Courseiva

AWS Certified Data Engineer Associate DEA-C01 (DEA-C01) — Questions 1576–1650

1711 questions total · 23pages · All types, answers revealed

Take a mock examExam hub
Page 21

Page 22 of 23

Page 23
1576
Multi-Selecthard

A data engineer is using Amazon Athena to query data stored in an S3 bucket. The queries are running slowly. Which THREE actions can improve query performance?

Select 3 answers
A.Partition the data on commonly filtered columns.
B.Convert the data to JSON format for better schema evolution.
C.Move the data to S3 Standard-IA storage class.
D.Convert the data to a columnar format such as Parquet or ORC.
E.Use compression (e.g., Snappy, Gzip) on the data files.
AnswersA, D, E

Partition pruning reduces amount of data scanned.

Why this answer

Partitioning data on commonly filtered columns (Option A) improves Athena query performance by reducing the amount of data scanned. Athena uses Hive-style partitioning (e.g., `s3://bucket/table/year=2023/month=01/`), and when a query includes a filter on the partition column, Athena prunes partitions and only reads the relevant S3 prefixes. This directly reduces I/O and query cost, as Athena charges per TB of data scanned.

Exam trap

The trap here is that candidates may think S3 storage class (Standard-IA) affects query performance, but Athena's performance is independent of storage class; the key levers are data format, partitioning, and compression.

Full explanation →
1577
MCQhard

A data engineer is building a streaming pipeline using Amazon Kinesis Data Streams. The data must be enriched with reference data from a DynamoDB table before being written to S3. The engineer wants to minimize latency. Which architecture is BEST?

A.Use AWS Glue streaming ETL to read from Kinesis, enrich, and write to S3.
B.Use Kinesis Data Analytics for Apache Flink to enrich and output to Firehose.
C.Use Kinesis Data Firehose with a Lambda function for enrichment.
D.Use a Lambda function to poll the stream, enrich, and write to Firehose.
AnswerB

Flink provides low-latency streaming enrichment with external sources.

Why this answer

(Kinesis Data Analytics for Apache Flink) is the best choice because it supports low-latency enrichment using external sources like DynamoDB via asynchronous I/O, meeting the requirement to minimize latency. Option A (AWS Glue streaming ETL) is designed for batch-oriented processing and introduces higher latency. Option C (Kinesis Data Firehose with a Lambda function) may experience cold starts and limited concurrency, increasing latency.

Option D (Lambda polling the stream) also suffers from cold starts and scalability issues, making it less suitable for low-latency enrichment.

Full explanation →
1578
MCQeasy

A data engineer needs to monitor the number of records processed by a Kinesis Data Firehose delivery stream and set an alarm if the count drops below a threshold. Which CloudWatch metric should be used?

A.IncomingRecords
B.PutRecord.Success
C.DeliveryToS3.Success
D.IncomingBytes
AnswerA

This metric counts the number of records sent to Firehose.

Why this answer

'IncomingRecords' counts records received by Firehose, which directly indicates processing volume. Option B is wrong because 'IncomingBytes' measures bytes, not records. Option C is wrong because 'DeliveryToS3.Success' is a success metric but measures successful deliveries, not record count.

Option D is wrong because 'PutRecord.Success' is a per-API call metric for Kinesis Data Streams, not Firehose.

Full explanation →
1579
MCQeasy

A data engineer is designing a data lake on Amazon S3. Which feature should be used to manage the lifecycle of objects and move them to cheaper storage classes automatically?

A.S3 Lifecycle policies
B.S3 Object Lock
C.S3 Storage Class Analysis
D.S3 Inventory
AnswerA

Automatically transitions objects to cheaper storage.

Why this answer

S3 Lifecycle policies are the correct feature for automatically managing object lifecycles and transitioning objects to cheaper storage classes (e.g., from S3 Standard to S3 Glacier Deep Archive) based on age or other rules. This directly meets the requirement to move objects to cost-optimized storage without manual intervention.

Exam trap

The trap here is confusing S3 Storage Class Analysis (which only recommends transitions) with S3 Lifecycle policies (which actually execute them), leading candidates to pick Option C thinking it automates the move.

How to eliminate wrong answers

Option B is wrong because S3 Object Lock is designed to prevent object deletion or overwrites for compliance or retention purposes, not to automate storage class transitions. Option C is wrong because S3 Storage Class Analysis provides recommendations and visibility into access patterns to help decide when to transition objects, but it does not automatically move objects—it only generates reports. Option D is wrong because S3 Inventory provides a flat-file list of objects and their metadata for auditing or sync, but it has no capability to trigger lifecycle actions.

Full explanation →
1580
MCQmedium

A company has a Kinesis Data Firehose delivery stream that receives JSON data from IoT devices. The data is delivered to an S3 bucket. The company notices that the data in S3 is delayed by up to 30 minutes. The Firehose stream is configured with a buffer size of 1 MB and a buffer interval of 60 seconds. The incoming data rate is approximately 100 KB per second. The company needs to reduce the delivery latency to under 5 minutes. Which action should the company take?

A.Enable Lambda transformation to process data faster.
B.Increase the buffer interval to 300 seconds.
C.Change the compression format from GZIP to Snappy.
D.Decrease the buffer size to 256 KB.
AnswerD

Smaller buffer size causes more frequent deliveries, reducing latency.

Why this answer

The observed latency of up to 30 minutes is likely due to the buffer size being too large relative to the data rate, causing long waits to fill the buffer. With a data rate of 100 KB/s and a buffer size of 1 MB, the buffer fills in approximately 10 seconds, but the buffer interval of 60 seconds already limits delivery to at most 60 seconds. However, the 30-minute delay suggests additional issues such as backlog or configuration errors.

Decreasing the buffer size to 256 KB will cause more frequent deliveries (every ~2.5 seconds), reducing latency. Option A (Lambda transformation) adds processing time and increases latency. Option B (increase buffer interval to 300 seconds) would increase latency.

Option C (change compression) does not affect delivery frequency. Therefore, option D is correct.

Full explanation →
1581
MCQmedium

Refer to the exhibit. A data engineer needs to connect to the Redshift cluster from an EC2 instance in the same VPC. The engineer can ping the EC2 instance but cannot connect to Redshift using the endpoint address and port 5439. What is the most likely cause?

A.The security group for the Redshift cluster does not allow inbound traffic on port 5439 from the EC2 instance.
B.The Redshift cluster is in a different VPC.
C.The Redshift cluster is not in an available state.
D.The Redshift cluster is publicly accessible and requires an internet gateway.
AnswerA

Security group rules must permit the connection.

Why this answer

The most likely cause is that the security group associated with the Redshift cluster does not have an inbound rule allowing TCP traffic on port 5439 from the security group or IP address of the EC2 instance. Since the engineer can ping the EC2 instance (ICMP works), but cannot connect to Redshift on port 5439, this points to a firewall or security group rule blocking the specific port, not a network reachability issue.

Exam trap

AWS often tests the distinction between ICMP reachability (ping) and TCP port-level connectivity, leading candidates to overlook security group rules when they see successful ping results.

How to eliminate wrong answers

Option B is wrong because if the Redshift cluster were in a different VPC, the engineer would not be able to ping the EC2 instance from the same VPC context, and VPC peering or transit gateway would be required; the question states they are in the same VPC. Option C is wrong because if the cluster were not in an available state, the engineer would likely receive a different error (e.g., 'cluster not found' or connection timeout), and the question does not indicate any cluster status issues. Option D is wrong because the Redshift cluster is in the same VPC as the EC2 instance, so public accessibility and an internet gateway are not required; traffic stays within the VPC and uses private IPs.

Full explanation →
1582
Multi-Selecthard

A data engineer is building a pipeline to ingest data from an on-premises Oracle database into Amazon S3. The pipeline must capture change data (CDC) in near real-time and handle schema changes. Which TWO AWS services should the engineer use?

Select 2 answers
A.AWS Glue Schema Registry
B.AWS Snowball Edge
C.Amazon AppFlow
D.Amazon Kinesis Data Streams with Kinesis Agent
E.AWS Database Migration Service (DMS) with CDC
AnswersA, E

Manages schema evolution for streaming data.

Why this answer

AWS Glue Schema Registry (A) is correct because it enables schema discovery, validation, and evolution for streaming data, allowing the pipeline to handle schema changes from the Oracle CDC source. It integrates with Apache Kafka and Amazon Kinesis Data Streams to enforce schema compatibility rules (e.g., backward, forward, full) as data arrives, ensuring downstream consumers can adapt to evolving schemas without breaking.

Exam trap

The DEA-C01 exam often tests the misconception that Amazon Kinesis Data Streams alone can perform CDC from a database, but Kinesis requires a separate agent or connector (like Debezium or DMS) to read database logs, making DMS the correct CDC service.

Full explanation →
1583
Multi-Selecteasy

A company is using AWS Glue to catalog data in S3. The security team wants to ensure that only authorized users can access the Glue Data Catalog and that data lineage is tracked. Which AWS services can be used together to meet these requirements? (Choose TWO.)

Select 2 answers
A.AWS CloudTrail
B.AWS Glue DataBrew
C.Amazon Athena
D.AWS Lake Formation
E.Amazon Kinesis
AnswersB, D

Provides data lineage tracking.

Why this answer

Options B and D are correct. AWS Lake Formation provides fine-grained access control for the Glue Data Catalog, and AWS Glue DataBrew offers data lineage visualization. Option A is incorrect because CloudTrail logs API calls but does not manage permissions or access control.

Option C is incorrect because Athena is a query service, not for access control or lineage. Option E is incorrect because Kinesis is for streaming data.

Full explanation →
1584
Multi-Selecthard

A company is using AWS Lake Formation to manage a data lake. The data engineer needs to set up fine-grained access control so that users can only see specific columns in a table based on their IAM role. Which THREE steps should the data engineer take?

Select 3 answers
A.Ensure that the users query the table through a service integrated with Lake Formation, such as Athena.
B.Grant the IAM role SELECT permission on the table with column-level restrictions.
C.Create a view in the Data Catalog that exposes only the required columns.
D.Define a Lake Formation data permissions policy that includes column-level filtering.
E.Attach an S3 bucket policy to restrict access to the underlying data.
AnswersA, B, D

Lake Formation enforces permissions when queries are run through integrated services.

Why this answer

Options A, B, and D are correct. Lake Formation column-level access requires defining the policy in Lake Formation, granting permissions to the IAM role, and the user must use Lake Formation-enabled services. Option C is wrong because S3 bucket policies are not used for column-level control.

Option E is wrong because the table must be registered with Lake Formation.

Full explanation →
1585
Multi-Selecteasy

A company is evaluating Amazon DynamoDB for a new application. The application requires single-digit millisecond latency for read and write operations. Which TWO DynamoDB features should the company enable to achieve this? (Choose TWO.)

Select 2 answers
A.Use DAX with Write-Through caching.
B.Enable DynamoDB Global Tables.
C.Enable DynamoDB Streams.
D.Enable DynamoDB Accelerator (DAX).
E.Enable auto-scaling for read and write capacity.
AnswersA, D

Why this answer

DAX with Write-Through caching ensures that every write to DynamoDB is also written to the DAX cache, so subsequent reads of the same item are served from the in-memory cache with single-digit millisecond latency. Option D is correct because DynamoDB Accelerator (DAX) is a fully managed, highly available, in-memory cache that reduces read response times from single-digit milliseconds to microseconds, directly meeting the latency requirement for read operations.

Exam trap

The trap here is that candidates often confuse DynamoDB Accelerator (DAX) with DynamoDB Global Tables, assuming that multi-region replication improves local latency, when in fact DAX is the only feature that provides an in-memory cache for single-digit millisecond reads within a region.

Full explanation →
1586
Multi-Selecteasy

Which TWO AWS services can be used to ingest data from an on-premise relational database into Amazon S3 on a one-time basis?

Select 2 answers
A.AWS Data Pipeline
B.AWS Database Migration Service (DMS)
C.AWS Glue
D.Amazon Simple Queue Service (SQS)
E.Amazon Kinesis Data Streams
AnswersB, C

AWS Database Migration Service (DMS) is correct. It can perform a one-time full-load migration from an on-premise relational database directly to Amazon S3, supporting multiple output formats.

Why this answer

AWS DMS can perform one-time full-load migrations from on-premise relational databases to Amazon S3 by connecting to the source and writing data directly to S3 in formats like CSV or Parquet. AWS Glue can also be used for one-time data ingestion by creating an ETL job that reads from the source database via JDBC and writes to S3, with the option to run the job on demand. Both services support one-time transfers without ongoing replication.

Exam trap

The trap here is that candidates might think Glue is only for scheduled or recurring jobs, but Glue ETL jobs can be triggered on-demand for a one-time migration. Also, some might confuse Kinesis or SQS as suitable for one-time batch ingestion, but those are designed for streaming data.

Full explanation →
1587
MCQmedium

A data pipeline uses Kinesis Data Firehose to deliver streaming data to an S3 bucket. The data volume spikes occasionally, causing the Firehose buffer to fill up and leading to increased delivery latency. The latency must remain under 60 seconds. What should be done to minimize latency?

A.Enable GZIP compression on the Firehose delivery stream.
B.Increase the buffer size to 128 MB to accommodate larger batches.
C.Switch to Kinesis Data Streams with a Lambda consumer.
D.Reduce the buffer interval to 60 seconds.
AnswerD

This forces delivery every 60 seconds, meeting the latency requirement.

Why this answer

Reducing the buffer interval to 60 seconds ensures that Firehose delivers data to S3 at most every 60 seconds, directly capping latency even if the buffer size is not full. This aligns with the requirement to keep latency under 60 seconds, as Firehose delivers data when either the buffer interval or buffer size threshold is met first.

Exam trap

AWS often tests the misconception that increasing buffer size or enabling compression reduces latency, when in fact these options increase latency by allowing more data to accumulate before delivery.

How to eliminate wrong answers

Option A is wrong because enabling GZIP compression reduces data size but does not affect the buffer interval or delivery frequency; it may even increase latency due to compression overhead. Option B is wrong because increasing the buffer size to 128 MB would allow more data to accumulate before delivery, which would increase latency during spikes, not decrease it. Option C is wrong because switching to Kinesis Data Streams with a Lambda consumer introduces additional complexity and potential for increased latency due to Lambda invocation overhead and scaling limitations, and does not directly guarantee sub-60-second delivery to S3.

Full explanation →
1588
Multi-Selectmedium

Which TWO actions can improve query performance on an Amazon Redshift cluster? (Choose two.)

Select 2 answers
A.Define appropriate sort keys
B.Increase the number of nodes
C.Use EVEN distribution style for all tables
D.Use columnar compression
E.Run VACUUM command regularly
AnswersA, D

Sort keys reduce the amount of data scanned.

Why this answer

Defining appropriate sort keys in Amazon Redshift physically orders data on disk by the sort key columns, enabling the query optimizer to use zone maps to skip large blocks of data that do not match query predicates. This drastically reduces the amount of data scanned, especially for range-restricted queries, improving I/O and overall query performance.

Exam trap

The trap here is that candidates often confuse maintenance operations (VACUUM) or scaling actions (adding nodes) with direct query tuning techniques, while the exam specifically tests the understanding that sort keys and compression are the two primary table design choices that directly improve query performance.

Full explanation →
1589
MCQmedium

A data engineer notices that an AWS Glue job processing data from an Amazon S3 bucket frequently fails with 'OutOfMemoryError'. The job reads CSV files, applies transformations, and writes Parquet to another S3 bucket. The job has 10 workers of type G.1X. Which change is MOST likely to resolve the issue?

A.Change the worker type from G.1X to G.2X
B.Increase the number of workers to 20
C.Change the worker type from G.1X to G.8X
D.Enable the Spark UI to monitor memory and tune the job
AnswerA

G.2X provides 2x the memory of G.1X, directly addressing the OutOfMemoryError.

Why this answer

The G.1X worker type provides 16 GB of memory per worker. An OutOfMemoryError indicates that the job's memory requirements exceed this limit. Upgrading to G.2X doubles the memory per worker to 32 GB, directly addressing the memory shortage without changing the parallelism or incurring the overhead of additional workers.

Exam trap

The trap here is that candidates might think adding more workers (Option B) solves memory issues, but OutOfMemoryError is per-worker, not a cluster-wide shortage, so increasing parallelism does not fix the root cause.

How to eliminate wrong answers

Option B is wrong because increasing the number of workers to 20 does not increase the memory per worker; it only adds more workers, which can help with parallelism but not with per-worker memory exhaustion. Option C is wrong because G.8X provides 64 GB of memory per worker, which is excessive and likely unnecessary; the most cost-effective fix is G.2X. Option D is wrong because enabling the Spark UI only helps with monitoring and debugging, not with resolving the memory issue; it does not allocate additional memory.

Full explanation →
1590
MCQmedium

A company uses S3 as a data lake. They want to ingest on-premises relational database data daily with full-load snapshots. The data volume is 500 GB per day. The database is accessible over the internet. Which service should they use for this ingestion?

A.Kinesis Data Firehose
B.AWS Glue ETL job reading from JDBC
C.AWS Database Migration Service (DMS)
D.AWS Transfer Family
AnswerC

DMS supports full-load migration from on-premises databases to S3.

Why this answer

AWS Database Migration Service (DMS) can perform full-load migrations from on-premises databases to S3, making it ideal for daily snapshots of 500 GB. Option A is wrong because Kinesis Data Firehose is designed for streaming data, not for periodic database snapshots. Option B is wrong because while AWS Glue ETL can read from JDBC, it is not optimized for large full-load snapshots and lacks built-in replication capabilities.

Option D is wrong because AWS Transfer Family is for file transfers over SFTP, FTPS, or FTP, not for direct database connections.

Full explanation →
1591
MCQhard

A data engineer is designing a solution to securely store and rotate database credentials used by an application. The credentials should be automatically rotated every 90 days. Which AWS service should be used?

A.AWS Secrets Manager
B.AWS Systems Manager Parameter Store
C.AWS Key Management Service (KMS)
D.AWS Identity and Access Management (IAM)
AnswerA

Secrets Manager provides automatic rotation of secrets.

Why this answer

(AWS Secrets Manager) is correct because it can automatically rotate secrets, including database credentials, with built-in rotation support. Option B (AWS Systems Manager Parameter Store) can store secrets but lacks automatic rotation capability. Option C (AWS Key Management Service) manages encryption keys, not secrets.

Option D (AWS Identity and Access Management) manages users and roles, not credential rotation.

Full explanation →
1592
MCQmedium

A data engineer is troubleshooting an AWS Glue job that writes data to an S3 bucket. The IAM role attached to the Glue job has the policy shown in the exhibit. The job fails when writing to the 'secrets/' prefix but succeeds when writing to other prefixes. What is the reason for the failure?

A.The job does not have permission to write to the bucket at all.
B.The resource ARN in the Allow statement does not include the bucket itself.
C.The Deny statement is not effective because it is placed after the Allow.
D.The Deny statement explicitly denies PutObject to the secrets/ prefix.
AnswerD

Deny overrides Allow.

Why this answer

The Deny statement explicitly denies s3:PutObject to the secrets/ prefix, which overrides any Allow statements. Option A is incorrect because the job can write to other prefixes, so it does have permission to the bucket. Option B is incorrect because the resource ARN includes the bucket and all objects (*), so it is sufficient.

Option C is incorrect because in IAM, a Deny statement always overrides an Allow, regardless of order.

Full explanation →
1593
Multi-Selecteasy

A data engineer is monitoring an Amazon RDS for PostgreSQL instance. The engineer wants to set up alerts for high CPU utilization and low free storage space. Which AWS services can be used together to achieve this? (Choose TWO.)

Select 2 answers
A.Amazon Simple Notification Service (SNS)
B.Amazon CloudWatch
C.AWS CloudTrail
D.AWS Config
E.Amazon Route 53
AnswersA, B

SNS delivers alarm notifications.

Why this answer

Amazon CloudWatch is the correct service because it can monitor RDS metrics such as CPUUtilization and FreeStorageSpace, and trigger alarms based on thresholds. Amazon SNS is correct because it can receive CloudWatch alarm notifications and deliver them via email, SMS, or other endpoints, enabling the data engineer to be alerted when high CPU or low storage conditions occur.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (audit logging) with CloudWatch (monitoring), or think AWS Config can monitor performance metrics instead of just configuration compliance.

Full explanation →
1594
MCQmedium

A data engineer manages an Amazon Redshift cluster that hosts a 10 TB data warehouse. The cluster uses a single node of type dc2.large (160 GB SSD). The engineer notices that the cluster's disk space is 95% full, and queries are running slowly. The engineer runs the STV_PARTITIONS view and sees that many slices have high 'tossed' counts. The engineer also runs VACUUM and ANALYZE commands, but the disk space does not improve. The engineer suspects that the cluster needs more storage. However, the company wants to minimize cost. Which action should the engineer take to resolve the disk space issue most cost-effectively?

A.Switch to a ra3.xlplus node with managed storage.
B.Replace the cluster with a single ds2.xlarge node.
C.Scale the cluster to a single dc2.8xlarge node.
D.Add another dc2.large node to the cluster to increase total storage.
AnswerB

ds2.xlarge provides 2 TB HDD storage at a lower cost than dc2 options, solving the disk space issue.

Why this answer

The current cluster uses a single dc2.large node with only 160 GB SSD, which is nearly full. Replacing it with a single ds2.xlarge node provides 2 TB HDD storage, offering a significant capacity increase at a lower cost per GB compared to other options. Option A is wrong because switching to RA3 nodes introduces managed storage with higher costs and is unnecessary for this capacity need.

Option C is wrong because scaling to a single dc2.8xlarge node provides 2.56 TB SSD but is more expensive than the ds2.xlarge option. Option D is wrong because adding another dc2.large node only doubles the storage to 320 GB, which may not be sufficient and still leaves the cluster with limited SSD capacity, while also increasing CPU and memory unnecessarily.

Full explanation →
1595
MCQmedium

A data engineer is running a Spark job on Amazon EMR. The job reads from S3, processes data, and writes to S3. The job is taking longer than expected. The engineer notices that the job is spending a lot of time in the 'GC' (garbage collection) phase. Which configuration change is most likely to improve performance?

A.Increase the spark.executor.memory setting.
B.Increase the spark.sql.shuffle.partitions.
C.Decrease the number of executor cores.
D.Decrease the spark.executor.memoryOverhead.
AnswerA

More memory reduces GC overhead.

Why this answer

Increasing executor memory reduces GC frequency. Option B is wrong because it reduces parallelism. Option C is wrong because it reduces memory per task.

Option D is wrong because it reduces memory and may increase GC.

Full explanation →
1596
Multi-Selecthard

A company needs to implement a data encryption strategy for data in transit between an Amazon EC2 instance and an Amazon RDS for MySQL database. Which THREE actions should be taken?

Select 3 answers
A.Configure the RDS instance to require SSL connections
B.Set up VPC peering between the EC2 and RDS subnets
C.Enable encryption at rest using KMS on the RDS instance
D.Use a JDBC driver with the useSSL property set to true
E.Enable the rds.force_ssl parameter in the RDS parameter group
AnswersA, D, E

Requires SSL for connections.

Why this answer

Options A, D, and E are correct. To encrypt data in transit between EC2 and RDS MySQL, you need to enforce SSL/TLS connections. Option A configures the RDS instance to require SSL connections.

Option D uses a JDBC driver with useSSL=true to enforce SSL from the client side. Option E enables the rds.force_ssl parameter in the RDS parameter group to force SSL connections at the database level. Option B is incorrect because VPC peering establishes network connectivity but does not encrypt data.

Option C is incorrect because encryption at rest secures stored data, not data in transit.

Full explanation →
1597
Multi-Selecthard

A company runs a real-time analytics platform using Amazon Kinesis Data Streams. The data is consumed by multiple consumers: one for real-time dashboard (using Lambda) and one for long-term storage (using Firehose to S3). The Kinesis stream has 10 shards. Each record is 1 KB, and the total incoming data rate is 5 MB/s. The Lambda consumer is falling behind and processing latency exceeds 10 seconds. Which TWO actions should be taken to resolve the issue?

Select 2 answers
A.Increase the Lambda function's memory allocation
B.Increase the number of shards to 20
C.Enable enhanced fan-out for the Lambda consumer
D.Switch to using Kinesis Client Library (KCL) instead of Lambda
E.Decrease the batch size in the Lambda event source mapping
AnswersB, C

More shards increase the total throughput of the stream, allowing Lambda to process more data in parallel.

Why this answer

Increasing the number of shards from 10 to 20 doubles the stream's read capacity, allowing the Lambda consumer to poll more data per second and reduce backlog. Option C is correct because enabling enhanced fan-out provides each consumer with a dedicated 2 MB/s read throughput per shard, eliminating contention between the Lambda consumer and the Firehose consumer, which is critical when multiple consumers read from the same stream.

Exam trap

The trap here is that candidates often assume increasing Lambda resources (memory) or reducing batch size will fix processing lag, when the root cause is a shared read throughput bottleneck between multiple consumers on the same Kinesis stream.

Full explanation →
1598
MCQmedium

Refer to the exhibit. An IAM policy is attached to a role used by an AWS Glue job. The job fails with an 'AccessDenied' error when trying to write to 's3://my-bucket/output/'. What is the most likely cause?

A.The resource ARN for S3 should include the bucket itself.
B.The glue:StartJobRun action is not allowed.
C.The policy does not grant s3:ListBucket permission.
D.The s3:GetObject action is missing.
AnswerA

This option indicates that the resource ARN for S3 should include the bucket itself. If the policy has s3:PutObject allowed on the bucket ARN (e.g., 'arn:aws:s3:::my-bucket') rather than on the object ARN (e.g., 'arn:aws:s3:::my-bucket/*'), the PutObject action will fail. Therefore, this is the most likely cause of the AccessDenied error.

Why this answer

The job fails with 'AccessDenied' when writing to S3. This is most likely because the IAM policy attached to the Glue role does not grant the s3:PutObject permission on the object ARN (e.g., 'arn:aws:s3:::my-bucket/output/*'). Option A points out that the resource ARN should include the bucket itself, which is a common error: if the policy uses the bucket ARN (without the /* suffix) for the PutObject action, it will not allow the write operation.

Option C is incorrect because s3:ListBucket is not required for the PutObject action; it is needed for listing contents, not for writing. Option B is irrelevant to the S3 write failure. Option D (s3:GetObject) is for reading, not writing.

Full explanation →
1599
MCQeasy

A company has CSV files in an S3 bucket that need to be converted to Parquet and loaded into a Redshift table daily. The transformation is a simple schema mapping without joins. Which AWS Glue feature is BEST suited for this task?

A.AWS Glue ETL job
B.AWS Glue DataBrew
C.AWS Glue Workflow
D.AWS Glue Crawler
AnswerA

Glue ETL jobs can read CSV, convert to Parquet, and write to Redshift.

Why this answer

(AWS Glue ETL job) is the best suited because it can convert CSV to Parquet and load into Redshift daily. Option B (DataBrew) is a visual data preparation tool, not ideal for automated daily jobs. Option C (Workflow) orchestrates multiple jobs but does not perform transformation.

Option D (Crawler) only discovers schema and catalogs data, not transform.

Full explanation →
1600
MCQmedium

A company uses AWS Glue to process data in Amazon S3. The Glue job fails with an error indicating that the partition keys in the catalog do not match the actual S3 partition structure. What is the most likely cause?

A.The IAM role does not have permissions to read the S3 data
B.The data files are encrypted with SSE-KMS
C.The table name in the catalog is different from the one used in the job
D.The Glue Data Catalog partition metadata is outdated after the S3 structure changed
AnswerD

The catalog must be refreshed by running a crawler to reflect S3 changes.

Why this answer

The Glue Data Catalog stores partition metadata separately from the actual S3 partition layout. When the S3 partition structure changes (e.g., new partitions are added or existing ones are renamed) without updating the catalog, the Glue job reads stale partition metadata, leading to a mismatch error. The job fails because it expects partitions based on the catalog, not the live S3 structure.

Exam trap

The trap here is that candidates confuse a partition metadata mismatch with other common Glue errors like IAM permissions or encryption issues, but the error message explicitly references partition keys, not access or decryption problems.

How to eliminate wrong answers

Option A is wrong because an IAM permissions issue would typically cause an Access Denied error, not a partition key mismatch error. Option B is wrong because SSE-KMS encryption affects data decryption, not the structure or metadata of partitions in the catalog. Option C is wrong because a table name mismatch would cause a 'table not found' error, not a partition key mismatch; the error specifically points to partition keys, not table identifiers.

Full explanation →
1601
Multi-Selecthard

A data engineer is designing a data lake on Amazon S3 for analytics. The data includes sensitive PII that must be encrypted at rest. The company requires that the encryption keys be managed by the company's own hardware security module (HSM) and rotated every 90 days. Which TWO options meet these requirements? (Choose TWO.)

Select 2 answers
A.Use S3 server-side encryption with AWS KMS and an AWS managed key
B.Use S3 server-side encryption with customer-provided keys (SSE-C)
C.Use client-side encryption with keys stored in AWS Secrets Manager
D.Use S3 server-side encryption with AWS KMS (SSE-KMS) and a customer-managed key with imported key material from your HSM
E.Use S3 server-side encryption with S3 managed keys (SSE-S3)
AnswersB, D

SSE-C allows you to supply your own encryption keys, which you can rotate by re-encrypting objects.

Why this answer

SSE-C allows you to provide your own encryption keys, which can be managed and rotated from your own HSM. The keys are used server-side by S3 to encrypt objects at rest, but S3 does not store the keys—you manage them entirely, meeting the requirement for key management on your own HSM with 90-day rotation.

Exam trap

The trap here is that candidates often assume only SSE-KMS can meet key management requirements, but they overlook that SSE-C directly supports customer-supplied keys from an HSM without any AWS key storage, and that SSE-KMS with imported key material also satisfies the HSM and rotation needs when properly configured.

Full explanation →
1602
MCQeasy

A data engineer needs to store semi-structured JSON log files from multiple sources and query them using SQL. The data is rarely updated and access frequency is low. Which storage solution is MOST cost-effective?

A.Amazon Redshift with JSON ingestion and compression.
B.Amazon DynamoDB with JSON documents.
C.Amazon S3 with Amazon Athena for querying.
D.Amazon RDS for PostgreSQL with JSONB columns.
AnswerC

S3 provides cheap storage and Athena allows serverless SQL queries, ideal for low-frequency access.

Why this answer

Amazon S3 with Athena is the most cost-effective solution because the data is semi-structured JSON, rarely updated, and accessed infrequently. S3 provides low-cost storage for static data, and Athena uses a serverless, pay-per-query model, eliminating the need for a running cluster or provisioned capacity. This combination avoids the fixed costs of Redshift, DynamoDB, or RDS, making it ideal for low-frequency SQL querying of archival logs.

Exam trap

The trap here is that candidates often choose Redshift or RDS because they associate SQL querying with traditional databases, overlooking that Athena's serverless, pay-per-query model is far more cost-effective for infrequent access to static data stored in S3.

How to eliminate wrong answers

Option A is wrong because Amazon Redshift requires a provisioned cluster with ongoing compute costs, making it overkill and expensive for rarely accessed data; its JSON ingestion and compression do not offset the fixed infrastructure cost. Option B is wrong because Amazon DynamoDB is a NoSQL key-value store optimized for high-frequency, low-latency reads/writes, not for SQL-based ad-hoc querying of large JSON logs; its on-demand capacity mode still incurs per-request charges that are wasteful for infrequent access. Option D is wrong because Amazon RDS for PostgreSQL with JSONB columns requires a provisioned database instance with continuous compute and storage costs, and while JSONB supports indexing, it is not cost-effective for rarely queried, static log data compared to S3's pay-per-byte storage and Athena's pay-per-query model.

Full explanation →
1603
MCQeasy

A data engineer is designing a data lake on Amazon S3. The data includes sensitive personally identifiable information (PII). Which combination of services would provide the most comprehensive data protection?

A.Use S3 Transfer Acceleration and enable versioning
B.Enable S3 server-side encryption with AWS KMS
C.Use Amazon CloudWatch Logs to monitor access and enable MFA Delete
D.Enable S3 Block Public Access and use Amazon Macie to discover and classify PII
AnswerD

Block Public Access prevents exposure; Macie identifies and alerts on PII.

Why this answer

Combining S3 Block Public Access prevents unintended public exposure, and Amazon Macie automatically discovers, classifies, and protects sensitive PII. Option A is incorrect because S3 Transfer Acceleration speeds up uploads but does not protect data; versioning helps with accidental deletion but not confidentiality or access control. Option B is incorrect because SSE-KMS only provides encryption at rest, not comprehensive protection against misconfigurations or authorized access to PII.

Option C is incorrect because CloudWatch Logs monitor and audit access but do not prevent exposure or classify data; MFA Delete protects against accidental deletion but not against data leaks.

Full explanation →
1604
MCQmedium

A company uses Amazon Kinesis Data Firehose to deliver data to an S3 bucket. The data must be delivered within 60 seconds of ingestion. Currently, the delivery takes 3 minutes due to large buffer sizes. How should the engineer adjust the Firehose configuration?

A.Decrease the buffer interval to 60 seconds.
B.Increase the buffer interval to 120 seconds.
C.Increase the buffer size to 128 MB.
D.Decrease the buffer size to 1 MB.
AnswerA

Lowering the buffer interval triggers delivery sooner, meeting the latency requirement.

Why this answer

Amazon Kinesis Data Firehose delivers data to S3 based on either a buffer size threshold or a buffer interval (in seconds), whichever is reached first. To ensure delivery within 60 seconds, you must decrease the buffer interval to 60 seconds, which forces Firehose to flush data to S3 every 60 seconds regardless of buffer size. The current 3-minute delay is caused by the buffer interval being larger than 60 seconds, so reducing it directly meets the requirement.

Exam trap

The trap here is that candidates mistakenly think decreasing the buffer size alone will speed up delivery, but without adjusting the buffer interval, Firehose may still wait up to the default interval (e.g., 300 seconds) before flushing, so both parameters must be considered to meet a time-based requirement.

How to eliminate wrong answers

Option B is wrong because increasing the buffer interval to 120 seconds would make the delivery delay even longer (up to 2 minutes), not shorter, and fails to meet the 60-second requirement. Option C is wrong because increasing the buffer size to 128 MB does not reduce delivery time; it may actually increase latency since Firehose waits for more data to accumulate before flushing, and the buffer interval is the primary control for time-based delivery. Option D is wrong because decreasing the buffer size to 1 MB could cause more frequent flushes but does not guarantee delivery within 60 seconds if the buffer interval remains larger than 60 seconds; the buffer interval must be explicitly set to 60 seconds to enforce the time constraint.

Full explanation →
1605
Multi-Selectmedium

A data engineer is designing a data pipeline that uses AWS Glue to transform data stored in Amazon S3. The transformation logic must be written in Python and should handle schema evolution automatically. Which THREE features or configurations should the engineer use? (Select THREE.)

Select 3 answers
A.Schedule a Glue crawler to update the schema
B.Use `applyMapping` transformations
C.Use Spark SQL for transformations
D.Enable schema detection in the Glue job
E.Use DynamicFrames instead of DataFrames
AnswersB, D, E

Facilitates schema manipulation.

Why this answer

Correct options: B, D, E. AWS Glue DynamicFrames (E) handle schema evolution automatically by allowing schema on read and accommodating changes in data structure. Schema detection in the Glue job (D) enables the job to infer the schema from the data, which is essential for handling evolving schemas.

Using `applyMapping` (B) provides explicit control over schema transformations and can be combined with DynamicFrames to manage schema changes. Option A (scheduling a Glue crawler) is meant for updating the Data Catalog, not for within-job schema evolution. Option C (Spark SQL) does not inherently handle schema evolution; it relies on static schemas.

Full explanation →
1606
MCQeasy

A logistics company uses AWS Glue to process GPS data from delivery trucks. The data is stored in Amazon S3 as JSON files. The Glue job reads the JSON files, converts them to Parquet, and writes them back to S3. The company notices that the Glue job takes too long to complete. The data engineer wants to improve the job's performance without changing the code. What should the data engineer do?

A.Increase the number of DPUs to 20.
B.Change the worker type to G.2X.
C.Change the worker type to G.1X.
D.Decrease the number of DPUs to 5 to reduce overhead.
AnswerB

G.2X workers have double the memory and compute, accelerating the transformation.

Why this answer

Changing the worker type to G.2X provides more memory and CPU per worker, which improves performance for memory-intensive tasks like converting JSON to Parquet. Option A is wrong because increasing the number of DPUs can help with parallelism but may still be limited by per-worker memory; upgrading worker type is more efficient. Option C is wrong because G.1X is the default and provides less resources than G.2X.

Option D is wrong because decreasing DPUs would reduce parallelism and worsen performance.

Full explanation →
1607
MCQhard

Refer to the exhibit. A data engineer configured CloudTrail to log data events for an S3 bucket. However, the engineer notices that no data events are being logged for objects in the 'logs/' prefix. What is the most likely reason?

A.The S3 bucket policy does not allow CloudTrail to write logs
B.The data resource should specify the bucket ARN without a prefix
C.The prefix 'logs/' must not include a trailing slash
D.Data events are not supported for S3
AnswerA

CloudTrail needs a bucket policy granting s3:PutObject.

Why this answer

The data resource value is missing a trailing slash (should be 'logs/')? Actually it has a trailing slash. Wait, the issue is that the ARN is for a prefix, but CloudTrail data event selectors for S3 require a bucket ARN or prefix ARN with a trailing slash. The provided ARN 'arn:aws:s3:::my-bucket/logs/' is correct format.

However, the likely issue is that the bucket is in a different region, but the trail is in a different region? No, more common: the IAM role for CloudTrail lacks permissions to log to S3. But the exhibit shows a correct selector. Actually, common mistake: the selector must have a trailing slash, which it does.

The most likely cause is that the trail is not logging because the S3 bucket policy does not grant CloudTrail write access. Option A is plausible. Option B is wrong because prefix is correct.

Option C is wrong because it includes trailing slash. Option D is wrong because data events are enabled. So option A is correct.

Full explanation →
1608
MCQhard

A company runs a critical data pipeline using Amazon Kinesis Data Firehose to deliver data to Amazon S3. The data is compressed with GZIP and partitioned by year/month/day/hour. Recently, the delivery to S3 has been failing with 'Rate exceeded' errors. The Firehose delivery stream has a buffer size of 128 MB and buffer interval of 60 seconds. What is the most effective way to resolve this issue?

A.Transition objects to S3 Glacier after 30 days.
B.Decrease the buffer size to 64 MB and buffer interval to 30 seconds.
C.Increase the buffer size to 256 MB and buffer interval to 120 seconds.
D.Enable server-side encryption on the S3 bucket.
AnswerC

Larger buffers reduce the number of S3 PUT requests, alleviating throttling.

Why this answer

The 'Rate exceeded' error indicates that Kinesis Data Firehose is sending requests to S3 at a rate that exceeds the S3 bucket's request rate limits for PUT operations. Increasing the buffer size to 256 MB and the buffer interval to 120 seconds allows Firehose to accumulate more data before each S3 PUT request, reducing the number of requests per second and staying within S3's 3,500 PUT requests per second limit per prefix. This directly addresses the throttling issue without changing the data volume.

Exam trap

The trap here is that candidates mistakenly think reducing buffer size or interval will speed up delivery, but in reality, it increases request frequency and worsens S3 throttling, while increasing buffers is the correct way to reduce request rate.

How to eliminate wrong answers

Option A is wrong because transitioning objects to S3 Glacier after 30 days does not affect the rate of PUT requests to the S3 bucket; it only changes storage class after delivery, so it cannot resolve current delivery failures. Option B is wrong because decreasing the buffer size to 64 MB and buffer interval to 30 seconds would increase the frequency of S3 PUT requests, worsening the 'Rate exceeded' errors by exceeding the bucket's request rate limits even more. Option D is wrong because enabling server-side encryption on the S3 bucket does not change the request rate or throughput; it only encrypts objects at rest and has no impact on throttling of PUT operations.

Full explanation →
1609
MCQhard

A company is using AWS DMS to replicate data from an on-premises Oracle database to Amazon RDS for MySQL. The replication is working, but the target table has a different schema. Which DMS feature should be used to transform the source schema to match the target?

A.Use AWS Schema Conversion Tool (SCT)
B.Use AWS Glue ETL jobs
C.Use DMS transformation rules
D.Use AWS Lambda triggers
AnswerC

DMS transformation rules allow renaming tables, schemas, and columns during replication.

Why this answer

AWS DMS transformation rules allow you to modify the schema, table, or column names and data types during the migration process. This feature is specifically designed to handle schema transformations within the DMS task itself, enabling you to map the source Oracle schema to the target MySQL schema without external tools or services.

Exam trap

The trap here is that candidates often confuse AWS Schema Conversion Tool (SCT) with DMS transformation rules, assuming SCT handles runtime schema mapping, whereas SCT is a separate pre-migration assessment and conversion tool, not a DMS feature for ongoing replication transformations.

How to eliminate wrong answers

Option A is wrong because AWS Schema Conversion Tool (SCT) is used for heterogeneous database migrations to convert the entire database schema and code objects, but it is not a feature of DMS for runtime schema transformation during ongoing replication. Option B is wrong because AWS Glue ETL jobs are for batch data processing and transformation in a data lake or warehouse, not for real-time schema mapping within a DMS replication task. Option D is wrong because AWS Lambda triggers can be used for custom post-processing or validation, but they are not a built-in DMS feature for transforming source schemas to match target schemas during replication.

Full explanation →
1610
MCQmedium

A company uses AWS Database Migration Service (DMS) to continuously replicate data from an Oracle RDS instance to S3. The data is used for analytics. The replication lags behind the source by several hours. Which change would most likely reduce the lag?

A.Change the target endpoint from S3 to Kinesis Data Firehose.
B.Increase the source RDS instance storage to improve I/O.
C.Use a larger DMS replication instance (e.g., dms.c5.large instead of dms.t3.medium).
D.Change the target data format from CSV to Parquet.
AnswerC

More compute resources reduce lag.

Why this answer

The replication lag is most likely caused by the DMS replication instance being undersized for the volume of change data capture (CDC) events. Upgrading from a burstable t3.medium to a compute-optimized c5.large instance provides more consistent CPU performance and higher network throughput, enabling faster processing of Oracle redo logs and reducing the lag between source and target.

Exam trap

The trap here is that candidates assume the lag is caused by the target (S3 write performance or format) or source database I/O, rather than recognizing that DMS replication instance sizing is the primary bottleneck for CDC throughput.

How to eliminate wrong answers

Option A is wrong because changing the target to Kinesis Data Firehose does not address the bottleneck in the DMS replication instance's ability to capture and apply changes; Firehose is a delivery stream that still requires DMS to push data, and the lag originates from DMS processing capacity, not the target endpoint type. Option B is wrong because increasing source RDS storage improves I/O for the database itself, but DMS reads Oracle redo logs via LogMiner or binary reader, which are not significantly throttled by source storage I/O in a CDC scenario; the lag is due to DMS processing speed, not source I/O. Option D is wrong because changing the data format from CSV to Parquet reduces the target storage size and can improve query performance, but it does not affect the rate at which DMS captures and replicates changes from the source; the lag is a replication throughput issue, not a format conversion issue.

Full explanation →
1611
MCQeasy

A company is migrating its on-premises MySQL database to Amazon RDS for MySQL. They want to minimize downtime and ensure data consistency. Which AWS service should be used for the migration?

A.AWS S3 Transfer Acceleration
B.AWS Glue
C.AWS Database Migration Service (DMS)
D.AWS Snowball Edge
AnswerC

DMS supports continuous replication and minimal downtime for database migrations.

Why this answer

AWS Database Migration Service (DMS) is the correct choice because it is specifically designed for migrating databases to AWS with minimal downtime. DMS supports homogeneous migrations like MySQL to Amazon RDS for MySQL, and it uses ongoing replication (change data capture) to keep the source and target databases in sync during the migration, ensuring data consistency and allowing a cutover with only seconds of downtime.

Exam trap

The trap here is that candidates may confuse AWS DMS with AWS Glue, thinking both are for data migration, but Glue is for batch ETL and cannot perform live database replication with minimal downtime, while DMS is purpose-built for that task.

How to eliminate wrong answers

Option A is wrong because AWS S3 Transfer Acceleration is a service that speeds up uploads to Amazon S3 by using optimized network paths and edge locations; it has no capability to migrate or replicate a live MySQL database to RDS. Option B is wrong because AWS Glue is a serverless data integration service for ETL (extract, transform, load) jobs, primarily used for preparing and transforming data for analytics, not for ongoing database replication or minimizing downtime during a live database migration. Option D is wrong because AWS Snowball Edge is a physical data transport device used for large-scale data transfers over slow or unreliable networks, but it is not suitable for minimizing downtime in a live database migration as it involves shipping hardware and cannot perform continuous replication.

Full explanation →
1612
MCQhard

A data engineer is monitoring an Amazon Redshift cluster and notices that queries are taking longer than expected. The engineer checks the system tables and sees that many queries are waiting for 'WLM' resources. What is the most likely cause and recommended fix?

A.The table sort keys are poorly designed; recreate tables with better sort keys.
B.The distribution style is set to ALL; change to KEY distribution.
C.The WLM queue concurrency is set too low; increase the concurrency level.
D.The cluster is running low on disk space; resize the cluster.
AnswerC

Higher concurrency allows more simultaneous queries.

Why this answer

A wait for WLM (Workload Management) resources indicates that queries are being throttled due to insufficient concurrency slots. Increasing the WLM queue concurrency allows more queries to run simultaneously. Option A is incorrect because sort keys affect query scan efficiency, not WLM queue waits.

Option B is incorrect because distribution style affects data redistribution, not concurrency throttling. Option D is incorrect because low disk space would cause different errors, not specifically WLM queue waits.

Full explanation →
1613
MCQhard

A company has an S3 data lake with millions of objects. A data engineer needs to provide a daily report of objects that are not accessed for 90 days. The engineer must minimize cost and impact on performance. Which approach should be used?

A.Enable S3 Inventory and query with Athena
B.Use S3 Select on each object to check last access metadata
C.Analyze S3 server access logs to find objects not accessed
D.Use S3 Storage Lens to generate a dashboard of object age and last access
AnswerD

S3 Storage Lens provides a dashboard with free metrics such as 'Object Age' and 'Last Access Date', making it the most cost-effective and performant option for this use case.

Why this answer

S3 Storage Lens provides cost-effective analytics including last access date and object age, enabling identification of objects not accessed for 90 days without scanning all objects or incurring high costs. Option A is less suitable because S3 Inventory creates daily lists but requires additional Athena queries, adding complexity and cost. Option B is incorrect because S3 Select is designed for querying object content, not metadata; applying it to millions of objects would be highly inefficient and costly.

Option C is incorrect because analyzing S3 server access logs would involve storing and querying large volumes of log data, which is costly and impacts performance, and it logs all requests rather than providing a direct last access timestamp.

Full explanation →
1614
Multi-Selecthard

A data engineer is designing a data lake on Amazon S3. The data is ingested from multiple sources and must be queryable using Amazon Athena. The engineer needs to optimize query performance and reduce costs. Which THREE actions would achieve this?

Select 3 answers
A.Store data in many small files to increase parallelism.
B.Partition the data by a commonly used filter column.
C.Use S3 Select instead of Athena for queries.
D.Compress data with a splittable compression format like Snappy.
E.Convert data to Apache Parquet or ORC format.
AnswersB, D, E

Partition pruning limits the data scanned.

Why this answer

Partitioning data by a commonly used filter column (e.g., date, region) allows Athena to prune partitions during query execution, scanning only the relevant S3 prefixes. This reduces the amount of data read per query, directly lowering both query latency and cost, as Athena charges based on the volume of data scanned.

Exam trap

The trap here is that candidates confuse 'more files = more parallelism' with Athena's actual recommendation of fewer, larger files to minimize the overhead of S3 list and get operations, and they may also mistake S3 Select as a viable alternative to Athena for full SQL querying.

Full explanation →
1615
MCQhard

A company uses Amazon EMR to process large datasets stored in Amazon S3. The data is in Parquet format and partitioned by date. The EMR cluster uses Spark SQL for transformations. Recently, the job has been slow and some tasks are failing due to 'java.lang.OutOfMemoryError'. The cluster has 10 core nodes of type m5.xlarge. Which configuration change would MOST improve performance and stability?

A.Increase the number of Spark partitions using repartition(), but keep the same nodes.
B.Change the core node instance type to r5.xlarge (memory-optimized).
C.Increase the number of executor cores in the Spark configuration.
D.Enable Kryo serialization in the Spark configuration.
AnswerB

More memory per node helps OOM.

Why this answer

The error 'java.lang.OutOfMemoryError' indicates that the Spark executors are running out of memory during processing. The m5.xlarge instance type provides 16 GiB of memory, but the workload likely requires more memory per task. Switching to r5.xlarge (32 GiB of memory) doubles the available memory per node, reducing memory pressure and preventing task failures, which directly improves stability and performance for memory-intensive transformations.

Exam trap

The trap here is that candidates often focus on tuning Spark configurations (partitions, cores, serialization) to fix OutOfMemoryErrors, but the real issue is insufficient physical memory per node, which requires a change in instance family rather than software settings.

How to eliminate wrong answers

Option A is wrong because increasing the number of partitions with repartition() can actually increase memory overhead due to shuffle operations and does not address the root cause of insufficient memory per executor; it may even worsen the OutOfMemoryError by creating more tasks that compete for the same limited memory. Option C is wrong because increasing the number of executor cores without increasing memory per core will cause more concurrent tasks to share the same fixed heap, exacerbating memory contention and making OutOfMemoryErrors more likely. Option D is wrong because enabling Kryo serialization reduces the size of serialized objects and improves CPU efficiency, but it does not increase the available heap memory; it cannot prevent OutOfMemoryErrors caused by insufficient memory for data processing.

Full explanation →
1616
MCQmedium

The IAM policy shown is attached to an IAM role. When a user assumes this role and tries to read an object in example-bucket that has no tags, what will happen?

A.The request will be denied because the object does not have the 'public' tag
B.The request will be allowed because the Allow statement grants access to all objects
C.The request will be allowed because there is no explicit Deny
D.The request will be denied because the Deny statement applies when the tag is missing
AnswerD

The Deny statement explicitly denies access when the tag is null.

Why this answer

The Deny statement denies s3:GetObject if the object does not have the tag 'classification' (i.e., the tag is null). Since the object has no tags, the condition evaluates to true, and the action is denied. The Allow statement only allows if the tag equals 'public', which is not the case.

The explicit Deny overrides any Allow, so access is denied.

Full explanation →
1617
MCQhard

Your company runs a critical data processing pipeline that ingests data from multiple sources into an Amazon S3 bucket. An AWS Glue ETL job processes this data and writes the output to an Amazon Redshift cluster. The pipeline is triggered by an S3 event notification that invokes an AWS Lambda function, which starts the Glue job. Recently, you have observed that the Glue job occasionally fails with an AccessDenied error when trying to access the S3 bucket. The IAM role used by the Glue job has the following policy: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::input-bucket", "arn:aws:s3:::input-bucket/*" ] }, { "Effect": "Allow", "Action": [ "redshift:CopyData" ], "Resource": "*" } ] }. The S3 bucket has a bucket policy that allows access only from a specific VPC. The Glue job runs in a VPC with the appropriate VPC endpoints configured. The error occurs intermittently and sometimes retries succeed. What is the most likely cause and correct course of action?

A.Add a VPC endpoint for S3 and configure the bucket policy to allow access from the Glue job's VPC endpoint.
B.Ensure the Glue job's VPC configuration includes a NAT gateway to route traffic to S3.
C.Change the Lambda function to use a different IAM role with broader S3 permissions.
D.Modify the Glue job's IAM role to include s3:PutObject permission for the output bucket.
AnswerA

This ensures requests from Glue are routed through the VPC endpoint and comply with the bucket policy.

Why this answer

The Glue job intermittently fails with AccessDenied when accessing the S3 bucket because the bucket policy restricts access to requests originating from a specific VPC endpoint. Although the Glue job runs in a VPC, it does not automatically route S3 traffic through the VPC endpoint; it may use the internet or a different endpoint. The intermittent success occurs when requests happen to come from the allowed endpoint.

To resolve this, ensure the Glue job's VPC configuration includes a VPC endpoint for S3, and update the bucket policy to allow access from that endpoint. Option B is incorrect because a NAT gateway would route traffic through the internet, which may be denied by the bucket policy. Option C is incorrect because the Lambda function's IAM role does not affect the Glue job's access.

Option D is incorrect because the error is about reading from the input bucket, not writing to the output bucket, and the IAM role already has the necessary S3 permissions.

Full explanation →
1618
MCQmedium

A data engineer reviews this IAM policy attached to an S3 bucket. What is the effect of this policy?

A.Denies PutObject when encryption is not SSE-KMS.
B.Denies all PutObject requests.
C.Allows PutObject only when the object is encrypted with SSE-KMS.
D.Allows PutObject only when the object is NOT encrypted with SSE-KMS.
AnswerC

Correct. The Deny with StringNotEquals on aws:kms denies PutObject requests that do not use SSE-KMS encryption, thus allowing only those with SSE-KMS.

Why this answer

The IAM policy uses a Deny effect with a StringNotEquals condition on s3:x-amz-server-side-encryption for aws:kms. This means that if the encryption header is anything other than aws:kms (i.e., not SSE-KMS), the request is denied. The net effect is that PutObject is allowed only when the object IS encrypted with SSE-KMS.

Exam trap

The trap is that candidates may misread StringNotEquals as StringEquals, thinking the policy denies SSE-KMS encryption when it actually denies non-SSE-KMS.

How to eliminate wrong answers

Option A is wrong because the policy denies `PutObject` when encryption is NOT SSE-KMS, not when it is SSE-KMS; the condition `StringNotEquals` denies non-matching values. Option B is wrong because the policy does not deny all `PutObject` requests; it only denies those that do not meet the encryption condition, allowing those with SSE-KMS. Option C is wrong because the policy uses a `Deny` effect, not an `Allow`; it does not explicitly allow `PutObject` with SSE-KMS, but rather denies everything else, making SSE-KMS the only permitted case.

Full explanation →
1619
MCQmedium

A company uses Amazon S3 to store sensitive documents. The security team has mandated that all objects must be encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). Additionally, the company wants to ensure that any attempt to upload an unencrypted object is denied. A data engineer has configured a bucket policy that denies PutObject if the encryption header does not include x-amz-server-side-encryption: aws:kms. However, the engineer notices that some objects are still being stored without encryption. Upon investigation, the engineer suspects that the policy is not being evaluated correctly. What should the engineer do to ensure that all objects are encrypted with SSE-KMS?

A.Use an IAM policy to require encryption instead of a bucket policy.
B.Enable S3 Block Public Access settings.
C.Add a condition to the bucket policy that checks for aws:SourceVpce.
D.Enable default encryption on the S3 bucket with SSE-KMS.
AnswerD

Default encryption ensures all objects are encrypted, complementing the bucket policy.

Why this answer

Enabling default encryption on the S3 bucket with SSE-KMS ensures that any object uploaded without an explicit encryption header is automatically encrypted with SSE-KMS. This closes the gap where the bucket policy condition fails to catch uploads that omit the `x-amz-server-side-encryption` header entirely, as the policy only denies requests with an incorrect header but does not block requests that lack the header altogether. Default encryption applies server-side encryption at the bucket level, making it impossible to store an unencrypted object.

Exam trap

The trap here is that candidates assume a bucket policy condition denying PutObject without `x-amz-server-side-encryption: aws:kms` will block all unencrypted uploads, but they overlook that the condition only matches when the header is present with a wrong value, not when the header is absent entirely.

How to eliminate wrong answers

Option A is wrong because IAM policies cannot enforce encryption requirements on S3 PutObject operations as effectively as bucket policies; IAM policies lack the ability to condition on S3-specific headers like `x-amz-server-side-encryption`, and they apply to users/roles rather than the bucket itself, leaving gaps for anonymous or cross-account uploads. Option B is wrong because S3 Block Public Access settings only prevent public access to objects and buckets, not encryption enforcement; they have no effect on whether objects are encrypted at rest. Option C is wrong because checking for `aws:SourceVpce` restricts access based on VPC endpoint origin, which is unrelated to encryption requirements and would not prevent unencrypted uploads from other sources.

Full explanation →
1620
MCQeasy

A data engineer is monitoring an Amazon Kinesis Data Analytics application that uses a SQL query to aggregate streaming data. The application is falling behind and the millisBehindLatest metric is increasing. Which action should the engineer take to improve performance?

A.Switch from SQL to Apache Flink for the analytics application
B.Increase the number of shards in the source Kinesis stream
C.Increase the Parallelism setting of the Kinesis Data Analytics application
D.Decrease the window duration of the SQL query
AnswerC

Higher parallelism increases processing capacity, reducing lag.

Why this answer

Increasing the Parallelism setting of the Kinesis Data Analytics application allows the SQL query to process data across more in-application streams and operators concurrently, directly addressing the lag indicated by the rising millisBehindLatest metric. This action scales the compute resources allocated to the application without changing the source stream or the query logic, making it the most direct way to improve throughput for a SQL-based Kinesis Data Analytics application.

Exam trap

The trap here is that candidates often confuse scaling the source (shards) with scaling the processing engine (parallelism), assuming that more data input automatically fixes processing lag, when in fact the bottleneck is the application's compute capacity.

How to eliminate wrong answers

Option A is wrong because switching from SQL to Apache Flink is a fundamental architectural change that is not required to address performance tuning; the question specifically states the application uses SQL, and Flink would require rewriting the application entirely, not a simple performance fix. Option B is wrong because increasing the number of shards in the source Kinesis stream increases the ingestion capacity but does not directly improve the processing speed of the Kinesis Data Analytics application; if the application is already falling behind due to insufficient compute, more shards will only increase the backlog. Option D is wrong because decreasing the window duration of the SQL query reduces the amount of data aggregated per window, which may reduce latency but does not increase the overall processing parallelism or throughput; it could even cause more frequent window triggers, potentially worsening the lag.

Full explanation →
1621
MCQhard

A company uses Amazon Redshift for data warehousing. They notice that queries are running slowly, and the STL_LOAD_ERRORS table shows many 'Parse error' entries. The data is loaded from Amazon S3 using COPY commands. What is the MOST likely cause of the parse errors?

A.The source data files have a different schema or delimiter than what is specified in the COPY command.
B.The Redshift cluster does not have enough compute nodes to process the data.
C.The IAM role used by Redshift does not have permission to decrypt the S3 objects.
D.The source data files are compressed using an unsupported compression format.
AnswerA

Schema mismatch leads to parse errors.

Why this answer

Parse errors during COPY typically indicate that the source data does not match the target table schema (e.g., data type mismatch or delimiter issues). Option B is incorrect because insufficient compute nodes would cause performance degradation, not parse errors. Option C is incorrect because IAM permission issues would cause access denied errors, not parse errors.

Option D is incorrect because unsupported compression formats would cause decompression errors, not parse errors.

Full explanation →
1622
MCQhard

A logistics company ingests GPS tracking data from thousands of vehicles into Amazon S3 via AWS Direct Connect. Each vehicle sends a message every 5 seconds, resulting in about 200,000 messages per second. Each message is about 200 bytes. The company uses AWS Glue to transform the data into a parquet format and load it into Amazon Redshift for real-time analytics. However, the Glue jobs are failing due to memory issues and the data is not being loaded into Redshift quickly enough. The company needs to reduce the latency of data availability in Redshift. Which action should the data engineer take?

A.Use Amazon Kinesis Data Analytics to process the data in real-time and write to Redshift directly.
B.Increase the size of the Redshift cluster to improve load performance.
C.Use Amazon Kinesis Data Firehose to ingest the data directly into S3 and then use Redshift Spectrum to query the data without loading.
D.Increase the number of DPUs and allocate more memory to the Glue job.
AnswerC

Firehose can handle high throughput and Redshift Spectrum reduces load time.

Why this answer

Amazon Kinesis Data Firehose can ingest high-throughput streaming data (200,000 messages/sec) and deliver it to S3 in near-real-time (typically under 60 seconds). By using Redshift Spectrum to query the data directly in S3, the company avoids the latency and memory issues associated with AWS Glue batch transformations and Redshift bulk loads. This approach reduces data availability latency significantly.

Option A is incorrect because Amazon Kinesis Data Analytics adds processing overhead and does not directly solve the Glue memory issue or reduce latency to Redshift; it is more suitable for real-time streaming analytics, not for minimizing data ingestion latency.

Option B is incorrect because increasing the Redshift cluster size improves query performance and load speed but does not address the root cause: the Glue jobs are failing due to memory issues, and the data is not being transformed quickly enough. The bottleneck is upstream of Redshift.

Option D is incorrect because increasing DPUs and memory for the Glue job might resolve memory issues but does not significantly reduce latency; Glue batch processing still incurs minutes of delay, whereas Firehose provides near-real-time delivery.

Full explanation →
1623
MCQeasy

A company uses Amazon EMR to run Spark jobs on a transient cluster. The jobs process data from S3 and write results back to S3. The team wants to reduce costs by optimizing the cluster. Which action should the team take?

A.Use Spot Instances for the task nodes.
B.Increase the number of core nodes and use larger instance types.
C.Enable EMRFS consistent view.
D.Terminate the cluster after each job and manually restart it for the next job.
AnswerA

Spot instances are cheaper than on-demand.

Why this answer

Using Spot Instances for task nodes in a transient EMR cluster significantly reduces compute costs because Spot Instances are spare AWS EC2 capacity offered at up to 90% discount compared to On-Demand. Since transient clusters are terminated after job completion, the risk of Spot Instance interruptions is mitigated—the job can simply be retried on a new cluster if needed. This directly addresses the cost optimization goal without sacrificing job functionality.

Exam trap

The trap here is that candidates confuse cost optimization with performance tuning, leading them to choose larger instances (Option B) or consistency features (Option C), when the real cost lever for transient workloads is leveraging Spot pricing for ephemeral compute.

How to eliminate wrong answers

Option B is wrong because increasing the number of core nodes and using larger instance types increases costs, not reduces them, and core nodes host HDFS which is unnecessary for a transient cluster that reads/writes directly to S3. Option C is wrong because EMRFS consistent view is a feature to handle S3 eventual consistency for listing and renaming, not a cost optimization mechanism—it adds overhead without reducing spend. Option D is wrong because EMR transient clusters already terminate automatically after the job completes; manually restarting is redundant and does not further reduce costs, and it introduces operational overhead.

Full explanation →
1624
MCQhard

A company runs a data pipeline using AWS Glue ETL jobs to process daily files from an S3 bucket. The files are in CSV format and range from 1 GB to 10 GB. The Glue job runs successfully for small files but fails with an 'Out of Memory' error for files larger than 5 GB. The job uses a single G.1X DPU (16 GB memory). The company needs to process these large files without changing the existing ETL script. Which solution should the company implement?

A.Convert the input files from CSV to Parquet format to reduce memory usage.
B.Use the Optimus format in AWS Glue to compress data.
C.Use Amazon EMR with Spark instead of AWS Glue.
D.Increase the number of DPUs and use the G.2X worker type to provide more memory per worker.
AnswerD

More DPUs and G.2X provide additional memory.

Why this answer

Increasing the number of DPUs and switching to the G.2X worker type allocates more memory per worker (32 GB instead of 16 GB), allowing the Glue job to process larger CSV files without modifying the ETL script. Option A is incorrect because converting to Parquet would require changing the script and may still encounter memory limits with very large files. Option B is incorrect because Optimus format is not a standard AWS Glue feature; the correct approach is to increase memory.

Option C is incorrect because moving to Amazon EMR with Spark would likely require rewriting the script, which the company wants to avoid.

Full explanation →
1625
MCQeasy

A data engineer runs the above SQL commands on an Amazon Redshift cluster. The table 'users' is created with DISTSTYLE EVEN. What is the effect of the DISTSTYLE EVEN on query performance?

A.It stores all data on a single node for fast local queries.
B.It ensures data is evenly distributed across all nodes to prevent data skew.
C.It reduces data movement during queries by co-locating data based on user_id.
D.It improves join performance when joining on user_id.
AnswerB

EVEN distribution spreads rows evenly, avoiding skew.

Why this answer

DISTSTYLE EVEN in Amazon Redshift distributes rows across all nodes in a round-robin fashion, ensuring each node holds approximately the same amount of data. This prevents data skew, which can cause some nodes to become bottlenecks, and improves overall query performance for workloads that do not benefit from key-based distribution. It is the correct choice because it directly addresses the goal of balanced data distribution.

Exam trap

The trap here is that candidates often confuse DISTSTYLE EVEN with DISTSTYLE ALL, thinking EVEN improves performance by keeping data local, when in fact EVEN distributes data to prevent skew, not to localize it.

How to eliminate wrong answers

Option A is wrong because DISTSTYLE EVEN does not store all data on a single node; that describes DISTSTYLE ALL, which replicates the entire table to every node. Option C is wrong because EVEN distribution does not co-locate data based on user_id; that behavior is achieved with DISTSTYLE KEY, which distributes rows by the hash of a specified column. Option D is wrong because EVEN distribution does not improve join performance on user_id; joins on user_id benefit from DISTSTYLE KEY on user_id to enable collocated joins, while EVEN may require data redistribution across nodes during query execution.

Full explanation →
1626
MCQhard

Refer to the exhibit. An IAM policy is attached to an AWS Glue ETL job. The job reads from the Kinesis stream 'input-stream' and writes to S3 bucket 'data-lake-bucket'. The job fails with an access denied error. Which missing permission is most likely the cause?

A.kinesis:PutRecord permission on a wildcard stream ARN
B.kinesis:DescribeStream permission
C.s3:PutObject permission on a specific prefix
D.s3:ListBucket permission on the bucket
AnswerD

Glue needs ListBucket to verify bucket existence and structure.

Why this answer

The AWS Glue ETL job fails with an access denied error because it lacks the s3:ListBucket permission on the 'data-lake-bucket'. When writing to S3, the job must first list the bucket to verify the target prefix exists and to handle multipart uploads; without this permission, the write operation fails even if s3:PutObject is granted.

Exam trap

The trap here is that candidates assume only s3:PutObject is needed for writing to S3, forgetting that AWS S3 operations like multipart uploads and prefix validation require the s3:ListBucket permission on the bucket resource.

How to eliminate wrong answers

Option A is wrong because the job reads from the Kinesis stream, so it needs kinesis:GetRecords or kinesis:SubscribeToShard, not kinesis:PutRecord, and a wildcard stream ARN would be overly permissive but not the missing permission. Option B is wrong because kinesis:DescribeStream is used for stream metadata retrieval, but the error occurs during the S3 write phase, not during Kinesis consumption. Option C is wrong because while s3:PutObject on a specific prefix is necessary for writing objects, the missing permission is the prerequisite s3:ListBucket action on the bucket itself, which is required to validate the target location before any PutObject call.

Full explanation →
1627
MCQmedium

A data engineering team uses AWS Glue ETL jobs to process data daily. They notice that job run times are increasing as data volume grows. Which action will most effectively improve performance without changing the code?

A.Use a smaller instance type for the Glue job.
B.Enable job bookmark to skip previously processed data.
C.Split the data into more files in S3.
D.Increase the number of DPUs for the Glue job.
AnswerD

More DPUs increase parallelism and can significantly reduce run time.

Why this answer

Increasing the number of DPUs (Data Processing Units) allocated to the job provides more parallelism and memory, speeding up processing without code changes.

Full explanation →
1628
MCQhard

A data engineer is troubleshooting an Amazon Redshift cluster that is experiencing slow query performance. The engineer notices that the disk space is heavily utilized and queries are spilling to disk. What is the most cost-effective solution to improve performance?

A.Run VACUUM command to reclaim space
B.Change distribution style to KEY
C.Resize the cluster to a larger node type or add nodes
D.Apply compression encoding to tables
AnswerC

Adding memory and disk reduces spilling to disk.

Why this answer

When queries spill to disk due to heavy disk utilization, the root cause is insufficient memory or compute capacity relative to the workload. Resizing the cluster (adding nodes or moving to a larger node type) directly increases available memory and CPU, reducing or eliminating disk spill and improving query performance. This is the most cost-effective solution because it scales resources proportionally without requiring manual tuning or schema changes.

Exam trap

The trap here is that candidates confuse disk space management (VACUUM, compression) with memory/query execution issues, leading them to choose storage optimization options when the real bottleneck is insufficient compute resources.

How to eliminate wrong answers

Option A is wrong because VACUUM reclaims space from deleted rows but does not increase memory or reduce disk spill; it only reorganizes existing data. Option B is wrong because changing distribution style (e.g., to KEY) optimizes data redistribution for joins but does not address insufficient memory or disk spill. Option D is wrong because applying compression encoding reduces storage footprint and I/O, but does not increase memory or compute capacity to prevent queries from spilling to disk.

Full explanation →
1629
Multi-Selectmedium

A company uses AWS Glue to catalog data stored in Amazon S3. The data is in Parquet format and partitioned by date. The company wants to improve query performance in Amazon Athena and reduce costs. Which THREE actions should the company take? (Choose THREE.)

Select 3 answers
A.Convert the data to JSON format for better schema evolution.
B.Use Glue DataBrew to clean the data before querying.
C.Partition the data by date so Athena can use partition pruning.
D.Ensure the data is in a columnar format like Parquet or ORC.
E.Compress the data using a codec like Snappy or Gzip.
AnswersC, D, E

Partition pruning limits the amount of data scanned per query.

Why this answer

Partitioning the data by date allows Athena to use partition pruning, which limits the amount of data scanned by only reading the partitions that match the query's WHERE clause. This directly reduces both query cost (since Athena charges per byte scanned) and query latency, especially for date-range queries on large datasets.

Exam trap

The trap here is that candidates may confuse data preparation tools (like Glue DataBrew) with query optimization techniques, or mistakenly think that converting to a non-columnar format like JSON improves schema evolution, when in fact columnar formats with compression and partitioning are the standard best practices for Athena performance and cost efficiency.

Full explanation →
1630
MCQhard

A company is designing a data pipeline using Amazon Kinesis Data Streams. The data includes personally identifiable information (PII). The security team requires that data be encrypted at rest using a customer-managed KMS key. How should the data engineer configure the Kinesis stream?

A.Configure the Kinesis stream to use AWS CloudHSM for encryption.
B.Enable server-side encryption on the Kinesis stream and specify the customer-managed KMS key.
C.Store the encrypted data in S3 and use Kinesis to stream the S3 object keys.
D.Use client-side encryption in the producer application to encrypt data before sending to Kinesis.
AnswerB

Kinesis supports server-side encryption with KMS.

Why this answer

Kinesis Data Streams supports server-side encryption (SSE) using AWS KMS. By enabling SSE and specifying a customer-managed KMS key, the data is encrypted at rest. Option A is incorrect because CloudHSM is not used for Kinesis encryption.

Option C is incorrect because storing encrypted data in S3 and streaming keys is not a direct encryption method for the Kinesis stream. Option D is incorrect because client-side encryption is an alternative, but the question specifically requires encryption at rest using a customer-managed KMS key, which is achieved via server-side encryption on the stream itself.

Full explanation →
1631
MCQmedium

A company is streaming clickstream data from a website into Amazon Kinesis Data Streams. The data is then consumed by a Lambda function that transforms the records and writes them to an S3 bucket in Parquet format. Recently, the Lambda function has been timing out and the S3 bucket is not receiving all expected records. The Kinesis stream has a shard count of 10 and the Lambda function's reserved concurrency is set to the default. Which change would MOST likely resolve the issue?

A.Decrease the batch window from the default 300 seconds to 60 seconds.
B.Configure the Kinesis stream to directly write to S3 using a delivery stream.
C.Increase the Lambda function's reserved concurrency.
D.Increase the batch size from the default 100 to 500 records per invocation.
AnswerA

Correct: Decreasing the batch window reduces the number of records per invocation, which helps the Lambda function complete within its timeout.

Why this answer

The Lambda function is timing out because it cannot process the default batch of 100 records within the function timeout. Decreasing the batch window from 300 seconds to 60 seconds causes Lambda to invoke more frequently with smaller batches, reducing the number of records per invocation. This lowers the processing time per invocation, helping the function complete before the timeout.

Increasing the batch size (Option D) would worsen the issue by adding more records per invocation. Increasing reserved concurrency (Option C) does not reduce per-invocation processing time. Using a delivery stream (Option B) changes the architecture unnecessarily and may not preserve the transformation logic.

Exam trap

Candidates often think that increasing batch size or concurrency will improve throughput, but when functions are timing out, reducing the batch size (or batch window) is the correct fix. Increasing concurrency does not help per-invocation timeouts.

How to eliminate wrong answers

Option A is wrong because decreasing the batch window from 300 seconds to 60 seconds would cause more frequent invocations, increasing the likelihood of timeouts and not addressing the root cause. Option B is wrong because configuring a Kinesis Delivery Stream to write directly to S3 bypasses the Lambda transformation, which is required for converting records to Parquet format. Option C is wrong because increasing reserved concurrency would allow more concurrent invocations but does not reduce the processing load per invocation, so timeouts would persist.

Full explanation →
1632
MCQhard

A data engineer is running an AWS Glue ETL job that converts CSV files to Parquet. The job fails with the error shown in the exhibit. The input files are about 500 MB each. The job uses 5 workers of type G.1X (16 GB memory each). What is the MOST likely cause?

A.The output Parquet file size is too large for the executor memory
B.The data is highly skewed causing a single partition to receive too much data
C.The Spark driver does not have enough memory to handle the schema inference
D.The input CSV files are corrupt or have inconsistent schema
AnswerA

Writing a large file requires memory proportional to file size; splitting into smaller files can help.

Why this answer

The error indicates an out-of-memory (OOM) error during the write phase. When converting large CSV files to Parquet, Spark must buffer the output data in memory before writing. With 500 MB input files and 5 workers of G.1X (16 GB each), the executor memory is limited.

If the output Parquet file or partition is too large, it may exceed the executor's memory, causing OOM. Option B (data skew) could also cause OOM, but typically during shuffle, not write. Options C and D are unrelated to write OOM issues.

Full explanation →
1633
MCQmedium

A company uses Amazon Redshift for data warehousing. The data team notices that queries are slow due to high disk usage on the cluster. They need to free up space without deleting any data. What should they do?

A.Change the table's sort keys
B.Run a deep copy to re-sort and reclaim space
C.Run VACUUM command
D.Add more nodes to the cluster
AnswerB

Deep copy reorganizes data and reclaims disk space effectively.

Why this answer

A deep copy recreates the table with optimal sort order and reclaims unused space by reorganizing data blocks. This process effectively frees up disk space without deleting any data, addressing the high disk usage issue.

Exam trap

The trap here is that candidates often confuse the VACUUM command with a deep copy, assuming VACUUM reclaims all unused space, but VACUUM only handles space from deleted rows and does not fully reorganize unsorted data to reduce high disk usage.

How to eliminate wrong answers

Option A is wrong because changing sort keys does not reclaim disk space; it only improves query performance by optimizing data ordering. Option C is wrong because the VACUUM command reclaims space from deleted or updated rows but does not reorganize data to the extent needed when disk usage is high due to unsorted data or storage inefficiencies. Option D is wrong because adding more nodes increases cluster capacity but does not free up existing disk space; it is a scaling solution, not a space reclamation technique.

Full explanation →
1634
MCQmedium

A company is using AWS Lake Formation to manage access to a data lake in S3. They want to grant a data analyst access to specific columns in a table, but not to the entire table. Which Lake Formation feature should be used?

A.Row-level security (cell-level filtering)
B.IAM policies on the S3 bucket
C.Column-level filtering
D.Tag-based access control (TBAC)
AnswerC

Column-level filtering allows granting access to specific columns in a table.

Why this answer

Lake Formation column-level filtering allows granting access to specific columns in a table without granting access to the entire table. Option A (row-level security) controls access to rows, not columns. Option B (IAM policies on the S3 bucket) would grant access to the entire dataset or bucket, not specific columns.

Option D (tag-based access control) uses tags to manage permissions but does not provide column-level granularity.

Full explanation →
1635
MCQmedium

A data engineer is designing a data pipeline that ingests customer data from an on-premises database into Amazon S3. The data contains personally identifiable information (PII). The company policy requires that all PII be masked before it is stored in S3. The pipeline uses AWS DMS for migration and AWS Glue for transformation. The engineer needs to ensure that the masking is applied consistently and that no unmasked data is written to S3. The engineer has set up DMS to replicate data to an S3 bucket, and then a Glue job reads from S3, applies masking, and writes to another S3 bucket. However, there is a risk that unmasked data in the first S3 bucket could be accessed before the Glue job runs. What should the engineer do to mitigate this risk?

A.Configure DMS to apply masking transformations before writing to S3 using DMS's built-in transformation rules.
B.Block all access to the first S3 bucket except for the Glue job's IAM role.
C.Use Amazon Kinesis Data Firehose to stream data directly to Glue for real-time masking.
D.Set an S3 Lifecycle policy on the first bucket to delete objects after 1 hour.
AnswerD

An S3 Lifecycle policy with expiration deletes objects from the first bucket within a short time (e.g., 1 hour), minimizing the window during which unmasked data could be accessed. This directly mitigates the risk.

Why this answer

An S3 Lifecycle policy with expiration can automatically delete objects from the first bucket after a short time, reducing the window of exposure for unmasked data. Option A is incorrect because DMS does not have native masking capabilities; it can transform data types but not mask PII. Option B is incorrect because blocking all access except for the Glue role would still leave unmasked data accessible to the Glue job, and the risk of exposure exists if the Glue job fails or is delayed.

Option C is incorrect because Kinesis Data Firehose is not part of the existing pipeline and would require re-architecting.

Full explanation →
1636
Multi-Selecthard

A company is running a critical application that generates millions of small JSON files every hour in an S3 bucket. A data engineer needs to process these files in near real-time using AWS Glue. The engineer wants to minimize the latency between file arrival and Glue job start. Which TWO actions should the engineer take?

Select 2 answers
A.Increase the Glue job's batch window to 600 seconds.
B.Increase the number of DPUs for the Glue job to accelerate processing.
C.Pre-process the files to consolidate them into larger files before the Glue job runs.
D.Use Amazon S3 event notifications to trigger an AWS Lambda function that starts the Glue job upon file arrival.
AnswersC, D

Fewer larger files reduce Glue job overhead and improve throughput.

Why this answer

Consolidating millions of small JSON files into larger files reduces the overhead of S3 LIST operations and minimizes the number of partitions Glue must scan. This directly lowers the latency between file arrival and job start, as Glue jobs are more efficient when processing fewer, larger files rather than many small files. Option D is correct because S3 event notifications can trigger a Lambda function that immediately starts the Glue job upon file arrival, enabling near real-time processing without polling or scheduled delays.

Exam trap

The trap here is confusing job startup latency with job execution speed — candidates often choose DPU increases (Option B) thinking they reduce latency, but DPUs only affect processing speed after the job starts, not the time to initiate the job.

Full explanation →
1637
MCQhard

A data engineer needs to grant a data scientist access to query a Glue Data Catalog database but must prevent the data scientist from seeing the underlying S3 data locations. Which approach should be used?

A.Use a Glue resource policy to restrict access to the database
B.Grant the data scientist IAM permissions to access the Glue Data Catalog and the underlying S3 data
C.Create a VPC endpoint for Glue and S3 to restrict network access
D.Use AWS Lake Formation to grant SELECT permission on the database and tables without granting S3 access
AnswerD

Lake Formation can grant access to the Data Catalog and data without giving direct S3 access, and it can hide the S3 locations.

Why this answer

Lake Formation can be used to grant SELECT permission on the database and tables, and by using column-level and row-level filters, but to hide S3 locations, the data scientist should not have direct S3 access. Lake Formation does not require the user to see the S3 path. Granting IAM read-only access to S3 would expose locations.

Using a VPC endpoint does not hide locations. Glue resource policies cannot hide S3 locations.

Full explanation →
1638
MCQeasy

A company receives streaming clickstream data from its website. The data must be ingested with low latency and transformed in real time before being stored in Amazon S3. Which AWS service combination is most suitable for this use case?

A.Amazon S3 with S3 Object Lambda
B.Amazon Kinesis Data Streams with Amazon Kinesis Data Analytics
C.Amazon Kinesis Data Firehose with AWS Lambda for transformation
D.AWS Glue jobs triggered by Amazon S3 events
AnswerB

Kinesis Data Streams provides low-latency ingestion and Kinesis Data Analytics enables real-time transformations.

Why this answer

Amazon Kinesis Data Streams ingests streaming clickstream data with low latency, and Amazon Kinesis Data Analytics performs real-time transformations using SQL or Apache Flink. The processed data can then be stored in Amazon S3 via a Kinesis Data Firehose delivery stream, meeting the requirement for low-latency ingestion and real-time transformation.

Exam trap

The trap here is that candidates confuse Kinesis Data Firehose (which is near-real-time with a 60-second minimum buffer) with true low-latency streaming, leading them to select Option C despite the explicit 'low latency' requirement in the question.

How to eliminate wrong answers

Option A is wrong because Amazon S3 with S3 Object Lambda applies transformations only when objects are retrieved, not during ingestion, and cannot handle real-time streaming data with low latency. Option C is wrong because Amazon Kinesis Data Firehose is a near-real-time service with a minimum buffer interval of 60 seconds, which does not meet the low-latency requirement for streaming ingestion. Option D is wrong because AWS Glue jobs triggered by Amazon S3 events are batch-oriented and incur significant startup latency (often minutes), making them unsuitable for real-time transformation of streaming data.

Full explanation →
1639
MCQeasy

A company uses AWS Glue to run ETL jobs daily. The data is stored in S3 as Parquet files partitioned by date. Recently, jobs have failed with the error 'No such file or directory' for certain partitions. What is the MOST likely cause?

A.The schema has changed and Glue cannot parse the data.
B.A partition folder was deleted or not created by the upstream process.
C.The files are compressed with an unsupported codec.
D.The IAM role does not have s3:GetObject permission.
AnswerB

Missing partition leads to 'No such file or directory'.

Why this answer

The error 'No such file or directory' indicates that the Glue ETL job is attempting to read a specific S3 partition path that does not exist. Since the data is partitioned by date and the job runs daily, the most likely cause is that the upstream process failed to create or accidentally deleted the partition folder for that date. Glue's dynamic frame or Spark DataFrame will throw this error when it tries to list or read files from a missing prefix.

Exam trap

The trap here is that candidates confuse file-level permission errors (Option D) with missing directory errors, but S3 returns distinct HTTP status codes (403 vs 404) that map to different error messages in Spark/Glue.

How to eliminate wrong answers

Option A is wrong because a schema change would typically cause a parsing or schema mismatch error (e.g., 'Schema mismatch' or 'Cannot convert type'), not a 'No such file or directory' error. Option C is wrong because unsupported compression codecs (e.g., LZO without proper libraries) would cause a 'Codec not found' or 'Compression error', not a missing file error. Option D is wrong because missing s3:GetObject permission would result in an 'Access Denied' (403) error, not a 'No such file or directory' error.

Full explanation →
1640
Multi-Selecteasy

A data engineer is setting up a data pipeline using AWS DMS to migrate data from an on-premises database to Amazon RDS for MySQL. The data must be encrypted in transit. Which TWO options can the engineer use? (Choose TWO.)

Select 2 answers
A.Use VPC peering between on-premises and AWS
B.Enable SSL encryption on the DMS endpoint
C.Set up a VPN connection between on-premises and AWS
D.Use KMS to encrypt the DMS connection
E.Use a VPC endpoint for DMS
AnswersB, C

SSL encrypts the connection.

Why this answer

DMS supports SSL/TLS for encrypting connections. Option A (VPC peering) is incorrect because VPC peering does not encrypt traffic. Option B (Enable SSL encryption on the DMS endpoint) is correct because SSL/TLS encrypts the data in transit.

Option C (Set up a VPN connection) is correct because VPN creates an encrypted tunnel. Option D (Use KMS) is incorrect because KMS is for encryption at rest, not in transit. Option E (VPC endpoint) is incorrect because VPC endpoints provide private connectivity but do not encrypt transit.

Full explanation →
1641
Multi-Selectmedium

A data engineer is designing a data ingestion pipeline for real-time clickstream data from a website. The data must be ingested with low latency (seconds) and made available for multiple consumer applications, including a dashboard that refreshes every minute and a machine learning model that processes data in near-real-time. The engineer needs to choose a streaming ingestion service. Which TWO services meet these requirements? (Select TWO.)

Select 2 answers
A.Amazon Kinesis Data Firehose
B.Amazon Managed Streaming for Apache Kafka (Amazon MSK)
C.Amazon Kinesis Data Streams
D.Amazon Simple Queue Service (SQS)
E.Amazon S3
AnswersB, C

MSK is a fully managed Kafka service that provides low-latency streaming and supports multiple consumer groups.

Why this answer

Amazon Kinesis Data Streams (C) provides sub-second ingestion latency and supports multiple consumer applications via its enhanced fan-out feature, enabling a dashboard and ML model to consume data concurrently with low latency. Amazon MSK (B) offers similar real-time capabilities with Apache Kafka's native pub/sub model, allowing multiple consumers to process the same stream independently and with low latency, meeting the near-real-time requirements.

Exam trap

The trap here is that candidates often confuse Amazon Kinesis Data Firehose with Kinesis Data Streams, assuming Firehose provides real-time ingestion, but Firehose buffers data for at least 60 seconds before delivery, making it unsuitable for sub-second latency requirements.

Full explanation →
1642
MCQhard

A data engineer is designing a streaming pipeline that ingests data from an Amazon Kinesis Data Stream (with 5 shards) into Amazon S3. The data must be transformed using a complex stateful operation that cannot be done in a Lambda function (limited to 15 minutes). The engineer needs a solution that can maintain state across multiple records. Which service should be used?

A.Amazon EMR running Spark Structured Streaming
B.Amazon Kinesis Data Firehose with Lambda transformation
C.AWS Glue streaming ETL job
D.Amazon Kinesis Data Analytics for Apache Flink
AnswerD

Flink supports stateful stream processing, exactly what is needed.

Why this answer

Amazon Kinesis Data Analytics for Apache Flink is the correct choice because it supports stateful stream processing with exactly-once semantics, can maintain state across multiple records, and has no 15-minute execution limit like AWS Lambda. It natively integrates with Kinesis Data Streams and can sink transformed data to S3, meeting all requirements for complex stateful operations.

Exam trap

The trap here is that candidates often confuse AWS Glue streaming ETL (which is Spark-based and better for batch-oriented transformations) with a true stateful streaming engine, or they assume Kinesis Data Firehose can handle stateful logic via Lambda, not realizing Lambda's stateless nature and timeout limit.

How to eliminate wrong answers

Option A is wrong because Amazon EMR running Spark Structured Streaming, while capable of stateful processing, is overkill for a single streaming pipeline and requires managing a cluster, which adds operational overhead not needed when simpler managed services exist. Option B is wrong because Amazon Kinesis Data Firehose with Lambda transformation cannot handle stateful operations—Lambda has a 15-minute timeout and is stateless by design, making it unsuitable for maintaining state across multiple records. Option C is wrong because AWS Glue streaming ETL jobs are based on Spark and are designed for batch-oriented transformations, not for complex stateful operations that require persistent state across records in a low-latency streaming context.

Full explanation →
1643
MCQhard

A financial services company ingests real-time stock trade data from multiple exchanges into Amazon Kinesis Data Streams. Each trade record is a JSON object with fields: trade_id, symbol, price, quantity, timestamp. The stream has 5 shards. The data is consumed by an AWS Lambda function that aggregates trades per symbol every minute and writes the results to an Amazon DynamoDB table for a real-time dashboard. Recently, the dashboard has been showing outdated data, and the Lambda function is experiencing high error rates. The CloudWatch logs show 'ProvisionedThroughputExceededException' errors from DynamoDB. The DynamoDB table has 10 read capacity units (RCU) and 10 write capacity units (WCU). The average trade volume is 5,000 trades per second across all symbols, and there are 100 symbols. The Lambda function is configured with a batch size of 100 and a 1-minute window. The data volume is expected to double in the next month. As a data engineer, what is the most appropriate course of action?

A.Switch the storage from DynamoDB to Amazon S3 and use Amazon Athena for the dashboard
B.Increase the number of Kinesis shards to 10 to increase Lambda concurrency
C.Increase the DynamoDB write capacity units to 100 and enable auto scaling
D.Use Amazon Kinesis Data Firehose to deliver data to S3 and use Amazon QuickSight for the dashboard
AnswerC

Correct. The DynamoDB table is throttling writes; increasing WCU to 100 and enabling auto scaling resolves the current issue and accommodates future growth.

Why this answer

The DynamoDB table is throttling due to insufficient write capacity. With 5,000 trades/s and updating per symbol per minute, the write rate is about 100 writes per minute (one per symbol), but the aggregation may cause bursts. However, the 'ProvisionedThroughputExceededException' indicates WCU is too low.

Increasing WCU to 100 resolves the immediate issue; auto scaling handles future growth. Option A (switch to S3 and Athena) changes the architecture and loses real-time capabilities. Option B (increase shards) addresses Lambda concurrency but not DynamoDB throttling.

Option D (use Firehose and QuickSight) is for delivery to S3, not real-time dashboard.

Full explanation →
1644
Multi-Selecteasy

A data engineer is migrating a legacy data warehouse to Amazon Redshift. The engineer needs to load data from multiple sources efficiently. Which THREE services can be used to load data into Redshift? (Choose THREE.)

Select 3 answers
A.Use the COPY command to load from Amazon DynamoDB.
B.Use Kinesis Data Firehose to deliver data directly to Redshift.
C.Use AWS DMS to replicate data continuously.
D.Use S3 Transfer Acceleration.
E.Use the COPY command to load from Amazon S3.
AnswersA, C, E

Correct: The COPY command can load data directly from DynamoDB into Redshift.

Why this answer

The COPY command can load data from Amazon DynamoDB (A) and Amazon S3 (E) directly into Amazon Redshift. AWS DMS (C) can continuously replicate data from multiple sources into Redshift, making it a valid service for loading data. Option B (Kinesis Data Firehose) does not deliver data directly to Redshift; it writes to S3 first, then Redshift uses COPY.

Option D (S3 Transfer Acceleration) accelerates uploads to S3, not loading into Redshift.

Exam trap

Candidates often think Kinesis Data Firehose delivers directly to Redshift, but it actually writes to S3 first. AWS DMS is a valid service for loading data, not just for migration.

Full explanation →
1645
MCQeasy

A company wants to enforce that all data in an S3 bucket is encrypted at rest using AWS KMS. Which bucket policy condition key should be used?

A.s3:x-amz-acl with value bucket-owner-full-control
B.s3:x-amz-server-side-encryption with value aws:kms
C.s3:x-amz-server-side-encryption with value AES256
D.aws:SourceIp with value 10.0.0.0/8
AnswerB

Enforces SSE-KMS.

Why this answer

The condition key `s3:x-amz-server-side-encryption` with value `aws:kms` enforces that objects uploaded to the S3 bucket must be encrypted using AWS KMS (SSE-KMS). This bucket policy condition ensures that any PUT request includes the `x-amz-server-side-encryption` header set to `aws:kms`, thereby enforcing encryption at rest with KMS-managed keys.

Exam trap

The trap here is that candidates confuse `aws:kms` with `AES256` (SSE-S3), thinking both enforce KMS encryption, but only `aws:kms` enforces AWS KMS, while `AES256` enforces S3-managed keys.

How to eliminate wrong answers

Option A is wrong because `s3:x-amz-acl` with value `bucket-owner-full-control` enforces access control list ownership, not encryption. Option C is wrong because `s3:x-amz-server-side-encryption` with value `AES256` enforces SSE-S3 (Amazon S3-managed keys), not AWS KMS. Option D is wrong because `aws:SourceIp` restricts requests based on IP address, which is unrelated to encryption enforcement.

Full explanation →
1646
MCQhard

A company ingests streaming data from social media APIs into Kinesis Data Streams. Each record is approximately 5 KB. The data must be enriched with geolocation information from a DynamoDB table before being stored in S3. The enrichment process takes about 200 ms per record. Which architecture minimizes latency and cost?

A.Use an EC2 instance running a custom application to consume from Kinesis, enrich, and write to S3
B.Use AWS Glue ETL jobs running continuously on the stream
C.Use Kinesis Data Analytics to perform enrichment with SQL
D.Use Kinesis Data Firehose with a Lambda function that queries DynamoDB
AnswerD

Firehose with Lambda can perform enrichment per record.

Why this answer

Kinesis Data Firehose can invoke a Lambda function for per-record enrichment, providing automatic scaling and low operational overhead. Option A is wrong because an EC2 instance adds significant operational overhead and requires manual scaling, increasing complexity and cost. Option B is wrong because AWS Glue ETL jobs are optimized for batch processing, not continuous streaming with low latency per record.

Option C is wrong because Kinesis Data Analytics (SQL) is designed for real-time analytics on streaming data, not for per-record enrichment involving external lookups like DynamoDB.

Full explanation →
1647
MCQmedium

A data engineer is troubleshooting a Kinesis Data Analytics application that processes streaming data. The application is falling behind and has a high 'MillisBehindLatest' metric. The application uses a parallelism of 2. The source stream has 4 shards. What is the MOST likely cause and solution?

A.The application is using a JSON format; switch to Avro.
B.The source stream has too many shards; decrease to 2.
C.The application parallelism is too low; increase it to 4.
D.The output destination is slow; change to a faster sink.
AnswerC

With 4 shards, parallelism should be at least 4 to process all shards concurrently.

Why this answer

The 'MillisBehindLatest' metric indicates the application is not keeping up with the incoming data. With a source stream of 4 shards and a parallelism of only 2, the application cannot process data from all shards concurrently, leading to backpressure. Increasing parallelism to match the shard count (4) allows each shard to be processed by a separate task, reducing lag.

Exam trap

The trap here is that candidates may assume increasing parallelism always improves performance, but the key insight is that parallelism must match or exceed the number of source shards to avoid a concurrency bottleneck, not just be arbitrarily high.

How to eliminate wrong answers

Option A is wrong because changing the serialization format from JSON to Avro reduces data size but does not address the fundamental throughput mismatch between shard count and parallelism; the bottleneck is concurrency, not serialization efficiency. Option B is wrong because reducing the number of shards would decrease the source stream's throughput capacity, potentially causing data loss or throttling; the correct approach is to scale application parallelism to match the existing shards. Option D is wrong because a slow output sink would cause backpressure that manifests as increased 'MillisBehindLatest', but the question states the application is falling behind, and the most direct cause given the parallelism of 2 versus 4 shards is insufficient processing concurrency, not sink performance.

Full explanation →
1648
Multi-Selectmedium

A data engineer needs to protect sensitive data in an S3 bucket. Which TWO AWS services can be used to detect and prevent accidental public access?

Select 2 answers
A.AWS Config
B.AWS Trusted Advisor
C.AWS CloudTrail
D.S3 Block Public Access
E.Amazon Macie
AnswersB, D

AWS Trusted Advisor checks for S3 buckets with public access, helping to detect accidental public access.

Why this answer

AWS Trusted Advisor checks for S3 buckets with public access, helping to detect accidental public access. S3 Block Public Access can be enabled at the account or bucket level to prevent public access. AWS Config can evaluate rules but does not directly detect or prevent public access.

AWS CloudTrail records API calls but does not prevent public access. Amazon Macie discovers sensitive data, not public access.

Full explanation →
1649
MCQmedium

A company is using Amazon RDS for MySQL with Multi-AZ deployment. The database experiences intermittent slowdowns during peak hours. The company's DevOps team suspects that the primary instance is overwhelmed. Which action should the team take to distribute the read load without changing the application code?

A.Increase the instance size of the RDS instance.
B.Create a read replica and modify the connection string to point to the replica for read queries.
C.Enable Multi-AZ on the existing instance.
D.Configure DynamoDB Accelerator (DAX) in front of the RDS instance.
AnswerB

Read replicas offload read traffic from the primary instance.

Why this answer

Creating a read replica and modifying the connection string to point to the replica for read queries (Option B) offloads read traffic from the primary RDS instance without requiring application code changes. This directly addresses the intermittent slowdowns during peak hours by distributing the read load, leveraging MySQL’s native replication to keep the replica synchronized. The key constraint is 'without changing the application code,' which is satisfied by simply updating the connection string in the application configuration.

Exam trap

The trap here is that candidates confuse Multi-AZ with read replicas, assuming Multi-AZ can distribute read traffic, but in RDS for MySQL, the standby in a Multi-AZ deployment is not accessible for reads—it only provides failover support.

How to eliminate wrong answers

Option A is wrong because increasing the instance size scales vertically, which does not distribute the read load; it only provides more resources to a single instance, which may still be overwhelmed during peak hours and does not leverage Multi-AZ or read replicas. Option C is wrong because Multi-AZ is already enabled (as stated in the question) and its purpose is high availability and failover, not read load distribution; the standby instance in Multi-AZ cannot serve read traffic. Option D is wrong because DynamoDB Accelerator (DAX) is an in-memory cache for Amazon DynamoDB, not for Amazon RDS for MySQL; it cannot be placed in front of an RDS instance and would require significant application code changes to integrate.

Full explanation →
1650
Matchingmedium

Match each AWS monitoring tool to its primary use.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Metrics, logs, and alarms

API call history and auditing

Trace and analyze distributed applications

Event-driven automation

Resource configuration tracking

Why these pairings

CloudWatch monitors metrics and logs, CloudTrail audits API calls, X-Ray traces requests, and Trusted Advisor provides optimization recommendations. Common confusions include swapping the roles of CloudWatch and CloudTrail.

Full explanation →
Page 21

Page 22 of 23

Page 23

All pages

1234567891011121314151617181920212223

Practice DEA-C01 by domain

Target a specific domain to shore up weak areas.

Data Ingestion and TransformationData Operations and SupportData Security and GovernanceData Store Management
See all domains with question counts →