Courseiva

AWS Certified Data Engineer Associate DEA-C01 (DEA-C01) — Questions 1651–1711

1711 questions total · 23pages · All types, answers revealed

Take a mock examExam hub
Page 22

Page 23 of 23

1651
Multi-Selectmedium

A data engineer is evaluating storage options for a new application that requires low-latency access to unstructured blobs (up to 5 TB each) with high throughput. The data will be accessed frequently for the first 30 days and then rarely. Which TWO storage solutions meet these requirements? (Choose TWO)

Select 2 answers
A.Amazon S3 with lifecycle policies
B.Amazon EBS with io2 Block Express volumes
C.Amazon EFS
D.Amazon RDS for PostgreSQL
E.Amazon FSx for Lustre
AnswersA, E

S3 can handle large objects and lifecycle policies automate transitions to cost-optimized storage.

Why this answer

Amazon S3 with lifecycle policies is correct because S3 provides low-latency access to unstructured blobs (up to 5 TB each) with high throughput, and lifecycle policies can automatically transition objects to colder storage tiers (e.g., S3 Glacier Deep Archive) after 30 days, matching the access pattern of frequent then rare access.

Exam trap

The trap here is that candidates may confuse block storage (EBS) or file storage (EFS) with object storage (S3), or overlook that lifecycle policies are the key to handling the 'frequent then rare' access pattern, leading them to choose EBS or EFS for blob storage.

Full explanation →
1652
MCQeasy

A company uses Amazon S3 as a data lake. A data engineer needs to ensure that all objects uploaded to the 'incoming' prefix are automatically encrypted at rest using AWS KMS with a specific customer managed key. What is the simplest way to enforce this?

A.Enable S3 Transfer Acceleration to force encryption in transit.
B.Use a bucket policy that denies PutObject requests without the required encryption header.
C.Configure S3 Inventory to report on encryption status and alert on non-compliance.
D.Enable default encryption on the bucket with SSE-S3.
AnswerB

A bucket policy with a condition for s3:x-amz-server-side-encryption-aws-kms-key-id enforces the specific key.

Why this answer

A bucket policy with a condition that denies PutObject requests unless the request includes the required encryption headers (x-amz-server-side-encryption: aws:kms and x-amz-server-side-encryption-aws-kms-key-id with the specific customer managed key ARN) enforces encryption at rest using that key. Option A (S3 Transfer Acceleration) only optimizes transfer speed, not encryption at rest. Option C (S3 Inventory) reports on encryption status but does not enforce it.

Option D (default encryption with SSE-S3) uses S3-managed keys, not a customer managed KMS key, so it does not meet the requirement.

Full explanation →
1653
MCQmedium

A company uses AWS Lambda to process records from an Amazon Kinesis Data Stream. Each record is about 50 KB. The Lambda function transforms the data and writes to Amazon DynamoDB. Recently, the Lambda function has been experiencing throttling and high error rates. The Kinesis stream has 10 shards. What is the most cost-effective solution to improve processing throughput?

A.Increase the number of shards in the Kinesis stream.
B.Increase the Parallelization Factor for the Lambda event source mapping.
C.Increase the memory allocated to the Lambda function.
D.Increase the Batch Window (MaximumBatchingWindowInSeconds) for the event source mapping.
AnswerD

Reduces invocation frequency.

Why this answer

Increasing the Batch Window (MaximumBatchingWindowInSeconds) allows the Lambda function to accumulate more records from the Kinesis stream before invoking the function, reducing the number of invocations and thus lowering the chance of throttling. This is the most cost-effective solution as it does not require additional shards, memory, or parallelization, and directly addresses the high error rates caused by excessive concurrent executions.

Exam trap

The trap here is that candidates often assume increasing shards or parallelization is the only way to improve throughput, but the question specifically asks for the most cost-effective solution, and increasing the batch window reduces invocation count without incurring additional costs.

How to eliminate wrong answers

Option A is wrong because increasing the number of shards would increase the number of concurrent Lambda invocations, potentially worsening throttling and increasing costs, not improving throughput cost-effectively. Option B is wrong because increasing the Parallelization Factor (which controls concurrent batches per shard) would also increase concurrency, leading to more throttling and higher costs, and is not a cost-effective fix. Option C is wrong because increasing memory allocated to the Lambda function does not directly address throttling or error rates caused by invocation frequency; it may improve per-invocation performance but at a higher cost without solving the root cause.

Full explanation →
1654
MCQeasy

Refer to the exhibit. A data engineer is configuring a Kinesis Data Firehose delivery stream. The stream is expected to receive bursts of 10 MB of data every 2 minutes. What is the maximum time it will take for data to be delivered to S3 during a burst?

A.300 seconds
B.60 seconds
C.1 second
D.600 seconds
AnswerA

The buffer interval is 300 seconds; even with bursts, the maximum time is the interval.

Why this answer

The Kinesis Data Firehose delivery stream is configured with a buffer interval of 300 seconds (5 minutes) and a buffer size of 5 MB. During a burst of 10 MB every 2 minutes, the buffer will fill to 5 MB in 1 minute, so the buffer will be flushed every minute due to reaching the size threshold. However, the question asks for the maximum time it will take for data to be delivered to S3 during a burst.

The maximum time is determined by the buffer interval, which is 300 seconds. Even though the size trigger may cause earlier flushes, the maximum possible time before delivery is the interval setting of 300 seconds. Therefore, the correct answer is 300 seconds (option A).

Full explanation →
1655
Drag & Dropmedium

Arrange the steps to implement data encryption at rest for an Amazon Redshift cluster using AWS KMS.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First, create the KMS key. Then launch a new encrypted cluster, specify the key, configure, and verify encryption.

Full explanation →
1656
MCQmedium

A company uses Amazon Redshift for data warehousing. The security team requires that all data loading into Redshift be encrypted in transit. Which configuration ensures this requirement is met?

A.Use a VPC security group to restrict access
B.Configure the Redshift cluster to require SSL connections
C.Use client-side encryption before loading data
D.Enable server-side encryption on the Redshift cluster
AnswerB

SSL encrypts data in transit between clients and Redshift.

Why this answer

Encryption in transit for Redshift is achieved by using SSL connections. Client-side encryption before loading does not encrypt the transmission. Server-side encryption is for at-rest.

VPC security groups control network access, not encryption.

Full explanation →
1657
MCQeasy

A data engineer is responsible for ingesting daily CSV files from an external partner into an Amazon S3 bucket. The partner uploads files to an AWS Transfer Family (SFTP) endpoint. Once a file is uploaded, an AWS Lambda function triggers an AWS Glue ETL job to transform the data and load it into an Amazon RDS database. Recently, some files have failed to trigger the Glue job because the Lambda function timed out while waiting for the Glue job to complete. The engineer needs to ensure that all files are processed reliably without manual intervention. What should the data engineer do?

A.Modify the Lambda function to send a message to an Amazon SQS queue after uploading, and create a separate Lambda function that reads from the queue and triggers the Glue job asynchronously.
B.Increase the Lambda function timeout to 15 minutes to accommodate longer Glue jobs.
C.Increase the Lambda function's reserved concurrency to allow multiple invocations.
D.Configure S3 event notifications to trigger the Glue job directly without Lambda.
AnswerA

Decoupling prevents timeout and ensures retries.

Why this answer

Decoupling the Lambda function from the Glue job by using SQS allows the Lambda function to submit the job and exit, while a second Lambda function monitors completion. Option B is wrong because increasing Lambda timeout still ties it to job duration. Option C is wrong because the issue is not concurrency.

Option D is wrong because increasing S3 events does not address the timeout.

Full explanation →
1658
MCQeasy

A data engineer needs to ingest data from an Amazon S3 bucket into Amazon Redshift for analytics. The data is in CSV format and the Redshift table already exists. Which service can be used to perform this ingestion with minimal configuration?

A.AWS Glue
B.Amazon Kinesis Data Firehose
C.Amazon Redshift COPY command
D.AWS Database Migration Service (DMS)
AnswerC

The COPY command loads data from S3 into Redshift efficiently.

Why this answer

The Amazon Redshift COPY command is the most direct and minimal-configuration method to load data from an S3 bucket into an existing Redshift table. It is purpose-built for bulk data ingestion from S3, supports CSV format natively, and requires only the table name, S3 path, IAM role, and format options — no additional services or pipelines needed.

Exam trap

The trap here is that candidates often overthink and choose AWS Glue or Kinesis Firehose because they assume a managed service is always required, but the COPY command is the simplest and most efficient native tool for batch loading from S3 into an existing Redshift table.

How to eliminate wrong answers

Option A is wrong because AWS Glue is an ETL service that requires creating crawlers, jobs, and triggers, which adds unnecessary complexity for a simple S3-to-Redshift load; it is overkill when the COPY command suffices. Option B is wrong because Amazon Kinesis Data Firehose is designed for streaming data ingestion into Redshift, not for batch loading from static CSV files in S3, and it requires configuring a delivery stream, buffering, and transformation. Option D is wrong because AWS DMS is used for continuous database migration and replication between databases, not for one-time bulk loading of CSV files from S3 into an existing Redshift table.

Full explanation →
1659
MCQhard

A company runs a data pipeline that uses Amazon EMR to process large datasets. The pipeline reads data from S3, processes it using Spark, and writes results back to S3. Recently, the pipeline has been failing with 'OutOfMemoryError' in the Spark executors. The EMR cluster is configured with 5 core nodes of type m5.xlarge (4 vCPU, 16 GB memory each). The Spark application uses dynamic allocation and default Spark configurations. The input data size is approximately 500 GB in Parquet format. What is the most cost-effective way to resolve the out-of-memory errors?

A.Increase the spark.executor.memory setting to 8 GB in the Spark configuration.
B.Change the core node instance type to r5.xlarge (32 GB memory) and keep 5 nodes.
C.Increase the number of core nodes to 10 to distribute the data across more executors.
D.Change the input data format from Parquet to ORC to reduce memory footprint.
AnswerB

Memory-optimized instances provide more memory per node, reducing OOM without increasing node count.

Why this answer

The current cluster has limited memory per node (16 GB). By switching to memory-optimized instances like r5.xlarge (32 GB), each node has double the memory, reducing the chance of OOM. This is more cost-effective than adding more nodes because the total memory per node increases without increasing the number of instances.

Option A is wrong because increasing the number of nodes adds more memory but also more cost; it might be more expensive than using fewer, larger nodes. Option C is wrong because it's generally not recommended to increase spark.executor.memory beyond the physical memory; it could cause YARN to kill containers. Option D is wrong because Parquet is already efficient; changing to a different format may not solve memory issues.

Full explanation →
1660
MCQmedium

A company has an S3 bucket with millions of objects. The data engineer needs to identify which objects are not accessed for 90 days to move them to a lower-cost storage class. Which feature should be used?

A.S3 Storage Class Analysis
B.S3 Inventory
C.S3 Server Access Logs
D.S3 Event Notifications
AnswerA

It analyzes access patterns and provides recommendations for lifecycle transitions.

Why this answer

S3 Storage Class Analysis (SCA) is the correct feature because it monitors access patterns across objects and provides recommendations for transitioning data to lower-cost storage classes based on last-access dates. SCA can analyze objects that have not been accessed for 90 days and generate a report to inform lifecycle policy creation, directly addressing the requirement to identify objects for cost optimization.

Exam trap

The trap here is that candidates often confuse S3 Inventory (which lists objects) with S3 Storage Class Analysis (which analyzes access patterns), assuming that a list of objects is sufficient to determine access frequency, but Inventory lacks the temporal access data needed for this task.

How to eliminate wrong answers

Option B (S3 Inventory) is wrong because it provides a flat list of all objects and their metadata (e.g., size, storage class) but does not track access patterns or last-accessed timestamps, so it cannot identify objects unused for 90 days. Option C (S3 Server Access Logs) is wrong because it records detailed request-level logs (e.g., requester, operation, timestamp) but requires custom parsing and aggregation to derive last-access dates, and it does not natively provide a summary of objects not accessed for a specific period. Option D (S3 Event Notifications) is wrong because it triggers real-time events for object operations (e.g., PUT, POST, DELETE) but does not store historical access data or analyze access patterns over time, making it unsuitable for identifying long-unused objects.

Full explanation →
1661
MCQhard

A data engineer is troubleshooting an issue where an Amazon Redshift query returns an error: 'ERROR: permission denied for relation table_name'. The user has been granted SELECT on the table. What is the most likely cause?

A.The user's session has timed out.
B.The user does not have CONNECT permission on the database.
C.The table is in a different schema than expected.
D.The user does not have USAGE permission on the schema.
AnswerD

Without USAGE on the schema, the user cannot access tables even with SELECT.

Why this answer

In Amazon Redshift, to access a table, a user must have USAGE permission on the schema containing the table, in addition to SELECT or other table-level permissions. Without USAGE on the schema, the user receives a 'permission denied for relation' error even if SELECT is granted. Option D is correct.

Option A (session timeout) would cause a different error or disconnection. Option B (no CONNECT permission) would prevent connecting to the database. Option C (wrong schema) would result in a 'schema not found' error, not a permission denied error.

Full explanation →
1662
MCQeasy

A data engineer needs to store time-series data from IoT devices. The data is write-heavy and requires low-latency queries by device ID and timestamp. The data volume is expected to grow to terabytes. Which AWS database service is most suitable?

A.Amazon RDS for MySQL
B.Amazon ElastiCache for Redis
C.Amazon DynamoDB
D.Amazon Timestream
AnswerD

Timestream is designed for time-series data.

Why this answer

Amazon Timestream is purpose-built for time-series data, offering automatic tiered storage (in-memory for recent data and magnetic for historical) to handle write-heavy IoT workloads at scale. It supports low-latency queries by device ID and timestamp via its SQL-compatible query engine, making it the most suitable choice for terabytes of time-series data.

Exam trap

The trap here is that candidates often choose DynamoDB (Option C) because of its high write throughput and low-latency queries, but they overlook the lack of native time-series optimizations, leading to complex manual partitioning and TTL management that Timestream handles automatically.

How to eliminate wrong answers

Option A is wrong because Amazon RDS for MySQL is a relational database optimized for OLTP workloads with structured queries, not for the high-volume, write-heavy, time-series pattern that requires automatic data retention policies and time-based partitioning. Option B is wrong because Amazon ElastiCache for Redis is an in-memory cache designed for sub-millisecond read/write performance on hot data, but it cannot cost-effectively store terabytes of data and lacks native time-series query optimizations like downsampling and interpolation. Option C is wrong because Amazon DynamoDB is a key-value and document database that can handle high write throughput, but it does not have built-in time-series functions (e.g., time-based aggregation, retention policies) and requires manual partitioning and TTL management to handle time-series data efficiently at terabyte scale.

Full explanation →
1663
MCQhard

A company has an Amazon RDS for MySQL database that is experiencing performance issues due to a large number of read requests. The application is read-heavy and can tolerate eventually consistent reads. Which action will reduce the load on the primary database with the least operational overhead?

A.Create a read replica in the same region
B.Use Amazon ElastiCache for caching
C.Enable Multi-AZ deployment
D.Increase the instance size of the primary DB
AnswerA

Offloads read traffic with minimal overhead.

Why this answer

Creating a read replica in the same region offloads read traffic from the primary RDS instance to a read-only copy, which directly addresses the read-heavy workload. Since the application can tolerate eventually consistent reads, the slight replication lag is acceptable, and this solution requires minimal operational overhead—just a few clicks in the AWS console or a single API call—without any application code changes.

Exam trap

The trap here is that candidates often confuse Multi-AZ (which only provides failover, not read scaling) with read replicas, or assume that ElastiCache is always the best caching solution without considering the operational overhead of code changes and cache management.

How to eliminate wrong answers

Option B is wrong because using Amazon ElastiCache introduces additional infrastructure to manage (e.g., cache invalidation, cluster configuration) and requires application code changes to implement caching logic, increasing operational overhead compared to a simple read replica. Option C is wrong because enabling Multi-AZ deployment provides high availability and automatic failover but does not offload read traffic; the standby instance is not used for reads, so it does not reduce load on the primary. Option D is wrong because increasing the instance size of the primary DB only scales vertically, which can be costly and still leaves all read traffic hitting a single instance, failing to distribute the load and not leveraging the read-heavy, eventually consistent tolerance.

Full explanation →
1664
Multi-Selectmedium

A data engineer needs to ensure that data in an Amazon S3 bucket is not publicly accessible. Which TWO measures should the engineer implement? (Choose TWO.)

Select 2 answers
A.Attach a bucket policy that denies access to 'Principal': '*' unless specific conditions are met.
B.Create a lifecycle policy to delete objects after 30 days.
C.Enable S3 Block Public Access settings on the bucket.
D.Enable S3 Versioning on the bucket.
E.Enable default encryption on the bucket.
AnswersA, C

A bucket policy can deny all public access.

Why this answer

To prevent public access to an S3 bucket, you can use bucket policies that explicitly deny access to anonymous principals (option A) or enable S3 Block Public Access settings (option C). Option B is incorrect because lifecycle policies manage object retention and deletion, not access control. Option D is incorrect because versioning protects against accidental deletion/overwrites but does not control access.

Option E is incorrect because default encryption secures data at rest but does not restrict public access.

Full explanation →
1665
MCQeasy

A data engineer is designing a data pipeline that ingests data from an on-premises database into Amazon S3 using AWS Database Migration Service (DMS). The data must be encrypted at rest in S3 using SSE-S3. The engineer also needs to track changes to the source database in real time. Which DMS configuration should the engineer use?

A.Use DMS with a snapshot of the source database.
B.Use DMS with ongoing replication (change data capture) enabled.
C.Use DMS with a full load task only.
D.Use DMS with a full load task and then stream to Amazon Kinesis.
AnswerB

CDC captures real-time changes.

Why this answer

DMS with ongoing replication (change data capture) enables real-time tracking of changes from the source database. Option A is incorrect because using a snapshot only captures data at a point in time, not real-time changes. Option C is incorrect because a full load task only loads existing data without capturing ongoing changes.

Option D is incorrect because streaming to Amazon Kinesis is unnecessary; DMS CDC can directly replicate changes to S3. Encryption at rest in S3 with SSE-S3 is automatically supported by DMS when writing to S3.

Full explanation →
1666
MCQmedium

A company is running an Amazon EMR cluster with Spark for data processing. The data engineer wants to automatically scale the core and task nodes based on the YARN memory and CPU utilization. Which scaling metric should the engineer use for the EMR managed scaling policy?

A.YARNMemoryAvailablePercentage
B.CPUUtilization
C.DiskIOPS
D.HDFSUtilization
AnswerA

EMR managed scaling uses YARN memory metrics.

Why this answer

EMR managed scaling uses YARNMemoryAvailablePercentage and YARNContainersPending as the default metrics for scaling. Option B is incorrect because CPUUtilization is not a default metric for EMR managed scaling. Option C is incorrect because HDFSUtilization is for HDFS, not YARN.

Option D is incorrect because IOPS is not a metric for EMR managed scaling.

Full explanation →
1667
MCQeasy

A data engineer needs to store semi-structured JSON data that is accessed infrequently but requires millisecond retrieval latency. The data is immutable once written. Which AWS service is most cost-effective?

A.Amazon DynamoDB with on-demand capacity
B.Amazon ElastiCache for Redis
C.Amazon RDS for PostgreSQL with JSONB
D.Amazon S3 (Standard-IA) with S3 Select
AnswerD

S3 Select can retrieve subsets of JSON data efficiently, and Standard-IA is cost-effective for infrequent access.

Why this answer

Amazon S3 Standard-IA with S3 Select is the most cost-effective choice because it provides infrequent access storage at low cost while S3 Select enables server-side filtering to retrieve only the required subset of JSON data, achieving millisecond latency for small queries on immutable data without the overhead of a full database.

Exam trap

The trap here is that candidates assume infrequent access requires a database like DynamoDB or RDS, but S3 Select with Standard-IA provides the same millisecond retrieval latency for small filtered queries at a fraction of the cost, especially for immutable data.

How to eliminate wrong answers

Option A is wrong because DynamoDB with on-demand capacity is designed for frequent, unpredictable workloads and incurs higher per-request costs, making it cost-ineffective for infrequently accessed data. Option B is wrong because ElastiCache for Redis is an in-memory cache optimized for sub-millisecond latency on hot data, but it is expensive for infrequent access and requires ongoing memory costs even when idle. Option C is wrong because Amazon RDS for PostgreSQL with JSONB provides ACID compliance and indexing for JSON, but it incurs continuous compute and storage costs for a database instance that is over-provisioned for infrequent access, making it less cost-effective than S3.

Full explanation →
1668
MCQhard

A company uses Amazon DynamoDB to store session data for a web application. The application experiences occasional spikes in traffic, causing throttling on the table. The data engineer needs to implement a solution that handles traffic spikes without manual intervention and minimizes cost. What should the data engineer do?

A.Switch to provisioned capacity with a high fixed read/write capacity.
B.Implement DynamoDB Accelerator (DAX) to cache read requests.
C.Purchase DynamoDB reserved capacity.
D.Enable DynamoDB Auto Scaling for the table.
AnswerD

Auto Scaling adjusts capacity automatically to handle spikes and minimize cost.

Why this answer

DynamoDB Auto Scaling (option D) automatically adjusts the provisioned read and write capacity based on actual traffic patterns, using CloudWatch alarms and the Application Auto Scaling service. This handles traffic spikes without manual intervention and minimizes cost by scaling down during low traffic periods, making it the ideal solution for variable workloads like session data.

Exam trap

The trap here is that candidates often confuse caching (DAX) as a solution for all throttling, but DAX only addresses read-side throttling and does not help with write throttling, which is critical for session data that is frequently updated.

How to eliminate wrong answers

Option A is wrong because switching to provisioned capacity with a high fixed read/write capacity would lead to over-provisioning during normal traffic, incurring unnecessary costs, and still risks throttling if the spike exceeds the fixed limit. Option B is wrong because DynamoDB Accelerator (DAX) is an in-memory cache that only reduces read latency and read throttling; it does not address write throttling, which is a common issue with session data updates. Option C is wrong because purchasing DynamoDB reserved capacity provides a discount on provisioned capacity but does not dynamically handle traffic spikes; it still requires manual capacity planning and does not prevent throttling during unexpected surges.

Full explanation →
1669
Multi-Selecteasy

A data engineer is monitoring an Amazon Kinesis Data Stream used to ingest clickstream data. The engineer notices that the stream's 'WriteProvisionedThroughputExceeded' metric is frequently above zero. Which TWO actions could help mitigate this issue? (Choose TWO.)

Select 2 answers
A.Increase the number of shards in the stream.
B.Reduce the data retention period to free up capacity.
C.Decrease the number of shards to reduce overhead.
D.Implement a random prefix for the partition key to distribute data evenly.
E.Enable enhanced fan-out on the stream.
AnswersA, D

More shards increase total write capacity.

Why this answer

Options A and D are correct. Increasing the number of shards in the stream increases the write capacity, reducing the 'WriteProvisionedThroughputExceeded' metric. Implementing a random prefix for the partition key helps distribute data writes evenly across all shards, preventing hot shards.

Option B is incorrect because reducing the data retention period does not affect write throughput; it only changes how long data is stored. Option C is incorrect because decreasing the number of shards would reduce write capacity, potentially worsening the issue. Option E is incorrect because enabling enhanced fan-out increases read capacity, not write capacity.

Full explanation →
1670
Multi-Selectmedium

A data engineer is troubleshooting a Glue ETL job that reads from an S3 bucket and writes to a Redshift table. The job fails with a 'MemoryError' when processing a large dataset. Which TWO actions should the engineer take to resolve this issue? (Choose TWO.)

Select 2 answers
A.Increase the number of DPUs and set 'spark.sql.shuffle.partitions' to a higher value.
B.Increase the number of DPUs and set 'coalesce(1)' in the script.
C.Decrease the number of DPUs and increase 'spark.shuffle.partitions'.
D.Set the 'RedshiftTempDir' parameter to a larger S3 bucket.
E.Set the 'groupFiles' option to 'inPartition' in the S3 source configuration.
AnswersA, E

More DPUs and shuffle partitions distribute data across more executors, reducing per-executor memory load.

Why this answer

Increasing the number of DPUs (Data Processing Units) provides more memory and compute resources to the Glue job, directly addressing the MemoryError. Setting 'spark.sql.shuffle.partitions' to a higher value reduces the amount of data shuffled per partition, preventing out-of-memory errors during wide transformations like joins or aggregations.

Exam trap

The trap here is that candidates confuse 'coalesce(1)' (which reduces parallelism) with a memory-saving technique, or mistakenly think decreasing DPUs or adjusting RedshiftTempDir can fix memory errors, when in fact memory errors require more resources and better partition management.

Full explanation →
1671
MCQeasy

A data engineer has an IAM policy attached to an IAM role used by an AWS Glue job. The Glue job needs to read from S3 bucket 'data-bucket' and write to the same bucket. The job fails with an access denied error when trying to write to S3. What is the issue?

A.The Glue job cannot assume the IAM role because of trust policy.
B.The policy does not include s3:ListBucket permission, which Glue may need.
C.The resource ARN for S3 is missing the bucket-level permission.
D.The actions for S3 are incorrect; s3:PutObject is not sufficient.
AnswerB

Glue may require ListBucket to navigate the bucket.

Why this answer

AWS Glue jobs require the `s3:ListBucket` permission on the bucket to perform operations like listing objects, even when reading and writing specific keys. Without this permission, the job fails with an access denied error when trying to write, as Glue internally uses `ListBucket` to verify bucket existence and access patterns. The policy attached to the IAM role likely includes `s3:GetObject` and `s3:PutObject` but omits the bucket-level `s3:ListBucket` action, which is necessary for the Glue job to interact with S3 successfully.

Exam trap

The trap here is that candidates often assume only object-level permissions (GetObject, PutObject) are needed for read/write operations, overlooking the bucket-level ListBucket permission that AWS Glue implicitly requires for its internal operations.

How to eliminate wrong answers

Option A is wrong because the trust policy controls which entities can assume the IAM role, not the permissions within S3; if the Glue job could assume the role (which it does, as it runs), the trust policy is not the issue. Option C is wrong because the resource ARN for S3 must include both bucket-level and object-level ARNs (e.g., `arn:aws:s3:::data-bucket` and `arn:aws:s3:::data-bucket/*`), but the question states the job fails when writing, implying the bucket-level permission (like `s3:ListBucket`) is missing, not that the ARN format is incorrect. Option D is wrong because `s3:PutObject` is sufficient for writing objects to S3 when combined with the necessary bucket-level permissions; the issue is not that `s3:PutObject` is insufficient, but that the required `s3:ListBucket` action is missing from the policy.

Full explanation →
1672
MCQeasy

A startup is ingesting event data from a mobile app into an Amazon Kinesis Data Streams stream with 2 shards. Each shard can ingest up to 1 MB/s or 1000 records/s. The app sends about 800 records per second with an average record size of 1.5 KB. The data engineer notices that the stream is throttling some records, resulting in data loss. The engineer needs to ensure that all records are ingested without changing the application code. What should the data engineer do?

A.Reduce the average record size to below 1 KB by compressing data on the client side.
B.Switch from Kinesis Data Streams to Kinesis Data Firehose for ingestion.
C.Increase the number of shards in the Kinesis stream to 3.
D.Enable enhanced fan-out on the stream to provide dedicated throughput to each consumer.
AnswerC

Adding shards increases total ingestion capacity.

Why this answer

The current throughput is 800 records/s * 1.5 KB = 1.2 MB/s, which exceeds the per-shard limit of 1 MB/s. Adding a third shard increases the total write capacity to 3 MB/s, accommodating the current traffic. Option A is incorrect because reducing record size would require modifying the application code.

Option B is incorrect because Kinesis Data Firehose is not designed for real-time ingestion and does not address the shard capacity issue. Option D is incorrect because enhanced fan-out improves consumer read throughput, not producer write throughput.

Full explanation →
1673
Multi-Selecthard

A company is migrating a legacy data warehouse to Amazon Redshift. They need to choose a distribution style to minimize data movement during joins. Which THREE factors should they consider?

Select 3 answers
A.The size of the table (number of rows).
B.The join frequency with other tables on specific columns.
C.The number of columns in the table.
D.Whether the table is a fact or dimension table.
E.The data type of the distribution key column.
AnswersA, B, D

Large tables need careful distribution to avoid skew.

Why this answer

The size of the table (number of rows) directly influences the distribution strategy. In Amazon Redshift, large tables benefit from a distribution style that evenly distributes rows across slices to avoid data skew, which can cause performance bottlenecks during joins. Choosing a distribution key that aligns with the join columns minimizes data movement, but the table size determines whether an ALL distribution (for small tables) or a KEY distribution (for large tables) is more appropriate to reduce shuffling.

Exam trap

The trap here is that candidates may overthink irrelevant table properties like column count or data types, while the core considerations for minimizing data movement are table size, join frequency, and table role (fact vs. dimension).

Full explanation →
1674
MCQhard

A company uses Amazon DynamoDB for a gaming application. The table has a partition key of 'user_id' and a sort key of 'game_timestamp'. The application frequently queries by 'user_id' and filters by 'game_timestamp' within a specific date range. The queries are slow. The table has a global secondary index (GSI) on 'game_timestamp'. What is the most likely cause of the slow queries?

A.The GSI has insufficient read capacity.
B.The GSI is used instead of the base table for queries on 'user_id'.
C.A hot partition exists due to uneven access pattern on 'user_id'.
D.The sort key is not used in the query.
AnswerC

If a few 'user_id' values are accessed frequently, they create hot partitions, slowing queries.

Why this answer

The slow queries are most likely caused by a hot partition on the base table. Even though the query uses 'user_id' as the partition key, if a small number of 'user_id' values receive a disproportionate amount of traffic, those specific partitions become overloaded, causing throttling and high latency. The GSI on 'game_timestamp' is not used for these queries because the filter is on the sort key of the base table, and DynamoDB can efficiently query by partition key and filter by sort key without needing a GSI.

Exam trap

The trap here is that candidates assume a GSI is always the solution for slow queries, but the real issue is partition-level throttling from uneven access patterns, which a GSI on a different attribute cannot fix.

How to eliminate wrong answers

Option A is wrong because the GSI is not being used for these queries; the queries are on the base table's partition key 'user_id', so the GSI's read capacity is irrelevant. Option B is wrong because the GSI is on 'game_timestamp', not on 'user_id', so DynamoDB would not use the GSI for a query that filters by 'user_id'; it would use the base table. Option D is wrong because the sort key 'game_timestamp' is indeed used in the query as a filter, and DynamoDB can efficiently perform range queries on the sort key within a partition; the issue is not the absence of sort key usage but uneven access load.

Full explanation →
1675
MCQmedium

A data engineer is building a data pipeline that ingests data from Amazon S3 into Amazon Redshift. The data is in CSV format and includes a timestamp column. The pipeline should load only new data incrementally. Which approach is most efficient?

A.Use the COPY command to load the entire bucket and rely on Redshift to deduplicate
B.Use the COPY command with a manifest file that lists only the new S3 objects
C.Use Amazon Redshift Spectrum to query the S3 data directly without loading
D.Use INSERT statements within a loop to load each new file
AnswerB

A manifest file allows incremental loading by specifying only new files.

Why this answer

Using the COPY command with a manifest file allows you to explicitly list only the new S3 objects to be loaded, enabling incremental loading without scanning or loading the entire bucket. This approach is efficient as it avoids the overhead of deduplication or full-bucket scans, and it leverages Redshift's native high-speed parallel ingestion from S3.

Exam trap

The trap here is that candidates may think Redshift Spectrum is a valid alternative for loading data, but Spectrum is designed for external querying, not for persistent loading into Redshift tables, which is the explicit requirement in the question.

How to eliminate wrong answers

Option A is wrong because loading the entire bucket and relying on Redshift to deduplicate is inefficient; Redshift does not have built-in deduplication logic for COPY commands, and loading all data repeatedly would waste storage and compute resources. Option C is wrong because Redshift Spectrum queries data directly in S3 without loading it into Redshift tables, which does not meet the requirement of loading data into Redshift for persistent storage and incremental processing. Option D is wrong because using INSERT statements within a loop to load each new file is far less efficient than the COPY command, as it lacks parallelization and high-throughput optimization, leading to poor performance for large datasets.

Full explanation →
1676
MCQeasy

A company uses Amazon Kinesis Data Streams to ingest clickstream data. The data is consumed by a custom consumer application that writes to Amazon S3 every 5 minutes. The consumer is falling behind and processing lag is increasing. Which action is MOST effective to reduce the lag?

A.Switch to Amazon Kinesis Data Firehose to deliver data directly to S3
B.Increase the batch size of records written to S3
C.Increase the number of shards in the Kinesis stream
D.Reduce the retention period of the stream
AnswerC

More shards increase parallelism and throughput, allowing the consumer to keep up.

Why this answer

The consumer is falling behind because the stream's throughput capacity is insufficient for the incoming data volume. Increasing the number of shards in the Kinesis stream directly increases the total read capacity (each shard provides 2 MB/s read throughput and 5 transactions/second), allowing the consumer to process more data in parallel and reduce lag.

Exam trap

The trap here is that candidates often confuse throughput scaling with batch size or delivery destination changes, but the only way to increase read throughput from a Kinesis stream is to increase the number of shards or use enhanced fan-out.

How to eliminate wrong answers

Option A is wrong because switching to Kinesis Data Firehose does not change the underlying stream's throughput; Firehose is a delivery service that still reads from the same shards, so it would not resolve the consumer's processing lag. Option B is wrong because increasing the batch size written to S3 only affects the write operation to S3, not the consumer's ability to read from the stream faster; the bottleneck is the consumer's read throughput, not the S3 write batch size. Option D is wrong because reducing the retention period (default 24 hours to 1 hour) does not increase read throughput; it only causes data to expire sooner, which could lead to data loss but does not help the consumer catch up.

Full explanation →
1677
MCQmedium

A data engineer is ingesting data from an Amazon RDS for PostgreSQL database into Amazon S3 using AWS Glue. The Glue job reads the entire table each time it runs, which takes several hours. The team wants to reduce the job duration by reading only new or updated records. Which approach should the engineer adopt?

A.Enable job bookmarks in AWS Glue and use a column with timestamps as the bookmark key to read only incremental data.
B.Partition the table in the source database by date and read only the latest partition.
C.Increase the number of Glue workers to improve parallel reads.
D.Use Amazon Kinesis Data Streams to capture changes from PostgreSQL.
AnswerA

Glue bookmarks track processed records; using a timestamp column allows incremental reads.

Why this answer

AWS Glue job bookmarks track previously processed data using a specified column (e.g., a timestamp column) as the bookmark key. When enabled, the job reads only new or updated records since the last run, significantly reducing job duration by avoiding full table scans. This directly addresses the requirement to read incremental data from the PostgreSQL source.

Exam trap

The trap here is that candidates may confuse increasing parallelism (Option C) with reducing data volume, or assume that source-side partitioning (Option B) automatically translates to incremental reads in Glue, when in fact Glue job bookmarks are the native mechanism for incremental processing in batch jobs.

How to eliminate wrong answers

Option B is wrong because partitioning the source PostgreSQL table by date does not inherently enable incremental reads in AWS Glue; Glue would still need to scan the entire table unless combined with a bookmark or filter, and partitioning alone does not reduce the data read by the Glue job. Option C is wrong because increasing the number of Glue workers improves parallelism but does not reduce the volume of data read; the job would still process the entire table, just faster, which does not address the core issue of reading only new/updated records. Option D is wrong because Amazon Kinesis Data Streams is designed for real-time streaming ingestion, not for batch incremental reads from a static PostgreSQL table; it would require additional infrastructure (e.g., AWS DMS or Debezium) to capture CDC events, which is overkill and not a direct solution for reducing batch job duration.

Full explanation →
1678
MCQeasy

A company uses Amazon Redshift for its data warehouse. The data engineering team loads data daily from Amazon S3 using COPY commands. Recently, the load performance has degraded because the S3 bucket contains many small files. The team needs to optimize the COPY operation to improve performance. Which approach should they take?

A.Use Redshift Spectrum to query the data directly from S3 without loading.
B.Increase the number of nodes in the Redshift cluster.
C.Use a manifest file that lists only the necessary files, and consolidate small files into larger ones before loading.
D.Enable automatic compression on the Redshift table.
AnswerC

Fewer large files improve COPY performance.

Why this answer

The performance degradation is caused by the overhead of processing many small files during the COPY command. Consolidating small files into larger ones (e.g., 100 MB–1 GB each) reduces the number of S3 GET requests and the metadata overhead on Redshift, directly improving load throughput. Using a manifest file further optimizes by explicitly listing only the required files, avoiding unnecessary S3 list operations.

Exam trap

The trap here is that candidates often confuse scaling the cluster (Option B) with optimizing data ingestion, failing to recognize that the bottleneck is the number of S3 objects, not the cluster's compute capacity.

How to eliminate wrong answers

Option A is wrong because Redshift Spectrum queries data in place from S3 without loading it into Redshift tables, which does not optimize the COPY operation for loading data into the warehouse. Option B is wrong because increasing the number of nodes adds compute and storage capacity but does not address the root cause of many small files; the COPY command still suffers from the same per-file overhead regardless of cluster size. Option D is wrong because automatic compression (via the COPY command with the COMPUPDATE option) optimizes column encoding for storage efficiency, not the file-level I/O performance during the load process.

Full explanation →
1679
MCQeasy

A company uses Amazon S3 to store raw data and AWS Lambda to process files as they arrive. The Lambda function sometimes times out when processing large files. The team wants to improve reliability and scalability. Which approach should the team take?

A.Replace Lambda with AWS Batch and use S3 event notifications to trigger the batch job.
B.Use Amazon S3 event notifications to send events to an Amazon SNS topic, which triggers Lambda.
C.Increase the Lambda function timeout to 15 minutes and memory to 3 GB.
D.Use Amazon S3 event notifications to send events to an Amazon SQS queue, and then have Lambda poll the queue in batches.
AnswerD

Decoupling with SQS allows Lambda to process at its own pace.

Why this answer

Using S3 event notifications to send events to an SQS queue decouples the file upload from processing. Lambda can then poll the queue in batches, processing multiple events per invocation. This improves reliability by allowing retries and scalability by handling spikes in file arrivals without timing out.

Option A is incorrect because AWS Batch is designed for long-running batch jobs, not event-driven processing triggered by S3 events. Option B is incorrect because SNS is push-based and can still overwhelm Lambda, leading to timeouts. Option C is incorrect because increasing Lambda timeout and memory only postpones the problem without addressing the root cause of scaling and reliability.

Full explanation →
1680
MCQeasy

A data engineer is troubleshooting a failed AWS Glue Crawler. The crawler logs show 'Insufficient permissions to access S3 bucket'. What should the engineer do to resolve this?

A.Grant the crawler's IAM user access to the bucket
B.Attach a VPC endpoint to the S3 bucket
C.Enable S3 default encryption on the bucket
D.Update the IAM role used by the crawler to include S3 read permissions
AnswerD

The role must have s3:GetObject and s3:ListBucket.

Why this answer

The AWS Glue Crawler uses an IAM role to access data sources. The error 'Insufficient permissions to access S3 bucket' indicates that the IAM role attached to the crawler lacks the necessary S3 read permissions (e.g., s3:GetObject, s3:ListBucket). Updating the IAM role's policy to include these permissions resolves the issue, as the crawler operates under that role, not under a specific IAM user.

Exam trap

The trap here is that candidates may confuse the crawler's execution context with an IAM user, leading them to choose Option A, but AWS Glue Crawlers always run under an IAM role, not a user.

How to eliminate wrong answers

Option A is wrong because AWS Glue Crawlers do not use an IAM user for execution; they use an IAM role. Granting access to an IAM user would not affect the crawler's permissions. Option B is wrong because a VPC endpoint enables private connectivity between a VPC and S3 but does not grant or modify IAM permissions; the error is about authorization, not network connectivity.

Option C is wrong because enabling S3 default encryption controls server-side encryption settings and does not affect IAM permission policies; the crawler still needs explicit read access regardless of encryption.

Full explanation →
1681
MCQmedium

A company runs a data pipeline using AWS Lambda to process records from an Amazon Kinesis Data Stream. Recently, the Lambda function has been experiencing high invocation errors and the stream is throttling. The function performs simple transformations and writes to Amazon S3. What is the most effective way to reduce throttling and errors?

A.Increase the Lambda function timeout.
B.Enable provisioned concurrency on the Lambda function.
C.Increase the number of shards in the Kinesis stream.
D.Increase the batch size in the Lambda event source mapping.
AnswerD

Larger batch sizes mean fewer invocations, reducing throttling and errors.

Why this answer

Increasing the batch size in the Lambda event source mapping allows each invocation to process more records from the Kinesis stream, reducing the number of total invocations. This lowers the rate at which Lambda polls the stream, which decreases the likelihood of hitting the Kinesis read throughput limits (5 transactions per second per shard) and reduces throttling errors. The simple transformations and S3 writes are likely I/O-bound, so larger batches improve throughput without increasing invocation concurrency.

Exam trap

The trap here is that candidates mistakenly believe throttling is caused by Lambda concurrency limits or cold starts, when in fact the root cause is the Kinesis stream's read throughput limit per shard, which is reduced by increasing the batch size in the event source mapping.

How to eliminate wrong answers

Option A is wrong because increasing the Lambda function timeout does not reduce the invocation rate or the number of concurrent executions; it only allows a single invocation to run longer, which does not address throttling caused by excessive polling or read throughput limits. Option B is wrong because provisioned concurrency pre-warms execution environments to reduce cold starts, but it does not reduce the number of invocations or the rate at which Lambda polls the Kinesis stream; it may even increase concurrency and exacerbate throttling. Option C is wrong because increasing the number of shards would increase the total read throughput capacity of the stream, but it does not reduce the per-shard invocation rate or the number of Lambda invocations; it could actually increase the total number of concurrent invocations, potentially worsening throttling if the batch size remains small.

Full explanation →
1682
MCQeasy

A company has a nightly batch job that processes 100 GB of data from an Amazon S3 bucket and loads it into an Amazon Redshift table. The job currently runs on an Amazon EMR cluster. Which service would reduce operational overhead while providing similar functionality?

A.AWS Database Migration Service
B.AWS Glue
C.Amazon Redshift Spectrum
D.Amazon Athena
AnswerB

Glue can run serverless ETL jobs on a schedule, reducing overhead.

Why this answer

AWS Glue is a serverless ETL service that can process 100 GB of data from S3 and load it into Redshift without managing any infrastructure. It provides built-in job scheduling, automatic retries, and a Spark-based engine that handles large-scale data transformations, directly replacing the EMR cluster's functionality while eliminating operational overhead.

Exam trap

The DEA-C01 exam often tests the distinction between query engines (Athena, Redshift Spectrum) and ETL services (Glue), where candidates mistakenly choose Athena or Spectrum because they can read from S3, but they lack the batch processing and data loading capabilities required for this use case.

How to eliminate wrong answers

Option A is wrong because AWS Database Migration Service (DMS) is designed for continuous database replication or one-time migrations between databases, not for batch processing and transforming large datasets from S3 into Redshift. Option C is wrong because Amazon Redshift Spectrum allows querying data directly in S3 without loading it into Redshift, but it does not perform ETL transformations or replace the batch job's processing logic. Option D is wrong because Amazon Athena is an interactive query service for ad-hoc analysis on S3 data, not a managed ETL service for scheduled batch processing and loading into Redshift.

Full explanation →
1683
MCQmedium

A data engineer is running an Amazon Athena query that scans a large amount of data in Amazon S3, resulting in high costs. The data is stored in Parquet format in a partitioned table. Which strategy would be MOST effective in reducing the amount of data scanned?

A.Ensure the query includes a WHERE clause that filters on partition columns.
B.Convert the Parquet files to CSV format and apply GZIP compression.
C.Use S3 Intelligent-Tiering storage class to reduce storage costs.
D.Increase the number of partitions by adding more partition columns.
AnswerA

Partition pruning reduces the amount of data scanned.

Why this answer

Partition pruning allows Athena to read only the partitions that match the WHERE clause, significantly reducing the amount of data scanned. Option A is correct because filtering on partition columns is the most effective way to minimize scanned data. Option B is incorrect because Parquet is a columnar format that already compresses well and reduces scan compared to CSV with GZIP.

Option C is incorrect because S3 Intelligent-Tiering optimizes storage costs, not query scan costs. Option D is incorrect because adding more partition columns does not reduce scan unless the query filters on them, and may increase metadata overhead.

Full explanation →
1684
MCQeasy

A data engineer is designing a data lake on Amazon S3 for storing raw sensor data. The data is append-only and accessed infrequently after 30 days. Compliance requires that data be retained for 7 years. Which S3 storage class is the MOST cost-effective for data older than 30 days?

A.S3 Standard-IA
B.S3 Glacier Deep Archive
C.S3 One Zone-IA
D.S3 Intelligent-Tiering
AnswerB

This is the lowest-cost storage class for long-term archival data with infrequent access.

Why this answer

B is correct because Amazon S3 Glacier Deep Archive is the most cost-effective storage class for data that is accessed infrequently and must be retained for long periods (7 years). For data older than 30 days, the retrieval time of 12 hours is acceptable given the append-only, infrequent access pattern, and the storage cost is significantly lower than other classes.

Exam trap

The trap here is that candidates often choose S3 Glacier Flexible Retrieval (not listed) or S3 Standard-IA, mistakenly thinking that faster retrieval is necessary for compliance data, when in fact the 12-hour retrieval time of Glacier Deep Archive is sufficient for infrequent access patterns and offers the lowest cost.

How to eliminate wrong answers

Option A is wrong because S3 Standard-IA is designed for infrequently accessed data but has higher storage costs than Glacier Deep Archive, making it less cost-effective for 7-year retention. Option C is wrong because S3 One Zone-IA does not provide the durability of 99.999999999% across multiple Availability Zones, which is critical for compliance-retained data, and its storage cost is higher than Glacier Deep Archive. Option D is wrong because S3 Intelligent-Tiering automatically moves data between tiers but incurs a monthly monitoring and automation fee per object, and it does not include a Deep Archive tier by default, so it would not achieve the lowest cost for data older than 30 days without manual configuration.

Full explanation →
1685
MCQeasy

A data engineer needs to ingest data from an on-premises Apache Kafka cluster into Amazon S3. The data engineer wants to minimize operational overhead and avoid managing any servers. Which AWS service should the data engineer use?

A.Amazon Managed Streaming for Apache Kafka (Amazon MSK)
B.AWS Glue
C.Amazon Kinesis Data Analytics
D.Amazon Kinesis Data Streams
AnswerA

Amazon MSK is a fully managed Apache Kafka service that can ingest data from on-premises Kafka via MirrorMaker, then sink to S3.

Why this answer

Amazon MSK is correct. It is a fully managed Apache Kafka service that can ingest data from on-premises Kafka via MirrorMaker or replication, then sink to S3, minimizing operational overhead. AWS Glue (B) is for ETL jobs, not real-time Kafka ingestion.

Kinesis Data Analytics (C) is for analyzing streaming data, not ingestion. Amazon Kinesis Data Streams (D) is a different service not directly compatible with Kafka without custom connectors.

Full explanation →
1686
MCQhard

A company is running a production Amazon Aurora PostgreSQL database. The database experiences high write latency during peak hours. The data engineer suspects that the issue is due to a large number of small transactions. Which action would MOST effectively reduce write latency?

A.Enable parallel query for the database
B.Increase the instance size and use Provisioned IOPS storage
C.Enable Aurora Auto Scaling for read replicas
D.Enable Performance Insights to identify the bottleneck
AnswerB

Larger instances provide more CPU and memory, and Provisioned IOPS can reduce I/O latency, helping with write performance under high transaction loads.

Why this answer

Increasing the instance size and using Provisioned IOPS storage directly addresses high write latency by providing more CPU and memory resources to handle transaction processing, while Provisioned IOPS ensures consistent, low-latency I/O for write operations. This is the most effective action because small transactions create high I/O demand, and scaling up the instance with dedicated IOPS reduces contention and write queue depth.

Exam trap

The trap here is that candidates often confuse scaling read replicas (which only help read scaling) with solving write latency, or they mistake monitoring tools (like Performance Insights) for performance fixes, when the real solution is to provision more write capacity through larger instances and dedicated IOPS.

How to eliminate wrong answers

Option A is wrong because parallel query is designed for read-heavy analytical queries, not for reducing write latency from small transactions; it does not improve write throughput or I/O performance. Option C is wrong because Aurora Auto Scaling for read replicas only scales read capacity, not write capacity; write latency is a primary node issue and read replicas do not offload write operations. Option D is wrong because Performance Insights is a monitoring and diagnostic tool that helps identify bottlenecks but does not directly reduce write latency; it provides visibility but no performance improvement.

Full explanation →
1687
Multi-Selecthard

A company must encrypt all data at rest in their Amazon RDS for MySQL instance. Which THREE steps are required to achieve this? (Select THREE.)

Select 3 answers
A.Enable SSL/TLS for database connections
B.Use an AWS KMS key to encrypt the instance
C.Enable encryption at rest when creating the DB instance
D.Modify the DB parameter group to require encryption
E.Ensure that automated backups and snapshots are encrypted
AnswersB, C, E

KMS key is used for encryption at rest.

Why this answer

To encrypt data at rest in Amazon RDS for MySQL, you must enable encryption when creating the DB instance (option C). This uses an AWS KMS key (option B) to manage the encryption. Encrypted instances require that automated backups and snapshots are also encrypted (option E).

Option A (SSL/TLS) encrypts data in transit, not at rest. Option D (modifying the DB parameter group) does not enable encryption at rest.

Full explanation →
1688
Multi-Selecthard

A company is running a Redshift cluster and wants to improve query performance for a frequently used dashboard. Which THREE approaches are recommended?

Select 3 answers
A.Enable concurrency scaling
B.Apply column compression encoding
C.Define sort keys on columns used in WHERE clauses
D.Add more nodes to the cluster
E.Choose an appropriate distribution key for large tables
AnswersB, C, E

Reduces I/O and storage.

Why this answer

The recommended approaches for improving Redshift query performance include applying column compression encoding (Option B) to reduce I/O, defining sort keys on columns used in WHERE clauses (Option C) to enable range-restricted scans, and choosing an appropriate distribution key for large tables (Option E) to minimize data movement between nodes. Enabling concurrency scaling (Option A) primarily helps with handling multiple concurrent queries but does not directly improve the performance of an individual query. Adding more nodes (Option D) can increase overall capacity but is often not the most cost-effective or immediate solution for performance issues.

Full explanation →
1689
Multi-Selecteasy

Which TWO AWS services can be used to ingest streaming data into Amazon S3? (Choose two.)

Select 2 answers
A.Amazon S3 Transfer Acceleration
B.Amazon Managed Streaming for Apache Kafka (Amazon MSK)
C.Amazon Kinesis Data Firehose
D.Amazon Elastic Block Store (Amazon EBS)
E.AWS Snowball
AnswersB, C

MSK can stream data to S3 via Kafka Connect S3 sink.

Why this answer

Amazon Kinesis Data Firehose is the easiest way to reliably load streaming data into Amazon S3. It can capture, transform, and deliver streaming data to S3 destinations in near real-time with no code required. Amazon MSK (Managed Streaming for Apache Kafka) can also ingest streaming data into S3 by using Kafka Connect with an S3 sink connector, which writes data from Kafka topics directly to S3.

Exam trap

The trap here is that candidates often confuse Amazon S3 Transfer Acceleration (a speed optimization for existing uploads) with a streaming ingestion service, or they mistakenly think EBS or Snowball can handle real-time streaming data when they are designed for persistent block storage and offline bulk transfer, respectively.

Full explanation →
1690
Multi-Selecteasy

A data engineer is designing a real-time streaming pipeline to ingest clickstream data from a website into Amazon S3. The data must be transformed before storage. Which TWO AWS services can be used together to build this pipeline? (Choose TWO.)

Select 2 answers
A.Amazon Kinesis Data Firehose
B.AWS Glue
C.Amazon Kinesis Data Streams
D.Amazon S3 Transfer Acceleration
E.AWS Database Migration Service (DMS)
AnswersA, C

Delivers streaming data to S3 with transformation capabilities.

Why this answer

The correct combination is Amazon Kinesis Data Streams to ingest the streaming clickstream data, and Amazon Kinesis Data Firehose to read from the stream, perform transformations (e.g., via Lambda), and deliver the transformed data to Amazon S3. Kinesis Data Streams provides the durable ingestion layer, while Kinesis Data Firehose handles the delivery and transformation without managing servers.

Exam trap

The trap here is that candidates often confuse Kinesis Data Streams (which requires custom consumers and does not natively write to S3) with Kinesis Data Firehose (which directly delivers to S3 and supports built-in transformations), leading them to select only Data Streams or miss the need for a transformation service.

Full explanation →
1691
MCQeasy

A company uses AWS DMS to migrate data from an on-premises Oracle database to Amazon RDS for PostgreSQL. The migration completes successfully, but the target database has inconsistent data. What should the team do to ensure data consistency?

A.Use 'Limited LOB mode' and set the maximum LOB size to a higher value.
B.Enable 'Full LOB mode' in the DMS task settings.
C.Restart the DMS task after truncating the target tables.
D.Configure the DMS task to use 'Full LOB mode' with parallel threads and enable 'BatchApply'.
AnswerD

This ensures all LOBs are migrated and applied efficiently.

Why this answer

Using 'Full LOB mode' ensures that large objects are migrated without truncation, parallel threads improve throughput, and 'BatchApply' applies changes in batches to maintain transactional consistency. Option A is incorrect because 'Limited LOB mode' can truncate LOB data if the size exceeds the configured maximum, leading to data loss. Option B is incorrect because merely enabling 'Full LOB mode' without parallel threads and 'BatchApply' may not handle large volumes efficiently, potentially causing inconsistency under heavy load.

Option C is incorrect because truncating target tables and restarting the task is a destructive approach that does not resolve the underlying migration issues and can cause data loss or downtime.

Full explanation →
1692
MCQmedium

A company uses AWS Glue ETL jobs to transform data from Amazon S3 to Amazon Redshift. The job reads JSON files, applies schema mapping, and writes to a Redshift table. Recently, the job started failing with memory errors. The data volume has increased tenfold. Which approach should a data engineer take to resolve this issue with minimal code changes?

A.Switch from Spark to Python Shell job type.
B.Implement batch processing with smaller file sizes.
C.Increase the number of DPUs allocated to the Glue job.
D.Use Redshift Spectrum to query data directly from S3.
AnswerC

Provides more resources for processing.

Why this answer

Increasing the number of DPUs (Data Processing Units) allocated to the AWS Glue job directly addresses the memory constraint caused by a tenfold increase in data volume. Glue ETL jobs run on Apache Spark, which distributes data processing across executors; more DPUs provide more memory and compute capacity, allowing the job to handle larger datasets without code changes.

Exam trap

The trap here is that candidates may assume memory errors always require code optimization (e.g., batching or partitioning), but the question explicitly asks for minimal code changes, making resource scaling the correct answer.

How to eliminate wrong answers

Option A is wrong because switching from Spark to Python Shell job type would reduce parallelism and memory capacity, as Python Shell runs on a single node with limited resources, making it unsuitable for large-scale data transformations. Option B is wrong because implementing batch processing with smaller file sizes would require significant code changes to split and manage files, contradicting the 'minimal code changes' requirement, and does not address the root cause of insufficient memory allocation. Option D is wrong because using Redshift Spectrum to query data directly from S3 bypasses the Glue ETL job entirely, which is a different architectural approach that does not resolve the memory error in the existing Glue job and may introduce new costs and complexity.

Full explanation →
1693
MCQeasy

A data engineer is tasked with setting up a data pipeline that moves data from an on-premises Oracle database to Amazon S3 every hour. The network bandwidth is limited, and the engineer needs to ensure data consistency. Which AWS service should the engineer use?

A.AWS DataSync.
B.Amazon Kinesis Data Firehose.
C.S3 Transfer Acceleration.
D.AWS Database Migration Service (DMS) with change data capture (CDC).
AnswerD

DMS supports continuous replication and ensures data consistency via CDC.

Why this answer

AWS DMS with CDC is the correct choice because it can continuously replicate ongoing changes from an on-premises Oracle database to Amazon S3 while ensuring data consistency. CDC captures only the incremental changes (inserts, updates, deletes) after an initial full load, minimizing the data transferred over limited bandwidth and maintaining transactional integrity.

Exam trap

The trap here is that candidates often confuse AWS DataSync (a file-transfer service) with database replication, or assume S3 Transfer Acceleration can solve bandwidth issues without addressing the need for change data capture and consistency from a live database.

How to eliminate wrong answers

Option A is wrong because AWS DataSync is designed for large-scale file and object transfers between on-premises storage and AWS, not for streaming database changes from a relational database like Oracle. Option B is wrong because Amazon Kinesis Data Firehose is a streaming ingestion service for real-time data into S3, but it cannot directly connect to an on-premises Oracle database or perform change data capture. Option C is wrong because S3 Transfer Acceleration only speeds up uploads to S3 over the public internet by using AWS edge locations; it does not handle database replication, CDC, or data consistency from an on-premises source.

Full explanation →
1694
Multi-Selectmedium

A company needs to enforce encryption at rest for all data stored in Amazon S3. Which of the following are valid methods to achieve this? (Choose TWO.)

Select 2 answers
A.Use Amazon S3 Transfer Acceleration.
B.Enable default bucket encryption using SSE-S3.
C.Enable S3 Versioning.
D.Use client-side encryption before uploading objects.
E.Use SSL/TLS for all S3 API calls.
AnswersB, D

Default bucket encryption ensures all objects are encrypted at rest with SSE-S3.

Why this answer

Server-side encryption with S3 managed keys (SSE-S3) encrypts data at rest on the server side. Client-side encryption encrypts data before uploading, ensuring it is encrypted at rest from the client's perspective. Options A and E are for encryption in transit, and C is versioning, not encryption.

Correct: B and D.

Full explanation →
1695
MCQhard

A data engineer is troubleshooting an AWS Glue crawler that is not correctly inferring the schema of CSV files stored in Amazon S3. The files have headers, but the crawler is treating the header row as data. The crawler is configured with a custom classifier that has a CSV classifier with 'Column header' set to 'Use first row as header'. What is the most likely reason the crawler is not recognizing the header?

A.The CSV classifier's 'Quote symbol' setting does not match the files.
B.The CSV files have a varying number of columns across rows.
C.The CSV files have a different delimiter than the default comma.
D.The header row contains uppercase letters.
AnswerA

If the classifier expects a quote symbol but the files have none, the classifier may not apply, causing the crawler to treat header as data.

Why this answer

The CSV classifier's 'Quote symbol' setting must match the files. If the files do not use quotes, but the classifier expects a quote symbol (e.g., double quotes), the classifier may fail to match, causing the crawler to fall back to default behavior and treat the header row as data. Option B is wrong because a varying number of columns would cause schema issues, not header misrecognition.

Option C is wrong because the delimiter is unrelated to header detection; a custom delimiter can be set separately. Option D is wrong because case of header text does not affect the crawler's ability to recognize headers.

Full explanation →
1696
MCQmedium

Refer to the exhibit. A data engineer applies the following S3 bucket policy to an S3 bucket. What does this policy enforce?

A.Denies all uploads unless SSE-S3 is used
B.Allows only SSE-S3 encrypted uploads
C.Allows any type of server-side encryption
D.Requires that all objects uploaded to the bucket be encrypted with SSE-KMS
AnswerD

Denies PutObject if encryption header is not KMS.

Why this answer

The bucket policy uses a Deny effect with a condition that checks if the s3:x-amz-server-side-encryption header is not 'aws:kms'. This means any PutObject request that does not use SSE-KMS will be denied. Therefore, the policy enforces that all objects uploaded must be encrypted with SSE-KMS.

Option A is incorrect because the policy does not mention SSE-S3; it denies if not SSE-KMS. Option B is incorrect because it requires SSE-KMS, not SSE-S3. Option C is incorrect because the policy only allows SSE-KMS, not any type of server-side encryption.

Option D is correct.

Full explanation →
1697
MCQeasy

A data engineer needs to store encryption keys used for protecting data in Amazon S3 and automatically rotate them every year. Which service should be used?

A.AWS KMS
B.AWS CloudHSM
C.AWS Certificate Manager
D.AWS Secrets Manager
AnswerA

KMS provides automatic key rotation.

Why this answer

AWS KMS supports automatic key rotation for customer managed keys. Option B is wrong because CloudHSM does not provide automatic rotation. Option C is wrong because Secrets Manager is for secrets.

Option D is wrong because ACM is for certificates.

Full explanation →
1698
Multi-Selectmedium

A data engineer is designing a data lake on Amazon S3 that will store sensitive financial data. The engineer needs to implement encryption at rest and ensure that only authorized users can access the data. Which TWO actions should the engineer take to meet these requirements? (Choose TWO.)

Select 2 answers
A.Configure a bucket policy that denies writes if the object is not encrypted.
B.Use server-side encryption with customer-provided keys (SSE-C).
C.Enable S3 Transfer Acceleration for the bucket.
D.Enable object-level access control lists (ACLs).
E.Create IAM policies that grant least privilege access to users.
AnswersA, E

Bucket policies can enforce encryption and control access.

Why this answer

A bucket policy with a condition that denies writes if the object is not encrypted (e.g., using `s3:x-amz-server-side-encryption` or `s3:PutObject` with `aws:SecureTransport`) enforces encryption at rest at the time of upload. This ensures that all objects written to the bucket are encrypted, meeting the encryption requirement without relying on client-side behavior.

Exam trap

The trap here is that candidates often confuse encryption enforcement with encryption method selection, picking SSE-C (option B) because it sounds more secure, but the question asks for actions that ensure encryption at rest and authorized access, not a specific key management model.

Full explanation →
1699
Multi-Selecthard

A data engineer is building a data ingestion pipeline using AWS Glue. The source is an Amazon DynamoDB table, and the target is an Amazon S3 data lake in Parquet format. The pipeline must handle large volumes and ensure exactly-once processing. Which THREE features should the engineer use together to achieve this? (Choose THREE.)

Select 3 answers
A.Use Amazon Kinesis Data Streams to capture DynamoDB Streams changes.
B.Configure the Glue job to convert data to Parquet format.
C.Use Amazon S3 Object Lambda to transform data on the fly.
D.Enable job bookmarks in the Glue job to track processed items.
E.Use DynamoDB's export to S3 feature to get a full snapshot.
AnswersB, D, E

Parquet is columnar and efficient for analytics.

Why this answer

Converting data to Parquet format is a core requirement for an S3 data lake, as Parquet offers columnar storage, compression, and efficient querying via services like Amazon Athena and Amazon Redshift Spectrum. AWS Glue natively supports Parquet as an output format, enabling the engineer to specify it in the job's output schema or transformation logic.

Exam trap

The trap here is that candidates often confuse streaming services like Kinesis Data Streams with batch processing, assuming they are required for exactly-once guarantees, when in fact AWS Glue job bookmarks combined with DynamoDB Streams or export to S3 provide a simpler and more reliable solution.

Full explanation →
1700
MCQeasy

A company wants to enforce that all data in Amazon S3 is encrypted at rest. They want to automatically reject any PUT request that does not include encryption headers. What S3 feature should they use?

A.Bucket policy with a condition for encryption headers
B.Default encryption
C.MFA Delete
D.S3 Block Public Access
AnswerA

A bucket policy can deny requests that lack the required encryption header, enforcing encryption.

Why this answer

S3 bucket policies can include a condition that denies PutObject requests if they do not include the required encryption headers (e.g., x-amz-server-side-encryption). This enforces encryption at rest by rejecting unencrypted uploads. Default encryption only automatically encrypts objects that are uploaded without encryption headers, but does not reject them.

MFA Delete is for requiring multi-factor authentication for delete operations, not for encryption. S3 Block Public Access controls public access to buckets, not encryption. Therefore, option A is correct.

Full explanation →
1701
MCQmedium

A data engineer uses AWS Glue to process data from S3. The Glue job frequently fails with 'Out of Memory' errors. The job reads several large compressed files. What is the MOST effective way to resolve this issue without changing the code?

A.Increase the number of G.1X workers or use G.2X workers
B.Convert the compressed files to uncompressed format before processing
C.Repartition the data to fewer partitions
D.Increase the job timeout setting
AnswerA

More workers or higher memory workers provide more heap space for processing.

Why this answer

Increasing the number of G.1X workers or switching to G.2X workers directly addresses the 'Out of Memory' errors by allocating more memory per Spark executor. G.1X provides 16 GB of memory per worker, while G.2X provides 32 GB, which is critical when processing large compressed files because decompression and transformation require additional heap space. This approach resolves the issue without modifying the job code, as it only changes the resource configuration.

Exam trap

The trap here is that candidates often confuse 'Out of Memory' errors with performance issues and choose to reduce parallelism (Option C) or increase timeout (Option D), not realizing that memory exhaustion requires more memory per executor, not fewer tasks or longer runtime.

How to eliminate wrong answers

Option B is wrong because converting compressed files to uncompressed format would increase the data volume read from S3, potentially worsening memory pressure and increasing I/O costs, and it requires code changes to handle the new format. Option C is wrong because repartitioning to fewer partitions reduces parallelism, causing each Spark task to process more data, which would exacerbate memory issues rather than resolve them. Option D is wrong because increasing the job timeout setting only extends the maximum runtime before the job is killed; it does not address the underlying memory exhaustion, so the job will still fail with 'Out of Memory' errors.

Full explanation →
1702
MCQeasy

A data engineer is setting up a data ingestion pipeline using Amazon Kinesis Data Firehose to deliver web server logs to Amazon S3. The logs are in JSON format and the engineer wants to convert them to Parquet format. The engineer has configured a Glue table for the schema. However, when testing, the Firehose delivery stream fails with 'Error converting to Parquet'. The engineer checks the Glue table schema and notices that it includes a column 'timestamp' of type 'string' in the format 'yyyy-MM-dd HH:mm:ss'. The logs have a 'timestamp' field in the same format. What is the MOST likely cause of the failure?

A.Firehose does not support Parquet conversion.
B.The Glue table schema does not match the data schema exactly.
C.The S3 bucket lacks write permissions for Firehose.
D.The 'timestamp' column must be of type 'timestamp' instead of 'string'.
AnswerB

Mismatch between schema and data causes conversion failure.

Why this answer

The failure is most likely due to a schema mismatch between the Glue table and the actual data. Firehose uses the Glue table schema to convert JSON to Parquet, and if the schema does not exactly match (e.g., column order, data types, or extra columns), the conversion fails. Option A is incorrect because Firehose does support Parquet conversion when a Glue table is provided.

Option C is incorrect because S3 permissions would cause a different error (e.g., AccessDenied). Option D is incorrect because a string type for timestamp is acceptable as long as it matches; the issue is not the type but the overall schema mismatch.

Full explanation →
1703
MCQmedium

A company is ingesting streaming data from thousands of IoT devices into Amazon Kinesis Data Streams. The data is processed by a Kinesis Data Analytics application. Recently, the application started reporting high iterator age (millisBehindLatest). Which action would BEST reduce the iterator age?

A.Decrease the data retention period of the Kinesis stream.
B.Increase the data retention period of the Kinesis stream.
C.Increase the record size limit in the Kinesis stream.
D.Increase the number of shards in the Kinesis stream.
AnswerD

More shards allow higher throughput and reduce the backlog, decreasing iterator age.

Why this answer

Increasing the number of shards increases the stream's throughput capacity, allowing the Kinesis Data Analytics application to consume data faster and reduce the iterator age (millisBehindLatest). Option A is incorrect: decreasing the data retention period does not improve processing speed; it only reduces the time data is stored. Option B is incorrect: increasing retention also does not affect processing speed.

Option C is incorrect: the record size limit is fixed (1 MB) and cannot be increased; increasing shards is the appropriate scaling action.

Full explanation →
1704
MCQeasy

A company stores sensitive customer data in an S3 bucket. The data engineer needs to ensure that all data is encrypted at rest. Which S3 feature should be enabled?

A.S3 Versioning
B.S3 Block Public Access
C.Bucket policy requiring aws:SecureTransport
D.Default encryption
AnswerD

Default encryption automatically encrypts new objects.

Why this answer

Default encryption ensures that all new objects written to the bucket are encrypted at rest using SSE-S3, SSE-KMS, or SSE-C. Option A is incorrect because S3 Versioning tracks object versions but does not encrypt data. Option B is incorrect because S3 Block Public Access controls public access, not encryption.

Option C is incorrect because the aws:SecureTransport condition enforces encryption in transit, not at rest.

Full explanation →
1705
MCQeasy

A company is ingesting streaming data from IoT devices into Amazon Kinesis Data Streams. The data must be transformed in real-time and then stored in Amazon S3. Which AWS service should be used to perform the transformation?

A.AWS Glue
B.Amazon EMR
C.Amazon Kinesis Data Analytics
D.Amazon Athena
AnswerC

Kinesis Data Analytics provides real-time stream processing capabilities.

Why this answer

Amazon Kinesis Data Analytics (now part of Amazon Managed Service for Apache Flink) is the correct choice because it can consume streaming data from Kinesis Data Streams, apply real-time transformations using SQL or Apache Flink, and then output the transformed data to destinations like Amazon S3. This directly meets the requirement for real-time transformation of streaming IoT data before storage.

Exam trap

The trap here is that candidates often confuse AWS Glue's batch ETL capabilities with real-time streaming, leading them to select Glue despite its lack of native support for live Kinesis Data Streams processing.

How to eliminate wrong answers

Option A is wrong because AWS Glue is a serverless ETL service designed for batch processing and cataloging data in data lakes, not for real-time stream transformations; it cannot directly process live Kinesis Data Streams with sub-second latency. Option B is wrong because Amazon EMR is a big data platform for running frameworks like Apache Spark or Hadoop on clusters, which is overkill and not optimized for lightweight, continuous real-time transformations on a single Kinesis stream; it introduces cluster management overhead and higher latency. Option D is wrong because Amazon Athena is an interactive query service for analyzing data already stored in S3 using SQL, not for transforming streaming data in motion; it cannot ingest or process live Kinesis Data Streams.

Full explanation →
1706
MCQmedium

A company uses AWS DMS to migrate an on-premises PostgreSQL database to Amazon RDS for PostgreSQL. After initial load, ongoing replication is set up. The replication task shows 'Task status: failed with error: The specified LSN is not available in the source database logs.' What is the most likely cause?

A.DMS does not support PostgreSQL as a source for ongoing replication.
B.The source database's network security group blocks outbound traffic to DMS.
C.The full load was incomplete, preventing CDC from starting.
D.The source database's WAL retention period is too short, and required logs have been purged.
AnswerD

DMS uses WAL logs for CDC; if logs are purged, replication fails.

Why this answer

The error 'The specified LSN is not available in the source database logs' indicates that AWS DMS is trying to read a Write-Ahead Log (WAL) position that has already been purged. PostgreSQL sources require sufficient WAL retention to allow DMS to catch up during ongoing replication (CDC). If the WAL segments are recycled or removed before DMS reads them, the replication task fails with this specific LSN error.

Exam trap

The trap here is that candidates confuse connectivity issues (Option B) or general CDC support (Option A) with the specific LSN error, which is a WAL retention problem unique to PostgreSQL logical replication.

How to eliminate wrong answers

Option A is wrong because AWS DMS fully supports PostgreSQL as a source for ongoing replication using logical replication slots and WAL-based CDC. Option B is wrong because network security group blocks would cause connection timeout or 'Unable to connect' errors, not an LSN availability error. Option C is wrong because an incomplete full load would prevent the task from starting CDC at all, but the error message specifically refers to missing LSN in logs, which occurs after CDC has begun and the source WAL has been purged.

Full explanation →
1707
MCQhard

A data pipeline uses Amazon Kinesis Data Firehose to deliver data to an Amazon S3 bucket. The delivery stream is configured with a buffer size of 5 MB and a buffer interval of 60 seconds. The team notices that the S3 objects are much smaller than 5 MB. What is the most likely explanation?

A.The incoming data volume is low, so the 60-second buffer interval triggers delivery before the 5 MB buffer is filled.
B.The S3 bucket has event notifications that split the objects.
C.The S3 bucket has a lifecycle policy that transitions objects to Glacier.
D.The delivery stream is using GZIP compression, which reduces the object size.
AnswerA

Because if the incoming data rate is low, the buffer interval (60 seconds) expires before the buffer size (5 MB) is reached, causing small S3 objects.

Why this answer

If the incoming data rate is low, the buffer interval (60 seconds) expires before the buffer size (5 MB) is reached, causing small objects. Option B is incorrect because S3 event notifications do not split objects; they are triggered by events but do not affect object size. Option C is incorrect because S3 lifecycle policies transition objects to Glacier, which does not affect object size during delivery.

Option D is incorrect because GZIP compression reduces the object size after batching, but the buffer interval can still trigger delivery before the buffer is full, so it is not the most likely explanation.

Full explanation →
1708
MCQeasy

Refer to the exhibit. A data engineer runs the above CLI command to find files smaller than 1000 bytes in a bucket. The command returns an empty array, but the engineer knows there are small files. What is the issue?

A.The prefix is incorrect; it should be 'logs/2023/01/01/'.
B.The bucket policy does not allow listing objects.
C.The query syntax is invalid; use a filter instead.
D.The Size is compared as a string, not an integer; remove quotes around '1000'.
AnswerD

JMESPath comparison requires numeric types.

Why this answer

In the AWS CLI `list-objects-v2` command with `--query`, the `Size` field is a numeric value, but the query string `Size < '1000'` compares it as a string. This causes a lexicographic comparison, so files with sizes like '900' would be correctly matched, but any size with more digits (e.g., '1000' itself or '999') may fail due to string ordering. Removing the quotes around `1000` treats it as an integer, enabling proper numeric comparison.

Exam trap

The DEA-C01 exam often tests the subtle distinction between string and numeric comparisons in JMESPath queries, where candidates assume quoted values are automatically coerced to numbers, but in reality, quotes force string comparison.

How to eliminate wrong answers

Option A is wrong because the prefix 'logs/2023/01/01/' is not necessarily incorrect; the engineer knows small files exist, and the prefix is just a filter—if files are under that prefix, the issue is not the prefix. Option B is wrong because if the bucket policy did not allow listing objects, the CLI command would return an access denied error, not an empty array. Option C is wrong because the query syntax using `--query` with JMESPath expressions is valid; a filter is not required for this comparison, and the syntax `Size < '1000'` is syntactically correct but semantically wrong due to type coercion.

Full explanation →
1709
MCQmedium

A data engineer is troubleshooting a slow Amazon Redshift query that joins several large tables. The query plan shows a large number of broadcasts. Which design change would most likely reduce the broadcast operations?

A.Change the SORT KEY on all tables to match the join column.
B.Change the DISTSTYLE to EVEN on all tables.
C.Change the DISTKEY on all tables to match the join column.
D.Change the DISTSTYLE to ALL on all large tables.
AnswerC

Matching DISTKEY on join columns ensures data is co-located, avoiding broadcasts.

Why this answer

Setting the DISTKEY on all tables to the join column ensures that rows with the same join key value are co-located on the same compute node. This allows Redshift to perform a collocated join, eliminating the need to broadcast entire tables across the network, which is the primary cause of the slow query.

Exam trap

The trap here is that candidates confuse SORT KEY (which optimizes data skipping and range scans) with DISTKEY (which controls data distribution for joins), leading them to pick Option A, even though broadcast reduction is purely a distribution concern.

How to eliminate wrong answers

Option A is wrong because changing the SORT KEY affects the order of data on disk and can improve range-restricted scans, but it does not influence data distribution across nodes; broadcast operations are caused by distribution mismatches, not sort order. Option B is wrong because changing DISTSTYLE to EVEN distributes rows randomly across nodes, which maximizes the chance that join keys are scattered, forcing Redshift to broadcast rows to satisfy the join. Option D is wrong because changing DISTSTYLE to ALL on large tables copies the entire table to every node, which reduces broadcasts but at the cost of massive storage and maintenance overhead, making it impractical for large tables and often degrading overall performance.

Full explanation →
1710
MCQeasy

A data engineer needs to share a dataset from an S3 bucket in Account A with users in Account B. The dataset must remain encrypted at rest with an S3-managed key. What is the MOST secure way to grant cross-account access?

A.Make the bucket public and use bucket policies to allow only Account B users.
B.Create a bucket policy that grants cross-account access to an IAM role in Account B.
C.Use S3 object ACLs to grant access to Account B's root user.
D.Use an S3 VPC endpoint to allow Account B users through private IPs.
AnswerB

A bucket policy granting cross-account access to an IAM role in Account B is the recommended secure method.

Why this answer

A bucket policy granting access to the IAM role in Account B is the recommended secure method for cross-account access to S3 objects encrypted with S3-managed keys. Option A is insecure because it grants public access. Option C is incorrect because ACLs are legacy and less secure for cross-account scenarios.

Option D is incorrect because while S3 VPC endpoints are a valid AWS feature that provides private connectivity to S3, they do not grant cross-account access; bucket policies are still required to authorize access.

Full explanation →
1711
MCQhard

A company uses Amazon Kinesis Data Analytics for real-time anomaly detection on clickstream data. The application uses a sliding window of 1 minute. The data engineer notices that the application is producing incorrect results because late-arriving records are not being handled properly. What should the data engineer do to ensure late records are included in the window calculations?

A.Use a Kinesis Data Firehose to buffer the data and then send to Kinesis Data Analytics.
B.Increase the watermark delay in the Kinesis Data Analytics application to allow more time for late records.
C.Increase the window size from 1 minute to 2 minutes.
D.Increase the retention period of the Kinesis stream to 7 days.
AnswerB

Watermark delay controls how long the application waits for late data.

Why this answer

Kinesis Data Analytics uses watermarks to track event time progress and determine when to finalize window calculations. Increasing the watermark delay allows the application to wait longer for late-arriving records before closing the window, ensuring they are included in the aggregation.

Exam trap

The trap here is that candidates confuse stream retention (how long data is stored) with watermark delay (how long the application waits for late events), leading them to incorrectly choose option D.

How to eliminate wrong answers

Option A is wrong because Kinesis Data Firehose is a delivery stream that buffers data for loading into destinations like S3 or Redshift; it does not provide late-record handling logic for Kinesis Data Analytics windows. Option C is wrong because increasing the window size from 1 minute to 2 minutes does not address late arrivals—it simply aggregates over a longer period, which can still miss records that arrive after the window's end time. Option D is wrong because increasing the retention period of the Kinesis stream to 7 days only affects how long data is stored in the stream, not how the analytics application handles late-arriving records within its window computations.

Full explanation →
Page 22

Page 23 of 23

All pages

1234567891011121314151617181920212223

Practice DEA-C01 by domain

Target a specific domain to shore up weak areas.

Data Ingestion and TransformationData Operations and SupportData Security and GovernanceData Store Management
See all domains with question counts →