeout to 15 minutes and allocate more memory
D.Use AWS Batch to run a containerized thumbnail generation job triggered by S3 events
AnswerD

Batch is optimized for batch computing and can handle long-running jobs.

Why this answer

Use AWS Batch to run a containerized thumbnail generation job triggered by S3 events. AWS Batch is designed for long-running, compute-intensive workloads like video processing, and it can automatically scale resources based on the job queue. Option A (EC2 instance) requires manual management and scaling.

Option B (Glue Python shell) is intended for ETL jobs, not CPU-intensive video processing. Option C (increasing Lambda timeout and memory) may still not be reliable for 5-minute thumbnail generation since Lambda has a maximum execution time of 15 minutes and is not optimized for heavy compute tasks; it could still time out or be cost-inefficient.

Full explanation →
138
MCQeasy

A company needs to store application log files for 90 days for compliance. The logs are generated continuously and are rarely accessed after 30 days. The data engineer must minimize storage costs. Which storage solution should the engineer choose?

A.Amazon CloudWatch Logs with a retention policy of 90 days
B.Amazon S3 Glacier Deep Archive
C.Amazon EBS gp3 volumes attached to an EC2 instance
D.Amazon S3 Standard with a lifecycle policy to transition to S3 Standard-IA after 30 days and expire after 90 days
AnswerD

This minimizes cost by using cheaper storage for infrequently accessed data and deleting after compliance period.

Why this answer

Amazon S3 Standard with a lifecycle policy to transition to S3 Standard-IA after 30 days and expire after 90 days is correct because it aligns with the access pattern: logs are frequently accessed only in the first 30 days, then rarely accessed for the remaining 60 days. S3 Standard-IA offers lower storage costs for infrequently accessed data while still providing millisecond retrieval, and the lifecycle policy automates the transition and eventual deletion, minimizing costs without sacrificing availability.

Exam trap

The trap here is that candidates often choose CloudWatch Logs (Option A) because it is a familiar logging service, but they overlook that its cost model (per GB ingested, per GB stored, and per GB archived) can be significantly higher than S3 for long-term retention of large log volumes, and it lacks the automated tiering to lower-cost storage classes.

How to eliminate wrong answers

Option A is wrong because Amazon CloudWatch Logs is designed for real-time monitoring and log ingestion, not for long-term, cost-optimized archival storage; its retention policy only controls deletion, not tiered storage transitions, and costs can be higher than S3 for large volumes of rarely accessed logs. Option B is wrong because S3 Glacier Deep Archive is intended for data that is accessed at most once or twice a year and has retrieval times of 12 hours or more, making it unsuitable for logs that may need occasional access within 90 days; it also incurs minimum storage charges that make it cost-ineffective for short retention periods. Option C is wrong because EBS gp3 volumes attached to an EC2 instance incur compute costs even when idle, and managing log storage on block storage requires manual lifecycle management, leading to higher operational overhead and cost compared to a fully managed object storage solution.

Full explanation →
139
MCQmedium

A company is using Amazon Kinesis Data Streams with a Lambda consumer to process clickstream data. The data rate is high and the Lambda function is falling behind, resulting in increased processing latency. What is the MOST effective way to improve throughput?

A.Increase the memory allocated to the Lambda function.
B.Increase the Lambda function timeout.
C.Use Kinesis Data Firehose instead of Lambda.
D.Increase the number of shards in the Kinesis stream.
AnswerD

More shards increase parallelism and throughput.

Why this answer

Increasing the number of shards in the Kinesis stream increases the stream's total read capacity, allowing more concurrent Lambda invocations to process records in parallel. Since each shard supports up to 5 read transactions per second and a maximum of 2 MB/s read throughput, adding shards directly raises the aggregate throughput, enabling the Lambda consumer to keep up with the high data rate.

Exam trap

The DEA-C01 exam often tests the misconception that Lambda performance tuning (memory/timeout) is the primary solution for stream processing backpressure, when in fact the shard count is the fundamental parallelism bottleneck in Kinesis Data Streams with a Lambda consumer.

How to eliminate wrong answers

Option A is wrong because increasing Lambda memory also increases CPU allocation, which can speed up individual function execution, but it does not address the bottleneck of limited shard-level parallelism; the function is falling behind due to insufficient concurrent processing capacity, not per-invocation performance. Option B is wrong because increasing the Lambda timeout only allows the function to run longer before being terminated, but it does not improve throughput; if the function is already timing out, extending the timeout may mask the issue but does not increase the rate at which records are consumed. Option C is wrong because Kinesis Data Firehose is a delivery stream that buffers and loads data to destinations like S3 or Redshift; it does not support real-time per-record processing with custom logic like Lambda, and switching to Firehose would lose the ability to transform or react to each record individually, which is likely required for clickstream processing.

Full explanation →
140
Multi-Selecteasy

A company wants to enforce encryption in transit for data moving between an EC2 instance and an S3 bucket. Which TWO methods can achieve this? (Choose 2)

Select 2 answers
A.Add a bucket policy that denies requests without the aws:SecureTransport condition.
B.Use a VPC endpoint for S3.
C.Enable default SSE-S3 encryption on the bucket.
D.Use the HTTPS endpoint for S3 API calls.
E.Enable CloudTrail to monitor for non-encrypted requests.
AnswersA, D

This enforces HTTPS.

Why this answer

Options A and D are correct. Option A: Adding a bucket policy with the aws:SecureTransport condition denies any requests that are not using HTTPS, thus enforcing encryption in transit. Option D: By using the HTTPS endpoint for S3 API calls, data is encrypted in transit via TLS.

Option B is incorrect because a VPC endpoint for S3 does not automatically enforce encryption; it only keeps traffic within the AWS network. Option C is incorrect because SSE-S3 is for server-side encryption at rest, not in transit. Option E is incorrect because CloudTrail is a logging service and does not enforce encryption.

Full explanation →
141
Multi-Selectmedium

Which TWO actions are recommended for securing data at rest in Amazon S3? (Choose two.)

Select 2 answers
A.Enable default encryption on the S3 bucket using SSE-S3 or SSE-KMS.
B.Use S3 Bucket Key to reduce KMS request costs.
C.Enable S3 Versioning to protect against accidental deletions.
D.Apply a bucket policy that denies PutObject requests without the x-amz-server-side-encryption header.
E.Configure cross-region replication to replicate data to another bucket.
AnswersA, D

Ensures all new objects are encrypted automatically.

Why this answer

Enabling default encryption on an S3 bucket using SSE-S3 or SSE-KMS ensures that all objects stored in the bucket are encrypted at rest automatically, even if the upload request does not include encryption headers. This satisfies the requirement for securing data at rest by applying server-side encryption to every object written to the bucket.

Exam trap

The trap here is that candidates often confuse data protection features like Versioning or replication with encryption controls, but the question specifically asks for securing data at rest, which requires encryption mechanisms such as default encryption or policy-enforced encryption headers.

Full explanation →
142
Multi-Selectmedium

A data engineer is troubleshooting an Amazon Redshift cluster that has experienced a node failure. The engineer needs to ensure that the cluster is highly available and can withstand a single node failure with minimal downtime. Which TWO actions should the engineer take?

Select 2 answers
A.Enable automated snapshots with cross-region copy.
B.Enable concurrency scaling to handle increased read traffic.
C.Deploy the cluster as a single-node cluster for simplicity.
D.Place the cluster in a public subnet with an internet gateway.
E.Use a multi-node cluster with RA3 node types.
AnswersA, E

Enables recovery from a node failure by restoring from a cross-region snapshot. While it requires some downtime for restore, it is a key high-availability feature.

Why this answer

Options A and E are considered correct for ensuring high availability in Amazon Redshift. Option A: Automated snapshots with cross-region copy enable recovery from a node failure by restoring data from a snapshot in another region, which reduces downtime but does not guarantee zero downtime. Option E: A multi-node cluster with RA3 node types separates compute and storage, allowing faster node replacement and minimizing downtime, though it does not eliminate it entirely.

The exam expects these as the best actions among the given choices to improve availability and withstand a single node failure.

Full explanation →
143
MCQhard

A data engineer is designing a data ingestion pipeline for clickstream data that arrives in bursts, up to 100 MB/s, and must be processed with exactly-once semantics. The data must be stored in Amazon S3 partitioned by event date and hour. Which combination of services should the engineer use?

A.Amazon Kinesis Data Streams with AWS Lambda consumer writing to S3.
B.Amazon Kinesis Data Firehose with S3 destination and dynamic partitioning.
C.AWS Glue streaming ETL job reading from Amazon MSK and writing to S3.
D.Amazon Kinesis Data Streams with KCL application writing to S3.
AnswerB

Firehose handles bursts and supports partitioning with no custom code.

Why this answer

Amazon Kinesis Data Firehose with dynamic partitioning can directly ingest high-velocity clickstream data (up to 100 MB/s bursts) and automatically partition it by event date and hour in S3 with no custom code. It supports exactly-once delivery to S3 when configured with the `S3DestinationConfiguration` and appropriate error handling, meeting the burst throughput and partitioning requirements without managing consumers.

Exam trap

The trap here is that candidates often choose Kinesis Data Streams with Lambda (Option A) for real-time processing, overlooking Lambda's throughput limits and the fact that Firehose is purpose-built for high-volume streaming ingestion with automatic partitioning and exactly-once delivery to S3.

How to eliminate wrong answers

Option A is wrong because AWS Lambda has a maximum invocation duration of 15 minutes and a payload limit of 6 MB for synchronous invocations, making it unsuitable for sustained 100 MB/s bursts without complex sharding and throttling risks. Option C is wrong because AWS Glue streaming ETL jobs reading from Amazon MSK require managing Kafka clusters and do not natively provide exactly-once semantics to S3 without additional checkpointing logic, and MSK adds operational overhead. Option D is wrong because a Kinesis Client Library (KCL) application requires provisioning and managing compute resources (e.g., EC2 or ECS) to process records, and writing directly to S3 from a custom application does not guarantee exactly-once semantics without idempotency handling, unlike Firehose's built-in buffering and retry mechanism.

Full explanation →
144
MCQmedium

A data engineer needs to set up a data catalog for a new data lake in AWS Glue. The data resides in S3 in Parquet format. The engineer wants to ensure that the schema is automatically detected and updated when new columns are added to the data. Which configuration should the engineer use?

A.Add a partition index to the Glue Data Catalog table.
B.Configure the crawler's 'Schema updates' option to 'Update the table schema'.
C.Set the crawler's 'Database' output to a new database.
D.Enable partition indexing on the table.
AnswerB

This enables automatic schema detection and updates.

Why this answer

Configuring the crawler's 'Schema updates' option to 'Update the table schema' allows Glue crawlers to automatically detect and update the schema when new columns are added to the data. Option A is wrong because a partition index is used to improve query performance on partitioned data, not to update the schema. Option C is wrong because setting the crawler's database output to a new database does not affect schema updates; it simply directs the crawler to write to a different database.

Option D is wrong because partition indexing (enable partition indexing) is about indexing partitions for faster querying, not about schema updates.

Full explanation →
145
MCQhard

A data team runs a daily AWS Glue ETL job that processes data from an Amazon Redshift cluster and writes results to Amazon S3. The job completes successfully but takes 2 hours longer than expected. The job uses the JDBC connection to Redshift. The Redshift cluster is 4 dc2.large nodes. The Glue job has 10 workers of type G.1X. Which change would MOST likely reduce the job duration?

A.Use Redshift Spectrum to query data directly from S3
B.Use the S3 staging option in the Glue connection to unload data from Redshift to S3 first
C.Increase the Redshift cluster size to 8 nodes
D.Increase the number of Glue workers to 20
AnswerB

UNLOAD is parallel and faster than JDBC; Glue can then read from S3.

Why this answer

The JDBC connection in AWS Glue reads data row-by-row from Redshift, which is slow for large datasets. By enabling the S3 staging option in the Glue connection, the job uses Redshift's UNLOAD command to export data to S3 in parallel, then Glue reads from S3. This bypasses the JDBC bottleneck and leverages Redshift's massively parallel processing (MPP) to export data much faster.

Exam trap

The trap here is that candidates assume the bottleneck is either Redshift compute (C) or Glue parallelism (D), when in fact the JDBC driver's single-threaded row-by-row fetch is the primary performance limiter.

How to eliminate wrong answers

Option A is wrong because Redshift Spectrum queries data directly from S3, but the source data is in Redshift, not S3; Spectrum does not help extract data from Redshift. Option C is wrong because the bottleneck is the JDBC connection, not Redshift compute capacity; adding more Redshift nodes would not speed up a single-threaded JDBC read. Option D is wrong because increasing Glue workers only helps if the job is CPU-bound or parallelizable; the JDBC read is I/O-bound and limited by the single connection, so more workers would not reduce the 2-hour delay.

Full explanation →
146
MCQeasy

A company wants to audit all changes to IAM policies in their AWS account. Which AWS service should be used to record these changes?

A.AWS Config
B.AWS CloudTrail
C.Amazon GuardDuty
D.Amazon Inspector
AnswerA

Config tracks configuration changes and can record IAM policy changes.

Why this answer

AWS Config records configuration changes to AWS resources, including IAM policies. CloudTrail records API calls, not configuration snapshots. GuardDuty is for threat detection.

Inspector is for vulnerability assessment.

Full explanation →
147
Multi-Selecteasy

A company is using AWS Glue to catalog data in Amazon S3. The data is stored in CSV format, but the schema is not consistent across all files. Which TWO actions can the company take to handle schema evolution and ensure the Glue Data Catalog is up to date? (Choose TWO.)

Select 2 answers
A.Configure the Glue crawler to update the table schema on each run.
B.Manually update the Glue Data Catalog tables whenever the schema changes.
C.Disable schema update in the crawler and add partitions manually.
D.Schedule the Glue crawler to run periodically to detect changes.
E.Require all data producers to use a single fixed schema.
AnswersA, D

This allows the crawler to automatically detect and apply schema changes.

Why this answer

Options A and D are correct. Configuring the Glue crawler to update the table schema on each run (A) allows automatic schema evolution, while scheduling the crawler to run periodically (D) ensures that changes in the data are captured. Option B (manual update) is not scalable.

Option C (disabling schema update) would prevent automatic updates. Option E (fixed schema) is impractical for evolving data.

Full explanation →
148
MCQhard

A data engineer runs an AWS Glue ETL job that reads from a large Amazon S3 source (several terabytes of CSV files) and writes transformed data to an S3 bucket in Parquet format. The job fails with the error shown in the exhibit. The job uses the Standard worker type with 10 workers (G.1X). The engineer needs to resolve the failure with minimal cost increase. What should the engineer do?

A.Increase the number of workers to 20 while keeping G.1X worker type.
B.Change the worker type to G.2X with 10 workers.
C.Change the worker type to G.4X with 10 workers.
D.Set the 'coalesce' parameter to reduce the number of output files.
AnswerB

G.2X provides double the memory (32 GB) per worker compared to G.1X (16 GB), resolving the heap space error with minimal cost increase.

Why this answer

The error indicates that the Glue job is running out of memory during the shuffle phase, which is common when processing large datasets with transformations that require data redistribution. Changing the worker type to G.2X doubles the memory per worker (from 16 GB to 32 GB) without increasing the number of workers, providing the necessary memory headroom for the shuffle operation at a minimal cost increase compared to scaling out with more workers.

Exam trap

The trap here is that candidates assume scaling out (more workers) is always the cheapest fix, but increasing worker memory (scaling up) is often more cost-effective for memory-bound shuffle operations because it avoids the overhead of additional task serialization and network shuffling.

How to eliminate wrong answers

Option A is wrong because increasing the number of workers to 20 with G.1X type adds more total memory but does not address the per-worker memory limit; the shuffle phase still runs on individual executors and may exceed the 16 GB limit, plus it increases cost more than changing worker type. Option C is wrong because G.4X provides 64 GB per worker, which is excessive over-provisioning for this scenario and results in a higher cost than necessary. Option D is wrong because setting 'coalesce' reduces the number of output files but does not increase the memory available to executors during the shuffle phase; the failure is due to memory exhaustion during processing, not output file count.

Full explanation →
149
Multi-Selecthard

A company uses AWS DMS to continuously replicate data from an on-premises SQL Server to Amazon Aurora MySQL. The replication lag is increasing. Which THREE actions can reduce the lag? (Choose three.)

Select 3 answers
A.Use parallel apply on the target endpoint.
B.Filter out unnecessary tables from replication.
C.Enable DMS validation.
D.Enable Multi-AZ for the DMS replication instance.
E.Increase the DMS replication instance size.
AnswersA, B, E

Parallel apply speeds up writes on the target.

Full explanation →
150
MCQeasy

A data analyst needs to query a large Amazon S3 bucket containing CSV files using Amazon Athena. The bucket has millions of small files (less than 1 MB each). The analyst reports that queries are very slow and often time out. The data is partitioned by date and the partition columns are defined in the table. What is the most effective way to improve query performance?

A.Convert the files to Apache Parquet format using an AWS Glue ETL job.
B.Run a compaction job to consolidate small files into fewer larger files (e.g., 128 MB each).
C.Add more partitions by including hour and minute as partition keys.
D.Use S3 Select to push down filtering to S3 before Athena processes the data.
AnswerB

Consolidating small files reduces the overhead of listing and reading many objects, significantly improving Athena performance.

Why this answer

Many small files (under 1 MB) cause high overhead because each file requires a separate read operation and metadata call. Consolidating them into fewer larger files (e.g., 128 MB each) reduces the number of read operations and improves I/O efficiency, directly addressing the root cause of slowdowns and timeouts. Option A (converting to Parquet) improves storage efficiency and query performance but does not reduce the file count; it is a beneficial addition but not the most effective standalone fix for the small file problem.

Option C (adding more partitions) would increase overhead by creating even more directories/files to scan. Option D (S3 Select) applies within individual files and does not mitigate overhead from file quantity.

Full explanation →
Page 1

Page 2 of 23

Page 3

All pages

1234567891011121314151617181920212223

Practice DEA-C01 by domain

Target a specific domain to shore up weak areas.

Data Ingestion and TransformationData Operations and SupportData Security and GovernanceData Store Management
See all domains with question counts →