Courseiva

AWS Certified Data Engineer Associate DEA-C01 (DEA-C01) — Questions 1426–1500

1711 questions total · 23pages · All types, answers revealed

Take a mock examExam hub
Page 19

Page 20 of 23

Page 21
1426
MCQhard

A company runs a data pipeline that ingests streaming data from an IoT fleet into Amazon Kinesis Data Streams (KDS) with 50 shards. A Lambda function processes records from the stream and writes them to an Amazon DynamoDB table for real-time analytics. The Lambda function is configured with a batch size of 100 and a maximum batching window of 60 seconds. Recently, the company has been seeing an increasing number of 'WriteProvisionedThroughputExceededException' errors from DynamoDB, causing Lambda to retry and eventually send records to a dead-letter queue (DLQ). The DynamoDB table is provisioned with 5000 read capacity units (RCU) and 5000 write capacity units (WCU). The average item size is 1 KB. The KDS stream receives an average of 8000 records per second, each 2 KB in size. The Lambda function performs a simple transformation and writes each record individually to DynamoDB. The company wants to reduce the throttling errors without increasing the DynamoDB WCU provision. Which course of action is most likely to achieve this?

A.Modify the Lambda function to use DynamoDB BatchWriteItem to write records in batches of 25.
B.Increase the Lambda function's reserved concurrency to 1000.
C.Increase the Lambda function timeout to 5 minutes to allow more time for retries.
D.Increase the Lambda batch size to 500 and reduce the batching window to 30 seconds.
AnswerD

Incorrect. Increasing the Kinesis batch size to 500 and reducing the batching window to 30 seconds means each Lambda invocation will process more records, but if each record is still written individually to DynamoDB, the total number of write requests per second remains the same. Additionally, more records per invocation increases the likelihood of exceeding the per-request or per-partition write limits, potentially increasing throttling.

Why this answer

Increasing the Lambda batch size to 500 reduces the number of Lambda invocations per second from approximately 80 to 16, and reducing the batching window to 30 seconds helps spread writes more evenly across time. This lowers the concurrency of write operations to DynamoDB, which can reduce the frequency of 'WriteProvisionedThroughputExceededException' errors by staying within the provisioned 5000 WCU more consistently, even though the total write capacity required (16000 WCU) exceeds provisioned. Options A and B do not reduce the write load—batching writes (A) still consumes the same WCU, and increasing concurrency (B) worsens throttling.

Option C is irrelevant as timeout does not affect write rate.

Full explanation →
1427
Multi-Selectmedium

A data engineer is designing a disaster recovery plan for an Amazon RDS for MySQL database. The database must have a Recovery Point Objective (RPO) of less than 5 minutes and a Recovery Time Objective (RTO) of less than 30 minutes. Which TWO actions should the engineer take to meet these requirements?

Select 2 answers
A.Enable automated backups with a 1-day retention period and point-in-time recovery.
B.Enable Multi-AZ deployment.
C.Enable automated backups with a 5-minute retention period.
D.Create a cross-Region read replica.
E.Use a single-AZ instance with a standby in another Region.
AnswersA, B

Automated backups with point-in-time recovery allow restoring to any point within the retention period, achieving RPO of 5 minutes.

Why this answer

Options A and B are correct. Multi-AZ deployment (B) provides automatic failover to a standby in a different Availability Zone, meeting the RTO of less than 30 minutes. Automated backups with point-in-time recovery (A) allow recovery to any point within the retention period, enabling an RPO of less than 5 minutes.

Option C is wrong because automated backups have a minimum retention of 1 day; you cannot set a 5-minute retention. Option D is wrong because a cross-Region read replica requires manual promotion and does not provide automatic failover, resulting in higher RTO. Option E is wrong because a single-AZ instance without Multi-AZ does not provide automatic failover, leading to RTO exceeding 30 minutes.

Full explanation →
1428
Multi-Selecthard

Which THREE considerations are important when designing a DynamoDB table for high-traffic gaming leaderboards? (Choose three.)

Select 3 answers
A.Use strongly consistent reads for all queries
B.Enable DynamoDB Accelerator (DAX) for low-latency reads
C.Use Time to Live (TTL) to automatically expire old scores
D.Use DynamoDB Adaptive Capacity to handle uneven access patterns
E.Enable DynamoDB Streams for real-time updates
AnswersB, C, D

DAX provides caching for fast reads.

Why this answer

DynamoDB Accelerator (DAX) provides in-memory caching for DynamoDB tables, reducing read latency from single-digit milliseconds to microseconds. For high-traffic gaming leaderboards, where millions of players query scores concurrently, DAX offloads read traffic from the main table, preventing throttling and ensuring consistent low-latency responses for the most frequently accessed data.

Exam trap

The trap here is that candidates often confuse DynamoDB Streams with a read-acceleration feature, but Streams are strictly for change data capture and do not reduce query latency or handle high read throughput.

Full explanation →
1429
MCQhard

A company is ingesting data from multiple on-premises databases into AWS using AWS Database Migration Service (DMS). The data must be continuously replicated with minimal downtime. However, the source databases do not support native CDC. What should the data engineer do to enable continuous replication?

A.Use Amazon Kinesis Data Streams with a custom producer to capture database changes.
B.Use Amazon Redshift Spectrum to directly query the on-premises databases.
C.Use AWS DMS with log-based CDC if the source databases support it; otherwise, use DMS with batch replication and schedule frequent refreshes.
D.Set up AWS Glue jobs to run every minute to extract and load the data.
AnswerC

DMS supports CDC via source database logs, and if not available, batch replication can approximate continuous sync.

Why this answer

When source databases do not support native CDC, AWS DMS can still achieve continuous replication by using log-based CDC if the database engine supports it (e.g., Oracle, SQL Server, MySQL, PostgreSQL). If log-based CDC is not supported, DMS batch replication with frequent scheduled refreshes provides near-continuous replication by periodically extracting full or incremental changes, minimizing downtime. This approach leverages DMS's built-in task settings for change data capture and resumption without requiring external streaming services.

Exam trap

The trap here is that candidates assume AWS DMS always requires native CDC or that Kinesis is the only way to achieve streaming replication, but DMS provides fallback mechanisms like batch replication with frequent refreshes to handle sources without native CDC support.

How to eliminate wrong answers

Option A is wrong because Amazon Kinesis Data Streams with a custom producer requires building and maintaining custom code to capture database changes, which adds complexity and does not leverage AWS DMS's native replication capabilities; it also does not address the lack of native CDC in the source databases. Option B is wrong because Amazon Redshift Spectrum is a query engine for data in Amazon S3 and cannot directly query on-premises databases; it requires data to already be in S3 and does not provide continuous replication. Option D is wrong because AWS Glue jobs running every minute are batch-oriented and not designed for continuous, low-latency replication; they introduce significant overhead and cannot achieve minimal downtime compared to DMS's CDC or scheduled batch replication.

Full explanation →
1430
MCQeasy

A company uses AWS Database Migration Service (DMS) to continuously replicate data from an on-premises Oracle database to Amazon S3. The data is stored as CSV files. The downstream team requires the data to be in Apache Parquet format. Which change should the data engineer make to the DMS task?

A.Modify the DMS task to use Apache Parquet as the target table preparation mode.
B.Add an S3 lifecycle rule to convert CSV to Parquet.
C.Change the DMS task to use full load instead of continuous replication.
D.Configure a Lambda function to transform data after DMS writes to S3.
AnswerA

DMS can write directly in Parquet format.

Why this answer

AWS DMS supports specifying Apache Parquet as the target data format for Amazon S3 targets directly within the task configuration. By setting the 'Data format' to 'Parquet' in the S3 target endpoint or task settings, DMS automatically converts the replicated data into Parquet files, eliminating the need for post-processing. This is the most efficient and native approach to meet the downstream team's requirement.

Exam trap

The trap here is that candidates may assume DMS only supports CSV for S3 targets, overlooking the built-in Parquet option, and instead choose a complex workaround like Lambda or lifecycle rules.

How to eliminate wrong answers

Option B is wrong because S3 lifecycle rules can transition objects between storage classes or expire them, but they cannot convert file formats (e.g., CSV to Parquet). Option C is wrong because changing from continuous replication to full load would stop ongoing data synchronization and does not address the format conversion requirement. Option D is wrong because while a Lambda function could transform CSV to Parquet, it introduces unnecessary complexity, latency, and cost compared to the native DMS capability; DMS can directly write Parquet without additional services.

Full explanation →
1431
Multi-Selectmedium

A company is using Amazon DynamoDB as a data store for a real-time application. The application reads a single item by primary key and occasionally updates it. The data engineer notices high read latency during peak hours. Which TWO actions would most effectively reduce read latency?

Select 2 answers
A.Increase the read capacity units for the table.
B.Enable DynamoDB global tables.
C.Add a local secondary index on the table.
D.Disable auto-scaling and set a fixed read capacity.
E.Enable DynamoDB Accelerator (DAX) for the table.
AnswersA, E

More capacity reduces throttling and latency during peaks.

Why this answer

Increasing read capacity units (RCUs) for the DynamoDB table directly allocates more read throughput, reducing throttling and latency during peak hours when read demand exceeds provisioned capacity. This ensures the application can handle the higher read load without experiencing request throttling, which is a primary cause of increased latency.

Exam trap

The trap here is that candidates may confuse global tables or secondary indexes as solutions for read latency, when in fact they address different concerns (disaster recovery and query flexibility), while the correct approach is to either increase provisioned throughput or implement a caching layer like DAX.

Full explanation →
1432
MCQmedium

A company is designing a data lake on AWS and must comply with GDPR requirements. The company needs to implement data masking for personally identifiable information (PII) columns in Amazon Redshift. Which feature should be used?

A.Use Amazon RDS Proxy to intercept queries
B.Amazon S3 Object Lambda to mask data on the fly
C.Create views in Redshift that apply masking functions
D.AWS Lake Formation row-level security
AnswerC

Redshift views can apply masking functions to hide PII.

Why this answer

Amazon Redshift supports dynamic data masking through views that apply masking functions, such as using CASE statements or custom masking functions to obfuscate PII columns. Option A is incorrect because Amazon RDS Proxy is a connection proxy for RDS databases and does not provide data masking capabilities for Redshift. Option B is incorrect because Amazon S3 Object Lambda is used to transform data in S3, not to mask data in Redshift queries.

Option D is incorrect because AWS Lake Formation row-level security filters rows based on permissions but does not mask or obfuscate column values; it is for access control, not data masking.

Full explanation →
1433
MCQmedium

A data engineer is troubleshooting a step function that orchestrates ETL jobs. The state machine fails with 'State Machine Execution Throttled' error. What should the engineer do to resolve this?

A.Reduce the number of steps in the state machine.
B.Set up a CloudWatch alarm to detect throttling and retry.
C.Adjust the API rate limits in the state machine definition.
D.Request a service quota increase for concurrent executions.
AnswerD

Increasing the limit resolves the throttling.

Why this answer

The 'State Machine Execution Throttled' error indicates that the state machine has exceeded the default concurrent execution limit for Step Functions. The proper resolution is to request a service quota increase from AWS Support for the concurrently running executions. Option A is incorrect: reducing the number of steps does not affect the limit on concurrent executions.

Option B is incorrect: a CloudWatch alarm can detect throttling but cannot resolve it; the alarm would only notify, not increase quotas. Option C is incorrect: API rate limits are not the same as execution throttling; Step Functions has separate limits for API call rate and concurrent executions. Adjusting API rate limits would not address execution throttling.

Full explanation →
1434
MCQhard

A company uses Kinesis Data Firehose with a Lambda function for data transformation. The transformation is failing intermittently due to Lambda timeouts. The maximum record size is 1 MB. What is the most cost-effective way to reduce failures without losing data?

A.Use Kinesis Data Analytics to pre-process data before Firehose
B.Decrease the Firehose batch size to reduce the number of records per invocation
C.Configure the Firehose delivery stream to send failed records to an S3 dead-letter bucket
D.Increase the Lambda function timeout and memory allocation
AnswerD

Increasing timeout and memory reduces timeouts without losing data.

Why this answer

The most cost-effective way to reduce failures from Lambda timeouts without losing data is to increase the Lambda function's timeout and memory allocation (Option D). Lambda timeouts occur when the transformation takes longer than the allocated timeout. Increasing memory also increases CPU, which can speed up processing and reduce timeouts.

This approach is cost-effective because you only pay for the increased resources when the function runs, and it avoids data loss since all records are still transformed. Option A (Kinesis Data Analytics) adds unnecessary complexity and cost. Option B (decreasing batch size) reduces the number of records per invocation, which can help but may increase costs because more invocations are needed; also, it doesn't directly address timeouts.

Option C (sending failed records to an S3 dead-letter bucket) would result in data loss for those records, as they are not transformed, and the question says 'without losing data'. Thus, D is the best choice.

Full explanation →
1435
MCQeasy

A media company stores video files in an Amazon S3 bucket with S3 Standard storage class. The files are accessed frequently for the first 30 days, then rarely after that. However, the company must be able to restore any deleted file within 7 days. The company wants to minimize storage costs while meeting the access and retention requirements. What should a data engineer do?

A.Use S3 Standard-IA storage class from the start.
B.Use a lifecycle policy to transition objects to S3 One Zone-IA after 30 days.
C.Use S3 Glacier Deep Archive after 30 days and enable S3 Object Lock for retention.
D.Use S3 Intelligent-Tiering and enable S3 Versioning on the bucket.
AnswerD

S3 Intelligent-Tiering optimizes costs by moving data between access tiers, and Versioning allows recovery of deleted objects.

Why this answer

S3 Intelligent-Tiering automatically moves objects between access tiers (frequent, infrequent, and archive instant access) based on changing access patterns, which minimizes storage costs for data with unknown or changing access patterns. Enabling S3 Versioning allows the company to restore any deleted file within 7 days by reverting to a previous version, meeting the retention requirement without additional cost for a separate backup.

Exam trap

The trap here is that candidates may overlook the requirement to restore deleted files within 7 days and focus only on cost optimization, leading them to choose a storage class like S3 Standard-IA or S3 One Zone-IA that lacks versioning or retention capabilities, or they may incorrectly assume S3 Object Lock can restore already deleted files.

How to eliminate wrong answers

Option A is wrong because S3 Standard-IA has a minimum storage duration charge of 30 days and a per-GB retrieval cost, making it more expensive than S3 Standard for the first 30 days of frequent access, and it does not provide the ability to restore deleted files within 7 days. Option B is wrong because S3 One Zone-IA does not provide the same durability as S3 Standard (it stores data in a single Availability Zone) and lacks versioning or retention features to restore deleted files within 7 days; additionally, transitioning after 30 days incurs lifecycle transition costs. Option C is wrong because S3 Glacier Deep Archive has a minimum storage duration of 180 days and a retrieval time of 12 hours or more, which does not meet the requirement to restore deleted files within 7 days; S3 Object Lock only prevents object deletion or overwrites, but does not enable restoration of already deleted files.

Full explanation →
1436
MCQmedium

A company uses AWS Kinesis Data Streams to ingest real-time data. The data engineer notices that the stream's 'WriteProvisionedThroughputExceeded' error occurs frequently during peaks. Which action should be taken to resolve this issue?

A.Increase the number of shards in the stream.
B.Modify the producer to use a different partition key.
C.Compress the data before sending to the stream.
D.Enable enhanced fan-out for consumers.
AnswerA

More shards provide higher write throughput.

Why this answer

Increasing the number of shards increases the write capacity, directly addressing the throughput exceeded error. Option B is wrong because the error is not from the producer side. Option C is wrong because the error is about write throughput, not read.

Option D is wrong because the error is not about data format.

Full explanation →
1437
MCQhard

A data team uses the CloudFormation template in the exhibit to create an S3 bucket for storing log files. After one year, they notice that the bucket size is larger than expected. They investigate and find that older versions of objects are not being deleted or transitioned. What is the most likely cause?

A.The lifecycle rule does not apply to noncurrent versions because it lacks NoncurrentVersionExpiration or NoncurrentVersionTransition.
B.The lifecycle rule is not enabled because the Status property is not set to 'Enabled' properly.
C.The bucket has versioning enabled, but the lifecycle rule only applies to current versions.
D.The expiration in days is set to 365, which is too short.
AnswerA

Old versions are not managed by the rule.

Why this answer

The lifecycle rule in the CloudFormation template is missing the `NoncurrentVersionExpiration` or `NoncurrentVersionTransition` properties. When S3 bucket versioning is enabled, lifecycle rules that only specify `ExpirationInDays` or `Transition` apply exclusively to the current version of objects. To manage older (noncurrent) versions, you must explicitly include `NoncurrentVersionExpirationInDays` or `NoncurrentVersionTransitionInDays` in the rule.

Without these, noncurrent versions accumulate indefinitely, causing the bucket size to grow larger than expected.

Exam trap

The trap here is that candidates assume a lifecycle rule with `ExpirationInDays` automatically cleans up all versions of an object, but in S3 with versioning enabled, it only affects the current version, leaving noncurrent versions to accumulate.

How to eliminate wrong answers

Option B is wrong because the `Status` property set to 'Enabled' is not the issue; the lifecycle rule is active, but it only targets current versions. Option C is wrong because the lifecycle rule does apply to current versions, but the problem is that it does not apply to noncurrent versions, which is the exact reason for the bucket size growth. Option D is wrong because the expiration in days being set to 365 is not too short; it is a reasonable period, but the rule still only affects current versions, leaving noncurrent versions untouched.

Full explanation →
1438
MCQeasy

A data engineer needs to ingest data from an Amazon S3 bucket into an Amazon Redshift table on a daily schedule. The data is in CSV format and the schema matches. Which service is simplest for this batch ingestion?

A.Amazon Redshift COPY command
B.AWS Glue ETL job with JDBC connection
C.AWS Data Pipeline
D.Amazon Athena CREATE TABLE AS SELECT
AnswerA

Direct and optimized for loading from S3.

Why this answer

The Amazon Redshift COPY command is the simplest and most efficient method for batch loading data from Amazon S3 into Redshift when the schema matches and the data is in CSV format. It leverages Redshift's massively parallel processing (MPP) architecture to read data directly from S3, automatically handling compression, encryption, and error logging without requiring any intermediate services or custom code.

Exam trap

The trap here is that candidates may overcomplicate the solution by choosing AWS Glue or Data Pipeline, forgetting that Redshift's native COPY command is purpose-built for high-speed, parallel batch ingestion from S3 with minimal configuration.

How to eliminate wrong answers

Option B is wrong because AWS Glue ETL with JDBC connection introduces unnecessary complexity and overhead for a simple schema-matching CSV load; Glue is better suited for complex transformations or semi-structured data, not for a direct COPY operation. Option C is wrong because AWS Data Pipeline is a legacy orchestration service that requires defining pipelines, schedules, and activities, adding operational overhead compared to the single COPY command. Option D is wrong because Amazon Athena CREATE TABLE AS SELECT (CTAS) writes query results to a new table in S3, not into Redshift; it cannot directly ingest data into a Redshift table.

Full explanation →
1439
MCQmedium

A financial services company uses Amazon Athena to query a data lake in S3. The data lake contains sensitive financial transactions. The security team has implemented row-level security using views in AWS Glue Data Catalog. Each view is defined with a WHERE clause that filters rows based on the user's IAM role using a custom tag. However, when a data analyst runs a SELECT * FROM view_name in Athena, the query returns all rows, ignoring the row-level filter. The analyst's IAM role has the tag 'department=analytics'. The view was created with a filter condition 'department = current_user_department()', where current_user_department() is a user-defined function that extracts the department tag from the caller's IAM role. The function is defined in the Glue Data Catalog. What is the most likely reason the filter is not applied?

A.The user-defined function current_user_department() is not registered in the Glue Data Catalog.
B.Athena does not support user-defined functions in views.
C.The IAM role does not have the tag 'department=analytics'.
D.The view is not defined with the filter condition properly; the function current_user_department() may not be invoked correctly in the view definition.
AnswerD

The function must be used in the view's SELECT statement.

Why this answer

The most likely reason is that the user-defined function current_user_department() is not invoked correctly in the view definition. In Athena, views store the SQL logic, and when queried, the filter condition is evaluated. If the function is not registered properly or is not supported in view filters, the query may ignore it.

Option A is incorrect because the function is already defined in the Glue Data Catalog. Option B is incorrect because Athena does support user-defined functions in views. Option C is incorrect because the analyst's role does have the tag.

Full explanation →
1440
MCQmedium

A data engineer is using Amazon EMR to transform large datasets stored in S3. The cluster runs once a day and takes 3 hours. The engineer notices that the cluster is idle for 30 minutes at the start while waiting for resources. What is the most cost-effective way to reduce the idle time?

A.Increase the instance type size
B.Use Spot Instances for all nodes
C.Configure a larger initial core instance count and enable managed scaling
D.Purchase Reserved Instances for the cluster
AnswerC

More core nodes reduce the time to allocate resources, and managed scaling adjusts during the job.

Why this answer

Enabling managed scaling allows the EMR cluster to automatically adjust its core instance count based on workload demands, reducing the initial idle time caused by waiting for resource allocation. By configuring a larger initial core instance count, the cluster can start processing immediately with sufficient capacity, and managed scaling then optimizes resource usage throughout the job, making it the most cost-effective solution for a daily 3-hour transformation job.

Exam trap

The trap here is that candidates often confuse cost optimization strategies (like Spot Instances or Reserved Instances) with performance improvements, failing to recognize that idle time at startup is a resource allocation issue best solved by managed scaling and initial capacity configuration.

How to eliminate wrong answers

Option A is wrong because increasing the instance type size (e.g., using larger EC2 instances) does not address the root cause of idle time—resource allocation delays—and would increase costs without guaranteeing faster startup. Option B is wrong because using Spot Instances for all nodes can reduce cost but introduces the risk of interruptions and does not reduce the initial idle time; in fact, Spot Instances may have longer provisioning delays or be preempted, worsening the problem. Option D is wrong because purchasing Reserved Instances is a commitment-based discount model that reduces per-hour costs for steady-state workloads, but it does not reduce the idle time at cluster startup; it would be cost-ineffective for a cluster that runs only 3 hours per day.

Full explanation →
1441
MCQhard

A data engineer is troubleshooting an issue where an IAM role used by AWS Glue cannot read data from an S3 bucket encrypted with SSE-KMS. The bucket policy allows the role to perform s3:GetObject. What additional permission is needed?

A.s3:GetObjectVersion
B.kms:Decrypt on the KMS key
C.s3:GetObjectAcl
D.kms:GenerateDataKey on the KMS key
AnswerB

The role must be able to decrypt the S3 object.

Why this answer

For SSE-KMS, the IAM role needs kms:Decrypt permission on the KMS key to read encrypted objects. Option A (s3:GetObjectVersion) is not required because the bucket policy already allows s3:GetObject; versioning is not relevant here. Option C (s3:GetObjectAcl) is for access control lists, not encryption.

Option D (kms:GenerateDataKey) is used for encrypting new objects, not reading existing ones. Therefore, the correct answer is B.

Full explanation →
1442
MCQmedium

A data engineer needs to transfer 50 TB of historical data from an on-premises HDFS cluster to Amazon S3. The on-premises network has a 1 Gbps link to AWS. The transfer must complete within 5 days. Which solution is MOST cost-effective and meets the requirements?

A.Use Amazon S3 Transfer Acceleration to speed up the transfer over the internet.
B.Use AWS DataSync to transfer the data over the existing network link.
C.Use AWS Snowball Edge to physically transfer the data.
D.Use AWS Direct Connect to establish a dedicated network connection.
AnswerC

AWS Snowball Edge is a physical device used for offline data transfer. It can handle large volumes faster than network transfer and is cost-effective for this scenario.

Why this answer

AWS Snowball Edge is a physical device that can transfer large amounts of data faster than a network link, especially with a 1 Gbps link that would take about 4.6 days for 50 TB (theoretical max, but actual throughput will be lower due to overhead). Snowball Edge can transfer 50 TB in a few days and is cost-effective for large data volumes. Option A (Amazon S3 Transfer Acceleration) speeds up transfers but still limited by network bandwidth.

Option B (AWS DataSync) is efficient for online transfers but may not meet the 5-day deadline over 1 Gbps. Option D (AWS Direct Connect) would require additional setup and cost, and still limited by the 1 Gbps link.

Full explanation →
1443
MCQmedium

A data engineer needs to allow a Lambda function to read data from an S3 bucket in the same account. The Lambda function's execution role has the required permissions, but access is denied. The S3 bucket has a bucket policy that explicitly denies access to any principal that is not from the organization. What is the most likely issue?

A.The Lambda execution role is not part of the AWS organization.
B.The Lambda function is in a VPC without an S3 VPC endpoint.
C.The S3 bucket is in a different AWS account.
D.The Lambda function does not have kms:Decrypt permission.
AnswerA

The bucket policy explicitly denies access to principals not in the organization, so the Lambda role must be part of the organization.

Why this answer

The bucket policy explicitly denies access to any principal that is not from the AWS organization. Since the Lambda execution role is not part of the organization, the explicit deny overrides any allow permissions granted to the role. Option B is incorrect because the VPC endpoint policy is not mentioned in the scenario.

Option C is incorrect because the bucket is in the same account. Option D is incorrect because KMS permissions are not relevant to this access denial.

Full explanation →
1444
MCQmedium

A data engineer needs to ingest JSON files from an on-premises SFTP server into Amazon S3. The files are uploaded daily and each file is up to 500 MB. The solution must be serverless and minimize cost. Which service should the engineer use?

A.Amazon Kinesis Data Firehose.
B.AWS DataSync with an on-premises agent.
C.Amazon S3 Transfer Acceleration.
D.AWS Transfer Family (SFTP) endpoint.
AnswerD

Fully managed SFTP service that writes directly to S3.

Why this answer

AWS Transfer Family provides a fully managed SFTP endpoint that directly integrates with Amazon S3, enabling file transfers without managing servers. Option A (Kinesis Data Firehose) is designed for streaming data, not file-based SFTP ingestion. Option B (AWS DataSync with an on-premises agent) requires installing and managing an agent, which adds operational overhead and is not fully serverless.

Option C (S3 Transfer Acceleration) accelerates transfers to S3 but does not support ingesting from SFTP sources.

Full explanation →
1445
MCQmedium

A company uses Amazon DynamoDB with global tables in three AWS Regions. The data engineer needs to ensure that writes to the table in us-east-1 are replicated to other regions with minimal latency. Which DynamoDB feature should be used?

A.DynamoDB Global Tables
B.DynamoDB Time to Live (TTL)
C.DynamoDB Streams
D.DynamoDB Accelerator (DAX)
AnswerA

Global Tables replicate data across regions automatically.

Why this answer

DynamoDB Global Tables is the correct feature because it provides multi-region, multi-master replication, automatically replicating writes from us-east-1 to other regions with sub-second latency. This is achieved through DynamoDB Streams and a last-writer-wins conflict resolution mechanism, ensuring data consistency across regions without requiring custom replication logic.

Exam trap

The trap here is that candidates may confuse DynamoDB Streams (a change capture mechanism) with Global Tables (a managed replication service), not realizing that Streams alone cannot replicate data across regions without additional custom code.

How to eliminate wrong answers

Option B is wrong because DynamoDB Time to Live (TTL) is used to automatically delete expired items based on a timestamp attribute, not for replicating data across regions. Option C is wrong because DynamoDB Streams captures item-level changes in a single table and can trigger AWS Lambda functions, but it does not natively replicate data to other regions; Global Tables uses Streams internally but the feature itself is not a replication solution. Option D is wrong because DynamoDB Accelerator (DAX) is an in-memory cache that reduces read latency for a single table, but it does not provide cross-region write replication.

Full explanation →
1446
MCQhard

A data engineer is monitoring an Amazon Kinesis Data Streams application that processes real-time events. The application uses a Kinesis Client Library (KCL) consumer. The engineer notices that the consumer is lagging behind the producer, and the lag is increasing over time. The stream has 10 shards. Which action will MOST effectively reduce the lag?

A.Use multiple KCL workers per shard to increase processing capacity.
B.Increase the number of shards in the Kinesis data stream.
C.Decrease the number of records per shard per second.
D.Decrease the number of shards in the Kinesis data stream.
AnswerB

More shards increase the stream's read and write capacity.

Why this answer

Increase the number of shards in the Kinesis data stream. Increasing shards increases the stream's read capacity and allows more parallel consumers to process data, which reduces lag. Option A is incorrect because using multiple KCL workers per shard is not recommended; each shard should be processed by one worker to avoid duplicate processing.

Option C is incorrect because decreasing the number of records per shard per second would reduce throughput, not help catch up. Option D is incorrect because decreasing shards reduces capacity, worsening lag.

Full explanation →
1447
Multi-Selecthard

A company uses Amazon S3 to store sensitive data. The security team requires that all data in transit between on-premises applications and S3 be encrypted. The data engineer must implement a solution that meets this requirement without changing the applications. Which TWO solutions should the engineer consider? (Choose two.)

Select 2 answers
A.Enable S3 Transfer Acceleration on the bucket.
B.Enable default encryption on the S3 bucket.
C.Use server-side encryption with S3 managed keys (SSE-S3).
D.Use an S3 VPC Endpoint and enforce the use of HTTPS through bucket policies.
E.Use AWS Storage Gateway to mount S3 as a file system and configure it to use HTTPS.
AnswersD, E

VPC Endpoint with HTTPS policy ensures encrypted transit.

Why this answer

Using an S3 VPC Endpoint with a bucket policy that enforces HTTPS ensures all traffic to S3 is encrypted in transit, without any application changes. Option E is correct because AWS Storage Gateway can mount S3 as a file system and be configured to use HTTPS, enforcing encryption in transit. Option A is incorrect because S3 Transfer Acceleration only improves speed over long distances, it does not enforce encryption—it optionally uses HTTPS but the application must still use HTTPS.

Option B is incorrect because default encryption (SSE-S3, SSE-KMS, DSSE-KMS) encrypts data at rest, not in transit. Option C is incorrect because server-side encryption with SSE-S3 also only encrypts data at rest.

Full explanation →
1448
MCQhard

A company has a DynamoDB table with a partition key of 'user_id' and a sort key of 'timestamp'. They need to query all items for a user within a date range. Which query operation should be used?

A.BatchGetItem with multiple keys
B.Query with KeyConditionExpression on partition key and sort key
C.GetItem with both partition and sort key
D.Scan with FilterExpression
AnswerB

Query is efficient for this access pattern.

Why this answer

The Query operation in DynamoDB is designed to retrieve items based on a specific partition key and an optional sort key condition. Since the table has a partition key of 'user_id' and a sort key of 'timestamp', using Query with a KeyConditionExpression that filters on the partition key (user_id) and a range condition on the sort key (timestamp) is the most efficient and correct approach to get all items for a user within a date range.

Exam trap

The trap here is that candidates often confuse BatchGetItem with Query, thinking BatchGetItem can handle range queries, but BatchGetItem only retrieves items by exact primary key values and cannot filter by sort key conditions.

How to eliminate wrong answers

Option A is wrong because BatchGetItem retrieves items by their primary key (partition key and sort key) but does not support range-based filtering on the sort key; it only fetches specific items by exact key values, not a range of timestamps. Option C is wrong because GetItem retrieves a single item by its full primary key (both partition key and sort key), so it cannot return multiple items or filter by a date range. Option D is wrong because Scan reads the entire table and then applies a FilterExpression, which is inefficient and costly for large tables, and it should be avoided when a more targeted Query operation can be used.

Full explanation →
1449
MCQhard

A data engineering team is troubleshooting a slow AWS Glue ETL job that reads from an Amazon DynamoDB table and writes to Amazon S3 in Parquet format. The job processes 50 GB of data. Which action would most effectively improve job performance?

A.Use S3 Select to push down filters
B.Reduce the batch size in the DynamoDB connector
C.Increase the number of DPUs
D.Change output to JSON format to reduce overhead
AnswerC

More DPUs increase parallelism and can speed up the job.

Why this answer

Increasing the number of DPUs (Data Processing Units) for the AWS Glue job directly allocates more distributed computing resources (CPU, memory, and network bandwidth) to parallelize the read from DynamoDB and the write to S3. Since the job processes 50 GB of data, the bottleneck is likely the throughput of the Glue Spark cluster, and adding DPUs increases parallelism, reducing overall execution time.

Exam trap

The trap here is that candidates often confuse S3 Select as a universal filter mechanism or assume that reducing batch size always improves performance, when in fact it increases API overhead and latency in distributed systems like Glue.

How to eliminate wrong answers

Option A is wrong because S3 Select is used to filter data within S3 objects (e.g., CSV or JSON files) and cannot be applied to a DynamoDB source; the filter pushdown must happen at the DynamoDB API level using expressions, not S3 Select. Option B is wrong because reducing the batch size in the DynamoDB connector would decrease the number of items read per request, increasing the number of API calls and likely worsening performance due to higher latency and throttling risk. Option D is wrong because changing output to JSON format would increase file size and write overhead compared to Parquet (which is columnar and compressed), thus degrading performance, not improving it.

Full explanation →
1450
MCQhard

A data engineer is designing a data ingestion pipeline for IoT sensor data. The data arrives as JSON via AWS IoT Core, and must be stored in Amazon S3 in partitioned Parquet format. The pipeline must handle late-arriving data (up to 1 hour) and ensure exactly-once processing. Which combination of services should the engineer use?

A.Amazon Kinesis Data Streams with AWS Lambda for transformation and Amazon S3.
B.Amazon Simple Queue Service (SQS) with AWS Lambda for transformation and Amazon S3.
C.AWS Glue streaming jobs consuming from Amazon Kinesis Data Streams and writing to Amazon S3.
D.Amazon Kinesis Data Firehose with data transformation via AWS Lambda, delivering to Amazon S3.
AnswerD

Firehose supports Parquet conversion and partitioning; Lambda handles transformation.

Why this answer

Amazon Kinesis Data Firehose is the correct choice because it can directly ingest streaming data from AWS IoT Core, use a built-in AWS Lambda function to transform JSON to Parquet, and deliver the data to Amazon S3 with automatic partitioning. It also supports buffering and retry logic to handle late-arriving data (up to 1 hour) and provides exactly-once delivery to S3 when configured with the appropriate error handling and idempotent transformations.

Exam trap

The trap here is that candidates often choose Kinesis Data Streams with Lambda (Option A) because they think it offers more control, but they overlook that Firehose provides a managed, exactly-once, partitioned Parquet delivery pipeline with built-in late-arriving data handling, which is the exact requirement in the question.

How to eliminate wrong answers

Option A is wrong because Amazon Kinesis Data Streams with AWS Lambda requires custom code to manage checkpointing, partitioning, and exactly-once semantics, and does not natively support Parquet conversion or S3 delivery without additional complexity. Option B is wrong because Amazon SQS does not guarantee exactly-once processing (standard queues offer at-least-once, FIFO queues offer exactly-once but lack native streaming integration with IoT Core and Parquet transformation). Option C is wrong because AWS Glue streaming jobs consume from Kinesis Data Streams, not directly from IoT Core, and they do not provide built-in exactly-once delivery to S3; they rely on checkpointing that can lead to duplicates or data loss in failure scenarios.

Full explanation →
1451
Multi-Selecthard

A company is using AWS Glue to run ETL jobs that process data from Amazon S3 and load it into Amazon Redshift. The data engineer notices that the Glue job is failing with the error 'S3ServiceException: Access Denied' when writing to the staging S3 bucket. Which TWO actions should the engineer take to resolve this issue?

Select 2 answers
A.Ensure that the Glue job script is correctly referencing the S3 bucket path.
B.Verify that the IAM role used by the Glue job has the s3:PutObject permission for the staging bucket.
C.Ensure that the S3 bucket has a bucket policy that allows the AWS Glue service principal to write objects.
D.Verify that the IAM role has s3:GetObject permission for the source bucket.
E.Check the S3 bucket policy for the staging bucket and ensure it allows the Glue job's IAM role to perform s3:PutObject.
AnswersB, E

Correct. The IAM role must have s3:PutObject permission on the staging bucket.

Why this answer

Options B and E are correct. The Glue job's IAM role must have s3:PutObject permission on the staging S3 bucket (option B). Additionally, the S3 bucket policy must explicitly allow the Glue job's IAM role to perform s3:PutObject (option E).

Option C is incorrect because AWS Glue uses the IAM role attached to the job for S3 operations, not the Glue service principal; granting the service principal write access is unnecessary and not a standard practice. Option A is incorrect because the error is a permission issue, not a script path issue. Option D is incorrect because the error is about writing to the staging bucket, not reading from the source bucket.

Exam trap

The question asks for two actions, and there are several plausible options. Candidates may be misled into selecting incorrect options such as option C (granting write to the Glue service principal) or option D (read permission for source bucket), which do not directly resolve the write access error.

Full explanation →
1452
MCQhard

A data engineer is investigating a failed AWS Glue job. The engineer runs the CLI command shown in the exhibit to retrieve the latest log stream. The output shows storedBytes: 0. What does this indicate?

A.The log stream is from a different Glue job.
B.The log stream is empty because the job is still running.
C.The Glue job failed before writing any log events to CloudWatch.
D.The log stream has been expired and deleted.
AnswerC

No logs were written, indicating early failure or logging misconfiguration.

Why this answer

StoredBytes: 0 means no log events were stored, likely because the job failed before writing any logs or logging was not enabled. Option A is wrong because logs are not expired; they were never written. Option B is wrong because the stream exists.

Option D is wrong because the command retrieved the latest stream.

Full explanation →
1453
MCQeasy

A company wants to ingest streaming data from IoT devices into Amazon S3 using Amazon Kinesis Data Firehose. The data must be transformed from JSON to Parquet format before landing in S3. What is the SIMPLEST way to achieve this?

A.Configure Kinesis Data Firehose with a built-in Parquet converter.
B.Use an AWS Lambda function as a data transformation in Kinesis Data Firehose to convert JSON to Parquet.
C.Use Kinesis Data Firehose to deliver data directly to S3 in JSON format and run a nightly Glue job to convert to Parquet.
D.Use Kinesis Data Analytics to convert the data to Parquet before sending to Firehose.
AnswerA

Correct. Firehose has a built-in Parquet converter that uses an AWS Glue schema. This is the simplest method as it requires no custom code or additional services.

Why this answer

Amazon Kinesis Data Firehose has a built-in Parquet conversion feature that uses an AWS Glue schema to convert incoming JSON data to Parquet format. This is the simplest approach because it requires no custom code or additional services; you only need to provide a schema and enable the conversion in the Firehose delivery stream configuration. Option B (using Lambda) is more complex, as it requires writing and maintaining a custom transformation function.

Exam trap

Candidates often overlook the native Parquet conversion capability in Kinesis Data Firehose and assume a Lambda function is required. The built-in conversion using an AWS Glue schema is actually simpler and supported directly.

How to eliminate wrong answers

Option A is wrong because Kinesis Data Firehose does not have a built-in Parquet converter; it can deliver data in Parquet format only if the input data is already in a format that can be converted (e.g., via a Lambda transformation or by using a schema from AWS Glue), but there is no native 'Parquet converter' toggle. Option C is wrong because it introduces unnecessary complexity and latency by storing JSON in S3 first and then running a nightly Glue job, which is not the simplest approach and does not meet the requirement for real-time transformation before landing. Option D is wrong because Kinesis Data Analytics is designed for real-time analytics and stream processing, not for format conversion; it would add unnecessary overhead and complexity compared to using Firehose's built-in Lambda transformation.

Full explanation →
1454
MCQmedium

A data engineer is configuring an S3 bucket policy to allow cross-account access for a partner account to read objects. The bucket is encrypted with SSE-KMS using a customer-managed key. What additional configuration is needed to allow the partner account to decrypt the objects?

A.Add a bucket policy that grants the partner account s3:GetObject
B.Create a VPC endpoint for S3 and add it to the bucket policy
C.Update the KMS key policy to grant the partner account kms:Decrypt permission
D.Add a bucket policy that grants s3:GetObject and s3:GetEncryptionConfiguration
AnswerC

The KMS key policy must allow the partner account to use the key for decryption.

Why this answer

For cross-account access with SSE-KMS, the KMS key policy must grant the partner account access to use the key. The bucket policy alone is insufficient. The partner account does not need VPC endpoints, and the bucket policy for decryption is not needed.

The partner account does not need access to the S3 bucket's encryption configuration.

Full explanation →
1455
MCQhard

Refer to the exhibit. A data engineer runs the commands shown. What can be determined about the key with ID 1234abcd-12ab-34cd-56ef-1234567890ab?

A.It is pending deletion.
B.It was created in us-west-2.
C.It is a customer managed key.
D.It is an AWS managed key.
AnswerD

KeyManager: AWS means it's AWS managed.

Why this answer

The command output shows that the key's KeyManager is 'AWS', indicating it is an AWS managed key, which corresponds to option D. Option A is incorrect because the key state is 'Enabled', not 'PendingDeletion'. Option B is incorrect because the ARN does not specify a region; the key was created in us-east-1 by default.

Option C is incorrect because AWS managed keys have KeyManager set to 'AWS', not 'CUSTOMER'.

Full explanation →
1456
MCQeasy

A data engineer is troubleshooting a nightly AWS Glue ETL job that reads from an Amazon RDS for MySQL table and writes to an Amazon S3 bucket in Parquet format. The job runs successfully most days, but occasionally fails with the error 'ERROR: An error occurred while calling o67.pyWriteDynamicFrame. The transaction log for the database is full due to 'LOG_BACKUP'.' What is the MOST likely cause of this error?

A.The MySQL database has reached its maximum number of concurrent connections.
B.The AWS Glue job does not have sufficient permissions to write to the S3 bucket.
C.The AWS Glue job is configured with an incorrect 'writeDynamicFrame' method.
D.The MySQL database transaction log needs to be backed up to free space.
AnswerD

The error 'LOG_BACKUP' indicates that the transaction log is full and requires a backup to truncate it.

Why this answer

The error message 'The transaction log for the database is full due to 'LOG_BACKUP'' indicates that the MySQL database's transaction log has reached its maximum size because it has not been backed up and truncated. In MySQL, the transaction log (often the InnoDB redo log or binary log) must be backed up periodically to free space; otherwise, write operations fail. This is a database-side issue, not a Glue or permissions problem, so the correct action is to back up the transaction log to release space.

Exam trap

The trap here is that candidates may confuse a database-side resource exhaustion error (transaction log full) with a permissions or configuration issue in AWS Glue, leading them to incorrectly select options related to Glue permissions or method syntax.

How to eliminate wrong answers

Option A is wrong because the error specifically mentions the transaction log being full, not a limit on concurrent connections; a connection limit would produce a 'Too many connections' error. Option B is wrong because insufficient S3 write permissions would result in an access denied or authorization error, not a database transaction log error. Option C is wrong because the 'writeDynamicFrame' method is correctly used in AWS Glue for writing DynamicFrames; an incorrect method would cause a syntax or API error, not a database transaction log issue.

Full explanation →
1457
MCQhard

A data engineer is troubleshooting a slow AWS Glue ETL job that reads from Amazon S3 and writes to Amazon Redshift. The job processes 10 GB of CSV data. The engineer notices that the job runs with a single DPU and takes longer than expected. Which change would MOST likely improve performance?

A.Replace Redshift with Amazon Redshift Spectrum.
B.Change the input format to Parquet and enable predicate pushdown.
C.Use a JDBC connection to read data directly from S3.
D.Increase the number of DPUs and configure the job to use the S3 list implementation for parallel reads.
AnswerD

More DPUs allow parallel processing, and S3 list implementation improves file discovery.

Why this answer

The job runs with a single DPU, which limits parallelism. Increasing the number of DPUs allows the job to process data in parallel across multiple workers. Additionally, configuring the S3 list implementation enables the job to list objects in parallel, reducing the overhead of discovering input files.

This combination directly addresses the bottleneck of a single-threaded read from S3.

Exam trap

The trap here is that candidates often focus on data format optimization (Parquet) or query engine changes (Redshift Spectrum) without realizing that the primary bottleneck is the single-DPU configuration limiting parallelism, which is a common oversight in Glue job tuning questions.

How to eliminate wrong answers

Option A is wrong because replacing Redshift with Redshift Spectrum does not address the root cause of low parallelism in the Glue job; Spectrum is a query engine for data in S3, not a performance fix for a Glue ETL writing to Redshift. Option B is wrong because changing to Parquet and enabling predicate pushdown improves read efficiency and reduces data scanned, but the job is bottlenecked by a single DPU, not by I/O format or filtering. Option C is wrong because using a JDBC connection to read data directly from S3 is not a valid approach; JDBC is for relational databases, not for reading files from S3, and this would introduce unnecessary overhead.

Full explanation →
1458
MCQeasy

A startup is building a data pipeline to ingest user activity logs from a mobile app. The logs are sent in real-time via HTTP POST requests. The data volume is low (a few hundred requests per second) but can spike to a few thousand during promotions. The team wants to store the logs in Amazon S3 for analysis. They also need to be able to query the data using Amazon Athena with minimal latency. The data must be transformed from JSON to Parquet and partitioned by date. The team is considering using Amazon API Gateway with AWS Lambda to receive the logs and write to S3. However, they are concerned about Lambda cold starts and the complexity of handling spikes. Which alternative solution should they choose?

A.Use Amazon API Gateway with AWS Lambda that sends logs to Amazon SQS, then a separate Lambda reads from SQS and writes to S3
B.Use Amazon Kinesis Data Firehose with a HTTP endpoint as source, enable Parquet conversion, and deliver to S3 with dynamic partitioning
C.Use Amazon Kinesis Data Streams with AWS Lambda to process and write to S3
D.Use Amazon EMR with Spark Streaming to ingest logs from a custom endpoint
AnswerB

Firehose handles ingestion, transformation, and partitioning with automatic scaling.

Why this answer

Amazon Kinesis Data Firehose is the best choice because it can directly receive HTTP POST requests (via its HTTP endpoint or integrated with API Gateway), automatically buffer incoming data, convert JSON to Parquet, and deliver to S3 with dynamic partitioning by date. This handles traffic spikes without custom code or Lambda cold starts, meeting all requirements with minimal operational overhead. Option A (API Gateway + Lambda → SQS → Lambda) adds complexity and still involves Lambda cold starts.

Option C (Kinesis Data Streams + Lambda) also requires Lambda and cold start management. Option D (EMR Spark Streaming) is overkill for this low-volume use case.

Full explanation →
1459
MCQmedium

A company uses Amazon S3 to store sensitive data. The data engineer needs to ensure that all data in transit between the S3 bucket and clients is encrypted. Which configuration should the engineer implement?

A.Use Amazon CloudFront to serve the content and enable SSL.
B.Enable default encryption on the S3 bucket using SSE-S3.
C.Create an S3 bucket policy that denies requests where SecureTransport is false.
D.Use SSE-C to encrypt the data with a customer-provided key.
AnswerC

This ensures all requests use HTTPS, encrypting data in transit.

Why this answer

An S3 bucket policy that denies requests where SecureTransport is false enforces HTTPS for all access, encrypting data in transit. Option A is wrong because CloudFront with SSL can enforce HTTPS but is not a direct S3 configuration and may incur additional costs. Option B is wrong because SSE-S3 only encrypts data at rest, not in transit.

Option D is wrong because SSE-C also encrypts data at rest with a customer-provided key, not in transit.

Full explanation →
1460
MCQhard

A company runs an Amazon Redshift cluster with 10 RA3 nodes. The data warehouse stores 50 TB of data. The company notices that queries are slow and the cluster's storage utilization is high. The data engineer needs to improve query performance and reduce storage costs without changing the cluster's node count. Which action should the engineer take?

A.Use Redshift Spectrum to offload historical data to Amazon S3 and query it in place.
B.Change the distribution style of large tables to DISTSTYLE ALL.
C.Migrate the cluster to Dense Compute node types.
D.Enable concurrency scaling to handle more concurrent queries.
AnswerA

Spectrum queries data in S3, reducing cluster storage and allowing faster queries on hot data.

Why this answer

Redshift Spectrum allows you to query data directly from Amazon S3 without loading it into the cluster. By offloading historical or less-frequently accessed data to S3, you reduce the storage utilization on the RA3 nodes, which frees up managed storage and can improve query performance. This approach also lowers storage costs because S3 is cheaper than Redshift managed storage, and it does not change the node count.

Exam trap

The trap here is that candidates often confuse concurrency scaling (which improves query throughput) with storage optimization, or they assume that changing distribution styles (like DISTSTYLE ALL) will always improve performance, ignoring the storage cost impact in a high-utilization scenario.

How to eliminate wrong answers

Option B is wrong because changing large tables to DISTSTYLE ALL replicates the entire table to every node, which increases storage utilization and can worsen the high storage issue, not reduce it. Option C is wrong because migrating to Dense Compute nodes would change the node type, which violates the constraint of not changing the cluster's node count; also, Dense Compute nodes use local SSD storage and are not designed for the same storage-to-compute ratio as RA3 nodes. Option D is wrong because concurrency scaling adds additional compute capacity to handle more concurrent queries but does not reduce storage utilization or costs; it addresses throughput, not the underlying storage pressure.

Full explanation →
1461
Multi-Selecthard

A data engineer is designing a data lake on Amazon S3 with sensitive data. The engineer needs to ensure that data at rest is encrypted and that access is logged for compliance. Which TWO actions should the engineer take? (Choose TWO.)

Select 2 answers
A.Enable S3 Select to filter data at read time.
B.Enable S3 Transfer Acceleration.
C.Enable CloudTrail data events for S3 object-level operations.
D.Enable default encryption on the S3 bucket using SSE-KMS.
E.Enable S3 Block Public Access on the account.
AnswersC, D

CloudTrail data events log read/write operations to objects.

Why this answer

Enabling CloudTrail data events for S3 object-level operations captures detailed logs of all read, write, and delete actions on objects, which is essential for compliance auditing. Option D is correct because enabling default encryption on the S3 bucket using SSE-KMS ensures that all objects stored in the bucket are encrypted at rest with AWS Key Management Service (KMS) keys, providing centralized control and auditability of encryption keys.

Exam trap

The trap here is that candidates often confuse S3 Block Public Access (a security control) with encryption or logging, or they mistakenly think S3 Select or Transfer Acceleration contribute to compliance requirements, when they are unrelated to data-at-rest encryption and access logging.

Full explanation →
1462
MCQmedium

Refer to the exhibit. A data engineer sees this output from the AWS CLI for a failed Glue job. The job uses 10 workers of Standard type. What is the MOST appropriate action to resolve the OutOfMemoryError?

A.Increase NumberOfWorkers to 20
B.Reduce NumberOfWorkers to 5
C.Change WorkerType to G.1X
D.Increase MaxCapacity to 20
AnswerC

Correct. Changing WorkerType to G.1X doubles the memory per worker (from 4 GB to 8 GB), resolving the OutOfMemoryError.

Why this answer

The OutOfMemoryError occurs because each Standard worker has a memory limit of 4 GB. Increasing MaxCapacity to 20 does not increase memory per worker when NumberOfWorkers is explicitly set; it only increases the total DPU allocation but the job still uses 10 workers each with 1 DPU. The correct solution is to change the worker type to G.1X, which provides 2 DPUs (8 GB memory) per worker, effectively doubling the memory per worker and resolving the error.

Option A (increase workers) adds parallelism but does not increase per-worker memory. Option B (reduce workers) decreases parallelism and may aggravate memory pressure. Option D (increase MaxCapacity) is ineffective when NumberOfWorkers is fixed.

Exam trap

Candidates often mistakenly think increasing MaxCapacity raises memory per worker, but when NumberOfWorkers is set, MaxCapacity only sets the maximum total DPU; the job still uses exactly the specified number of workers each with the default DPU for the worker type.

Full explanation →
1463
MCQhard

A company uses AWS Lake Formation to manage permissions on a data lake in S3. A data analyst reports that queries using Amazon Athena return zero rows for a table that the analyst has been granted SELECT permission on. The table is registered in Lake Formation and uses a partition projection. What is the most likely cause?

A.The table is not registered as a resource in Lake Formation
B.The analyst does not have DESCRIBE permission on the table
C.The analyst lacks GetObject and ListBucket permissions on the underlying S3 location
D.The table uses server-side encryption with KMS and the analyst lacks kms:Decrypt permission
AnswerC

Lake Formation grants metadata permissions, but S3 permissions are still needed for partition projection.

Why this answer

When a table in Lake Formation uses partition projection, Athena bypasses the Glue Data Catalog for partition discovery and directly accesses the S3 location. This requires explicit S3 permissions (GetObject and ListBucket) on the underlying data, which Lake Formation does not automatically grant. The analyst likely can see the table metadata but cannot read the data, resulting in zero rows.

Option A is incorrect because the table is registered in Lake Formation (otherwise it wouldn't appear in Athena). Option B is incorrect because DESCRIBE permission is not required for SELECT queries; SELECT alone should suffice. Option D is incorrect because encryption permission issues would cause an error message, not a silent return of zero rows.

Full explanation →
1464
MCQmedium

A company needs to ingest data from multiple SaaS applications (e.g., Salesforce, Marketo) into Amazon S3 for analytics. The data sources have different schemas and update frequencies. Which AWS service should be used to build this ingestion pipeline with minimal code?

A.AWS Data Pipeline
B.AWS Glue
C.Amazon Kinesis Data Firehose
D.Amazon AppFlow
AnswerD

AppFlow is designed to ingest data from SaaS applications to S3 with minimal code.

Why this answer

Amazon AppFlow (Option D) is the correct answer because it is purpose-built for ingesting data from SaaS applications like Salesforce and Marketo into Amazon S3 with minimal code. It supports various source connectors, handles schema variations, and allows scheduling based on update frequencies. AWS Data Pipeline (A) requires more manual configuration and code for connectors.

AWS Glue (B) has connectors but is more complex for this use case, often requiring additional ETL scripting. Amazon Kinesis Data Firehose (C) is designed for streaming data, not batch extraction from SaaS APIs.

Full explanation →
1465
MCQeasy

A company uses an Amazon RDS for MySQL DB instance with Multi-AZ deployment. The primary DB instance fails unexpectedly. What happens to the database endpoint?

A.A new endpoint is created for the standby and the application must use the new endpoint.
B.The existing endpoint continues to work and automatically points to the standby DB instance.
C.The database becomes unavailable until the primary is restored from a snapshot.
D.The existing endpoint is deleted and a new endpoint is provided after manual DNS update.
AnswerB

RDS automatically updates the DNS CNAME record to point to the standby instance.

Why this answer

In a Multi-AZ RDS deployment, the DNS endpoint remains unchanged during a failover. When the primary DB instance fails, Amazon RDS automatically updates the DNS record to point to the standby instance in the other Availability Zone. This ensures the application can continue using the same endpoint without any manual intervention, providing high availability.

Exam trap

The trap here is that candidates may think a new endpoint is created or that manual DNS changes are required, confusing Multi-AZ failover with a manual snapshot restore or a cross-region read replica promotion.

How to eliminate wrong answers

Option A is wrong because the DNS endpoint is not recreated; it remains the same and is automatically remapped to the standby instance. Option C is wrong because Multi-AZ failover is automatic and typically completes within 1-2 minutes, so the database does not become unavailable until a snapshot restore is performed. Option D is wrong because no manual DNS update is required; the existing endpoint is automatically updated by RDS to point to the standby instance.

Full explanation →
1466
MCQeasy

A company wants to ingest data from multiple SaaS applications into Amazon S3 using a fully managed service that supports schema discovery and transformation. Which AWS service should they use?

A.Amazon Kinesis Data Firehose
B.Amazon AppFlow
C.AWS Glue
D.AWS Data Pipeline
AnswerB

Amazon AppFlow is fully managed, supports multiple SaaS sources, schema discovery, and transformation.

Why this answer

Amazon AppFlow is a fully managed integration service that supports SaaS sources, schema discovery, and data transformation. Option A (Amazon Kinesis Data Firehose) is for streaming data but not for SaaS ingestion directly. Option C (AWS Glue) is an ETL service but not for SaaS ingestion directly.

Option D (AWS Data Pipeline) is not fully managed for SaaS.

Full explanation →
1467
MCQhard

A company uses Amazon Kinesis Data Firehose to ingest JSON logs from multiple sources into an S3 data lake. The data is then consumed by Amazon Athena for analysis. Recently, some queries have been failing with the error 'HIVE_BAD_DATA: Field xyz's type is an unsupported type'. The firehose delivery stream transforms the data using a Lambda function that converts timestamps to Unix epoch. What is the MOST likely cause of the query failure?

A.Some records contain timestamps that were not converted to epoch, so Athena infers the column as a string.
B.The data is in JSON format instead of Parquet.
C.The S3 partitions are not registered in the Glue Data Catalog.
D.The IAM role for Firehose does not have permission to write to S3.
AnswerA

Inconsistent data types in a column cause Athena to default to string, leading to type mismatch when queried.

Why this answer

The error 'HIVE_BAD_DATA: Field xyz's type is an unsupported type' occurs when Athena's schema inference encounters inconsistent data types for the same column. Since the Lambda function converts timestamps to Unix epoch, but some records may have failed conversion (e.g., due to malformed input or Lambda errors), those records retain the original string timestamp. Athena then sees a mix of numeric epoch values and string timestamps, causing it to infer the column as a string type, which is unsupported for the expected numeric operations in the query.

Exam trap

The DEA-C01 exam often tests the misconception that Athena errors are always due to file format or permissions, when in reality schema-on-read type inference from inconsistent data is a common pitfall.

How to eliminate wrong answers

Option B is wrong because Athena can query JSON data directly; the error is about type mismatch, not file format. Option C is wrong because unregistered partitions would cause a 'Table not found' or 'Partition not found' error, not a type inference error. Option D is wrong because a missing S3 write permission would cause Firehose delivery failures or missing data, not a schema/type error during query execution.

Full explanation →
1468
MCQmedium

A data engineer runs an AWS Glue ETL job that reads from an S3 bucket containing JSON files. The job fails with an error indicating that some records are malformed. The engineer wants to skip the malformed records and continue processing. Which approach should the engineer take?

A.Pre-process the JSON files to correct the malformed records before Glue reads them.
B.Convert the JSON files to Parquet format and use Glue to read Parquet.
C.Use AWS Glue Schema Registry to reject invalid records.
D.Configure the Glue DynamicFrame to use the `withErrorThreshold` option to skip corrupt records.
AnswerD

Glue can skip malformed records using error thresholds.

Why this answer

The `withErrorThreshold` option on an AWS Glue DynamicFrame allows the ETL job to skip a specified number of corrupt or malformed records without failing. This is the most direct way to handle malformed JSON records in Glue. Option A is incorrect because pre-processing all files is inefficient and may not be feasible for large datasets.

Option B is incorrect because converting to Parquet does not address the issue of malformed JSON within the existing files. Option C is incorrect because AWS Glue Schema Registry validates schema compliance, not individual record malformation; it would reject entire datasets that don't match the schema, not skip malformed records.

Full explanation →
1469
MCQmedium

Refer to the exhibit. A data engineer configured the lifecycle policy shown. The 'logs/' prefix contains important audit logs. After 365 days, what happens to the objects?

A.Objects are permanently deleted.
B.Objects are transitioned to Glacier Deep Archive.
C.Objects are transitioned to Glacier.
D.Objects are transitioned to Standard-IA.
AnswerA

The expiration action with Days: 365 deletes the objects after 365 days.

Why this answer

The lifecycle policy shown has a single rule that expires objects in the 'logs/' prefix after 365 days. In Amazon S3, an 'expiration' action permanently deletes the objects once the specified number of days has passed since object creation. There is no transition action configured, so objects are not moved to any storage class; they are simply deleted.

Exam trap

The DEA-C01 exam often tests the distinction between 'expiration' (permanent deletion) and 'transition' (moving to another storage class), and candidates mistakenly assume that expiration implies a transition to a cold storage class like Glacier.

How to eliminate wrong answers

Option B is wrong because the policy does not include a transition action to Glacier Deep Archive; expiration deletes objects, not transitions them. Option C is wrong because there is no transition rule to Glacier; the policy only specifies expiration. Option D is wrong because Standard-IA is a transition target, but the policy lacks any transition action and only has an expiration action.

Full explanation →
1470
Multi-Selecteasy

Which TWO statements about Amazon Redshift data distribution are correct? (Choose two.)

Select 2 answers
A.DISTSTYLE is a distribution style option
B.AUTO distribution always chooses EVEN
C.KEY distribution places rows with the same distribution key on the same slice
D.EVEN distribution distributes rows across slices evenly
E.ALL distribution distributes data across all slices
AnswersC, D

KEY distribution colocates data by key.

Why this answer

In Amazon Redshift, KEY distribution places all rows with the same distribution key value on the same slice (compute node segment). This ensures that join operations on the distribution key are collocated, reducing data movement across the network and improving query performance.

Exam trap

The trap here is confusing distribution styles with distribution options (e.g., DISTSTYLE is a parameter, not a style) and misunderstanding that ALL distribution replicates the entire table to every node, not slices, while AUTO dynamically selects the best style rather than defaulting to EVEN.

Full explanation →
1471
Multi-Selectmedium

A company's Amazon Redshift cluster is running slowly. The data engineer suspects that table design is the cause. Which TWO design practices can improve query performance? (Choose TWO.)

Select 2 answers
A.Define appropriate sort keys on frequently filtered columns.
B.Use GROUP BY instead of DISTINCT in queries.
C.Define appropriate distribution keys to collocate joins.
D.Increase the number of slices per node by resizing the cluster.
E.Use VARCHAR instead of CHAR for fixed-length strings.
AnswersA, C

Sort keys minimize the number of blocks scanned.

Why this answer

Options A and C are correct. Defining appropriate sort keys on frequently filtered columns allows Redshift to use zone maps to skip irrelevant blocks, reducing the amount of data scanned. Defining appropriate distribution keys to collocate data on the same node slices minimizes data shuffling during joins, improving performance.

Option B is incorrect because GROUP BY and DISTINCT are query optimization techniques, not table design practices. Option D is incorrect because resizing the cluster (adding nodes or slices) is an infrastructure change, not a table design practice. Option E is incorrect because using VARCHAR instead of CHAR for fixed-length strings does not directly impact query performance from a table design perspective; it is a data type choice that affects storage but not query performance via sort or distribution design.

Full explanation →
1472
Multi-Selectmedium

A data engineer is designing a data ingestion pipeline for real-time user activity logs. The logs are generated by a web application and must be ingested into Amazon S3 with minimal latency (under 1 minute). The logs also need to be queried in Amazon Athena. The engineer considers using Amazon Kinesis Data Firehose. Which TWO configurations are required to achieve near-real-time delivery to S3? (Choose TWO.)

Select 2 answers
A.Set the BufferIntervalInSeconds to 60 seconds.
B.Enable S3 compression (e.g., GZIP) on the delivery stream.
C.Enable Amazon CloudWatch error logging for the delivery stream.
D.Enable data format conversion to Parquet using AWS Glue.
E.Set the BufferSizeInMBs to 1 MB.
AnswersA, E

Controls how often data is delivered.

Why this answer

Setting BufferIntervalInSeconds to 60 seconds forces Kinesis Data Firehose to deliver data to S3 every 60 seconds, meeting the sub-1-minute latency requirement. Option E is correct because setting BufferSizeInMBs to 1 MB ensures that the buffer fills quickly and triggers delivery when the buffer reaches 1 MB, which, combined with the time-based trigger, minimizes latency.

Exam trap

The trap here is that candidates often confuse features that improve query performance or monitoring (compression, Parquet conversion, CloudWatch logging) with features that directly control delivery latency, leading them to select those options instead of the buffer configuration parameters.

Full explanation →
1473
MCQmedium

A company runs a daily batch process that reads data from Amazon S3, transforms it with AWS Glue, and loads it into Amazon Redshift. The process takes 6 hours, but the business requires completion within 4 hours. Which design change would MOST reduce runtime?

A.Increase the number of Glue workers
B.Load data directly from S3 to Redshift using COPY command, then transform in Redshift
C.Use S3 Select to filter data before Glue
D.Switch to columnar storage in Redshift
AnswerB

COPY is highly efficient for bulk loading, and in-database transformation can be faster than Glue.

Why this answer

Loading data directly from S3 to Redshift using the COPY command eliminates the AWS Glue transformation step, which is the primary bottleneck. The COPY command is optimized for high-speed bulk loads, and performing transformations within Redshift (e.g., using SQL or stored procedures) can often be faster than an external ETL tool. Option A (increasing Glue workers) may help parallelism but does not address the overhead of the Glue job itself.

Option C (S3 Select) reduces the data volume scanned by Glue but still requires the Glue transformation. Option D (columnar storage) is already the default in Redshift and does not reduce the Glue job runtime.

Full explanation →
1474
MCQhard

A data engineer notices that an Amazon Redshift cluster's storage utilization has grown unexpectedly. The cluster uses automatic compression and has a mix of fact and dimension tables. The engineer runs VACUUM and ANALYZE, but storage does not decrease. Which action is most likely to reduce storage consumption?

A.Perform a DEEP COPY on the largest tables.
B.Run VACUUM with the BOOST option.
C.Run ANALYZE with the FULL keyword on all tables.
D.Modify the sort key on the largest tables to a more selective column.
AnswerA

DEEP COPY recreates the table with optimal compression, reclaiming storage from deleted rows and reorganizing data.

Why this answer

DEEP COPY recreates the table with a fresh, optimally sorted and compressed storage layout, reclaiming space that VACUUM alone cannot recover. In Redshift, VACUUM reorganizes and reclaims space from deleted rows but does not re-apply compression or rebuild the underlying storage blocks; DEEP COPY (e.g., using CREATE TABLE AS or the DEEP COPY command) physically rewrites the data, eliminating fragmentation and applying the current compression encoding, which can significantly reduce storage consumption when automatic compression has left suboptimal encodings or when historical updates have bloated the table.

Exam trap

The trap here is that candidates confuse VACUUM's space reclamation (which only removes deleted rows) with the need to physically rebuild the table to reapply compression, assuming VACUUM or ANALYZE can fix storage bloat caused by suboptimal encodings.

How to eliminate wrong answers

Option B is wrong because VACUUM BOOST is not a valid Redshift command; VACUUM has a BOOST option only in certain other database systems, and Redshift's VACUUM with the BOOST parameter does not exist — the correct options are VACUUM FULL, VACUUM DELETE ONLY, or VACUUM SORT ONLY, none of which reapply compression or reclaim space from suboptimal encodings. Option C is wrong because ANALYZE with the FULL keyword updates table statistics for the query planner but does not modify physical storage or reclaim space; it only refreshes metadata about data distribution and does not affect the actual data blocks. Option D is wrong because modifying the sort key on the largest tables changes the physical order of rows on disk, which can improve query performance but does not directly reduce storage consumption; sort keys affect how data is organized, not the compression ratio or the amount of space used by existing data.

Full explanation →
1475
MCQhard

A company uses Amazon S3 to store large datasets for analytics. Each dataset is stored in a separate prefix and consists of thousands of small objects (1-10 KB each). The company notices that listing objects in a prefix takes several seconds, slowing down data processing. Which solution would MOST improve listing performance?

A.Add a lifecycle policy to transition objects to S3 Glacier.
B.Use S3 Select to filter objects during listing.
C.Use S3 Inventory to generate a daily listing of objects.
D.Increase the number of parallel requests by using more prefixes.
AnswerC

S3 Inventory provides a pre-generated list that can be queried quickly.

Why this answer

S3 Inventory provides a scheduled CSV/Parquet file listing all objects in a bucket or prefix, including metadata like size and last modified date. By querying this inventory file instead of issuing real-time ListObject API calls, you avoid the latency of enumerating thousands of small objects, dramatically improving listing performance for analytics workflows.

Exam trap

The trap here is that candidates confuse S3 Select (which filters object content) with filtering object keys during listing, or assume that parallel requests to a single prefix are allowed, when in fact S3 throttles ListObject calls per prefix and parallelism only helps across different prefixes.

How to eliminate wrong answers

Option A is wrong because transitioning objects to S3 Glacier does not improve listing performance; it only changes storage class and adds retrieval latency, while the ListObject API still must enumerate all objects. Option B is wrong because S3 Select is used to filter the content of objects (e.g., SQL queries on CSV/JSON data), not to filter object keys during listing; it cannot accelerate the ListObject operation. Option D is wrong because increasing parallel requests with more prefixes would require redesigning the data layout and does not reduce the time to list a single prefix; the bottleneck is the number of objects in that prefix, not parallelism.

Full explanation →
1476
MCQeasy

A company uses AWS Glue ETL jobs to transform data stored in Amazon S3. The job reads data in Parquet format, applies transformations, and writes the output back to S3 in Parquet format. The team wants to improve the job's performance and reduce costs. Which action is MOST effective?

A.Change the input format from Parquet to CSV to simplify parsing.
B.Coalesce the input data into a single large file before processing.
C.Use column pruning and predicate pushdown to read only necessary columns and filter data early.
D.Increase the number of workers to maximum allowed.
AnswerC

Reduces the amount of data processed, improving performance and reducing costs.

Why this answer

Column pruning and predicate pushdown reduce the amount of data read from S3 by Spark-based AWS Glue ETL jobs. By reading only the necessary columns and filtering rows early in the scan, I/O and memory usage decrease, directly improving performance and reducing costs.

Exam trap

The trap here is that candidates often confuse 'coalesce' (reducing partitions) with 'repartition' (increasing parallelism) and assume fewer files always improve performance, ignoring that Glue ETL benefits from parallel reads across many small files when using columnar formats.

How to eliminate wrong answers

Option A is wrong because changing from Parquet to CSV would increase data size and parsing overhead, degrading performance and increasing costs. Option B is wrong because coalescing input into a single file eliminates parallelism, causing a single executor to process all data, which increases runtime and resource contention. Option D is wrong because increasing workers to the maximum allowed without addressing data skew or I/O bottlenecks can lead to excessive cost with diminishing returns, and may hit service limits or shuffle overhead.

Full explanation →
1477
Multi-Selecteasy

A company must comply with a regulation that requires logging all access to sensitive data stored in Amazon S3. Which AWS services can be used to capture and store access logs? (Choose TWO.)

Select 2 answers
A.AWS Config
B.Amazon CloudWatch Logs
C.AWS CloudTrail
D.Amazon S3 server access logs
E.VPC Flow Logs
AnswersC, D

CloudTrail logs S3 API calls.

Why this answer

Options C and D are correct. AWS CloudTrail can be configured to log API calls to S3, including data events for object-level access. Amazon S3 server access logs provide detailed records of requests made to an S3 bucket.

Option A is wrong because AWS Config records configuration changes, not data access logs. Option B is wrong because Amazon CloudWatch Logs can store logs but does not generate S3 access logs directly. Option E is wrong because VPC Flow Logs capture IP traffic metadata, not S3 object-level access.

Full explanation →
1478
MCQhard

A data engineering team needs to store log files for 90 days with immediate access, then archive them for 7 years with infrequent access. Which S3 storage class configuration meets these requirements cost-effectively?

A.Use S3 One Zone-IA for 90 days, then lifecycle to S3 Glacier Deep Archive
B.Use S3 Intelligent-Tiering with lifecycle transition to S3 Glacier Deep Archive after 90 days
C.Use S3 Glacier Instant Retrieval for 90 days, then lifecycle to S3 Glacier Flexible Retrieval
D.Use S3 Standard for 90 days, then lifecycle policy to S3 Glacier Deep Archive
AnswerB

Intelligent-Tiering optimizes costs for unknown patterns, and lifecycle to Deep Archive meets long-term retention.

Why this answer

S3 Intelligent-Tiering automatically moves data between access tiers based on changing access patterns, making it cost-effective for logs that may have variable access during the first 90 days. A lifecycle policy then transitions the data to S3 Glacier Deep Archive after 90 days, which provides the lowest-cost storage for the 7-year archival period with infrequent access needs.

Exam trap

The trap here is that candidates often assume S3 Standard is necessary for immediate access over 90 days, overlooking that S3 Intelligent-Tiering provides the same retrieval performance at lower cost for data with variable access patterns, and that Glacier Deep Archive is the most cost-effective option for long-term archival with infrequent access.

How to eliminate wrong answers

Option A is wrong because S3 One Zone-IA is not designed for immediate access needs over 90 days; it lacks the durability of multi-AZ storage and is intended for re-creatable data, not critical logs. Option C is wrong because S3 Glacier Instant Retrieval is optimized for long-lived, rarely accessed data that requires millisecond retrieval, not for the initial 90-day active access period, and transitioning to Glacier Flexible Retrieval adds unnecessary cost and retrieval latency. Option D is wrong because S3 Standard is over-provisioned and more expensive than necessary for logs that do not require low-latency access for the full 90 days; a more cost-effective approach would use Intelligent-Tiering or Standard-IA to reduce costs during the active period.

Full explanation →
1479
MCQhard

Refer to the exhibit. A data engineer runs this AWS Glue job but it fails with an error that the table 'orders' does not exist in the 'sales_db' database. The engineer has verified that the table exists in the AWS Glue Data Catalog. What is the most likely cause of the error?

A.The IAM role used by the Glue job does not have permission to read the Data Catalog
B.The Glue job has job bookmark enabled and is skipping the table
C.The script uses 'create_dynamic_frame.from_catalog' incorrectly
D.The S3 path 's3://data-lake/raw/' does not exist
AnswerA

The job needs glue:GetTable permission to access the table metadata.

Why this answer

The error 'table orders does not exist in sales_db' occurs because the IAM role associated with the Glue job does not have the necessary permissions to read the AWS Glue Data Catalog. Even though the table exists, the job requires 'glue:GetTable' permission on the 'sales_db.orders' table to discover it. Option B is incorrect because job bookmark settings control data processing state, not table discovery.

Option C is incorrect because the script using 'create_dynamic_frame.from_catalog' is syntactically correct. Option D is incorrect because the error specifically indicates the table is missing, not the S3 path.

Full explanation →
1480
MCQmedium

A data engineer is monitoring an Amazon EMR cluster running a Spark job. The job is processing a large dataset and the engineer notices that the cluster is using a high percentage of disk space on the core nodes. The job fails with 'No space left on device' error. What is the most effective way to resolve this issue without modifying the job logic?

A.Attach additional EBS volumes to the core nodes.
B.Increase the EBS volume size attached to the core nodes.
C.Change the core node instance type to one with more memory.
D.Increase the number of core nodes in the cluster.
AnswerD

More nodes distribute the intermediate data, reducing disk usage per node.

Why this answer

Increasing the number of core nodes distributes the intermediate shuffle data and temporary files across more nodes, reducing the per-node disk usage. This directly addresses the 'No space left on device' error without altering the Spark job logic, as core nodes in EMR store both HDFS data and local shuffle spills.

Exam trap

The trap here is that candidates confuse storage issues with memory or compute issues, and incorrectly choose to increase EBS volume size (Option B) instead of scaling horizontally, which is the most effective way to distribute disk load in a distributed system like EMR.

How to eliminate wrong answers

Option A is wrong because attaching additional EBS volumes does not increase the total available disk space on the core nodes unless they are mounted and configured; EMR automatically uses the root volume for local data, and adding extra volumes requires manual intervention or instance store configuration, which is not a direct fix. Option B is wrong because increasing the EBS volume size on existing core nodes only provides more space on the root device, but the error may stem from ephemeral storage or HDFS usage; moreover, this requires stopping the cluster or modifying the launch configuration, which is less effective than scaling horizontally. Option C is wrong because changing the instance type to one with more memory does not increase disk space; it addresses memory constraints, not the 'No space left on device' error, which is a storage issue.

Full explanation →
1481
MCQhard

A data pipeline uses AWS Glue to run ETL jobs that read from and write to an Amazon Redshift cluster. The pipeline recently started failing with the error 'ERROR: cannot execute INSERT in a read-only transaction'. The Glue job's IAM role has the necessary permissions. What could be the cause of this error?

A.The Glue job is using a transaction that was opened in read-only mode.
B.The Redshift cluster is in read-only mode due to maintenance.
C.The Glue connection is configured with 'read-only' set to true.
D.The Glue job's IAM role does not have sufficient Redshift permissions.
AnswerA

If auto_commit=False and the first operation is a SELECT, the session becomes read-only; subsequent INSERT fails.

Why this answer

The error 'ERROR: cannot execute INSERT in a read-only transaction' occurs when attempting to write data within a transaction that was opened as read-only. In AWS Glue ETL jobs, if the Spark session is configured with `auto_commit=False` or if the job explicitly starts a read-only transaction (e.g., via `SET TRANSACTION READ ONLY`), any subsequent INSERT operation will fail. Option A correctly identifies this cause.

Option B is incorrect because Redshift clusters do not enter a read-only mode during maintenance; instead, they are briefly unavailable. Option C is incorrect because Glue connections do not have a 'read-only' property; the connection string may set `defaultTransactionIsolation`, but not a read-only flag. Option D is incorrect because the IAM role has necessary permissions per the question stem, and insufficient permissions would produce a different error (e.g., permission denied).

Full explanation →
1482
MCQhard

Refer to the exhibit. A data engineer runs an AWS Glue ETL job that writes output to an S3 bucket. The job fails with the error shown. What is the most likely cause?

A.The IAM role used by the Glue job lacks the s3:PutObject permission for the output bucket
B.The Glue job attempted to write data in an unsupported format
C.The S3 bucket does not exist
D.The output file name contains invalid characters
AnswerA

The error explicitly states the role is not authorized to perform s3:PutObject.

Why this answer

The error shown in the exhibit indicates an access denied or permission failure when the AWS Glue ETL job attempts to write its output to the S3 bucket. The most likely cause is that the IAM role assigned to the Glue job does not include the s3:PutObject permission for the target bucket, which is required to upload objects. Without this permission, the job cannot complete the write operation, resulting in the failure.

Exam trap

The trap here is that candidates may focus on the data format or bucket existence, but the error message explicitly points to an access permission issue, which is a common misconfiguration in IAM roles for Glue jobs.

How to eliminate wrong answers

Option B is wrong because AWS Glue supports writing data in multiple formats (e.g., Parquet, ORC, JSON, CSV) and the error message does not indicate an unsupported format issue; such a problem would typically produce a different error related to format conversion. Option C is wrong because if the S3 bucket did not exist, the error would be a 'NoSuchBucket' or '404 Not Found' error, not an access denied error. Option D is wrong because while invalid characters in file names can cause errors, the error message shown is specifically about access permissions, not about invalid object key syntax.

Full explanation →
1483
MCQeasy

A company uses AWS Glue to run ETL jobs that process data from an Amazon RDS for MySQL database and load it into an Amazon S3 data lake. The Glue job runs daily and processes incremental data. Recently, the job has been taking longer than expected. The engineer checks the CloudWatch logs and sees that the job is spending most of its time on the 'Reading from JDBC' phase. The MySQL table has 10 million rows and is indexed on the primary key. The Glue job uses a 'job bookmark' to track processed data. The engineer wants to improve the performance of the read phase. Which action is most likely to help?

A.Increase the JDBC 'fetchSize' parameter to 10000.
B.Disable job bookmark and perform a full refresh each time.
C.Increase the number of DPUs for the Glue job.
D.Modify the job to use a 'query' parameter that selects only the new or modified rows based on a timestamp column.
AnswerD

By filtering at the source, less data is read and transferred, speeding up the read phase.

Why this answer

Modifying the job to use a 'query' parameter with a WHERE clause that filters on a timestamp column (the bookmark key) allows AWS Glue to read only the new or modified rows, reducing the amount of data transferred from the database and significantly improving read performance. Option A is wrong because increasing the JDBC 'fetchSize' parameter can improve throughput per connection but does not address the root cause of reading all 10 million rows; it may also cause memory issues if set too high. Option B is wrong because disabling job bookmarks and performing a full refresh would reprocess all data, making the job even slower and defeating the purpose of incremental processing.

Option C is wrong because increasing the number of DPUs adds parallelism but does not reduce the volume of data read; the database can still become a bottleneck when reading the entire table.

Full explanation →
1484
MCQeasy

A company uses Amazon QuickSight for data visualization. The data engineer needs to ensure that users can only see data relevant to their department. The data is stored in Amazon S3 and is accessed via SPICE. The engineer has created datasets in QuickSight and wants to implement row-level security (RLS). The dataset contains a column 'Department' that indicates which department a row belongs to. The engineer has configured RLS rules using a separate permissions dataset. However, users report that they can see all rows, not just their department's rows. What is the most likely reason?

A.The RLS permissions dataset is not correctly configured to map users to department values.
B.The 'Department' column is not included in the dataset.
C.The users have been granted admin access to the QuickSight dashboard.
D.The SPICE dataset does not support row-level security.
AnswerA

Correct. The permissions dataset likely has incorrect or incomplete mappings, causing RLS to not apply.

Why this answer

The most likely reason because the RLS permissions dataset must correctly map each user to the specific department values they are allowed to see. If this mapping is misconfigured or missing, QuickSight will default to showing all rows, making the RLS ineffective. The 'Department' column is present in the dataset (Option B is false).

Admin access to the dashboard does not bypass RLS at the dataset level (Option C is false). SPICE datasets fully support row-level security (Option D is false).

Full explanation →
1485
MCQhard

Refer to the exhibit. An AWS Glue job is failing with 'AccessDenied' when trying to write to the 'data-lake-bucket' which is encrypted with an AWS KMS key. The IAM role used by the Glue job has the attached policy shown. What is the MOST likely cause of the failure?

A.The policy does not include s3:ListBucket permission.
B.The policy does not include s3:GetObject permission.
C.The KMS key ARN in the policy is incorrect.
D.The policy does not include kms:GenerateDataKey or kms:Encrypt permission.
AnswerD

Writing to SSE-KMS encrypted S3 requires GenerateDataKey and Encrypt.

Why this answer

The policy allows s3:PutObject but does not include kms:GenerateDataKey or kms:Encrypt permissions, which are required to write to an SSE-KMS encrypted S3 bucket. Option A is incorrect because ListBucket is allowed. Option B is incorrect because GetObject is allowed.

Option C is incorrect because the KMS key ARN in the policy is correct; the issue is missing KMS actions.

Full explanation →
1486
MCQhard

A company uses AWS Lake Formation to manage data lake permissions. A data engineer notices that a user can query tables in Athena even though the user does not have SELECT permission on the table in Lake Formation. What could be the cause?

A.The user is using Redshift Spectrum
B.The user has S3 permissions to read the underlying data
C.The user has an IAM policy that allows Athena access
D.The IAMAllowedPrincipals group has been granted Super permission on the database
AnswerD

The IAMAllowedPrincipals group bypasses Lake Formation permissions and allows IAM users to access tables directly.

Why this answer

The IAMAllowedPrincipals group is a special group in Lake Formation that, when granted permissions (such as Super), allows IAM users and roles to bypass Lake Formation permissions and access data directly via services like Athena. This is a common misconfiguration that leads to unintended data access. Option A is incorrect because Redshift Spectrum uses its own permissions, not Athena.

Option B is incorrect because S3 permissions allow reading the underlying data but not querying via Athena without proper Lake Formation grants. Option C is incorrect because an IAM policy granting Athena access does not override Lake Formation permissions; the IAMAllowedPrincipals group is the key bypass mechanism.

Full explanation →
1487
MCQmedium

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The primary instance fails, and automatic failover occurs. After failover, the application experiences higher latency. What is the most likely cause?

A.The read replica is now the primary and cannot handle write traffic.
B.The failover process disabled automatic backups.
C.The DNS endpoint did not update to point to the new primary.
D.The new primary instance is in a different Availability Zone, increasing network latency.
AnswerD

Cross-AZ latency can be higher than same-AZ.

Why this answer

After a Multi-AZ failover in Amazon RDS for MySQL, the new primary instance is launched in a different Availability Zone (AZ) than the original primary. If the application's compute resources (e.g., EC2 instances) remain in the original AZ, cross-AZ network traffic incurs additional latency due to the physical distance and the need to traverse the AZ boundary, which typically adds 1–2 ms of round-trip time. This increased network latency directly impacts application performance, especially for latency-sensitive queries.

Exam trap

The trap here is that candidates often assume the DNS endpoint fails to update (Option C) or that the standby cannot handle writes (Option A), but AWS explicitly ensures both are handled correctly, and the real issue is the unavoidable cross-AZ network latency introduced by the new primary's location.

How to eliminate wrong answers

Option A is wrong because in a Multi-AZ deployment, there is no read replica; the standby instance is a synchronous replica that is promoted to primary during failover, and it is fully capable of handling write traffic. Option B is wrong because the failover process does not disable automatic backups; automated backups continue to run on the new primary instance based on the same backup window and retention policy. Option C is wrong because the DNS endpoint (CNAME) for the RDS instance automatically updates to point to the new primary within 60–120 seconds after failover, so the application's connection string remains valid without manual intervention.

Full explanation →
1488
MCQhard

A company uses Redshift for analytics. The security team requires that all queries be logged and that any access to sensitive columns be blocked for non-admin users. Which combination of features should the data engineer implement?

A.Enable Redshift audit logging and create views that expose only non-sensitive columns, granting access to views.
B.Use Redshift row-level security and enable CloudTrail logging.
C.Enable CloudWatch Logs for Redshift and use IAM conditions to block sensitive columns.
D.Enable Redshift audit logging and use IAM policies to restrict column access.
AnswerA

Views can restrict column access, and audit logging captures queries.

Why this answer

Redshift audit logging captures all queries, and creating views that expose only non-sensitive columns with access granted to those views enforces column-level access control for non-admin users. Option B is incorrect because row-level security is not supported in Redshift, and CloudTrail logging alone does not block access. Option C is incorrect because CloudWatch Logs do not control access; they only provide monitoring.

Option D is incorrect because IAM policies cannot restrict access to specific columns in Redshift.

Full explanation →
1489
MCQhard

A company uses Amazon DynamoDB as the primary data store for a real-time application. The data engineer observes that some read requests are returning stale data, even though the application uses strongly consistent reads. The table has auto-scaling enabled with a maximum read capacity of 10,000 RCUs. The observed read traffic averages 8,000 RCUs but occasionally spikes to 12,000 RCUs. What is the most likely cause of the stale reads?

A.Read capacity auto-scaling cannot keep up with sudden traffic spikes, causing throttling and fallback to eventually consistent reads.
B.The application uses write sharding, causing read-after-write inconsistencies.
C.The application is using DynamoDB Accelerator (DAX) which caches data and may return stale values.
D.The table is part of a DynamoDB global table, and the application reads from a replica in a different region.
AnswerA

Throttling can cause fallback to eventual consistency.

Why this answer

When read traffic spikes above the maximum auto-scaling limit of 10,000 RCUs (e.g., to 12,000 RCUs), the table cannot provision enough read capacity units quickly enough. This leads to throttling of requests. The AWS SDKs are designed to retry throttled requests, and under certain conditions, they may fall back to eventually consistent reads to reduce latency, which can return stale data.

This explains why stale data appears even when the application explicitly requests strongly consistent reads. Option B is incorrect: write sharding does not inherently cause read-after-write inconsistencies; DynamoDB's strong consistency guarantees hold if capacity is sufficient. Option C is incorrect: DAX is a caching layer that provides eventual consistency by default; strongly consistent reads bypass DAX and go directly to the table, so DAX is not involved.

Option D is incorrect: global tables replicate data asynchronously, but the statement says the application uses a single table; moreover, reading from a replica region would use eventually consistent reads only if configured, but the question states strongly consistent reads are used.

Full explanation →
1490
MCQeasy

A company wants to ingest streaming data from thousands of IoT devices into AWS for real-time analytics. Which AWS service is best suited for this purpose?

A.Amazon S3
B.AWS Lambda
C.Amazon RDS
D.Amazon Kinesis Data Streams
AnswerD

It is designed for real-time streaming data ingestion.

Why this answer

Amazon Kinesis Data Streams is purpose-built for ingesting and processing streaming data at scale from thousands of sources. It can capture and store terabytes of data per hour from IoT devices, enabling real-time analytics with millisecond latencies. The service provides durable, ordered data streams that can be consumed by multiple applications simultaneously.

Exam trap

The trap here is that candidates often confuse batch-oriented services like S3 or compute services like Lambda with the dedicated streaming ingestion layer required for real-time data, overlooking that Kinesis Data Streams provides the necessary buffering, ordering, and replay capabilities.

How to eliminate wrong answers

Option A is wrong because Amazon S3 is an object storage service designed for static data, not for real-time streaming ingestion; it lacks the low-latency, ordered delivery and concurrent consumer support required for streaming IoT data. Option B is wrong because AWS Lambda is a serverless compute service that can process events but is not designed as a primary ingestion buffer for high-throughput streaming data; it has a maximum invocation duration of 15 minutes and cannot natively store or replay streaming data. Option C is wrong because Amazon RDS is a relational database service for transactional workloads and structured queries, not for high-velocity, unbounded streaming data ingestion; it would create bottlenecks and cannot handle the throughput and ordering requirements of thousands of IoT devices.

Full explanation →
1491
MCQhard

A company uses Amazon Kinesis Data Analytics for Apache Flink to process streaming data. The application reads from a Kinesis stream with 10 shards and writes to an S3 bucket. The application is experiencing high latency. Analysis shows that the application is not keeping up with the incoming data rate. Which action would MOST effectively reduce latency?

A.Increase the number of shards in the Kinesis stream
B.Increase the Parallelism of the Flink application
C.Enable exactly-once delivery to S3
D.Use a larger Kinesis Data Analytics application (increase KPU)
AnswerB

Higher parallelism allows more concurrent processing.

Why this answer

The high latency is caused by the Flink application not keeping up with the incoming data rate, which indicates a processing bottleneck within the application itself. Increasing the Parallelism of the Flink application (Option B) directly increases the number of parallel subtasks that can process data concurrently, improving throughput and reducing latency. This is the most effective action because it addresses the root cause—insufficient compute resources for stream processing—without changing the source or sink configuration.

Exam trap

The trap here is that candidates often confuse scaling the infrastructure (KPU or shards) with scaling the application logic (parallelism), assuming that more shards or larger instances automatically resolve processing bottlenecks without explicitly tuning the Flink application's parallelism.

How to eliminate wrong answers

Option A is wrong because increasing the number of shards in the Kinesis stream would increase the incoming data rate and parallelism at the source, but the application is already unable to keep up with the current rate; adding more shards would worsen the bottleneck unless the Flink application's parallelism is also increased. Option C is wrong because enabling exactly-once delivery to S3 increases processing overhead and checkpointing frequency, which would further degrade performance and increase latency, not reduce it. Option D is wrong because increasing the Kinesis Data Analytics application size (KPU) increases the underlying compute resources (vCPU and memory), but without increasing Flink parallelism, the additional resources may not be fully utilized; parallelism must be explicitly configured to match the increased KPU for effective scaling.

Full explanation →
1492
Drag & Dropmedium

Order the steps to set up a Kinesis Data Analytics application for real-time stream processing.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First, set up the source stream. Then create the analytics application, configure it with the source and logic, start it, and finally monitor performance.

Full explanation →
1493
MCQeasy

A data engineer needs to ingest data from a relational database (MySQL) into Amazon S3 for analytics. The database is 500 GB and the job must run daily with incremental updates. Which AWS service is BEST suited for this task?

A.Amazon EMR with Apache Sqoop.
B.Amazon Kinesis Data Firehose with a database source.
C.AWS Database Migration Service (DMS) with a replication task.
D.AWS Glue ETL job with a JDBC connection.
AnswerC

DMS supports continuous replication and can write to S3.

Why this answer

AWS DMS with a replication task is the best choice because it is specifically designed for continuous, incremental data replication from relational databases like MySQL to Amazon S3. DMS supports ongoing replication (change data capture) to capture incremental changes without custom scripting, and it can handle the initial 500 GB load efficiently. Other services either lack native incremental support or require additional configuration for this use case.

Exam trap

The trap here is that candidates often choose AWS Glue ETL (Option D) because it is familiar for data transformation, but they overlook that Glue lacks native incremental replication from databases, whereas DMS is purpose-built for this exact scenario with minimal overhead.

How to eliminate wrong answers

Option A is wrong because Amazon EMR with Apache Sqoop is a batch-oriented tool that does not natively support continuous incremental updates; it requires manual scripting for change data capture and is more complex to manage for daily incremental runs. Option B is wrong because Amazon Kinesis Data Firehose does not natively connect to a relational database as a source; it ingests streaming data from producers like Kinesis Data Streams or SDK, not directly from MySQL. Option D is wrong because AWS Glue ETL with a JDBC connection is designed for batch ETL jobs and does not have built-in change data capture for incremental updates; it would require custom logic to track changes, making it less suitable for daily incremental ingestion.

Full explanation →
1494
MCQeasy

A company needs to store relational data that requires complex joins and transactional consistency. The workload is predictable and the data size is less than 500 GB. Which AWS service is MOST cost-effective for this use case?

A.Amazon Redshift
B.Amazon S3
C.Amazon RDS for PostgreSQL
D.Amazon DynamoDB
AnswerC

RDS offers managed relational databases with full SQL support, ideal for transactional workloads up to 500 GB.

Why this answer

Amazon RDS for PostgreSQL is the most cost-effective choice because it provides a fully managed relational database service that supports complex joins and transactional consistency (ACID compliance) for predictable workloads under 500 GB. Unlike Redshift, which is optimized for petabyte-scale analytics, RDS offers lower cost for this data size and workload pattern, while DynamoDB lacks native SQL join capabilities and S3 is not a relational database.

Exam trap

The trap here is that candidates often choose Amazon Redshift for any data that involves joins or analytics, ignoring that it is cost-prohibitive and architecturally mismatched for transactional, sub-500 GB workloads, while RDS is the correct relational database service for this scale.

How to eliminate wrong answers

Option A is wrong because Amazon Redshift is a columnar data warehouse designed for large-scale analytical queries (petabytes), not for transactional workloads requiring complex joins and ACID compliance; it is over-provisioned and cost-inefficient for sub-500 GB data. Option B is wrong because Amazon S3 is an object store that does not support relational queries, joins, or transactional consistency natively; it lacks a SQL engine and ACID guarantees. Option D is wrong because Amazon DynamoDB is a NoSQL key-value and document database that does not support complex joins or relational operations; it is optimized for high-throughput, low-latency access patterns, not transactional consistency across multiple tables.

Full explanation →
1495
Multi-Selectmedium

A data engineer is designing a data ingestion pipeline for real-time clickstream data. The data must be available for both real-time analytics and batch processing. The engineer wants to use Amazon Kinesis Data Streams. Which THREE components should be included in the architecture?

Select 3 answers
A.Amazon Kinesis Data Analytics
B.Amazon Kinesis Data Streams
C.Amazon Kinesis Client Library (KCL) application
D.Amazon Kinesis Data Firehose to deliver data to Amazon S3
E.Amazon SQS as a buffer
AnswersB, C, D

Primary ingestion service.

Why this answer

Amazon Kinesis Data Streams is the core ingestion service for real-time clickstream data, providing low-latency, durable storage of data records that can be consumed by multiple applications simultaneously. It enables both real-time analytics (via Kinesis Data Analytics or KCL applications) and batch processing (by integrating with Kinesis Data Firehose to deliver data to Amazon S3).

Exam trap

The trap here is that candidates often assume Kinesis Data Analytics is a required component for real-time analytics, but the question only requires the data to be available for real-time analytics—not that analytics must be performed within the pipeline—so Kinesis Data Analytics is optional, not mandatory.

Full explanation →
1496
MCQmedium

The exhibit shows the lifecycle configuration for an S3 bucket. Objects in the bucket are 200 days old on average. What will happen to the objects?

A.Objects will be transitioned to GLACIER after 90 days and deleted after 365 days.
B.Objects are in GLACIER now and will be deleted after 365 days from creation.
C.Objects will be transitioned to GLACIER after 200 days and deleted after 365 days.
D.Objects will be deleted after 90 days.
AnswerB

At 200 days, objects have been transitioned; expiration is at 365 days.

Why this answer

The lifecycle configuration shows a current version action to transition to GLACIOR (a misspelling of GLACIER) immediately (0 days after creation) and an expiration action to permanently delete the object 365 days after creation. Since the objects are already 200 days old on average, they have already been transitioned to GLACIER storage class. The expiration rule will delete them 365 days from their creation date, not from the current time.

Exam trap

The trap here is that candidates misinterpret the '0 days' transition as 'no transition' or assume the average age of 200 days means the transition hasn't happened yet, when in fact the lifecycle rules are based on creation date, not current age.

How to eliminate wrong answers

Option A is wrong because the lifecycle rule transitions objects to GLACIER immediately (0 days), not after 90 days. Option C is wrong because the transition occurs at 0 days, not after 200 days. Option D is wrong because the expiration deletes objects after 365 days, not after 90 days.

Full explanation →
1497
Multi-Selectmedium

A company is using AWS Glue Data Catalog to store metadata about datasets in S3. The data engineer wants to implement a data governance solution that tracks lineage and versioning of datasets. Which TWO AWS services can be used together to achieve this?

Select 2 answers
A.AWS Data Pipeline
B.AWS Lake Formation
C.AWS Glue Data Catalog
D.AWS CloudTrail
E.Amazon S3
AnswersB, C

Provides data lineage and versioning capabilities.

Why this answer

The correct answers are B (AWS Lake Formation) and C (AWS Glue Data Catalog). AWS Lake Formation provides data lineage tracking and versioning capabilities for datasets in the data lake. AWS Glue Data Catalog serves as the central metadata repository and integrates with Lake Formation to enable governance features like lineage.

Option A (AWS Data Pipeline) is a data orchestration service, not a governance tool. Option D (AWS CloudTrail) logs API calls but does not track data lineage or versioning. Option E (Amazon S3) is object storage and does not provide lineage or versioning by itself.

Full explanation →
1498
MCQmedium

A company stores sensitive user data in an Amazon RDS for PostgreSQL DB instance. A security audit requires that all data be encrypted at rest. The database is currently unencrypted. What is the MOST operationally efficient way to enable encryption at rest?

A.Create a read replica with encryption enabled and promote it.
B.Take a snapshot of the DB instance, copy it with encryption enabled, and restore the snapshot to a new DB instance.
C.Modify the DB instance and enable encryption in the console.
D.Modify the DB parameter group to include encryption parameters and reboot the instance.
AnswerB

This is the standard method to enable encryption for an existing unencrypted RDS instance.

Why this answer

RDS for PostgreSQL does not support enabling encryption at rest on an existing unencrypted DB instance directly. The only way to achieve this is by taking a snapshot of the unencrypted instance, creating an encrypted copy of that snapshot, and then restoring it to a new encrypted DB instance. This method is operationally efficient as it uses native RDS snapshot copy and restore capabilities without requiring additional infrastructure or manual data migration.

Exam trap

The trap here is that candidates assume encryption can be toggled on via a simple 'Modify' operation in the console or CLI, but AWS RDS explicitly requires a snapshot copy and restore for existing unencrypted instances, a detail often overlooked in favor of more familiar modification workflows.

How to eliminate wrong answers

Option A is wrong because creating a read replica of an unencrypted source DB instance does not allow enabling encryption on the replica; RDS read replicas inherit the encryption setting of the source, and you cannot enable encryption on a replica if the source is unencrypted. Option C is wrong because the RDS console does not provide a 'Modify' option to enable encryption at rest on an existing unencrypted DB instance; encryption can only be specified at creation time or via snapshot restore. Option D is wrong because modifying the DB parameter group does not affect storage encryption; encryption at rest is a storage-layer feature controlled by the RDS instance configuration, not by PostgreSQL parameters.

Full explanation →
1499
MCQeasy

A company runs a daily batch processing job on Amazon EMR that reads data from Amazon S3 and writes results back to S3. The job takes longer than expected. The engineer wants to monitor the job's resource utilization. Which AWS service should be used to collect and visualize metrics such as CPU and memory usage of the EMR cluster's nodes?

A.AWS Config to record configuration changes in the EMR cluster.
B.Amazon Athena to query EMR job logs stored in S3.
C.Amazon CloudWatch with the CloudWatch Agent installed on the EMR nodes.
D.AWS CloudTrail to log API calls made by the EMR job.
AnswerC

CloudWatch can collect CPU, memory, and disk metrics from EC2 instances (EMR nodes) via the CloudWatch Agent.

Why this answer

Amazon CloudWatch with the CloudWatch Agent installed on EMR nodes can collect CPU, memory, and other system-level metrics, which can be visualized in CloudWatch dashboards. Option A is incorrect because AWS Config records configuration changes, not resource utilization. Option B is incorrect because Amazon Athena is a query service for data in S3, not a monitoring service.

Option D is incorrect because AWS CloudTrail logs API calls, not performance metrics.

Full explanation →
1500
Multi-Selecteasy

A data engineer needs to transform CSV files in S3 to Parquet format using a serverless solution. The files are large (up to 5 GB each) and arrive irregularly. Which TWO services can accomplish this with minimal operational overhead? (Choose TWO.)

Select 2 answers
A.AWS Glue ETL job
B.AWS Step Functions with Athena CTAS queries
C.Amazon EC2 with a script
D.Amazon EMR cluster
E.Amazon Redshift Spectrum
AnswersA, B

Glue is serverless and can convert large CSV to Parquet efficiently.

Why this answer

AWS Glue ETL job is correct because it is a fully managed, serverless service that can automatically convert CSV to Parquet without provisioning infrastructure. It handles large files (up to 5 GB) by scaling Spark executors dynamically, and can be triggered by S3 events for irregular arrivals, minimizing operational overhead.

Exam trap

The trap here is that candidates often confuse query engines (like Athena or Redshift Spectrum) with transformation services, or assume that any AWS service with 'serverless' in its name can perform ETL, when in fact Athena CTAS requires Step Functions orchestration and is limited to SQL-based transformations, not direct file format conversion.

Full explanation →
Page 19

Page 20 of 23

Page 21

All pages

1234567891011121314151617181920212223

Practice DEA-C01 by domain

Target a specific domain to shore up weak areas.

Data Ingestion and TransformationData Operations and SupportData Security and GovernanceData Store Management
See all domains with question counts →