Knowledge + Practice

AWS Certified Data Engineer Associate DEA-C01 (DEA-C01) — Questions 1501–1575

1711 questions total · 23pages · All types, answers revealed

Take a mock exam Exam hub

Page 21 of 23

1501

MCQmedium

A data engineer is designing a data store for a time-series application that requires sub-millisecond read latency for the latest data and high ingestion rates. Which AWS service is most suitable?

A.Amazon DynamoDB

B.Amazon ElastiCache for Redis

C.Amazon RDS for PostgreSQL

D.Amazon Timestream

AnswerD

Timestream is purpose-built for time-series data with fast queries.

Why this answer

Amazon Timestream is purpose-built for time-series data, offering sub-millisecond read latency for recent data via its in-memory store and supporting high ingestion rates with automatic partitioning and tiering. It is the most suitable choice because it natively handles time-series workloads without requiring manual tuning or schema optimization.

Exam trap

The trap here is that candidates often choose Amazon DynamoDB for its low-latency reputation, overlooking that time-series workloads require specialized storage engines to handle high-frequency writes and time-based queries without manual sharding or hot partition issues.

How to eliminate wrong answers

Option A is wrong because Amazon DynamoDB, while fast for key-value lookups, does not natively optimize for time-series patterns; it requires careful design of partition keys and time-based sorting to avoid hot partitions, and its read latency for the latest data can exceed sub-millisecond under high throughput. Option B is wrong because Amazon ElastiCache for Redis is an in-memory cache, not a durable data store; it lacks built-in time-series functions (e.g., downsampling, retention policies) and requires manual eviction or TTL management, making it unsuitable for long-term storage and high ingestion rates without data loss. Option C is wrong because Amazon RDS for PostgreSQL is a relational database with row-based storage; it cannot achieve sub-millisecond read latency for the latest data under high write loads due to disk I/O and indexing overhead, and it lacks native time-series optimizations like automatic data tiering or time-based partitioning.

Full explanation →

1502

MCQmedium

A media company ingests large video files from partners via AWS Transfer Family (SFTP) into an S3 bucket. Each file is typically 2-5 GB. Once uploaded, an AWS Lambda function is triggered to transcode the video using Amazon Elastic Transcoder. The Lambda function reads the file from S3, submits a transcoding job to Elastic Transcoder, and writes the output back to a different S3 bucket. Recently, the Lambda function has been failing intermittently with timeouts, and the company reports that some files are not being transcoded. The CloudWatch logs show that the Lambda function is timing out after 15 minutes. The average transcoding job takes about 10 minutes to complete. The data engineer needs to fix the issue without changing the architecture drastically. What should the data engineer do?

A.Increase the Lambda function's reserved concurrency to allow multiple invocations in parallel.

B.Increase the Lambda function timeout to 20 minutes to accommodate longer transcoding jobs.

C.Modify the Lambda function to submit the transcoding job asynchronously and exit, using an SNS topic to trigger a second Lambda function when the job completes.

D.Replace AWS Transfer Family with AWS Database Migration Service to handle file transfers more efficiently.

AnswerC

Decoupling submission from completion avoids timeout.

Why this answer

The Lambda function is timing out because it waits synchronously for the Elastic Transcoder job to complete, which can exceed the 15-minute Lambda timeout. The correct fix is to decouple the transcoding submission from the waiting: modify the Lambda function to submit the job asynchronously and exit immediately, then use an SNS topic or CloudWatch Events to trigger a second Lambda function when the job completes. This avoids the timeout.

Option A (increasing reserved concurrency) does not address the root cause; timeouts occur per invocation, not due to lack of concurrency. Option B (increasing timeout to 20 minutes) might work but is not ideal because jobs can vary and still exceed the new timeout; the better pattern is asynchronous processing. Option D (replacing Transfer Family with DMS) is incorrect because DMS is for database migration, not file transfer and transcoding.

Full explanation →

1503

MCQeasy

A company is migrating an on-premises MongoDB database to Amazon DocumentDB. The data engineer needs to ensure minimal downtime during migration. Which AWS service should be used to facilitate the migration?

A.AWS Glue

B.AWS Snowball

C.AWS Database Migration Service (DMS)

D.Amazon S3 Transfer Acceleration

AnswerC

DMS supports live migration from MongoDB to DocumentDB with minimal downtime.

Why this answer

AWS Database Migration Service (DMS) supports continuous replication from MongoDB to Amazon DocumentDB using change data capture (CDC), enabling near-zero downtime migration. DMS can perform a full load followed by ongoing replication to keep the target synchronized until cutover.

Exam trap

The trap here is that candidates may confuse AWS Glue's ETL capabilities with database migration, overlooking that DMS is the only service purpose-built for live database migrations with minimal downtime and CDC support.

How to eliminate wrong answers

Option A is wrong because AWS Glue is a serverless data integration service for ETL (Extract, Transform, Load) jobs, not designed for live database migration with minimal downtime. Option B is wrong because AWS Snowball is a physical data transfer device for moving large volumes of data offline, which introduces significant downtime and is unsuitable for a live migration requiring minimal interruption. Option D is wrong because Amazon S3 Transfer Acceleration is a feature that speeds up uploads to S3 over the internet, not a database migration tool and cannot handle schema conversion or ongoing replication.

Full explanation →

1504

MCQmedium

A company is ingesting streaming data from IoT devices into Amazon Kinesis Data Streams. The data must be transformed in real-time using custom Python code before being stored in Amazon S3. Which AWS service should be used to perform this transformation?

A.Amazon EMR with Spark Streaming

B.AWS Lambda function triggered by Kinesis Data Streams

C.Kinesis Data Analytics for Apache Flink

D.Kinesis Data Firehose with custom data transformation

AnswerC

Kinesis Data Analytics for Apache Flink is the correct choice because it allows running custom Apache Flink applications that support custom Python code via the Apache Flink Python API, enabling real-time data transformation.

Why this answer

Amazon EMR with Spark Streaming, which is optimized for large-scale batch and stream processing but is not the simplest or most direct service for this specific use case. Option B is AWS Lambda, which can be used for simple transformations but has limitations on execution time and complexity. Option D is Kinesis Data Firehose with custom data transformation, which supports only built-in transformations or Lambda functions, not arbitrary custom Python code directly.

Option C, Kinesis Data Analytics for Apache Flink, is correct because it allows running custom Apache Flink applications, which support custom Python code via the Apache Flink Python API, for real-time data transformation.

Full explanation →

1505

Multi-Selecthard

A company needs to ingest data from multiple SaaS applications (Salesforce, Marketo) into Amazon S3 for analytics. The data volume is moderate (~100 GB per day). The pipeline must handle schema changes, deduplicate records, and provide low latency (under 1 hour). Which THREE services should be used? (Choose THREE.)

Select 3 answers

A.Amazon AppFlow

B.Amazon EventBridge

C.Amazon Kinesis Data Streams

D.AWS Glue DataBrew

E.AWS Database Migration Service (DMS)

AnswersA, B, D

AppFlow can ingest data from SaaS applications like Salesforce and Marketo.

Why this answer

Amazon AppFlow is the correct choice because it is a fully managed integration service specifically designed to transfer data from SaaS applications like Salesforce and Marketo to AWS services such as Amazon S3. It supports incremental transfers, handles schema changes automatically via its schema evolution feature, and can achieve sub-hour latency for moderate data volumes (~100 GB/day) without custom coding.

Exam trap

The trap here is that candidates often confuse Amazon Kinesis Data Streams as a universal ingestion service, but it lacks native SaaS connectors and schema evolution handling, making it unsuitable for this specific use case compared to AppFlow.

Full explanation →

1506

Multi-Selecthard

A company is migrating a legacy on-premises ETL pipeline to AWS. The pipeline processes daily batch files from an FTP server. The data must be transformed using complex business logic before being loaded into Amazon Redshift. Which THREE AWS services should be used for this migration?

Select 3 answers

A.Amazon Athena

B.Amazon Redshift

C.AWS Glue

D.Amazon Kinesis Data Streams

E.AWS Transfer Family

AnswersB, C, E

Redshift is the target data warehouse.

Why this answer

(Amazon Redshift) is correct as the target data warehouse for loading transformed data. Option C (AWS Glue) is correct because it can handle complex business transformations using PySpark or Python. Option E (AWS Transfer Family) is correct for replacing the FTP server and ingesting daily batch files securely into Amazon S3, which can then be processed by Glue.

Option A (Amazon Athena) is incorrect because Athena is a query service, not an ETL tool for complex transformations. Option D (Amazon Kinesis Data Streams) is incorrect because it is designed for real-time streaming data, not batch file processing from FTP.

Full explanation →

1507

MCQeasy

Refer to the exhibit. A data engineer sees this error log from an Amazon EC2 instance that is trying to access an S3 bucket in the us-west-2 region. The EC2 instance is in a VPC with a private subnet and no internet gateway. What is the MOST likely cause of this error?

A.The S3 bucket is in a different region than us-west-2.

B.The VPC does not have a VPC endpoint for S3.

C.The S3 bucket does not exist.

D.The IAM role attached to the EC2 instance does not have s3:GetObject permission.

AnswerB

Private subnet needs VPC endpoint to access S3.

Why this answer

The EC2 instance is in a private subnet without an internet gateway, so it cannot reach S3 over the internet. A VPC endpoint (Gateway or Interface) for S3 is required for private connectivity. The error log shows a connection timeout, which is consistent with the lack of a VPC endpoint.

Option A is incorrect because the bucket's region is us-west-2 as specified, and the bucket exists (DNS resolves). Option C is incorrect because the error is a timeout, not a 404 (bucket not found). Option D is incorrect because the error is a connection timeout, not an access denied (403), so IAM permissions are not the issue.

Full explanation →

1508

MCQeasy

A data engineer is designing a data lake on Amazon S3. The data lake will store raw data, transformed data, and curated datasets. The engineer needs to ensure that raw data is immutable (never overwritten or deleted) and that only authorized users can access the transformed data. Which combination of S3 features should the engineer use?

A.Use S3 Lifecycle policies to archive raw data to S3 Glacier and set bucket policies for transformed data.

B.Enable S3 Versioning and use S3 Access Points for each prefix.

C.Enable default encryption with SSE-KMS and use S3 bucket policies to restrict access.

D.Enable S3 Object Lock in compliance mode on the raw data prefix and use bucket policies to restrict access to transformed data prefix.

AnswerD

Object Lock in compliance mode prevents writes and deletes; bucket policies control access.

Why this answer

S3 Object Lock in compliance mode enforces a write-once-read-many (WORM) model, preventing any user—including the root user—from overwriting or deleting raw data. Bucket policies then provide granular access control to restrict the transformed data prefix to authorized users only, meeting both immutability and access control requirements.

Exam trap

The DEA-C01 exam often tests the distinction between versioning (which preserves history but allows overwrites) and Object Lock (which enforces immutability), leading candidates to choose versioning when immutability is explicitly required.

How to eliminate wrong answers

Option A is wrong because S3 Lifecycle policies only automate data transitions and deletions; they do not prevent overwrites or deletions, so raw data would not be immutable. Option B is wrong because S3 Versioning preserves previous versions but does not prevent deletion or overwrite of the current version; users can still delete or overwrite objects, and Access Points alone do not enforce immutability. Option C is wrong because SSE-KMS provides encryption at rest but does not prevent data from being overwritten or deleted; bucket policies control access but do not enforce immutability.

Full explanation →

1509

MCQeasy

A data engineer needs to store semi-structured JSON data that is accessed infrequently but must be retrievable within 5 minutes. The data is immutable once stored. Which storage solution is MOST cost-effective?

A.Amazon S3 Glacier Deep Archive

B.Amazon S3 Standard

C.Amazon S3 One Zone-IA

D.Amazon S3 Glacier Instant Retrieval

AnswerD

S3 Glacier Instant Retrieval: Correct. Lowest storage cost among options that meet the 5-minute retrieval requirement, ideal for long-term archival of infrequently accessed, immutable data.

Why this answer

Amazon S3 Glacier Instant Retrieval is the most cost-effective choice for long-term archival of infrequently accessed, immutable data with a 5-minute retrieval requirement. It offers a storage cost of $0.004/GB/month, significantly lower than One Zone-IA at $0.01/GB/month, and retrieval times of milliseconds to minutes, easily meeting the 5-minute requirement. One Zone-IA is cheaper than S3 Standard but more expensive than Glacier Instant Retrieval, and its single-AZ design introduces availability risk.

Glacier Deep Archive has a higher retrieval cost and typically takes hours, exceeding the 5-minute requirement.

Exam trap

The trap is that candidates may assume 'infrequently accessed' maps to 'archival' and choose Glacier Deep Archive, or they may focus on the single-AZ cost savings of One Zone-IA without comparing it to Glacier Instant Retrieval, missing the even lower storage cost of the latter.

How to eliminate wrong answers

Option A is wrong because Amazon S3 Glacier Deep Archive has a retrieval time of 12–48 hours, which far exceeds the 5-minute requirement. Option B is wrong because Amazon S3 Standard is designed for frequently accessed data and has a higher per-GB storage cost than One Zone-IA, making it less cost-effective for infrequently accessed immutable data. Option D is wrong because Amazon S3 Glacier Instant Retrieval, while providing millisecond retrieval, has a higher storage cost than One Zone-IA and is intended for long-term archival data that needs immediate access, not for infrequently accessed data that can tolerate a single-AZ risk.

Full explanation →

1510

MCQeasy

A data engineer needs to ingest data from multiple SaaS applications (Salesforce, Marketo) into Amazon S3 for a data lake. The data volumes are moderate and the sync needs to be scheduled daily. Which AWS service is most appropriate for this task?

A.AWS Glue

B.Amazon AppFlow

C.AWS Database Migration Service (DMS)

D.Amazon Kinesis Data Firehose

AnswerB

Designed for SaaS data ingestion.

Why this answer

Amazon AppFlow is purpose-built for securely transferring data between SaaS applications (like Salesforce and Marketo) and AWS services (like S3). It supports scheduled, incremental data syncs with built-in connectors, making it the most appropriate choice for moderate-volume daily ingestion into a data lake.

Exam trap

The trap here is that candidates often confuse AWS Glue's ETL capabilities with direct SaaS ingestion, overlooking that Glue requires a custom connector or script to pull from APIs, whereas AppFlow provides native, managed connectors.

How to eliminate wrong answers

Option A is wrong because AWS Glue is an ETL service designed for batch data transformation and cataloging, not for direct ingestion from SaaS applications; it lacks native connectors for Salesforce or Marketo. Option C is wrong because AWS DMS is intended for migrating databases (e.g., Oracle, MySQL) to AWS, not for pulling data from SaaS APIs. Option D is wrong because Amazon Kinesis Data Firehose is optimized for streaming data ingestion (e.g., from IoT or logs) and does not provide native SaaS connectors or scheduled sync capabilities.

Full explanation →

1511

Matchingmedium

Match each AWS data migration tool to its primary function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Migrate databases with minimal downtime

Physical device for large data transfer

Online data transfer between on-prem and AWS

Fast uploads over long distances

Combine data across sources into views

Why these pairings

AWS DMS migrates databases with minimal downtime; AWS Snowball transfers large datasets physically; AWS DataSync automates online data transfer. Common confusions include swapping tool functions or attributing schema conversion to DataSync instead of SCT.

Full explanation →

1512

MCQmedium

A company uses Amazon Kinesis Data Firehose to deliver streaming data to an S3 bucket. The data must be transformed from JSON to Parquet format before delivery. Which approach should be used?

A.Configure Kinesis Data Firehose to invoke a Lambda function for data transformation.

B.Use an AWS Glue ETL job to read from S3 and write Parquet back to S3.

C.Use Amazon EMR to process the data and output Parquet.

D.Use Kinesis Data Analytics to convert the data to Parquet.

AnswerA

Firehose can call a Lambda function to transform records, including converting JSON to Parquet.

Why this answer

Kinesis Data Firehose can invoke a Lambda function as a transformation step before data is delivered to S3. This allows you to convert JSON records to Parquet format inline, without needing an intermediate storage or separate processing pipeline. The Lambda function receives batches of records, transforms them (e.g., using PyArrow or similar libraries), and returns them to Firehose for delivery.

Exam trap

The trap here is that candidates may think they need a separate ETL service like Glue or EMR for format conversion, but Firehose's built-in Lambda integration is the simplest and most cost-effective way to transform data in-flight before delivery.

How to eliminate wrong answers

Option B is wrong because using an AWS Glue ETL job to read from S3 and write Parquet back to S3 introduces unnecessary latency and cost, and does not meet the requirement for transformation before delivery — it processes data after it is already stored. Option C is wrong because Amazon EMR is a heavy, cluster-based solution designed for large-scale batch or stream processing, not for lightweight, real-time transformation within a Firehose delivery stream. Option D is wrong because Kinesis Data Analytics is used for real-time analytics and SQL-based processing, not for converting data formats like JSON to Parquet; it cannot output Parquet directly to S3.

Full explanation →

1513

MCQmedium

Refer to the exhibit. Exhibit: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::123456789012:role/DataEngineer" }, "Action": [ "kms:Decrypt", "kms:ReEncrypt*" ], "Resource": "*" } ] } A data engineer tries to encrypt data using the KMS key associated with this key policy and receives an access denied error. What is the cause?

A.The principal is an IAM role, which is not allowed

B.There is an explicit deny in the policy

C.The Resource element is set to "*", which is invalid for KMS key policies

D.The policy does not include kms:Encrypt action

AnswerD

Encrypt action is missing.

Why this answer

The key policy grants Decrypt and ReEncrypt* actions, but not Encrypt. Therefore, the DataEngineer role does not have permission to encrypt data using this key. Option A is incorrect because IAM roles can be used as principals in key policies.

Option B is incorrect because there is no explicit deny statement in the policy. Option C is incorrect because "Resource": "*" is valid in KMS key policies and refers to the current key.

Full explanation →

1514

MCQmedium

A company is streaming IoT sensor data to Amazon Kinesis Data Streams. The data is JSON with a schema that changes occasionally. They want to load the data into Amazon S3 in Parquet format partitioned by date and sensor_id. Which approach is MOST cost-effective and operationally efficient?

A.Use Amazon EMR to read from Kinesis Data Streams and write to S3 in Parquet format.

B.Use a Lambda function to transform records to Parquet and write to S3.

C.Use a custom Kinesis Client Library application on EC2 to buffer and write Parquet files to S3.

D.Use Amazon Kinesis Data Firehose with a schema from AWS Glue Data Catalog to convert to Parquet and enable dynamic partitioning by date and sensor_id.

AnswerD

Amazon Kinesis Data Firehose can directly convert incoming JSON data to Parquet using a schema from AWS Glue Data Catalog, and supports dynamic partitioning by date and sensor_id without custom code. It is fully managed, making it the most cost-effective and operationally efficient.

Why this answer

Amazon Kinesis Data Firehose can directly convert incoming JSON data to Parquet using a schema from AWS Glue Data Catalog, and it supports dynamic partitioning by date and sensor_id without requiring custom code. This is the most cost-effective and operationally efficient approach as it is a fully managed service that handles buffering, conversion, and partitioning automatically. Option A (EMR) is overkill for this use case and adds operational complexity.

Option B (Lambda) would require additional transformation logic and is less efficient for high-throughput streaming. Option C (custom KCL application on EC2) requires ongoing management and is not as simple as using Firehose.

Full explanation →

1515

MCQhard

A data engineer is designing a data ingestion pipeline for JSON files landing in an Amazon S3 bucket. The pipeline must transform the data (e.g., flatten nested structures) and load it into Amazon Redshift. The transformation logic is complex and may evolve frequently. Which approach provides the MOST flexibility and ease of maintenance?

A.Use AWS Lambda functions to transform each file and load into Redshift.

B.Use the Amazon Redshift COPY command to load raw JSON directly.

C.Use AWS Glue ETL jobs to transform the data and load into Redshift.

D.Use Amazon Athena to query the raw data and insert into Redshift.

AnswerC

Glue ETL supports complex transformations and is easy to maintain.

Why this answer

AWS Glue ETL jobs provide a serverless, code-based environment using Apache Spark, which offers flexibility for complex transformations like flattening nested JSON structures. Glue can be configured to support exactly-once semantics through Spark checkpointing and transactional writes to Redshift, making it reliable for critical data pipelines. It handles varying file sizes and can be easily updated as transformation logic evolves.

Option A is incorrect because Lambda has execution time and memory limits, making it unsuitable for large JSON files or complex transformations, and achieving exactly-once requires careful idempotency design. Option B is incorrect because the Redshift COPY command loads raw JSON without transformation. Option D is incorrect because Athena is primarily for querying data in S3, not for performing ETL transformations and loading into Redshift.

Full explanation →

1516

MCQmedium

Refer to the exhibit. A data engineer is troubleshooting an AWS Lambda function that reads from an S3 bucket and writes to a Kinesis Data Stream. The Lambda function fails with an AccessDeniedException when calling the kinesis:PutRecords API. Which change is needed to the IAM policy?

A.Add s3:PutObject permission to the policy

B.Change the resource ARN for Kinesis to a wildcard

C.Change the resource ARN for Kinesis to include the correct stream name

D.Add kinesis:PutRecords permission to the policy

AnswerC

Correct. The resource ARN must match the stream name. Using the correct stream name fixes the error and follows security best practices.

Why this answer

The Lambda function's IAM policy grants kinesis:PutRecords permission but the resource ARN does not match the target Kinesis Data Stream. The AccessDeniedException occurs because IAM evaluates the resource ARN against the stream's ARN and denies access on mismatch. The correct fix is to change the resource ARN to include the correct stream name (option C).

While using a wildcard (option B) would also resolve the error, it is not the recommended approach because it violates the principle of least privilege. Option A is incorrect because the error is from Kinesis, not S3. Option D is incorrect because the kinesis:PutRecords action is already present in the policy.

Exam trap

The DEA-C01 exam often tests the misconception that adding the missing API action (kinesis:PutRecords) is the fix, but here the action is already present and the error stems from an incorrect resource ARN. The exam expects the specific stream name to be used, aligning with AWS best practices for least privilege.

How to eliminate wrong answers

Option A is wrong because the error is from Kinesis, not S3; adding s3:PutObject does not address the kinesis:PutRecords AccessDeniedException. Option C is wrong because the policy already includes a specific stream name, but it is incorrect; changing to a wildcard is the fix, not specifying a different name. Option D is wrong because the policy already includes kinesis:PutRecords permission; the issue is the resource ARN restriction, not a missing action.

Full explanation →

1517

MCQeasy

A company wants to ensure that all S3 buckets are encrypted using server-side encryption. Which AWS service can be used to automatically remediate non-compliant buckets?

A.AWS CloudTrail

B.Amazon Inspector

C.AWS Trusted Advisor

D.AWS Config

AnswerD

AWS Config can evaluate compliance and automatically remediate resources.

Why this answer

AWS Config can use managed rules like s3-bucket-server-side-encryption-enabled to check compliance and trigger auto-remediation via SSM Automation or Lambda. Option D is correct.

Full explanation →

1518

MCQeasy

A data engineer is configuring AWS Glue jobs to access data stored in Amazon S3. The data is encrypted using server-side encryption with AWS KMS (SSE-KMS). The Glue job needs to read and write data to the S3 bucket. Which IAM policy statement should be added to the Glue job's IAM role to allow it to use the KMS key?

A.{"Effect":"Allow","Action":["kms:Decrypt"],"Resource":"*"}

B.{"Effect":"Allow","Action":["kms:Decrypt","kms:GenerateDataKey"],"Resource":"*"}

C.{"Effect":"Allow","Action":["kms:Decrypt","kms:ReEncrypt"],"Resource":"*"}

D.{"Effect":"Allow","Action":["kms:Decrypt","kms:Encrypt"],"Resource":"*"}

AnswerB

These actions allow reading (Decrypt) and writing (GenerateDataKey) encrypted data.

Why this answer

To read and write data encrypted with SSE-KMS, AWS Glue needs both `kms:Decrypt` (to read existing encrypted data) and `kms:GenerateDataKey` (to create a new data key for writing encrypted data). `kms:GenerateDataKey` is required because S3 uses a data key to encrypt objects, and the caller must generate that key via KMS. Option B correctly includes both actions, allowing the Glue job to perform read and write operations on the SSE-KMS encrypted bucket.

Exam trap

The trap here is that candidates often assume `kms:Encrypt` is needed for writing encrypted data, but S3 SSE-KMS actually requires `kms:GenerateDataKey` because the encryption is done with a derived data key, not by calling `kms:Encrypt` directly.

How to eliminate wrong answers

Option A is wrong because it only grants `kms:Decrypt`, which allows reading encrypted data but not writing new encrypted objects; writing requires `kms:GenerateDataKey` to create the encryption key. Option C is wrong because `kms:ReEncrypt` is used for re-encrypting data under a different KMS key, which is not needed for standard S3 read/write operations with SSE-KMS. Option D is wrong because `kms:Encrypt` is used to encrypt plaintext data directly with a KMS key, but S3 SSE-KMS requires `kms:GenerateDataKey` (not `kms:Encrypt`) to obtain a data key for object-level encryption.

Full explanation →

1519

MCQhard

A company runs a critical application on Amazon RDS for MySQL that requires a Recovery Point Objective (RPO) of 5 minutes and a Recovery Time Objective (RTO) of 1 hour. The database is 500 GB. What is the MOST cost-effective disaster recovery solution that meets these requirements?

A.Deploy the database in a single Availability Zone and perform manual point-in-time restores.

B.Take automated snapshots daily and store them in Amazon S3.

C.Use a Multi-AZ deployment with automatic failover.

D.Create a cross-region read replica and promote it during a disaster.

AnswerC

Multi-AZ provides synchronous replication to a standby in another AZ, achieving RPO of seconds and RTO of minutes.

Why this answer

Multi-AZ RDS for MySQL provides synchronous standby replication to a second Availability Zone, enabling automatic failover with minimal data loss (typically zero) and RTO under 1 hour. This meets the RPO of 5 minutes and RTO of 1 hour without manual intervention, and is more cost-effective than a cross-region replica for a 500 GB database.

Exam trap

The trap here is that candidates often confuse Multi-AZ (synchronous, same-region, automatic failover) with cross-region read replicas (asynchronous, manual promotion), assuming both provide similar DR capabilities, but Multi-AZ is the only option that meets both RPO and RTO cost-effectively for a single-region requirement.

How to eliminate wrong answers

Option A is wrong because manual point-in-time restores from backups cannot achieve an RTO of 1 hour due to the time required to restore 500 GB from S3, and RPO depends on backup frequency, which is not guaranteed to be 5 minutes. Option B is wrong because daily automated snapshots provide an RPO of up to 24 hours, far exceeding the 5-minute requirement, and restoring from snapshots takes longer than 1 hour for a 500 GB database. Option D is wrong because a cross-region read replica uses asynchronous replication, which can introduce lag exceeding 5 minutes, and promoting it during a disaster requires manual steps that increase RTO beyond 1 hour; it is also more expensive due to cross-region data transfer costs.

Full explanation →

1520

MCQhard

A company ingests clickstream data into Amazon S3 via Kinesis Data Firehose. The data arrives in 20 MB files every 2 minutes. The data engineering team needs to transform nested JSON into a flat structure before loading into Amazon Redshift. Which approach is most cost-effective and scalable?

A.Create an AWS Glue ETL job that runs on a schedule, using dynamic frames to flatten the data and write to S3 in Parquet

B.Run an Amazon EMR cluster with Spark to flatten the data and write back to S3

C.Use AWS Lambda to transform each file as it arrives in S3

D.Use Amazon Redshift Spectrum to query the nested JSON directly and create a view

AnswerA

Glue's dynamic frames natively handle nested JSON and can run cost-effectively on a schedule.

Why this answer

AWS Glue ETL jobs are designed for serverless, scalable data transformation, and using dynamic frames to flatten nested JSON and write to Parquet is both cost-effective (pay per DPU-hour) and scalable (automatically handles data volume). The 20 MB files arriving every 2 minutes are well-suited for Glue's batch processing, and Parquet output optimizes Redshift loading via COPY commands.

Exam trap

The trap here is that candidates overestimate Lambda's suitability for file transformations, overlooking its payload and timeout constraints, while underestimating Glue's efficiency for small, frequent batch jobs compared to the overhead of a full EMR cluster.

How to eliminate wrong answers

Option B is wrong because running an Amazon EMR cluster with Spark for this small, frequent workload (20 MB every 2 minutes) incurs significant overhead from cluster provisioning and management, making it less cost-effective than serverless Glue. Option C is wrong because AWS Lambda has a 15-minute timeout and 6 MB invocation payload limit, making it unsuitable for transforming 20 MB files (even with streaming, it would require chunking and complex orchestration). Option D is wrong because Redshift Spectrum queries nested JSON directly without flattening, and creating a view does not transform the data into a flat structure required for loading into Redshift; it only provides a query-time abstraction.

Full explanation →

1521

Multi-Selectmedium

A company wants to use AWS Glue to transform data stored in Amazon S3. The data is partitioned by date and includes both CSV and Parquet files. The transformation should be optimized for cost and performance. Which THREE actions should the data engineer take? (Choose THREE.)

Select 3 answers

A.Run a crawler to update the schema before each job run.

B.Use partition pruning by filtering on the date column in the ETL script.

C.Use job bookmarks to process only new data.

D.Increase the number of DPUs to the maximum allowed.

E.Convert all files to Parquet format before processing.

AnswersB, C, E

Reduces data scanned.

Why this answer

Options B, C, and E are correct. Partition pruning (B) reduces the amount of data scanned by filtering on the date column, lowering cost and improving performance. Job bookmarks (C) track processed data, preventing reprocessing and saving time and cost.

Converting files to Parquet (E) reduces data size and enhances query performance due to its columnar format. Option A is incorrect because running a crawler before each job creates unnecessary overhead; the schema can be defined once or crawled periodically. Option D is incorrect because increasing DPUs to the maximum is costly and does not optimize performance; proper data partitioning and format are more effective.

Full explanation →

1522

MCQmedium

Refer to the exhibit. A data engineer creates an AWS Glue job using this CloudFormation template. The job processes new data files in S3 and uses job bookmarks to track processed files. After initial success, the job runs again but processes all files again instead of only new ones. What is the most likely cause?

A.The job bookmark option is set to 'job-bookmark-disable'

B.The enable-metrics parameter is set to true

C.The MaxRetries parameter is set to 0

D.The S3 input path does not have a partitioning scheme or timestamp to identify new files

AnswerD

Job bookmarks rely on partition structure or file timestamps to track progress.

Why this answer

AWS Glue job bookmarks rely on the structure of the input data to identify new files. Without a partitioning scheme or a timestamp-based naming convention in the S3 path, Glue cannot determine which files are new; it falls back to reprocessing all files. The job bookmark feature tracks processed files by examining the S3 path and file metadata, so a flat or non-partitioned structure prevents it from distinguishing new files from old ones.

Exam trap

The trap here is that candidates often assume job bookmarks automatically track any new files in S3, but they fail to realize that without a partitioning scheme or timestamp in the path, Glue cannot differentiate new files from existing ones, leading to full reprocessing.

How to eliminate wrong answers

Option A is wrong because if the job bookmark option were set to 'job-bookmark-disable', the job would never use bookmarks and would always process all files, but the question states the job initially succeeded and then reprocessed all files, implying bookmarks were enabled initially but failed to track new files. Option B is wrong because setting 'enable-metrics' to true enables CloudWatch metrics for monitoring, which has no effect on job bookmark behavior or file reprocessing. Option C is wrong because 'MaxRetries' set to 0 controls the number of retry attempts for the job run, not the bookmark tracking or file selection logic.

Full explanation →

1523

Multi-Selectmedium

Which TWO statements are true about Amazon Redshift distribution styles? (Choose TWO.)

Select 2 answers

A.KEY distribution is always the best choice to minimize data skew.

B.AUTO distribution always selects EVEN distribution.

C.ALL distribution copies the entire table to every node.

D.Redshift automatically assigns a ROUND ROBIN distribution style by default.

E.EVEN distribution distributes rows across slices in a round-robin fashion.

AnswersC, E

ALL distribution is useful for small tables that are frequently joined.

Why this answer

The ALL distribution style in Amazon Redshift copies the entire table to every node in the cluster. This is ideal for small, slowly changing dimension tables (like date or location tables) that need to be joined with large fact tables, as it eliminates the need to redistribute data across nodes during query execution.

Exam trap

The trap here is that candidates often confuse AUTO distribution with ROUND ROBIN, or assume that KEY distribution is always optimal, when in fact poor key selection can lead to severe data skew and performance degradation.

Full explanation →

1524

MCQeasy

A media company is building a data pipeline to ingest user activity logs from multiple sources into Amazon S3. The logs are JSON files generated every minute. The company wants to use Amazon Athena to query the logs with minimal latency and cost. The current approach is to use AWS Kinesis Data Firehose to deliver the logs to S3 with a prefix like 'logs/2024/01/01/00/file.json'. However, when running Athena queries, the team notices high query costs because Athena scans all files in the 'logs/' prefix even when querying for a specific date. What should the team do to reduce the amount of data scanned by Athena?

A.Create an Athena view that filters by date.

B.Increase the number of partitions by using a more granular prefix like 'logs/2024/01/01/00/00/'.

C.Convert the JSON files to Apache Parquet format using AWS Glue ETL jobs.

D.Create a Hive-style partition structure in S3 with keys like 'year=2024/month=01/day=01/hour=00/' and update the Glue Data Catalog accordingly.

AnswerD

Partition pruning allows Athena to scan only relevant directories, reducing costs.

Why this answer

Creating a Hive-style partition structure (e.g., year=2024/month=01/day=01/) enables Athena to perform partition pruning. When querying for a specific date, Athena scans only the relevant partition, reducing data scanned and cost. Option A is incorrect because Athena views do not reduce data scanning; they just store query logic.

Option B is incorrect because more granular prefixes without a partition structure (like Hive-style) do not enable partition pruning in Athena; Athena treats the prefix as a folder and still scans all files. Option C is incorrect because while converting to Parquet reduces scan size due to columnar storage and compression, it does not address the lack of partitioning; the main issue is full scan of all files regardless of format.

Full explanation →

1525

MCQmedium

A company runs a nightly ETL job using AWS Glue. The job reads data from a JDBC connection to an on-premises MySQL database. The job fails with an error indicating that the connection pool is exhausted. What is the most likely cause and solution?

A.The database is not reachable due to network issues. Check VPC and security groups.

B.The Glue job is hitting the AWS Glue connection pool limit. Increase the Glue connection pool size.

C.The database credentials are expired. Rotate the password in AWS Secrets Manager.

D.The Glue job is using too many executors, exhausting the database connections. Reduce the number of DPUs or increase the database max connections.

AnswerD

Glue can open multiple connections; reducing parallelism or scaling database helps.

Why this answer

AWS Glue jobs distribute work across multiple executors, each of which opens its own JDBC connection to the source database. When the number of executors (controlled by DPUs) exceeds the database's configured maximum connections, the database connection pool is exhausted, causing the error. Reducing the number of DPUs or increasing the database's max_connections setting resolves the issue.

Exam trap

The trap here is that candidates confuse a database-side connection pool exhaustion with an AWS Glue service limit or network issue, leading them to incorrectly choose options about Glue connection pools or VPC configurations.

How to eliminate wrong answers

Option A is wrong because a network connectivity issue (e.g., VPC or security group misconfiguration) would typically result in a timeout or 'cannot connect' error, not a 'connection pool exhausted' error. Option B is wrong because AWS Glue does not have a configurable 'connection pool size' for JDBC connections; the pool exhaustion is on the database side, not Glue's internal pool. Option C is wrong because expired credentials would cause an authentication failure (e.g., 'Access denied for user'), not a connection pool exhaustion error.

Full explanation →

1526

MCQhard

A company is running a MySQL database on Amazon RDS. The database size is 2 TB, and the company needs to migrate it to Amazon Aurora MySQL with minimal downtime. Which migration strategy is most appropriate?

A.Create an Aurora MySQL read replica from the RDS instance, then promote it.

B.Use mysqldump to export the database and import it into Aurora.

C.Take a snapshot of the RDS instance and restore it as an Aurora cluster.

D.Use AWS Database Migration Service (DMS) with full load and ongoing replication.

AnswerA

This approach allows replication with minimal downtime, then promote to master.

Why this answer

Creating an Aurora MySQL read replica from the existing RDS MySQL instance allows the Aurora cluster to stay synchronized with the source using MySQL’s native binlog replication. Once the replica lag reaches zero, you can promote it to a standalone Aurora cluster with minimal downtime, typically just a few seconds to stop writes and redirect traffic. This approach avoids the lengthy export/import process and leverages Amazon’s managed replication for near-zero-downtime migration.

Exam trap

The trap here is that candidates often assume DMS is always the best for minimal downtime, but for MySQL-to-Aurora migrations, the native read-replica promotion is simpler, faster, and fully managed by AWS, making it the most appropriate choice for this specific scenario.

How to eliminate wrong answers

Option B is wrong because mysqldump exports data as SQL statements, which for a 2 TB database would take hours to export and even longer to import, causing significant downtime and potential consistency issues. Option C is wrong because RDS snapshots cannot be directly restored as an Aurora cluster; you must first migrate the snapshot to an Aurora-compatible format using AWS DMS or the RDS-to-Aurora snapshot migration feature, which still requires downtime. Option D is wrong because while DMS with full load and ongoing replication can achieve minimal downtime, it adds unnecessary complexity and overhead compared to the simpler, native read-replica promotion method, which is the recommended AWS approach for MySQL-to-Aurora migrations.

Full explanation →

1527

Multi-Selecthard

A data engineer is designing a disaster recovery strategy for an Amazon RDS for MySQL database with Multi-AZ deployment. Which THREE actions should the engineer take to meet a Recovery Point Objective (RPO) of 5 minutes and a Recovery Time Objective (RTO) of 15 minutes? (Choose THREE.)

Select 3 answers

A.Enable automated backups with a retention period of 7 days.

B.Create a cross-region read replica to another AWS region.

C.Configure the DB instance to be Single-AZ for simplicity.

D.Export automated snapshots to an S3 bucket in a different region.

E.Enable Multi-AZ deployment for automatic failover.

AnswersA, B, E

Automated backups allow point-in-time recovery within the retention window, helping meet RPO.

Why this answer

To achieve an RPO of 5 minutes and RTO of 15 minutes for an Amazon RDS for MySQL database with Multi-AZ deployment, the engineer should enable automated backups (A) for point-in-time recovery within minutes, create a cross-region read replica (B) for fast failover in another region, and enable Multi-AZ deployment (E) for automatic failover within the same region. Option C (Single-AZ) would not provide high availability, and option D (exporting snapshots to S3) is too slow for the required RTO.

Full explanation →

1528

MCQmedium

A company uses AWS Glue ETL jobs to transform data in S3. The job runs successfully but takes longer than expected. The data is in Parquet format and partitioned by date. Which change would most improve performance without increasing cost?

A.Repartition the data by a different column.

B.Convert Parquet to CSV for faster serialization.

C.Increase the number of DPUs for the job.

D.Enable pushdown predicates to filter partitions early.

AnswerD

Reduces data scanned, improving performance.

Why this answer

Pushdown predicates allow AWS Glue to filter data at the storage layer (e.g., S3 partition pruning) before reading it into memory. Since the data is partitioned by date, enabling pushdown predicates reduces the amount of data scanned, which directly decreases job runtime without requiring additional DPUs or changing the data format.

Exam trap

The trap here is that candidates often assume performance issues are solved by adding more resources (DPUs) or changing file formats, when the real bottleneck is reading unnecessary data due to lack of partition pruning.

How to eliminate wrong answers

Option A is wrong because repartitioning by a different column would likely increase shuffle overhead and may not align with the existing partition structure, potentially worsening performance. Option B is wrong because converting Parquet to CSV would increase data size and I/O due to CSV's lack of compression and columnar storage, making the job slower and more expensive. Option C is wrong because increasing DPUs would raise cost without addressing the root cause (scanning unnecessary partitions), and the question explicitly asks for a change that does not increase cost.

Full explanation →

1529

MCQeasy

A media company stores video files in an Amazon S3 bucket. The bucket policy allows access only from a specific VPC. The company has enabled S3 Server Access Logs to monitor access. Recently, the security team found that some requests were coming from an IP address outside the allowed VPC. They suspect that the bucket policy may have an incorrect condition. What should they check first?

A.Verify that the bucket policy uses the 'aws:SourceVpc' condition key with the correct VPC ID.

B.Review the S3 Server Access Logs to identify the source IP addresses.

C.Ensure that the IAM role used by the application has the correct permissions.

D.Check if the bucket policy allows public access.

AnswerA

The 'aws:SourceVpc' condition key restricts access to requests originating from the specified VPC.

Why this answer

The `aws:SourceVpc` condition key is specifically designed to restrict access to requests originating from a specific VPC. If the bucket policy uses `aws:SourceVpce` (for VPC endpoints) or has an incorrect VPC ID, it may allow unintended access. Therefore, verifying the condition key and its value is the first troubleshooting step.

Option B is incorrect: while reviewing Server Access Logs can help identify suspicious IPs, the immediate issue is the bucket policy condition misconfiguration; logs are for detection, not root cause verification. Option C is incorrect: IAM role permissions are separate from the bucket policy's condition-based restriction; even with correct IAM permissions, the bucket policy condition could be misconfigured. Option D is incorrect: checking for public access is relevant but not the first step since the policy already uses a VPC-based condition; the specific condition key is the likely problem.

Full explanation →

1530

Multi-Selecteasy

A data engineer is designing a data ingestion pipeline that uses AWS Lambda to process records from a Kinesis Data Stream and write to DynamoDB. Which TWO strategies can help handle increased throughput and prevent data loss? (Choose TWO.)

Select 2 answers

A.Configure the Lambda event source mapping with a batch window and set the number of concurrent batches per shard

B.Use synchronous invocation of Lambda from the producer

C.Increase the number of shards in the Kinesis data stream

D.Configure a dead-letter queue (DLQ) for the Lambda function

E.Increase the Lambda function timeout

AnswersA, C

This improves throughput and handles spikes.

Why this answer

Configuring a batch window allows Lambda to accumulate records from the Kinesis stream for up to 300 seconds before invoking the function, which helps smooth out traffic spikes and reduces the number of invocations. Setting the number of concurrent batches per shard (via the ParallelizationFactor, up to 10) enables Lambda to process multiple batches from the same shard in parallel, increasing throughput without data loss. This combination ensures that records are processed efficiently even under high load, as Lambda can handle more concurrent executions per shard while batching reduces the risk of throttling.

Exam trap

The trap here is that candidates often think a dead-letter queue (DLQ) prevents data loss during high throughput, but DLQs only capture records after processing failures, not during ingestion spikes, and they confuse synchronous invocation (Option B) with the actual asynchronous event source mapping used by Kinesis.

Full explanation →

1531

MCQmedium

A data engineer needs to ensure that an S3 bucket is encrypted at rest using AWS KMS. The bucket policy must allow only a specific IAM role to access the bucket and enforce encryption in transit. Which combination of bucket policy statements should be used?

A.Use kms:ViaService: s3.*.amazonaws.com and aws:SecureTransport: true

B.Use s3:x-amz-server-side-encryption: AES256 and aws:SecureTransport: true

C.Use s3:x-amz-server-side-encryption-aws-kms-key-id and aws:SourceIp

D.Use kms:EncryptionContext: service:s3 and aws:SecureTransport: true

AnswerA

This enforces KMS encryption via S3 and TLS.

Why this answer

Option A uses the kms:ViaService condition key to restrict the use of the KMS key to requests that come through Amazon S3 (s3.*.amazonaws.com) and the aws:SecureTransport condition to enforce encryption in transit. This ensures that only requests made via S3 and using HTTPS/TLS are allowed to use the key. Option B uses s3:x-amz-server-side-encryption: AES256, which enforces SSE-S3 (AES-256) encryption, not KMS encryption.

Option C uses s3:x-amz-server-side-encryption-aws-kms-key-id, which requires a specific KMS key ID, but the aws:SourceIp condition does not enforce encryption in transit. Option D uses kms:EncryptionContext, which can be used to enforce KMS encryption but does not include the aws:SecureTransport condition, so encryption in transit is not enforced.

Full explanation →

1532

MCQmedium

A company uses AWS Glue for ETL jobs. The data engineer needs to ensure that the Glue job can access an S3 bucket in another account. What is the recommended approach?

A.Create an IAM role in the target account and have the Glue job assume that role

B.Assign an IAM role to the Glue job with permissions to access the bucket, and configure the bucket policy to allow the role

C.Configure the S3 bucket policy to allow the Glue job's IAM role and also set the Glue job's resource-based policy

D.Store AWS access keys for the target account in AWS Secrets Manager and have the Glue job retrieve them

AnswerB

Correct. To allow a Glue job in one account to access an S3 bucket in another account, the Glue job's IAM role must have the necessary S3 permissions, and the bucket policy in the target account must explicitly grant those permissions to the role's ARN. This is the recommended cross-account access pattern.

Why this answer

For a Glue job in one account to access an S3 bucket in another account, the standard approach is to grant the Glue job's IAM role permissions to perform S3 actions on the bucket and configure the bucket policy in the target account to allow that role's ARN. Option A is technically possible if the target account's role trusts the Glue job's account and the job has sts:AssumeRole permissions, but this adds unnecessary complexity and is not the recommended method. Option C is incorrect because Glue jobs do not have resource-based policies.

Option D is incorrect because Glue jobs cannot use static access keys.

Full explanation →

1533

MCQmedium

A data engineering team uses AWS Glue ETL jobs to process data from Amazon S3 and load it into an Amazon Redshift cluster. The cluster has a single node of type dc2.large. The team notices that the ETL jobs are failing intermittently with errors related to disk space. The Redshift cluster shows that the disk is nearly full. The team needs to resolve the disk space issue and ensure the ETL jobs can complete successfully without increasing costs significantly. Which solution should the team implement?

A.Convert the cluster to use RA3 node types (e.g., ra3.xlarge) with managed storage.

B.Load data into a staging table first, then perform a VACUUM and ANALYZE on the target tables.

C.Add more nodes to the Redshift cluster by resizing to a multi-node dc2.large configuration.

D.Set the table's distribution style to ALL for fact tables to avoid data redistribution during joins.

AnswerA

Correct: RA3 nodes decouple compute and storage via managed storage, eliminating fixed local disk limits and enabling storage scaling as needed.

Why this answer

Converting to RA3 node types with managed storage allows compute and storage to scale independently, resolving the disk space issue without over-provisioning compute. Options B and D do not increase disk capacity. Option C adds more nodes but still uses fixed storage per node and increases cost significantly.

Full explanation →

1534

MCQmedium

A company is using Amazon Kinesis Data Firehose to deliver streaming data to an Amazon S3 bucket. The data is delivered in JSON format. The company wants to convert the data to Apache Parquet format before delivery to reduce storage costs and improve query performance. How can this be achieved?

A.Deliver data to S3 as JSON, then use Amazon Athena to convert to Parquet.

B.Use the AWS Glue Data Catalog to define a schema and configure Firehose to use it for Parquet conversion.

C.Write an AWS Lambda function to transform the data to Parquet and deliver it to S3.

D.Configure the Firehose stream to convert data to Parquet automatically without any additional setup.

AnswerB

Correct. Kinesis Data Firehose can convert incoming data to Parquet or ORC using a schema from the AWS Glue Data Catalog. This is the recommended method.

Why this answer

Kinesis Data Firehose can convert the input data to Parquet or ORC format using a schema from the AWS Glue Data Catalog. Option A is incorrect because delivering as JSON then converting with Athena is an extra step after storage, not before delivery, and does not reduce storage costs from the outset. Option C is incorrect because Lambda can be used for custom transformations, but Firehose natively supports Parquet conversion using Glue.

Option D is incorrect because Firehose cannot convert to Parquet automatically without a schema; you must provide a schema (e.g., from Glue).

Full explanation →

1535

MCQmedium

A company is migrating an on-premises MySQL database to Amazon RDS for MySQL. The database is 500 GB and has a 24/7 uptime requirement. The migration must minimize downtime. Which approach should be used?

A.Take a snapshot of the on-premises database, convert it to a volume, and restore to RDS.

B.Use AWS Database Migration Service (DMS) with ongoing replication to migrate the data.

C.Export the database using mysqldump and import it into RDS using mysql command.

D.Create an RDS MySQL read replica from the on-premises database using native replication.

AnswerB

DMS supports ongoing replication, minimizing downtime by allowing a final cutover after the initial load.

Why this answer

AWS DMS with ongoing replication (change data capture) allows you to perform a full load of the 500 GB database and then continuously replicate changes from the on-premises MySQL source to the Amazon RDS target. This minimizes downtime because you can cut over to RDS in seconds after the target is synchronized, rather than taking the source offline for an extended period.

Exam trap

The trap here is that candidates often choose mysqldump (Option C) because it is a familiar tool, but they overlook the requirement for minimal downtime and the fact that a 500 GB dump/import would take hours, violating the 24/7 uptime requirement.

How to eliminate wrong answers

Option A is wrong because taking a snapshot of an on-premises database and converting it to a volume is not a supported method for migrating to RDS; snapshots are native to AWS block storage and cannot be directly created from an on-premises database. Option C is wrong because using mysqldump and mysql import requires the source database to be read-locked or offline during the export/import process, causing significant downtime for a 500 GB database with a 24/7 uptime requirement. Option D is wrong because RDS cannot be configured as a read replica of an on-premises MySQL database using native replication; native MySQL replication requires the replica to have direct network access to the source, and RDS does not support being a replica of an external source—only the reverse (RDS as source to external replica) is possible.

Full explanation →

1536

MCQmedium

An IAM policy is attached to an IAM role used by an EC2 instance in the 10.0.0.0/8 VPC. The EC2 instance cannot read objects from the S3 bucket. What is the most likely cause?

A.The policy does not grant s3:ListBucket permission.

B.The S3 bucket has a bucket policy that denies public access, and the IAM policy alone is insufficient.

C.The bucket is encrypted with SSE-KMS and the role does not have kms:Decrypt permission.

D.The EC2 instance's public IP is not in the 10.0.0.0/8 range.

AnswerB

The IAM policy allows access, but if the bucket policy denies all access except from specific principals, the IAM role may still be denied. The bucket policy must explicitly allow the role.

Why this answer

The most likely cause is that the S3 bucket has a bucket policy that denies access or does not explicitly grant access to the IAM role. Even if the IAM policy attached to the role allows S3 actions, a bucket policy can override it with an explicit deny or by not granting access to the role. Option A is incorrect because the s3:GetObject operation does not require s3:ListBucket permission.

Option C is incorrect because SSE-KMS is not mentioned and would require specific kms:Decrypt permission, but it is not the most likely cause. Option D is incorrect because the EC2 instance's private IP is within the 10.0.0.0/8 VPC range, and the public IP is irrelevant for in-VPC communication.

Exam trap

A common trap is to assume that IAM policies alone are sufficient for S3 access, but bucket policies can override them with explicit denies or by not granting access to the role.

Full explanation →

1537

MCQmedium

A data engineer applies the following IAM policy to an IAM user: ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::example-bucket/*", "Condition": { "StringEquals": { "s3:x-amz-server-side-encryption": "AES256" } } } ] } ``` The user attempts to download an object from the bucket 'example-bucket' that is encrypted with SSE-S3 (AES256). Will the request succeed?

A.Yes, but only if the user also has s3:ListBucket permission.

B.No, because the policy requires the encryption to be specified in the request.

C.Yes, because the object is encrypted with SSE-S3 which uses AES256.

D.No, because the policy does not allow the s3:GetObject action for encrypted objects.

AnswerB

Correct. The policy has a condition requiring the encryption header to be specified in the request. Since the user does not include it, the request is denied.

Why this answer

The IAM policy includes a condition that requires the request to include the `x-amz-server-side-encryption` header with value `AES256`. Even though the object is encrypted with SSE-S3, the policy condition evaluates the request headers, not the object's encryption state. Since the user does not specify the encryption header in the download request, the condition fails, and the request is denied.

Exam trap

The trap is that candidates assume SSE-S3 is transparent and always allows access, overlooking that the IAM policy condition explicitly requires the encryption header in the request. The condition applies to the request, not the object's encryption-at-rest.

How to eliminate wrong answers

Option A is wrong because s3:ListBucket permission is not required to download an object; s3:GetObject alone suffices, and the policy does not reference ListBucket. Option B is wrong because the policy requires encryption to be specified in the request only for objects encrypted with SSE-KMS or SSE-C, not for SSE-S3 objects, which are automatically handled by S3 without client-side encryption headers. Option D is wrong because the policy does allow s3:GetAction for encrypted objects; the condition only denies requests that fail to include encryption headers, and SSE-S3 objects do not require such headers.

Full explanation →

1538

MCQhard

A company uses AWS Glue to process data from Amazon S3. The data contains personally identifiable information (PII). The data engineer needs to automatically detect and mask PII fields before the data is loaded into Amazon Redshift. Which combination of AWS services should be used?

A.Amazon Macie and AWS Glue

B.Amazon CloudWatch Logs and AWS Lambda

C.Amazon S3 Object Lambda and AWS Glue

D.AWS IAM Access Analyzer and AWS Glue

AnswerA

Macie detects PII, Glue can mask it in the ETL job before writing to Redshift.

Why this answer

Amazon Macie discovers sensitive data, and then AWS Glue can apply transformations to mask the PII before loading into Redshift. CloudWatch Logs is for monitoring, not detection. IAM Access Analyzer is for analyzing resource policies.

S3 Object Lambda can redact data during retrieval but not during Glue ETL.

Full explanation →

1539

Multi-Selectmedium

A company uses Amazon S3 to store data for analytics. The data engineer needs to ensure that the S3 bucket is protected against accidental deletion of objects. Which THREE actions should the engineer take? (Choose THREE.)

Select 3 answers

A.Enable server access logging for the S3 bucket.

B.Create an S3 bucket policy that explicitly denies the s3:DeleteObject action.

C.Configure a lifecycle policy to transition objects to Glacier.

D.Enable versioning on the S3 bucket.

E.Enable MFA Delete on the S3 bucket.

AnswersB, D, E

Prevents any user from deleting objects.

Why this answer

To protect against accidental deletion of objects in Amazon S3, three effective measures are: creating a bucket policy that explicitly denies the s3:DeleteObject action (option B), enabling versioning (option D), and enabling MFA Delete (option E). Option B ensures that no principal can delete objects unless an explicit allow overrides it. Option D preserves all object versions, allowing recovery of deleted objects.

Option E requires multi-factor authentication for deletion operations, adding an extra security layer. Option A (server access logging) is for auditing, not prevention. Option C (lifecycle policy to Glacier) does not prevent deletion; it transitions objects to cheaper storage but objects can still be deleted by lifecycle rules or manually.

Full explanation →

1540

MCQeasy

A company needs to store JSON documents that are frequently read and written by a web application. The data must be highly available and durable across multiple Availability Zones. Which AWS database service meets these requirements?

A.Amazon RDS for PostgreSQL

B.Amazon S3

C.Amazon DynamoDB

D.Amazon ElastiCache for Redis

AnswerC

DynamoDB is a fully managed NoSQL database that supports JSON documents and offers multi-AZ durability.

Why this answer

Amazon DynamoDB is a fully managed NoSQL key-value and document database that provides single-digit millisecond performance at any scale. It stores JSON documents natively, supports frequent reads and writes, and offers built-in high availability and durability by automatically replicating data across multiple Availability Zones (AZs) in an AWS Region. This makes it the ideal choice for the described web application workload.

Exam trap

The trap here is that candidates often confuse Amazon S3's high durability and availability with database capabilities, overlooking that S3 is an object store with higher latency and no native query support, while DynamoDB is purpose-built for low-latency, high-throughput document storage with ACID transactions via DynamoDB Transactions.

How to eliminate wrong answers

Option A is wrong because Amazon RDS for PostgreSQL is a relational database that stores data in tables with a fixed schema, not as JSON documents natively, and while it can be deployed in a Multi-AZ configuration for high availability, it does not provide the same level of automatic, seamless scaling and native JSON document support as DynamoDB. Option B is wrong because Amazon S3 is an object storage service, not a database; it can store JSON files but is not designed for frequent, low-latency read/write operations from a web application, and it lacks features like atomic transactions and query capabilities that a database provides. Option D is wrong because Amazon ElastiCache for Redis is an in-memory cache, not a durable database; while it can store JSON documents using the RedisJSON module, data is primarily stored in memory and is not durable by default across AZs, making it unsuitable for the durability and persistence requirements of a primary data store.

Full explanation →

1541

Multi-Selectmedium

A healthcare company stores sensitive patient data in an S3 bucket (bucket name: patient-data-prod). The security team requires that all data be encrypted in transit and at rest, and that access be logged for auditing. The company currently uses S3 default encryption with SSE-S3. An external auditor finds that some objects have been uploaded without encryption because the default encryption setting was not applied to objects uploaded before the setting was enabled. The company wants to prevent any future unencrypted uploads and ensure all existing objects are encrypted. Which combination of actions should the data engineer take? (Choose TWO.)

Select 2 answers

A.Use S3 Batch Operations to copy all existing objects in place with the 'Copy' operation to apply default encryption.

B.Enable S3 Object Ownership and set the bucket ACL to private.

C.Enable S3 default encryption on the bucket.

D.Create a bucket policy that denies s3:PutObject if the x-amz-server-side-encryption-aws-kms-key-id is not present.

E.Create a bucket policy that denies s3:PutObject if the x-amz-server-side-encryption header is not set to 'AES256'.

AnswersA, E

Use S3 Batch Operations with the 'Copy' operation to copy objects in place, which applies the bucket's default encryption setting to each object.

Why this answer

To prevent future unencrypted uploads, the bucket policy must deny PutObject requests that do not include the x-amz-server-side-encryption header set to 'AES256' (Option E). This ensures all new objects are encrypted with SSE-S3. To encrypt existing objects that were uploaded before default encryption was enabled, S3 Batch Operations can perform a copy in place to apply default encryption (Option A).

Option C alone would not apply to existing objects. Option B is unrelated, and Option D references KMS, which is not needed since SSE-S3 uses AES256. Therefore, the correct combination is Options A and E.

Full explanation →

1542

MCQeasy

A company runs a MySQL database on Amazon RDS. The database size is 500 GB and is experiencing high read traffic. The team wants to improve read performance with minimal operational overhead. Which action should they take?

A.Create a read replica in the same region

B.Enable Multi-AZ deployment

C.Implement Amazon ElastiCache for caching

D.Upgrade to a larger instance class

AnswerA

Read replicas offload read traffic with minimal operational overhead.

Why this answer

Creating a read replica in the same region offloads read traffic from the primary RDS instance by providing a separate, read-only copy of the database. This directly addresses high read traffic with minimal operational overhead, as RDS manages the asynchronous replication using MySQL's native binlog-based replication. The replica can serve SELECT queries, reducing load on the primary instance without requiring application changes.

Exam trap

The trap here is confusing Multi-AZ (high availability) with read scaling, leading candidates to select Multi-AZ deployment thinking it improves read performance, when in fact the standby is not accessible for reads.

How to eliminate wrong answers

Option B is wrong because Multi-AZ deployment provides high availability and automatic failover, not read scaling; the standby instance cannot serve read traffic. Option C is wrong because while ElastiCache can improve read performance for cached data, it requires application-level caching logic and does not offload database read queries for all data, adding operational complexity. Option D is wrong because upgrading to a larger instance class scales vertically, which can improve performance but incurs higher cost and downtime during scaling, and does not distribute read load as efficiently as a read replica.

Full explanation →

1543

MCQmedium

A company uses AWS DMS to migrate data from an on-premises Oracle database to Amazon Aurora MySQL. The migration is successful, but the ongoing replication task is experiencing high latency. Which configuration change is most likely to reduce latency?

A.Increase the size of the DMS replication instance.

B.Decrease the task's batch size and batch apply timeout.

C.Change the target endpoint to Amazon S3.

D.Enable Change Data Capture (CDC) from binary logs.

AnswerA

A larger instance provides more resources to process change data capture (CDC) faster.

Why this answer

Increasing the size of the DMS replication instance provides more CPU and memory, which can process and apply changes faster, thereby reducing latency in ongoing replication. Option B is incorrect because decreasing the batch size and batch apply timeout would likely increase latency by reducing the efficiency of batch writes. Option C is incorrect because changing the target endpoint to Amazon S3 is not relevant; the target is Aurora MySQL, and migrating to S3 would not resolve latency issues for the current setup.

Option D is incorrect because enabling CDC from binary logs is not applicable; the source is Oracle, which uses redo logs, not binary logs. Additionally, CDC is already used in ongoing replication from Oracle.

Full explanation →

1544

MCQmedium

A data engineer is troubleshooting a Lambda function that reads from the Kinesis stream 'my-data-stream'. The Lambda function is able to read data but occasionally fails with 'KMS.AccessDeniedException'. What is the most likely cause?

A.The Lambda function's execution role does not have kms:Decrypt permission for the KMS key.

B.The retention period is too short; increase it.

C.The stream has too few shards; increase shard count.

D.The Lambda function is not authorized to consume from Kinesis streams.

AnswerA

Kinesis uses KMS for encryption; consumers need decrypt permission.

Why this answer

The KMS.AccessDeniedException indicates that the Lambda function's execution role lacks the kms:Decrypt permission for the AWS KMS key used to encrypt the Kinesis stream. When a Kinesis stream is encrypted with a customer managed KMS key, the consumer (Lambda) must have explicit decrypt permissions on that key to read the data records.

Exam trap

The trap here is that candidates may confuse KMS permissions with Kinesis stream permissions, assuming the error is about stream consumption authorization rather than decryption of encrypted data.

How to eliminate wrong answers

Option B is wrong because a short retention period would cause data to expire, not produce a KMS.AccessDeniedException. Option C is wrong because insufficient shards would cause throttling or throughput issues, not a KMS access error. Option D is wrong because the Lambda function is already able to read data (as stated), so it has Kinesis consumption authorization; the error is specifically about KMS decryption, not stream-level permissions.

Full explanation →

1545

MCQmedium

A data engineer notices that an AWS Glue job writing to Amazon S3 in Parquet format creates many small files (less than 1 MB each). This leads to poor query performance in Amazon Athena. What is the BEST way to reduce the number of output files?

A.Enable 'groupFiles' in the Glue job's S3 target configuration.

B.Use 'coalesce(1)' at the end of the ETL script.

C.Use 'repartition(100)' to increase parallelism.

D.Configure an S3 lifecycle policy to delete small files.

AnswerA

Glue's groupFiles option merges small files during write.

Why this answer

Enabling 'groupFiles' in the AWS Glue job's S3 target configuration instructs Glue to coalesce small files into larger ones (default target size ~128 MB) during the write phase. This directly reduces the number of small Parquet files written to S3, improving Athena query performance by minimizing S3 LIST and GET overhead.

Exam trap

The trap here is that candidates often confuse 'coalesce(1)' or 'repartition()' as file-size solutions, but these operations control the number of Spark partitions, not the final file size, and can actually worsen the problem or cause job failures.

How to eliminate wrong answers

Option B is wrong because 'coalesce(1)' forces all data into a single partition, which can cause out-of-memory errors or severe performance degradation in distributed Spark jobs, and it does not address the root cause of small files from multiple tasks. Option C is wrong because 'repartition(100)' increases parallelism, which would create even more output files (up to 100), worsening the small-file problem. Option D is wrong because an S3 lifecycle policy deletes files after a set time period, but it does not consolidate existing small files or prevent them from being created; it only removes them after the fact, which does not solve the immediate query performance issue.

Full explanation →

1546

MCQmedium

A data engineer is troubleshooting an AWS Glue job that is failing with an Access Denied error when trying to read data from an S3 bucket. The IAM policy attached to the Glue job's IAM role is shown in the exhibit. What is the likely cause of the failure?

A.The policy does not include s3:GetObject or s3:PutObject permissions.

B.The policy does not include glue:StartJobRun permission.

C.The policy does not include s3:ListBucket permission on the bucket.

D.The policy does not include glue:GetJobRun permission.

AnswerC

Glue needs s3:ListBucket to enumerate objects in the bucket before reading.

Why this answer

The IAM policy grants s3:GetObject and s3:PutObject on the bucket objects, but it does not include s3:ListBucket permission on the bucket itself. When AWS Glue reads data from S3, it needs to list the objects in the bucket first (s3:ListBucket) to discover which objects to read. Without this permission, the Glue job fails with an Access Denied error even though it has GetObject permission.

Option A is incorrect because the policy does include s3:GetObject (implied for objects) and the issue is not about PutObject. Option B is incorrect because glue:StartJobRun is not related to S3 access; the error is S3-specific. Option D is incorrect because glue:GetJobRun is unrelated to the S3 access issue.

Full explanation →

1547

MCQeasy

A company uses Amazon Athena to query data in S3. Recently, queries have become slow. The data is stored as CSV files in a partitioned table. What is the most effective way to improve query performance?

A.Increase the number of nodes in the Athena query engine.

B.Convert the data to Parquet format and optimize partitioning.

C.Convert the data to JSON format.

D.Increase the size of the CSV files to reduce the number of files.

AnswerB

Converting to Parquet (columnar) and optimizing partitioning reduces data scanned through column pruning and partition pruning, significantly improving performance. This is the correct answer.

Why this answer

The correct answer. Parquet is a columnar storage format that allows Athena to read only the columns needed for a query, reducing I/O and improving performance. Combined with effective partitioning, it enables partition pruning, which further limits the data scanned.

CSV files are row-based and require full scans, even with partitioning. Option A is incorrect because Athena is serverless and users cannot increase nodes; resources are managed automatically. Option C is incorrect: JSON is also row-based and verbose, making it even slower than CSV.

Option D is incorrect because larger CSV files still lead to full scans; Parquet's columnar nature is more impactful than file size.

Exam trap

A common trap is to think that simply increasing file size or using a more popular format like JSON will help. However, the key is switching to a columnar format (Parquet or ORC) that minimizes data scanned.

Full explanation →

1548

MCQmedium

A data engineer notices that an Amazon Redshift cluster is running low on disk space. The cluster has three nodes of type dc2.large. Which action will increase the available storage capacity?

A.Increase the number of nodes in the cluster.

B.Mount an Amazon S3 bucket as a file system to store data.

C.Change the volume type to Provisioned IOPS SSD (io1) to increase capacity.

D.Enable automatic compression on the tables.

AnswerA

Adding nodes increases total storage capacity.

Why this answer

Amazon Redshift stores data on the local instance store volumes attached to each node in the cluster. With a dc2.large cluster, each node provides approximately 160 GB of SSD storage. Adding nodes increases the total available storage linearly because each new node contributes its local storage to the cluster.

Therefore, increasing the number of nodes is the correct way to expand disk capacity.

Exam trap

The trap here is that candidates may confuse Redshift's local storage model with EBS-backed storage, leading them to think they can change volume types or mount external storage like S3, when in fact Redshift relies solely on the aggregate of each node's local instance store for persistent data.

How to eliminate wrong answers

Option B is wrong because Amazon S3 is an object storage service and cannot be mounted as a file system directly to Redshift; Redshift can only load data from S3 via COPY commands or external tables using Redshift Spectrum, but S3 does not expand the local disk space of the cluster. Option C is wrong because Provisioned IOPS SSD (io1) is an EBS volume type used for Amazon EC2 instances, not for Redshift nodes; Redshift dc2.large nodes use local instance store SSDs, and volume type cannot be changed. Option D is wrong because enabling automatic compression on tables optimizes storage efficiency by reducing the size of data on disk, but it does not increase the total available storage capacity of the cluster; it only helps use existing space more efficiently.

Full explanation →

1549

MCQmedium

Refer to the exhibit. A data engineer is creating an IAM policy for an application that sends data to a Kinesis stream and stores processed data in S3. The policy is attached to an IAM role used by an EC2 instance. The application fails to write to S3 with an access denied error. What is the cause?

A.The policy does not allow s3:ListBucket on the bucket.

B.The IAM role is not attached to the EC2 instance profile.

C.The policy does not allow kinesis:PutRecord on the stream.

D.The EC2 instance does not have an internet gateway to reach S3.

AnswerA

Some operations require ListBucket permission; without it, the SDK may fail.

Why this answer

The error occurs because the IAM policy grants s3:PutObject but not s3:ListBucket on the target S3 bucket. When the application writes to S3, the AWS SDK often performs a ListBucket operation first to verify bucket existence or to handle multipart uploads, and without s3:ListBucket permission, the request is denied with an access denied error.

Exam trap

The DEA-C01 exam often tests the nuance that S3 write operations (PutObject) require the s3:ListBucket permission on the bucket for SDK-level operations, even though the explicit API call is only PutObject.

How to eliminate wrong answers

Option B is wrong because the question states the policy is attached to an IAM role used by the EC2 instance, and the error is specifically about S3 access, not about role attachment. Option C is wrong because the application fails to write to S3, not to Kinesis, so kinesis:PutRecord permissions are irrelevant to this error. Option D is wrong because EC2 instances can access S3 via a VPC endpoint or through the public internet using a NAT gateway or internet gateway, but the error is an IAM permissions issue, not a network connectivity issue.

Full explanation →

1550

MCQmedium

A company is ingesting streaming data into Kinesis Data Streams. The consumer application experiences high latency due to a single shard bottleneck. What is the most effective way to reduce latency?

A.Increase the number of shards in the data stream.

B.Wait for automatic scaling to add shards.

C.Use the Kinesis Client Library (KCL) to process records.

D.Switch to Amazon Kinesis Data Firehose.

AnswerA

More shards increase parallelism and throughput, reducing latency.

Why this answer

Increasing the number of shards increases throughput and reduces latency. Waiting for autoscaling is passive, using KCL is for processing, and switching to Firehose changes the architecture.

Full explanation →

1551

MCQmedium

A data engineer is designing a data lake on Amazon S3. Data is ingested from multiple sources in JSON format. The engineer needs to optimize query performance for Amazon Athena while minimizing storage costs. Which storage strategy should the engineer use?

A.Store data as CSV files in a single S3 bucket without prefixes.

B.Convert data to Parquet format and partition by date.

C.Store data as JSON files in a single prefix without partitioning.

D.Store compressed JSON files in Amazon S3 Glacier.

AnswerB

Parquet is columnar and compressed; partitioning improves query performance.

Why this answer

Parquet is a columnar storage format that significantly reduces data scan volume in Amazon Athena, which charges per byte scanned. Partitioning by date further limits the data scanned to only relevant partitions, optimizing both query performance and cost. JSON and CSV are row-based formats that require full scans, and Glacier is unsuitable for interactive querying.

Exam trap

The trap here is that candidates assume JSON or CSV are acceptable for Athena due to their simplicity, overlooking that columnar formats like Parquet are required for cost-efficient querying in AWS's pay-per-scan model.

How to eliminate wrong answers

Option A is wrong because CSV files are row-based and lack compression, leading to higher storage costs and larger data scans in Athena, and storing them without prefixes prevents partition pruning. Option C is wrong because JSON files are also row-based and verbose, resulting in inefficient queries and higher costs, and a single prefix without partitioning forces full table scans. Option D is wrong because Amazon S3 Glacier is designed for archival storage with retrieval times of minutes to hours, making it incompatible with Athena's requirement for immediate data access.

Full explanation →

1552

Multi-Selecthard

Which THREE considerations are important when designing a data pipeline that uses AWS Glue to process streaming data from Amazon Kinesis Data Streams? (Choose 3.)

Select 3 answers

A.Set the number of Glue workers to match the number of shards for optimal parallelism

B.Ensure the Kinesis stream has enough shards to handle the expected record rate

C.Configure checkpointing to prevent data loss on failure

D.Use batch window to accumulate data before processing

E.Convert data to Avro format for better compression

AnswersA, B, C

Each worker can consume one shard.

Why this answer

A, B, and C are correct. A: Setting the number of Glue workers to match the number of shards ensures optimal parallelism and resource utilization. B: Ensuring sufficient shards in Kinesis Data Streams is essential to handle the expected record rate and avoid throttling.

C: Configuring checkpointing in AWS Glue streaming jobs prevents data loss and allows resumption from the last checkpoint on failure. D (batch window) is not appropriate for streaming pipelines as it introduces latency and is more suited for batch processing. E (converting to Avro) is a general data optimization but not a critical consideration specifically for Glue streaming with Kinesis.

Full explanation →

1553

MCQeasy

A company runs a nightly batch processing pipeline using AWS Glue ETL jobs. The pipeline reads data from an Amazon S3 bucket, transforms it, and writes results to an Amazon Redshift cluster. Recently, the data volume has increased significantly, and some Glue jobs are failing with the error 'java.lang.OutOfMemoryError: Java heap space'. The data engineer needs to modify the job configuration to prevent these failures without changing the code. The job currently uses 10 DPUs and processes data in a single Spark DataFrame. Which of the following is the MOST effective solution?

A.Reduce the number of DPUs to 5 and increase the Spark executor memory by setting 'spark.executor.memory' in job parameters.

B.Increase the number of DPUs to 20 and enable job bookmarking for incremental processing.

C.Change the script to use DynamicFrame instead of DataFrame and disable the 'spark.sql.shuffle.partitions' configuration.

D.Add a 'coalesce(1)' operation before writing to Redshift to reduce the number of output files.

AnswerB

More DPUs increase total available memory; job bookmarking reduces data volumes by processing only new data.

Why this answer

Increasing DPUs from 10 to 20 provides more memory and compute resources, directly addressing the 'java.lang.OutOfMemoryError: Java heap space' caused by insufficient memory for the single DataFrame. Enabling job bookmarking allows incremental processing, which reduces the volume of data processed per run, further mitigating memory pressure without code changes.

Exam trap

The trap here is that candidates may think reducing DPUs or using coalesce reduces memory usage, but in reality, both actions increase memory pressure on individual executors, making OOM errors more likely.

How to eliminate wrong answers

Option A is wrong because reducing DPUs to 5 would decrease available memory, worsening the OOM error, and increasing 'spark.executor.memory' without more DPUs cannot compensate for the overall resource reduction. Option C is wrong because changing to DynamicFrame does not inherently reduce memory usage; disabling 'spark.sql.shuffle.partitions' may cause imbalanced partitions and does not address the heap space issue. Option D is wrong because 'coalesce(1)' forces all data into a single partition, which increases memory pressure on that executor and can trigger or worsen OOM errors.

Full explanation →

1554

MCQhard

A company is ingesting streaming data from social media feeds using Amazon Kinesis Data Streams. The data volume peaks at 10,000 records per second, and each record is up to 1 KB. The company needs to archive the raw data in Amazon S3 in near real-time and also make it available for real-time analytics using Amazon Kinesis Data Analytics. What is the MOST efficient architecture to meet these requirements?

A.Use Kinesis Data Streams as the ingestion point. Use Kinesis Data Firehose to read from the stream, convert to Parquet, and write to S3. Use a Lambda function to send data to Kinesis Data Analytics.

B.Use Kinesis Data Streams as the ingestion point. Use a Lambda function to read from the stream, write to S3, and send data to Kinesis Data Analytics.

C.Use two Kinesis Data Streams: one for S3 delivery and one for Kinesis Data Analytics.

D.Use Kinesis Data Streams as the ingestion point. Use Kinesis Data Firehose to read from the stream and write to S3. Use Kinesis Data Analytics to read directly from the same stream.

AnswerD

Firehose can read from the stream and write to S3; Kinesis Data Analytics can read from the same stream for real-time analytics.

Why this answer

Kinesis Data Streams can serve as a single ingestion point, with Kinesis Data Firehose reading from the stream to deliver data to S3 (with optional transformation) and Kinesis Data Analytics reading directly from the same stream for real-time analytics. This avoids unnecessary duplication of streams or Lambda-based processing, which would add latency and complexity. The architecture is the most efficient as it leverages native integrations without intermediate compute.

Exam trap

The trap here is that candidates often overcomplicate the architecture by adding unnecessary Lambda functions or duplicate streams, not realizing that Kinesis Data Firehose and Kinesis Data Analytics can both consume from the same Kinesis Data Stream natively.

How to eliminate wrong answers

Option A is wrong because it suggests using a Lambda function to send data to Kinesis Data Analytics, which is unnecessary and introduces additional cost and latency; Kinesis Data Analytics can read directly from the Kinesis Data Stream. Option B is wrong because using a Lambda function to write to S3 and send data to Kinesis Data Analytics adds processing overhead and potential throughput limitations, whereas Kinesis Data Firehose is purpose-built for streaming to S3 with near-real-time delivery. Option C is wrong because using two separate Kinesis Data Streams is redundant and increases cost and management overhead; a single stream can be consumed by both Firehose and Kinesis Data Analytics simultaneously.

Full explanation →

1555

Multi-Selecteasy

Which TWO AWS services can be used to automatically back up an Amazon RDS for SQL Server DB instance? (Choose TWO.)

Select 2 answers

A.AWS Database Migration Service (DMS)

B.AWS Data Pipeline

C.Amazon RDS automated backups

D.Amazon S3

E.AWS Backup

AnswersC, E

RDS provides automated backups by default.

Why this answer

Amazon RDS automated backups are a built-in feature of RDS that automatically creates daily snapshots of the DB instance and backs up transaction logs every 5 minutes, enabling point-in-time recovery to any second within the retention period. This is the native, no-cost mechanism for backing up an RDS for SQL Server DB instance without additional configuration beyond setting the backup retention window.

Exam trap

The trap here is that candidates often confuse AWS Backup with a service that only works for on-premises or EC2 backups, or mistakenly think DMS or Data Pipeline can handle automated backups, when in fact only RDS automated backups and AWS Backup provide native, automatic backup capabilities for RDS for SQL Server.

Full explanation →

1556

MCQhard

A team manages an Amazon DynamoDB table with on-demand capacity. Recently, they noticed increased throttling errors during peak hours. The table has a Lambda trigger that processes changes and writes to an S3 bucket. Which design change would BEST reduce throttling?

A.Switch the table to provisioned capacity and enable auto-scaling.

B.Increase the write capacity units to handle the peak load.

C.Enable S3 bucket versioning to reduce the number of writes.

D.Implement DynamoDB Accelerator (DAX) to cache frequent reads.

AnswerD

DAX reduces read load on the table, lowering throttling.

Why this answer

DynamoDB Accelerator (DAX) provides an in-memory cache that reduces the number of read requests hitting the table, which can alleviate throttling during peak hours. The question describes throttling errors, which are typically caused by exceeding the table's read or write capacity; DAX offloads read traffic, reducing the load on the table and thus decreasing throttling events.

Exam trap

The trap here is that candidates may assume throttling is always due to insufficient write capacity, but the question's context of a Lambda trigger writing to S3 can increase read traffic (e.g., via stream processing or re-reading items), making DAX a read-side solution that addresses the actual cause.

How to eliminate wrong answers

Option A is wrong because switching to provisioned capacity with auto-scaling does not address the root cause of throttling under on-demand capacity, which already scales automatically; throttling in on-demand mode is usually due to exceeding the table's per-partition throughput limits or burst capacity, not capacity mode. Option B is wrong because increasing write capacity units is not applicable to on-demand capacity, which does not use provisioned write capacity units; on-demand tables automatically scale, and throttling is not resolved by manually setting a capacity that doesn't exist in that mode. Option C is wrong because enabling S3 bucket versioning increases the number of writes (by storing multiple versions of objects) rather than reducing them, and it does not affect DynamoDB throttling.

Full explanation →

1557

MCQeasy

A company uses AWS Lake Formation to manage data lake permissions. A data engineer needs to grant an IAM role 'Read' access to a specific database and all its tables in the Data Catalog. What is the MOST efficient way to achieve this?

A.Grant 'Super' permission on the Data Catalog

B.Add the IAM role to the Lake Formation administrators group

C.Grant 'Select' on the database and select 'Include' to apply to all tables

D.Grant 'Describe' on the database and 'Select' on each table individually

AnswerC

This grants read access to all tables in one operation.

Why this answer

Lake Formation allows granting 'Select' permission on a database with the 'Include' option, which automatically applies the same permission to all current and future tables in that database. This is the most efficient way to grant read access to an IAM role for a specific database and all its tables in the Data Catalog, as it avoids manual per-table grants.

Exam trap

The trap here is that candidates may confuse 'Super' or admin roles with a simple read grant, or think that granting 'Describe' on the database is sufficient for read access, when in fact 'Select' on the tables is required for data access.

How to eliminate wrong answers

Option A is wrong because 'Super' permission grants full administrative access to the Data Catalog, which is excessive and violates the principle of least privilege. Option B is wrong because adding the IAM role to the Lake Formation administrators group grants full administrative permissions over all Lake Formation resources, not just read access to a specific database. Option D is wrong because granting 'Select' on each table individually is inefficient and does not cover future tables, while 'Describe' on the database alone does not grant read access to table data.

Full explanation →

1558

Multi-Selectmedium

A company needs to ingest streaming data from an existing Amazon Kinesis Data Streams into Amazon S3 with partitioning by date. Which TWO services can accomplish this with minimal coding? (Choose two.)

Select 2 answers

A.Amazon Kinesis Data Firehose

B.AWS Glue Streaming

C.AWS Lambda

D.Amazon Kinesis Data Analytics

E.Amazon S3 Transfer Acceleration

AnswersA, C

Firehose can read from a Kinesis stream and deliver to S3 with partitioning.

Full explanation →

1559

MCQeasy

A data engineer needs to move data from an Amazon S3 bucket to an Amazon Redshift cluster on a daily schedule. The data is in CSV format and the target table already exists. Which AWS service should the engineer use to automate this task?

A.AWS Glue

B.Amazon Athena

C.Amazon EMR

D.Amazon Kinesis Data Analytics

AnswerA

Glue provides job scheduling and ETL capabilities.

Why this answer

AWS Glue is the correct choice because it provides managed ETL (extract, transform, load) capabilities and can be scheduled to run daily. Glue jobs can directly read CSV files from S3 and write to a Redshift table that already exists. Option A (correct) accurately identifies AWS Glue for this automated data movement task.

Option B (Amazon Athena) is wrong because Athena is an interactive query service, not an ETL scheduler; it cannot autonomously move data on a schedule. Option C (Amazon EMR) is wrong because while EMR can handle such tasks, it requires provisioning a cluster, managing lifecycle, and more configuration than needed for a simple daily copy—Glue is simpler and more cost-effective for this use case. Option D (Amazon Kinesis Data Analytics) is wrong because it is designed for processing streaming data in real time, not for batch copying of CSV files.

Full explanation →

1560

MCQhard

A data engineering team is designing a data lake on Amazon S3. They need to store raw data in a format that supports schema evolution and is optimized for analytics with Amazon Athena. Which storage format should they use?

A.Parquet

B.CSV

C.Avro

D.JSON

AnswerA

Parquet is columnar, supports schema evolution, and is optimized for Athena.

Why this answer

Parquet is the correct choice because it is a columnar storage format that is highly optimized for Amazon Athena, which can read only the necessary columns to minimize data scanned and reduce query costs. Parquet also supports schema evolution through features like nested data structures and the ability to add or remove columns without rewriting the entire dataset, making it ideal for raw data lakes that must accommodate changing schemas over time.

Exam trap

The trap here is that candidates often choose Avro or JSON because they are known for schema evolution, but they overlook that the question specifically asks for optimization with Amazon Athena, which requires a columnar format like Parquet to minimize scanned data and cost.

How to eliminate wrong answers

Option B is wrong because CSV is a row-based, plain-text format that lacks native schema evolution support, requires full table scans in Athena, and incurs higher storage and query costs due to lack of compression and column pruning. Option C is wrong because Avro is a row-based format primarily designed for serialization and streaming workloads, not for analytical query engines like Athena, which benefit from columnar storage to reduce I/O. Option D is wrong because JSON is a self-describing, text-based format that supports schema evolution but is row-oriented, leading to inefficient querying in Athena due to full scans, larger data sizes, and no built-in compression or columnar optimization.

Full explanation →

1561

Multi-Selecthard

A data engineer is designing a streaming ingestion pipeline using Amazon Kinesis Data Streams with multiple consumers. The data must be processed by a Lambda function for real-time alerts and also stored in Amazon S3 for historical analysis. Which THREE components are needed to implement this architecture? (Choose THREE.)

Select 3 answers

A.Amazon Kinesis Data Firehose

B.Amazon Kinesis Data Streams

C.AWS Lambda function

D.Amazon Kinesis Data Analytics

E.Amazon SQS queue

AnswersA, B, C

Reads from the stream and delivers to S3.

Why this answer

Amazon Kinesis Data Firehose is the correct component because it is the fully managed service designed to load streaming data into Amazon S3 without requiring custom code. It can directly subscribe to a Kinesis Data Stream as its source and automatically buffer, batch, compress, and deliver records to S3 for historical analysis, making it the ideal choice for the storage leg of this architecture.

Exam trap

The trap here is that candidates often confuse Amazon Kinesis Data Analytics as a necessary component for any streaming pipeline, but it is only required when you need to perform real-time analytics on the stream, not for simple data movement to S3.

Full explanation →

1562

MCQhard

A company runs a real-time analytics platform that ingests data from thousands of sensors via Amazon Kinesis Data Streams. Each sensor sends a JSON payload every second. The data is consumed by a fleet of EC2 instances running a custom consumer application. Recently, the consumer has been falling behind, with the iterator age exceeding 10 minutes. The company has already increased the number of shards to 100, but the problem persists. The consumer application is single-threaded per shard and uses the Kinesis Client Library (KCL). The CPU utilization on the EC2 instances is below 30%. What should the data engineer do to reduce the iterator age?

A.Increase the number of shards to 200

B.Use larger EC2 instances with more vCPUs

C.Modify the consumer to use multiple worker threads per shard

D.Replace the EC2 consumer with AWS Lambda functions

AnswerC

Increases processing parallelism within each shard.

Why this answer

The correct solution. The consumer is single-threaded per shard, which limits processing throughput despite low CPU utilization. Using multiple worker threads per shard allows concurrent processing of records from the same shard, reducing iterator age.

Option A (more shards) was already tried and did not resolve the issue. Option B (larger EC2 instances) is unlikely to help because CPU is not the bottleneck. Option D (Lambda) may not handle the high-frequency sensor data efficiently and can introduce additional latency.

Full explanation →

1563

MCQeasy

A data pipeline ingests streaming data from thousands of IoT devices into Kinesis Data Streams. The data must be transformed using a simple field mapping before being stored in S3. Which service should be used to perform the transformation with minimal operational overhead?

A.AWS Lambda function invoked by the Kinesis stream

B.AWS Glue ETL job

C.Kinesis Data Analytics

D.Kinesis Data Firehose with a Lambda transformation

AnswerD

Firehose can invoke a Lambda function for simple transformations before delivery.

Why this answer

Kinesis Data Firehose can invoke a Lambda function to perform simple field mapping transformations before delivering data to S3, minimizing operational overhead. Option A is wrong because AWS Lambda invoked directly by the Kinesis stream requires custom logic for S3 delivery and stream management, increasing overhead. Option B is wrong because AWS Glue ETL jobs are designed for batch processing and are more complex to set up for streaming transformations.

Option C is wrong because Kinesis Data Analytics is used for real-time analytics with SQL or Flink, not simple field mapping transformations.

Full explanation →

1564

MCQeasy

A company is using Amazon S3 to store critical data and needs to ensure that objects are automatically transitioned to S3 Glacier Deep Archive after 180 days to reduce costs. Which S3 lifecycle action should be configured?

A.Expiration

B.Transition

C.AbortIncompleteMultipartUpload

D.NoncurrentVersionTransition

AnswerB

Transition moves objects to another storage class based on age.

Why this answer

The S3 lifecycle 'Transition' action is specifically designed to move objects between storage classes after a specified number of days. To reduce costs by moving objects to S3 Glacier Deep Archive after 180 days, you configure a lifecycle rule with a Transition action that targets the 'DEEP_ARCHIVE' storage class at the 180-day mark.

Exam trap

The trap here is that candidates often confuse 'Expiration' (deletion) with 'Transition' (storage class change), or incorrectly apply 'NoncurrentVersionTransition' when the question does not mention versioning or noncurrent versions.

How to eliminate wrong answers

Option A is wrong because 'Expiration' is used to permanently delete objects after a set period, not to transition them to a different storage class. Option C is wrong because 'AbortIncompleteMultipartUpload' is used to clean up incomplete multipart uploads after a specified number of days, not to transition objects between storage classes. Option D is wrong because 'NoncurrentVersionTransition' applies only to noncurrent versions of versioned objects, not to current versions, and the question does not specify versioning or noncurrent versions.

Full explanation →

1565

MCQeasy

A data engineer needs to ingest data from an external FTP server into S3 on a schedule. The FTP server is only accessible via VPN. Which AWS service is best suited for this task?

A.AWS Transfer Family

B.AWS Snowcone

C.AWS Glue with a Python shell

D.AWS DataSync

AnswerA

Supports FTP and integrates with VPN.

Why this answer

AWS Transfer Family supports FTP, FTPS, and SFTP protocols and can be integrated with a VPC using Elastic IPs or a VPC endpoint, enabling secure access to an FTP server reachable only via VPN. It automates the transfer of files from the external FTP server to Amazon S3 on a schedule without requiring custom code or infrastructure management.

Exam trap

The DEA-C01 exam often tests the distinction between services that support FTP natively (Transfer Family) versus those that only handle file transfers over NFS/SMB or via physical devices, leading candidates to mistakenly choose DataSync or Snowcone for FTP-based ingestion.

How to eliminate wrong answers

Option B is wrong because AWS Snowcone is a physical edge device used for offline data migration or edge computing, not for scheduled online transfers from an FTP server. Option C is wrong because AWS Glue with a Python shell is a serverless ETL service that can run custom scripts, but it lacks native FTP protocol support and would require complex, non-scalable workarounds to handle FTP transfers over VPN. Option D is wrong because AWS DataSync is designed for high-speed transfers between on-premises storage and AWS, but it does not support FTP protocol and cannot connect to an FTP server directly.

Full explanation →

1566

MCQeasy

A startup is building a ride-sharing application that uses Amazon DynamoDB to store trip data. The table has a partition key of 'trip_id' and a sort key of 'status'. The application writes a new item when a trip starts and updates the status when the trip ends. The development team is experiencing high write latency during peak hours. The table is provisioned with 5,000 write capacity units (WCU) and 5,000 read capacity units (RCU). CloudWatch metrics show that WriteThrottleEvents are occurring frequently, but the consumed write capacity is never above 4,000 WCU. The team suspects that the issue is due to hot partitions. How should the data engineer resolve this issue?

A.Modify the application to add a random suffix to the partition key when writing items.

B.Enable DynamoDB Accelerator (DAX) to cache write operations.

C.Decrease the provisioned RCU to 2,000 to reduce costs.

D.Increase the provisioned WCU to 10,000 to handle the spikes.

AnswerA

Adding random suffix distributes writes across multiple partitions, reducing hot spots.

Why this answer

Adding a random suffix to the partition key distributes writes across multiple partitions, preventing any single partition from becoming a hot spot and causing throttling. Option B is incorrect because DAX is an in-memory cache that speeds up reads, not writes; it does not address write throttling. Option C is incorrect because decreasing RCU does not affect write performance; write throttling is independent of read capacity.

Option D is incorrect because increasing WCU does not solve hot partition issues; throttling occurs at the partition level, and a single partition can only handle up to 1000 WCU per partition. Thus, distributing writes is the appropriate solution.

Full explanation →

1567

MCQmedium

A company uses Amazon Redshift for data warehousing. The data engineer notices that query performance has degraded over time. The tables are frequently updated with new data, and the data engineer suspects that the distribution style is causing data skew. Which distribution style should the data engineer use to minimize data skew?

A.KEY distribution on a column with high cardinality

B.AUTO distribution

C.ALL distribution

D.EVEN distribution

AnswerD

Distributes rows evenly, ideal for preventing skew.

Why this answer

EVEN distribution (D) distributes rows across all slices in a round-robin fashion, ensuring each slice holds approximately the same number of rows. This eliminates data skew caused by uneven distribution keys, which is the suspected issue when query performance degrades over time with frequent updates. By avoiding any dependency on column values, EVEN distribution guarantees balanced data distribution regardless of data characteristics.

Exam trap

The trap here is that candidates often choose KEY distribution on a high-cardinality column (A) assuming it will balance data, but they overlook that high cardinality does not guarantee uniform distribution—skew can still occur if the column's values are not evenly distributed, which is a common misconception tested in the DEA-C01 exam.

How to eliminate wrong answers

Option A is wrong because KEY distribution on a high-cardinality column can still cause skew if the column's values are not uniformly distributed (e.g., many rows share the same value), leading to uneven data distribution across slices. Option B is wrong because AUTO distribution lets Redshift choose the distribution style based on table size and usage patterns, but it may select KEY distribution if the table is large, which could perpetuate or introduce skew if the chosen key is skewed. Option C is wrong because ALL distribution copies the entire table to every node, which minimizes skew but is inefficient for large, frequently updated tables due to high storage and maintenance overhead, and it does not address the root cause of skew in the distribution method.

Full explanation →

1568

MCQeasy

A company needs to store archival logs that must be retained for 10 years. The logs are accessed infrequently, but when accessed, retrieval must occur within 12 hours. Which storage class is MOST cost-effective?

A.Amazon S3 Glacier Deep Archive

B.Amazon S3 Intelligent-Tiering

C.Amazon S3 Standard

D.Amazon S3 One Zone-Infrequent Access

AnswerA

Glacier Deep Archive provides the lowest storage cost with retrieval times up to 12 hours.

Why this answer

Amazon S3 Glacier Deep Archive is the most cost-effective storage class for archival logs that must be retained for 10 years with infrequent access and a 12-hour retrieval window. It offers the lowest storage cost among S3 classes, with retrieval times typically within 12 hours for standard retrievals, making it ideal for long-term archival data that is rarely accessed.

Exam trap

The trap here is that candidates often confuse retrieval time with cost, assuming that any class with faster retrieval is better, but the 12-hour retrieval window explicitly allows the use of the lowest-cost archival tier, making Glacier Deep Archive the correct choice despite its slower retrieval speed.

How to eliminate wrong answers

Option B (S3 Intelligent-Tiering) is wrong because it is designed for data with unknown or changing access patterns and automatically moves objects between tiers, but it incurs monitoring and automation fees that make it less cost-effective than Glacier Deep Archive for purely archival data with a known 10-year retention. Option C (S3 Standard) is wrong because it is optimized for frequently accessed data with millisecond retrieval times and has a much higher storage cost, making it prohibitively expensive for 10 years of archival logs. Option D (S3 One Zone-Infrequent Access) is wrong because it is intended for infrequently accessed data that can be recreated if lost, but it does not provide the durability or cost savings of Glacier Deep Archive for long-term archival, and its retrieval times are faster than needed, leading to unnecessary cost.

Full explanation →

1569

MCQmedium

A data engineer is migrating an on-premises Apache Hive data warehouse to Amazon EMR. The warehouse contains partitioned tables stored in HDFS. The engineer wants to use Amazon S3 as the storage layer for the EMR cluster. What is the MOST important consideration for maintaining query performance on S3?

A.Ensure that the table partitions are organized in a way that minimizes S3 LIST requests

B.Configure EMR to use HDFS for storage instead of S3 for better performance

C.Use DynamoDB as the Hive metastore to improve metadata access

D.Use Amazon Redshift Spectrum to query the data directly from S3

AnswerA

S3 LIST operations are slower than HDFS; partitioning by common query filters and using partition projection can improve performance.

Why this answer

When using Amazon S3 as the storage layer for an EMR cluster, the most critical factor for query performance is minimizing S3 LIST requests. S3 LIST operations are significantly slower and more expensive than GET requests, and Hive/Spark queries on partitioned tables often issue LIST requests to discover partition locations. By organizing partitions with a common prefix (e.g., `year=2023/month=01/day=15/`) and using partition pruning, you reduce the number of LIST calls, directly improving query latency and reducing S3 API costs.

Exam trap

The trap here is that candidates may focus on metastore performance (Option C) or alternative query engines (Option D), missing the fundamental S3 performance bottleneck of LIST requests when querying partitioned data on EMR.

How to eliminate wrong answers

Option B is wrong because using HDFS for storage would negate the benefits of S3 (durability, scalability, cost) and is not the 'most important consideration' for maintaining query performance on S3; EMR can use S3 with optimizations like EMRFS and consistent view. Option C is wrong because DynamoDB is used as a Hive metastore for high availability and scalability, not to improve metadata access performance for S3 queries; the metastore choice does not directly address S3 LIST request overhead. Option D is wrong because Redshift Spectrum is a separate service for querying S3 data with Redshift, not an EMR optimization; it does not address the core performance issue of S3 LIST requests in an EMR context.

Full explanation →

1570

MCQmedium

A company wants to ingest data from SaaS applications (e.g., Salesforce, Marketo) into Amazon S3 for analytics. The data volume is moderate and updates occur frequently. Which AWS service is BEST suited for this task?

A.Amazon Kinesis Data Streams

B.Amazon AppFlow

C.AWS Database Migration Service (DMS)

D.AWS Glue

AnswerB

AppFlow supports many SaaS sources and can write to S3.

Why this answer

Amazon AppFlow is specifically designed to securely transfer data from SaaS applications like Salesforce and Marketo to AWS services such as Amazon S3. It handles authentication, data transformation, and scheduling. Amazon Kinesis Data Streams is for real-time streaming data, not batch ingestion from SaaS.

AWS Database Migration Service (DMS) is for migrating databases, not SaaS data. AWS Glue is an ETL service that can process data but is not optimized for direct SaaS ingestion.

Full explanation →

1571

MCQeasy

A data pipeline ingests daily CSV files from an FTP server into an Amazon S3 bucket. The files must be converted to Parquet format and partitioned by date for efficient querying using Amazon Athena. Which AWS service is most suitable for this transformation?

A.Amazon Kinesis Data Firehose

B.Amazon EMR

C.AWS Glue

D.AWS Lambda

AnswerC

Glue provides a serverless Spark environment that can transform CSV to Parquet and partition data efficiently.

Why this answer

AWS Glue is the most suitable service because it provides a fully managed ETL (Extract, Transform, Load) capability that can natively read CSV files from S3, convert them to Parquet format, and write the output partitioned by date. Glue's built-in transform 'ConvertToParquet' and dynamic frame partitioning make this a straightforward, serverless solution without needing to manage infrastructure.

Exam trap

The trap here is that candidates often confuse AWS Glue with Amazon EMR, thinking EMR is always needed for Parquet conversion, but Glue's serverless ETL is more appropriate for scheduled batch jobs without cluster management overhead.

How to eliminate wrong answers

Option A is wrong because Amazon Kinesis Data Firehose is designed for streaming data ingestion, not batch processing of daily CSV files from an FTP server; it lacks native support for reading from S3 as a source and performing complex transformations like CSV-to-Parquet conversion with custom partitioning. Option B is wrong because Amazon EMR is a managed Hadoop cluster that can perform this transformation, but it requires provisioning and managing EC2 instances, which is overkill for a simple daily batch job and not the most suitable service for a serverless, cost-effective solution. Option D is wrong because AWS Lambda has a maximum execution time of 15 minutes and a limited memory capacity (up to 10 GB), which is insufficient for processing large daily CSV files (e.g., gigabytes in size) and performing efficient Parquet conversion with partitioning.

Full explanation →

1572

MCQmedium

A data engineer needs to store clickstream data from a web application in Amazon S3. Each event is about 5 KB, and the application generates 1 million events per hour. The data is used for real-time analytics and also for batch processing. The engineer wants to minimize storage costs while ensuring that data is available for real-time queries as soon as it is written. Which storage class should the engineer use for the S3 bucket?

A.S3 Standard.

B.S3 Intelligent-Tiering.

C.S3 Standard-IA.

D.S3 Glacier Instant Retrieval.

AnswerA

Standard offers the best performance for frequently accessed data and no retrieval fees.

Why this answer

S3 Standard is the correct choice because it offers low-latency (milliseconds) first-byte-out performance, making data available for real-time queries immediately after writing. It also supports both real-time analytics and batch processing without retrieval fees, and at 5 KB per event with 1 million events per hour (approximately 5 GB/hour or 120 GB/day), the storage cost is manageable compared to the frequent access pattern. S3 Standard is optimized for frequently accessed data and provides the durability and availability needed for clickstream analytics.

Exam trap

The DEA-C01 exam often tests the misconception that S3 Intelligent-Tiering automatically optimizes costs for all workloads, but the trap here is that the per-object monitoring fee and potential tier transitions make it more expensive than S3 Standard for high-volume, small-object, frequently accessed data like clickstream events.

How to eliminate wrong answers

Option B (S3 Intelligent-Tiering) is wrong because it incurs a monthly monitoring and automation fee per object, which for 1 million events per hour (24 million objects/day) would result in excessive costs, and it may not guarantee immediate availability for real-time queries if objects are moved to colder tiers. Option C (S3 Standard-IA) is wrong because it has a minimum billable object size of 128 KB and a 30-day minimum storage charge, so storing 5 KB events would be cost-inefficient due to rounding up to 128 KB, and it also charges a retrieval fee per GB, which adds cost for frequent real-time access. Option D (S3 Glacier Instant Retrieval) is wrong because while it offers millisecond retrieval, it has a minimum billable object size of 128 KB and a 90-day minimum storage duration, making it prohibitively expensive for small, short-lived clickstream events, and it is designed for long-term archival, not real-time streaming ingestion.

Full explanation →

1573

Multi-Selectmedium

A data engineer is designing a disaster recovery plan for an Amazon RDS for MySQL database. The database must be recoverable within 1 hour in a different AWS Region. Which TWO actions should the engineer take?

Select 2 answers

A.Create a cross-Region read replica.

B.Enable Multi-AZ deployment.

C.Enable automated backups with cross-Region copy.

D.Take manual snapshots and copy them to an S3 bucket in the other Region.

E.Use Amazon EventBridge to schedule snapshot copies.

AnswersA, C

A read replica can be promoted to a primary in another Region for disaster recovery.

Why this answer

A cross-Region read replica for Amazon RDS for MySQL provides a fully provisioned secondary database in a different AWS Region that can be promoted to a standalone primary in minutes, meeting the 1-hour recovery time objective (RTO). This approach ensures continuous replication from the source database, minimizing data loss and enabling rapid failover without manual snapshot management.

Exam trap

The trap here is that candidates often confuse Multi-AZ (high availability within a Region) with cross-Region disaster recovery, or they assume that scheduling snapshot copies via EventBridge is sufficient for fast recovery, ignoring the significant restore time required for snapshots.

Full explanation →

1574

MCQeasy

A data engineer needs to monitor the number of records processed by an AWS Glue ETL job and send an alert if the count drops below a threshold. Which AWS service should be used to create this custom metric?

A.Amazon S3

B.AWS Config

C.Amazon CloudWatch

D.AWS CloudTrail

AnswerC

CloudWatch can store custom metrics and trigger alarms.

Why this answer

Amazon CloudWatch is the correct service for creating custom metrics because it allows you to publish your own data points, such as the number of records processed by an AWS Glue ETL job. You can use the CloudWatch PutMetricData API or the AWS Glue job script to emit a custom metric, then set an alarm on that metric to trigger an alert when the count drops below a threshold.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail with CloudWatch because both are monitoring-related, but CloudTrail is for auditing API calls, not for ingesting custom numerical metrics or setting alarms on them.

How to eliminate wrong answers

Option A is wrong because Amazon S3 is an object storage service and does not provide a mechanism to create or monitor custom metrics; it only stores data and logs access via server access logs or AWS CloudTrail. Option B is wrong because AWS Config is a service for evaluating and auditing resource configurations against rules, not for ingesting or alerting on custom operational metrics like record counts. Option D is wrong because AWS CloudTrail records API activity for auditing and governance, but it cannot be used to create custom metrics or set threshold-based alarms; it captures events, not numerical data points.

Full explanation →

1575

MCQmedium

A gaming company uses Amazon Redshift for analytics. The Redshift cluster stores user data that must be encrypted at rest using a customer-managed KMS key. The company has enabled audit logging using AWS CloudTrail. The security team wants to ensure that any attempt to disable or delete the KMS key is immediately detected and triggers an automated response. They have set up a CloudWatch Events rule that triggers an SNS notification when the KMS key is scheduled for deletion. However, they also want to prevent the key from being deleted accidentally. What should they do?

A.Enable automatic key rotation for the KMS key to ensure that even if the key is deleted, the data remains encrypted.

B.Add a statement to the KMS key policy that denies 'kms:ScheduleKeyDeletion' for all principals except the root user.

C.Attach an IAM policy to the Redshift cluster role that denies 'kms:ScheduleKeyDeletion'.

D.Set up a CloudTrail trail to monitor for 'ScheduleKeyDeletion' events and send an alert to the security team.

AnswerB

This prevents any IAM user or role from scheduling key deletion.

Why this answer

Adding a statement to the KMS key policy that denies 'kms:ScheduleKeyDeletion' for all principals except the root user explicitly prevents any user (including IAM users with full admin permissions) from scheduling deletion of the key. This is the most direct and authoritative control to prevent accidental deletion. Option A is incorrect because automatic key rotation does not prevent the key from being deleted; it only changes the backing key material.

Option C is incorrect because an IAM policy attached to the Redshift cluster role does not affect permissions on the KMS key; the key policy is the authoritative control for actions on a customer-managed key. Option D is incorrect because CloudTrail monitoring only detects deletion events but does not prevent the deletion itself.

Full explanation →

Page 21 of 23

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23

Practice DEA-C01 by domain

Target a specific domain to shore up weak areas.

Data Ingestion and Transformation Data Operations and Support Data Security and Governance Data Store Management

See all domains with question counts →