Courseiva

AWS Certified Data Engineer Associate DEA-C01 (DEA-C01) — Questions 151225

1711 questions total · 23pages · All types, answers revealed

Page 2

Page 3 of 23

Page 4
151
MCQmedium

A company runs a data warehouse on Amazon Redshift. Queries are slow, and the team suspects data distribution is skewed. Which approach would best help identify distribution skew?

A.Check the STL_LOAD_ERRORS table for load failures
B.Query the SVV_TABLE_INFO table to see table size
C.Query the SVV_DISKUSAGE table to examine data distribution across slices
D.Review the WLM configuration in the parameter group
AnswerC

SVV_DISKUSAGE provides per-slice disk usage, helping identify skew.

Why this answer

The SVV_DISKUSAGE table provides per-slice data distribution information, allowing you to identify skew by comparing the number of blocks allocated to each slice for a given table. In Amazon Redshift, data is distributed across slices based on the distribution key, and significant variation in block counts across slices indicates distribution skew, which can cause query performance degradation due to uneven workload distribution.

Exam trap

The trap here is that candidates confuse table-level metadata (SVV_TABLE_INFO) with slice-level distribution data (SVV_DISKUSAGE), assuming overall table size alone can reveal skew, when in fact only per-slice block counts expose uneven data distribution.

How to eliminate wrong answers

Option A is wrong because STL_LOAD_ERRORS records errors during COPY or INSERT operations, such as data type mismatches or malformed data, and has no relation to data distribution skew. Option B is wrong because SVV_TABLE_INFO shows overall table size, row count, and compression ratios, but it does not provide per-slice data distribution details needed to identify skew. Option D is wrong because WLM configuration in the parameter group manages query concurrency and memory allocation, not data distribution or skew detection.

152
MCQhard

An organization is using AWS Glue to process sensitive data. The data is stored in S3 with server-side encryption using AWS KMS (SSE-KMS). The Glue job fails with an error indicating that it cannot read the data. The IAM role used by Glue has the following policy. What is missing?

A.The s3:GetObject permission on the bucket
B.The kms:Decrypt permission on the KMS key
C.The kms:GenerateDataKey permission on the KMS key
D.The kms:ReEncrypt permission on the KMS key
AnswerB

Correct. The role lacks kms:Decrypt, which is required to decrypt objects encrypted with SSE-KMS.

Why this answer

The Glue job fails because the IAM role lacks the kms:Decrypt permission on the KMS key. While s3:GetObject is also required, the role already has that permission (or it is not the missing permission causing the error). The key missing permission for decrypting SSE-KMS encrypted data is kms:Decrypt.

Option A is incorrect because s3:GetObject is present. Option B is correct. Options C and D are incorrect because they are not required for read operations.

Exam trap

Candidates often assume that both s3:GetObject and kms:Decrypt are missing, but the question's context implies that s3:GetObject is already present. The trap is to overlook that the IAM policy already includes s3:GetObject, so only kms:Decrypt needs to be added.

153
MCQmedium

A company uses Amazon Kinesis Data Streams to ingest real-time data. The compliance team requires that all data in the stream be encrypted at rest. Which configuration should be enabled?

A.Enable TLS encryption on the Kinesis stream
B.Enable server-side encryption using an AWS KMS key
C.Use client-side encryption in the producer application
D.Store the data in Amazon CloudWatch Logs instead
AnswerB

Kinesis supports SSE with KMS.

Why this answer

Server-side encryption (SSE) for Amazon Kinesis Data Streams uses an AWS KMS key to automatically encrypt data at rest as it is written to the stream and decrypt it when read. This meets the compliance requirement for encryption at rest without requiring any changes to the producer or consumer applications.

Exam trap

The trap here is confusing encryption in transit (TLS) with encryption at rest (SSE), leading candidates to select TLS as the solution for at-rest compliance.

How to eliminate wrong answers

Option A is wrong because TLS encryption protects data in transit between clients and the Kinesis endpoint, not data at rest within the stream. Option C is wrong because client-side encryption encrypts data before it is sent to Kinesis, but this is a client-managed approach that does not leverage Kinesis's native at-rest encryption and adds complexity; the question asks which configuration should be enabled on the stream itself. Option D is wrong because storing data in CloudWatch Logs does not encrypt the Kinesis stream data at rest and is a different service entirely, not a configuration for Kinesis Data Streams.

154
MCQeasy

A data engineer needs to ingest JSON data from an on-premises relational database into Amazon S3 every hour. Which AWS service should be used to set up a scheduled, incremental data transfer?

A.Amazon S3 Transfer Acceleration with a cron job.
B.AWS Database Migration Service (DMS) with S3 as target.
C.AWS Glue with a JDBC connection and a scheduled crawler.
D.Amazon Kinesis Data Firehose with a database source.
AnswerB

DMS supports scheduled, incremental transfers from databases to S3.

Why this answer

AWS DMS is purpose-built for migrating databases to AWS targets, including Amazon S3. It supports ongoing replication (change data capture) and scheduled full-load tasks, making it ideal for hourly incremental transfers from an on-premises relational database to S3 without custom scripting.

Exam trap

The trap here is that candidates confuse AWS Glue's ETL capabilities with DMS's managed database migration, assuming Glue's JDBC connections can handle incremental transfers, but Glue lacks built-in change data capture and requires custom logic for scheduled incremental loads.

How to eliminate wrong answers

Option A is wrong because S3 Transfer Acceleration only speeds up uploads over long distances via edge locations; it does not provide scheduling, incremental data capture, or database connectivity. Option C is wrong because AWS Glue crawlers are designed for schema discovery and metadata cataloging, not for scheduled incremental data transfer from a database to S3; Glue ETL jobs can do this but require custom code, whereas DMS is the managed service for database migration. Option D is wrong because Kinesis Data Firehose ingests streaming data from producers like Kinesis streams or direct PUT, not from a relational database via JDBC; it lacks built-in change data capture for incremental database loads.

155
MCQhard

A data engineer is troubleshooting an Amazon DynamoDB table that has frequent throttling exceptions for write requests. The table has auto scaling enabled. What is the most likely cause?

A.The partition key is causing a hot partition
B.The table's read capacity is set too low
C.The table's auto scaling is disabled
D.The table is using global tables without conflict resolution
AnswerA

Hot partitions throttle even if overall capacity is sufficient.

Why this answer

Auto scaling adjusts capacity based on utilization, but it cannot prevent throttling caused by a hot partition. If a single partition key value receives a disproportionate share of write traffic, that partition's throughput limit (3,000 WCU or 10 MB per partition) is exceeded, triggering ProvisionedThroughputExceededException. Auto scaling operates at the table level, not per partition, so it cannot resolve this imbalance.

Exam trap

The trap here is that candidates assume auto scaling automatically prevents all throttling, but it only adjusts table-level capacity and cannot fix uneven data access patterns like a hot partition.

How to eliminate wrong answers

Option B is wrong because write throttling is unrelated to read capacity; the question specifies write request throttling, so read capacity settings are irrelevant. Option C is wrong because the question states auto scaling is enabled, so this option describes a scenario that does not match the given condition. Option D is wrong because global tables with conflict resolution handle eventual consistency and replication conflicts, not throughput throttling on write requests.

156
Matchingmedium

Match each AWS data analytics service to its primary function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Serverless SQL query on S3

Business intelligence and dashboards

Data lake setup and access control

Real-time SQL on streaming data

Query data in S3 from Redshift

Why these pairings

The correct matches are: Amazon Athena for serverless SQL querying on S3, Amazon Redshift for data warehousing, Amazon EMR for big data processing, and Amazon Kinesis for real-time streaming. Common confusions include swapping the roles of Athena and Redshift.

157
MCQmedium

A company is running a data warehouse on Amazon Redshift. The data engineering team notices that query performance has degraded over time. They suspect that data distribution is causing excessive data movement between nodes. The table is joined frequently on the customer_id column. Which column should be chosen as the distribution key to optimize join performance?

A.AUTO distribution
B.customer_id
C.order_date
D.EVEN distribution
AnswerB

Distributing on the join column reduces data movement.

Why this answer

(customer_id) because Redshift distributes data across nodes based on the distribution key. When two tables are joined on customer_id, using it as the distribution key ensures that matching rows from both tables are co-located on the same node, eliminating the need for data redistribution (broadcast or shuffle) during the join. This minimizes network traffic and reduces query latency, directly addressing the performance degradation caused by excessive data movement.

Exam trap

The trap here is that candidates may choose EVEN distribution (D) thinking it balances data evenly, but they overlook that it causes maximum data movement for joins, while AUTO distribution (A) seems safe but does not guarantee co-location for the specific join column.

How to eliminate wrong answers

Option A (AUTO distribution) is wrong because AUTO lets Redshift choose the distribution style based on table size and usage patterns, but it may not guarantee co-location for frequent joins on customer_id, potentially still causing data movement. Option C (order_date) is wrong because it is not the join column; using it as the distribution key would scatter customer_id values across nodes, forcing redistribution for every join on customer_id. Option D (EVEN distribution) is wrong because it distributes rows round-robin across nodes without considering join keys, which maximizes data movement during joins on customer_id and degrades performance.

158
Multi-Selecteasy

A company is designing a data lake on AWS using S3. The security team requires that all data be encrypted at rest and that encryption keys be rotated annually. Which services can be used to meet these requirements? (Choose TWO.)

Select 2 answers
A.AWS Secrets Manager
B.AWS Certificate Manager (ACM)
C.AWS Key Management Service (AWS KMS)
D.AWS CloudHSM
E.Amazon S3 managed keys (SSE-S3)
AnswersC, E

Allows customer-managed keys with automatic yearly rotation.

Why this answer

AWS KMS (C) allows creating customer-managed keys that can be rotated annually or automatically. Amazon S3 managed keys (SSE-S3) (E) provide encryption at rest with keys that are automatically rotated by AWS. Option A (AWS Secrets Manager) is for storing secrets, not encryption keys.

Option B (ACM) is for SSL/TLS certificates. Option D (CloudHSM) provides hardware security modules but does not support automatic key rotation for S3 and is not typically used for S3 encryption key management.

159
Multi-Selecteasy

A company uses Kinesis Data Firehose to deliver streaming data to S3. They need to transform the data by adding a timestamp and removing sensitive fields. Which TWO approaches can achieve this?

Select 2 answers
A.Use Kinesis Data Analytics to transform the stream
B.Use S3 Select to transform data at rest
C.Use AWS Glue ETL to process data after delivery to S3
D.Use Amazon Redshift Spectrum to transform data
E.Configure a Lambda function as a data transformation in Firehose
AnswersC, E

Glue can transform data after it is stored in S3.

Why this answer

Options C and E are correct. E: Kinesis Firehose can invoke a Lambda function to transform records (add timestamp, remove fields) before delivery to S3. C: AWS Glue ETL can process data after it is stored in S3, performing transformations like adding timestamps and removing sensitive fields.

Option A is incorrect because Kinesis Data Analytics is for real-time analytics, not for adding timestamps or removing fields in the Firehose pipeline. Option B is incorrect because S3 Select is used to retrieve subsets of data using SQL, not to transform data. Option D is incorrect because Redshift Spectrum is for querying data in S3, not for transforming it.

160
MCQhard

A data engineer created the IAM policy shown in the exhibit. The engineer then attempts to upload an object to 'my-bucket' using the AWS CLI with the command: aws s3 cp file.txt s3://my-bucket/ --sse aws:kms. The upload fails with an 'AccessDenied' error. What is the most likely cause?

A.The policy resource is incorrect
B.The policy requires SSE-S3 (AES256), but the command uses SSE-KMS
C.The policy does not allow the s3:PutObject action
D.The command is missing the --sse-customer-algorithm parameter
AnswerB

The condition mandates AES256, but the command uses aws:kms.

Why this answer

The IAM policy in the exhibit requires the `s3:x-amz-server-side-encryption` header to be set to `AES256`, which corresponds to SSE-S3. The AWS CLI command uses `--sse aws:kms`, which sets the header to `aws:kms` for SSE-KMS. This mismatch causes the request to fail the `s3:PutObject` condition check in the policy, resulting in an 'AccessDenied' error.

Exam trap

The trap here is that candidates may overlook the condition key in the policy and assume the error is due to a missing action or incorrect resource, rather than recognizing that the encryption header value must exactly match the policy's requirement.

How to eliminate wrong answers

Option A is wrong because the policy resource `arn:aws:s3:::my-bucket/*` correctly specifies the bucket and its objects, so the resource is not the issue. Option B is wrong because the policy explicitly requires SSE-S3 (AES256), but the command uses SSE-KMS, which is the direct cause of the failure. Option C is wrong because the policy does allow `s3:PutObject` via the `Effect: Allow` statement; the failure is due to the condition key mismatch, not a missing action.

Option D is wrong because `--sse-customer-algorithm` is used for SSE-C, not SSE-KMS or SSE-S3, and the command already specifies `--sse aws:kms` correctly for SSE-KMS.

161
MCQmedium

A data engineer needs to audit all access to an Amazon S3 bucket containing sensitive data. The audit must capture who accessed the bucket, from which IP address, and what actions were performed. Which AWS service should be enabled?

A.Enable S3 server access logging for the bucket.
B.Enable AWS CloudTrail with data events for the S3 bucket.
C.Use AWS Config to record S3 bucket-level changes.
D.Configure Amazon CloudWatch Logs to monitor S3 access.
AnswerB

CloudTrail data events capture detailed API activity.

Why this answer

AWS CloudTrail logs all API calls to S3, including the caller identity, source IP, and actions. Option A is wrong because S3 server access logs provide similar info but are not as detailed or centralized. Option C is wrong because CloudWatch Logs can store logs but does not generate them.

Option D is wrong because AWS Config tracks resource configuration changes, not API calls.

162
MCQhard

A company uses AWS Lake Formation to manage data lake permissions. A data engineer needs to grant a group of analysts SELECT permission on a set of tables in the 'analytics' database, but only for columns that are not classified as 'PII'. Which approach should the engineer use?

A.Grant SELECT on the entire database and rely on analysts to avoid PII columns.
B.Create an IAM policy that denies access to PII columns.
C.Use an S3 bucket policy to restrict access to objects containing PII data.
D.Use Lake Formation tag-based access control (LF-TBAC) to grant SELECT on columns without the 'PII' tag.
AnswerD

LF-TBAC allows column-level permissions by matching tags on columns with tags on the grant.

Why this answer

Lake Formation tag-based access control (LF-TBAC) allows granting SELECT permission on columns that do not have the 'PII' tag, enabling fine-grained column-level access. Option A is incorrect because granting SELECT on the entire database would include all columns, including those classified as PII. Option B is incorrect because IAM policies cannot enforce column-level restrictions based on tags within Lake Formation tables.

Option C is incorrect because S3 bucket policies operate at the object level and cannot restrict access to specific columns within a table.

163
MCQeasy

Your organization uses Amazon Redshift for analytical workloads. You have noticed that queries are slow on a large fact table. The table is distributed by KEY on the customer_id column and sorted by transaction_date. The table is frequently updated with new records. To improve query performance, you decide to implement a distribution style that reduces data movement. Which action should you take?

A.Change the distribution style to ALL to put a copy of the table on every node.
B.Change the distribution style to AUTO to let Redshift choose the best distribution.
C.Change the distribution style to EVEN to distribute rows evenly across all nodes.
D.Change the sort key to include customer_id as well.
AnswerC

EVEN distribution distributes rows evenly across all nodes, minimizing data movement during queries and loads, making it ideal for large, frequently updated tables.

Why this answer

Changing to EVEN distribution distributes rows evenly across all nodes, reducing data movement during queries that do not benefit from the current KEY distribution on customer_id. This is especially useful for large, frequently updated tables where data skew or redistribution can cause performance issues. Option A (ALL) is wrong because it duplicates the entire table on every node, which is inefficient for large tables.

Option B (AUTO) is wrong because it may not choose the optimal distribution style for this workload. Option D (adding a sort key) improves sort performance but does not directly reduce data movement.

164
MCQhard

A data engineer is designing a data ingestion pipeline for real-time clickstream data from a website. The data must be stored in Amazon S3 in near-real time, and also be available for real-time analytics using Amazon Athena. The pipeline must handle occasional spikes of up to 10x the normal throughput. Which combination of services should the engineer use?

A.Amazon Simple Queue Service (SQS) with AWS Lambda to write to Amazon S3, and Amazon Athena for queries.
B.AWS Database Migration Service (DMS) to stream data to Amazon S3, and Amazon Athena for queries.
C.Amazon Kinesis Data Streams with AWS Lambda to write to Amazon S3, and Amazon Athena for queries.
D.Amazon Kinesis Data Firehose with AWS Glue for transformation, and Amazon Athena for queries.
AnswerC

Kinesis handles spikes, Lambda writes to S3, Athena queries.

Why this answer

Amazon Kinesis Data Streams can handle high throughput spikes (10x normal) with its scalable stream capacity. AWS Lambda can process records in near-real time and write them to Amazon S3. Amazon Athena can query the data directly from S3 using its schema-on-read approach.

Option A is wrong because Amazon SQS is a pull-based queue; Lambda would need to poll SQS, adding latency and complexity for near-real-time ingestion. Option B is wrong because AWS DMS is designed for database migration and continuous replication, not for ingesting real-time clickstream data from a website. Option D is wrong because Amazon Kinesis Data Firehose is a simpler option for streaming data to S3, but the question requires near-real-time availability for Athena; Firehose has a minimum buffer interval of 60 seconds, which may not meet near-real-time requirements, and AWS Glue is typically used for batch ETL rather than low-latency streaming transformations.

165
MCQeasy

A company wants to ingest real-time clickstream data from a website into Amazon S3 with minimal code. The data should be delivered within 60 seconds of generation. Which AWS service should be used?

A.Amazon Kinesis Data Firehose
B.AWS Database Migration Service (DMS)
C.Amazon Kinesis Data Streams
D.Amazon S3 Transfer Acceleration
AnswerA

Firehose is designed for near-real-time streaming ingestion into S3 with minimal configuration.

Why this answer

(Amazon Kinesis Data Firehose) is correct because it is a fully managed service that can ingest real-time clickstream data and deliver it to Amazon S3 in near-real-time (typically less than 60 seconds). Option B (AWS DMS) is for database migration, not streaming ingestion. Option C (Amazon Kinesis Data Streams) requires custom consumers to process and deliver data to S3, adding code overhead.

Option D (S3 Transfer Acceleration) only speeds up uploads but does not provide streaming ingestion capabilities.

166
Multi-Selecteasy

A data engineer is setting up a data pipeline using AWS Glue. The engineer wants to monitor job failures and receive notifications. Which TWO services can be used together for this purpose?

Select 2 answers
A.AWS Step Functions
B.Amazon CloudWatch
C.Amazon SNS
D.Amazon Kinesis Data Streams
E.Amazon SQS
AnswersB, C

Glue publishes job metrics to CloudWatch.

Why this answer

Amazon CloudWatch (B) is correct because it is the native monitoring service for AWS Glue, capturing job metrics, logs, and state changes. You can configure CloudWatch alarms to trigger on job failures, which then invoke Amazon SNS (C) to send notifications via email, SMS, or other endpoints. Together, they provide a complete monitoring and alerting solution without additional orchestration.

Exam trap

The trap here is that candidates may confuse AWS Step Functions (A) as a monitoring tool because it can orchestrate retries, but it does not natively send notifications and is not the primary service for monitoring Glue job failures.

167
MCQeasy

A data engineer needs to transfer 50 TB of historical data from an on-premises Hadoop cluster to Amazon S3. The company has a slow internet connection (100 Mbps). The data must be transferred within 2 weeks. Which service should the engineer recommend?

A.AWS DataSync
B.AWS Snowball Edge
C.Amazon Kinesis Data Firehose
D.AWS Glue ETL job with JDBC connection to Hadoop
AnswerB

Snowball Edge physically transfers data, bypassing network limitations.

Why this answer

B is correct because transferring 50 TB over a 100 Mbps connection would take approximately 48 days (50 TB * 1024 GB/TB * 8 bits/byte / (100 Mbps * 86400 seconds/day)), far exceeding the 2-week deadline. AWS Snowball Edge is a physical appliance that can be loaded with data on-premises and shipped to AWS, bypassing the slow network entirely and completing the transfer within days.

Exam trap

The trap here is that candidates may choose AWS DataSync (Option A) because it is a common migration tool, but they fail to calculate the transfer time over a slow link, overlooking the physical appliance option when bandwidth is severely constrained.

How to eliminate wrong answers

Option A is wrong because AWS DataSync is a network-based transfer service that still relies on the internet connection; at 100 Mbps, it would take over 48 days to transfer 50 TB, exceeding the 2-week requirement. Option C is wrong because Amazon Kinesis Data Firehose is designed for real-time streaming data ingestion, not for batch transfer of 50 TB of historical data from a Hadoop cluster. Option D is wrong because AWS Glue ETL with a JDBC connection would require pulling data over the slow network, which is impractical for 50 TB, and Glue is optimized for schema discovery and transformation, not bulk data migration.

168
MCQmedium

A company is using Amazon Redshift for analytics and needs to ensure that all data is encrypted at rest. The current cluster does not have encryption enabled. What is the most efficient way to enable encryption?

A.Change the cluster parameter group to enable encryption
B.Modify the cluster configuration to enable encryption
C.Use AWS DMS to migrate data to a new encrypted cluster
D.Create a snapshot of the cluster and restore it to a new cluster with encryption enabled
AnswerD

This is the supported method to migrate to an encrypted cluster.

Why this answer

Redshift does not support enabling encryption on an existing cluster; a new encrypted cluster must be created and data migrated. Modifying the cluster configuration or parameter groups does not enable encryption. Creating a snapshot and restoring it to a new cluster with encryption enabled is the standard approach.

169
MCQeasy

A data engineer is designing a data lake on AWS using Amazon S3. The data consists of CSV files generated by IoT devices. The data is accessed by multiple analytics jobs, and the engineer needs to ensure that new files are immediately visible to all consumers after writing. What S3 consistency model applies?

A.Consistent reads require S3 Object Lock.
B.Strong consistency for all operations.
C.Eventual consistency for all operations.
D.Read-after-write consistency for new object PUTS.
AnswerB

While S3 now has strong consistency, the question asks about new files specifically.

Why this answer

Amazon S3 now provides strong consistency for all operations. After a successful write of a new object (or overwrite of an existing object), any subsequent read request immediately receives the latest version of the object, and list operations are also strongly consistent. Therefore, for new CSV files written to S3, the applicable model is strong consistency for all operations.

Exam trap

Candidates may incorrectly choose 'Read-after-write consistency for new object PUTS' (option D) because the question mentions new files after writing. While read-after-write behavior for new object PUTs is true, the current S3 consistency model is strong consistency for all operations. Another pitfall is selecting 'Eventual consistency for all operations' (option C) due to outdated knowledge of S3's previous eventual consistency model.

How to eliminate wrong answers

Option A is wrong because S3 Object Lock is a feature for preventing object deletion or overwrites for compliance or retention, not for ensuring consistency. Option B is wrong because while S3 now offers strong consistency for all operations (including overwrites and deletes), this was not always the case; historically S3 offered eventual consistency for overwrites, and the question's phrasing about 'new files' specifically tests the read-after-write consistency model for new PUTS. Option C is wrong because S3 no longer provides eventual consistency for new object PUTS; it guarantees strong read-after-write consistency for new objects since December 2020.

170
MCQeasy

A data engineer needs to schedule a daily ETL job that runs on Amazon EMR. The job should be triggered automatically and send an email on failure. Which AWS service should the engineer use to orchestrate the job?

A.Amazon EventBridge
B.AWS Step Functions
C.Amazon Simple Queue Service (SQS)
D.Amazon CloudWatch Events
AnswerB

Orchestrates EMR steps and integrates with SNS.

Why this answer

WS Step Functions (Option B). Step Functions is a serverless workflow service that can orchestrate multiple AWS services, including EMR steps, into a state machine. It can be triggered on a schedule using Amazon EventBridge or CloudWatch Events, and it can integrate with Amazon SNS to send email notifications on failure.

Option A (Amazon EventBridge) is an event bus that can trigger services but does not provide built-in orchestration for complex workflows. Option C (SQS) is a message queue service and not an orchestrator. Option D (Amazon CloudWatch Events) is similar to EventBridge and can trigger Lambda functions but lacks native workflow orchestration capabilities.

171
MCQhard

A gaming company uses Amazon DynamoDB to store player profiles and game state. The table has a partition key of 'player_id' and no sort key. The table is provisioned with 5,000 RCUs and 5,000 WCUs. The application performs frequent reads and writes to update player scores. Recently, the company introduced a new feature that allows players to form guilds. The guild data is stored in a separate DynamoDB table with a partition key of 'guild_id'. The application often needs to retrieve all members of a guild. The data engineer is encountering high latency when querying the guild table because the guilds can have up to 100 members. The engineer wants to reduce latency without changing the application architecture. What should the data engineer do?

A.Increase the provisioned read and write capacity for the guild table to 10,000 RCUs and 10,000 WCUs.
B.Create a global secondary index (GSI) on the guild table with partition key guild_id and sort key member_id.
C.Enable DynamoDB Streams on the guild table and process the stream to populate a separate read table.
D.Use DynamoDB Accelerator (DAX) to cache the results of the guild queries.
AnswerB

The GSI allows efficient retrieval of all members of a guild by querying on guild_id.

Why this answer

Adding a global secondary index (GSI) on the guild table with guild_id as the partition key and member_id as the sort key allows efficient queries for all members of a guild. Option A is wrong because increasing capacity may not solve the access pattern issue. Option C is wrong because DynamoDB Streams are for change data capture, not for query optimization.

Option D is wrong because DAX caches read results; if the query pattern is inefficient, DAX won't help much.

172
Multi-Selectmedium

Which TWO statements are true about Amazon S3 bucket policies and ACLs?

Select 2 answers
A.When both exist, bucket policies are evaluated before ACLs.
B.ACLs are a legacy access control mechanism that is still supported.
C.ACLs can grant permissions to all authenticated AWS users.
D.ACLs support conditions such as IP address restrictions.
E.Bucket policies can grant access to users in other AWS accounts.
AnswersB, E

ACLs are older but still functional.

Why this answer

ACLs (Access Control Lists) are indeed a legacy access control mechanism that Amazon S3 continues to support for backward compatibility. While bucket policies and IAM policies are the modern, recommended approach, ACLs can still be used to grant basic read/write permissions to AWS accounts or predefined groups like AllUsers or AuthenticatedUsers.

Exam trap

The trap here is that candidates confuse ACLs with bucket policies, assuming ACLs support advanced conditions like IP restrictions or that bucket policies and ACLs are evaluated in a strict order, when in fact ACLs are simplistic and both are evaluated as an OR.

173
MCQmedium

A data engineer reviewed the S3 lifecycle policy shown in the exhibit. The engineer notices that objects under the 'logs/' prefix are being deleted after 365 days. The business requirement is to retain logs for at least 5 years. What should the engineer change in the lifecycle policy?

A.Change the prefix to 'logs/archive/'
B.Set the expiration days to 1825
C.Change the transition to GLACIER on day 365
D.Remove the expiration action
AnswerB

1825 days equals 5 years.

Why this answer

The business requirement is to retain logs for at least 5 years, which is 1,825 days (5 × 365). The current lifecycle policy sets expiration to 365 days, causing premature deletion. By setting the expiration days to 1,825, the S3 lifecycle policy will delete objects under the 'logs/' prefix only after 5 years, meeting the retention requirement.

Exam trap

The trap here is that candidates may confuse transition actions (which change storage class) with expiration actions (which delete objects), or incorrectly assume that changing the prefix or removing expiration will meet the retention requirement without adjusting the day count.

How to eliminate wrong answers

Option A is wrong because changing the prefix to 'logs/archive/' would only apply the lifecycle rules to a different subset of objects, not fix the retention period for the original 'logs/' prefix. Option C is wrong because transitioning to GLACIER on day 365 only changes the storage class for cost optimization; it does not extend the deletion timeline, so objects would still be deleted after 365 days. Option D is wrong because removing the expiration action entirely would mean objects are never automatically deleted, which may lead to indefinite storage and increased costs, not a 5-year retention.

174
Multi-Selecthard

A company uses Amazon Kinesis Data Analytics for Apache Flink to process streaming data. The Flink application reads from a Kinesis Data Streams source, performs aggregations, and writes results to Amazon S3. The application is experiencing high checkpoint failures, and the processing lag is increasing. The data volume is 50 MB/s with an average record size of 1 KB. Which TWO actions would improve checkpoint reliability and reduce lag? (Choose TWO.)

Select 2 answers
A.Decrease the checkpoint interval to complete checkpoints faster.
B.Replace the S3 sink with Kinesis Data Firehose.
C.Decrease the parallelism of the Flink application.
D.Increase the checkpoint interval in the Flink configuration.
E.Increase the number of Kinesis Processing Units (KPUs) for the application.
AnswersD, E

Less frequent checkpoints reduce overhead.

Why this answer

Increasing the checkpoint interval (Option D) reduces the frequency of checkpoint operations, which decreases the overhead on the Flink application and allows it to dedicate more resources to processing data, thereby reducing lag. This is especially effective when checkpoint failures are caused by the system being unable to complete checkpoints within the current interval due to high throughput (50 MB/s).

Exam trap

The trap here is that candidates often think decreasing the checkpoint interval will speed up checkpoints, but in reality, it increases overhead and failure rates, while increasing parallelism (Option C) seems intuitive but actually reduces per-task resources and can worsen backpressure.

175
MCQeasy

A data engineer is monitoring an Amazon EMR cluster and notices that the cluster is running out of disk space on the core nodes. Which action can be taken to resolve this issue?

A.Reduce the retention period of data stored on HDFS
B.Change the core node instance type to a compute-optimized type
C.Increase the EBS volume size attached to core nodes
D.Use Spot Instances for core nodes
AnswerC

More EBS capacity directly adds disk space.

Why this answer

Increasing the EBS volume size attached to core nodes directly adds storage capacity, resolving the disk space issue. Option A is wrong because reducing HDFS data retention may free space but does not increase available disk space; it could result in data loss. Option B is wrong because changing to a compute-optimized instance type affects CPU and memory, not storage.

Option D is wrong because Spot Instances are a pricing model and do not add disk space.

176
MCQhard

A financial services company processes real-time stock trade data. They use Amazon Kinesis Data Streams with a shard count of 5, each shard receiving about 500 records per second. The consumer application uses the Kinesis Client Library (KCL) with DynamoDB for checkpointing. Lately, some records are being processed multiple times. What is the most likely cause?

A.The consumer application is crashing and restarting, causing re-processing of records.
B.The Kinesis stream's iterator age is exceeding the retention period.
C.The DynamoDB table used for checkpointing is throttling write requests.
D.The record size exceeds the 1 MB API limit, causing retries.
AnswerA

KCL reprocesses from last checkpoint after failure.

Why this answer

The Kinesis Client Library (KCL) uses DynamoDB to track checkpoint progress for each shard. If the consumer application crashes and restarts, the KCL will resume processing from the last committed checkpoint, which may be behind the actual processing point. This causes records that were already processed (but not yet checkpointed) to be re-processed, leading to duplicate processing.

Exam trap

The trap here is that candidates often confuse checkpoint throttling (Option C) with duplicate processing, but throttling would cause checkpoint failures and potential re-processing only if the application cannot recover, whereas the direct cause of duplicates is the gap between processing and checkpointing after a crash.

How to eliminate wrong answers

Option B is wrong because iterator age exceeding the retention period would cause data to expire and become unavailable, not cause duplicate processing. Option C is wrong because DynamoDB throttling on checkpoint writes would cause checkpoint failures and potential re-processing, but the question states checkpointing is occurring and the issue is duplicate processing, not checkpoint failures. Option D is wrong because the 1 MB API limit applies to the total payload per PutRecords request, not per record, and exceeding it would cause write failures or retries, not duplicate processing of already-successful records.

177
Multi-Selectmedium

A company needs to ingest streaming data from thousands of IoT devices. The data must be processed in real-time and stored in Amazon S3. Which TWO services should be used together?

Select 2 answers
A.Amazon Kinesis Data Streams
B.Amazon Kinesis Data Firehose
C.AWS Glue
D.Amazon Simple Queue Service (SQS)
E.AWS Direct Connect
AnswersA, B

Provides real-time data ingestion.

Why this answer

Amazon Kinesis Data Streams is correct because it provides a scalable, real-time data ingestion service that can capture streaming data from thousands of IoT devices with low latency. Amazon Kinesis Data Firehose is correct because it can directly consume data from Kinesis Data Streams and automatically deliver it to Amazon S3 without requiring custom code for buffering, transformation, or loading.

Exam trap

The trap here is that candidates often confuse Kinesis Data Firehose with Kinesis Data Streams, thinking only one is needed, but the question requires both: Data Streams for real-time ingestion from devices and Data Firehose for automated delivery to S3.

178
MCQeasy

A data engineer is troubleshooting an Amazon Redshift cluster that is running slowly. The cluster has 4 dc2.large nodes. The engineer runs a query that scans a large table and notices that the query uses only a single slice instead of all slices. The table is distributed with DISTSTYLE ALL. What is the most likely reason for the query using only one slice?

A.The query is running on the leader node instead of the compute nodes.
B.The table uses DISTSTYLE ALL, which stores the entire table on a single slice per node.
C.The workload management (WLM) queue is configured with a single query slot.
D.The table does not have a sort key defined.
AnswerB

DISTSTYLE ALL replicates the table to each node, but it is stored on one slice per node, limiting parallelism.

Why this answer

DISTSTYLE ALL replicates the entire table to every node, but within each node, the data is stored on a single slice. For dc2.large nodes, which have 2 slices per node, this means that a full table scan will only use one slice per node, not all available slices. This leads to underutilization and slow query performance.

Option A is incorrect because the leader node does not execute data queries; it only coordinates them. Queries are executed on compute nodes. Option C is incorrect because WLM queue slots control concurrency, not the number of slices used by a single query.

Option D is incorrect because sort keys affect data ordering and compression, not slice distribution.

179
MCQeasy

A data engineer needs to securely store database credentials used by a Lambda function. The solution must automatically rotate the credentials every 90 days. Which AWS service should the engineer use?

A.AWS CloudHSM
B.AWS Systems Manager Parameter Store
C.IAM Roles for Lambda
D.AWS Secrets Manager
AnswerD

Secrets Manager provides automatic rotation of secrets.

Why this answer

AWS Secrets Manager supports automatic rotation of secrets. Option A is wrong because CloudHSM is a hardware security module, not a secret store with rotation. Option B is wrong because Parameter Store does not natively rotate secrets.

Option C is wrong because IAM Roles are for access to AWS services, not for storing database credentials.

180
Multi-Selecteasy

A company is building a data pipeline that ingests streaming data from IoT devices. The data must be stored in a durable, scalable, and cost-effective manner for batch processing. Which TWO AWS services should be used together?

Select 2 answers
A.Amazon ElastiCache
B.Amazon Kinesis Data Streams
C.Amazon Redshift
D.Amazon DynamoDB
E.Amazon S3
AnswersB, E

Ingests streaming data in real-time.

Why this answer

Amazon Kinesis Data Streams (B) is the correct ingestion service for streaming IoT data because it provides a durable, scalable, and real-time data streaming platform that can capture and store data records for up to 365 days. Amazon S3 (E) is the correct storage service for batch processing because it offers virtually unlimited durability (99.999999999%), cost-effective tiered storage, and native integration with batch processing frameworks like Amazon EMR and AWS Glue. Together, they form a classic streaming-to-batch pipeline: Kinesis ingests and buffers the streaming data, which is then persisted in S3 for downstream batch analytics.

Exam trap

The trap here is that candidates often confuse Amazon Kinesis Data Streams with Amazon Kinesis Data Firehose (which directly writes to S3) or mistakenly choose Amazon Redshift for storage, overlooking that S3 is the correct durable and cost-effective storage layer for raw streaming data before any warehousing.

181
MCQeasy

A data engineer is running an AWS Glue ETL job that reads from an Amazon RDS MySQL database and writes to Amazon S3. The job fails with a 'Communications link failure' error. The security group for the RDS instance allows inbound traffic from the Glue job's security group. What is the most likely cause of the failure?

A.The JDBC connection string in the Glue job does not include the database name.
B.The Glue job is using the wrong JDBC driver.
C.The Glue job's security group does not allow outbound traffic to the RDS security group on port 3306.
D.The IAM role used by the Glue job does not have rds:Connect permission.
AnswerC

Without outbound rule, the connection fails.

Why this answer

AWS Glue ETL jobs run in a VPC that requires outbound security group rules to initiate connections to RDS. Even if the RDS security group allows inbound traffic from the Glue security group, the Glue security group must also have an outbound rule allowing traffic to the RDS security group on port 3306 (MySQL default port). Without this outbound rule, the TCP handshake from Glue to RDS fails, causing a 'Communications link failure'.

Exam trap

The trap here is that candidates assume only inbound rules matter for security groups, but outbound rules are equally critical for initiating connections from the client (Glue) to the server (RDS).

How to eliminate wrong answers

Option A is wrong because omitting the database name from the JDBC connection string would cause a different error (e.g., 'Unknown database' or connection rejection), not a 'Communications link failure', which indicates a network-level issue. Option B is wrong because AWS Glue automatically includes the correct JDBC driver for MySQL (compatible with Amazon RDS MySQL) when using the Glue connection type 'MySQL'; using the wrong driver would typically produce a class-not-found or driver-incompatibility error, not a communications link failure. Option D is wrong because IAM permissions for Glue jobs use actions like 'glue:GetConnection' and 'rds:DescribeDBInstances' to retrieve connection metadata, but there is no 'rds:Connect' IAM action; database authentication is handled via username/password in the Glue connection, not IAM.

182
MCQmedium

A company is ingesting data from multiple sources into S3 using AWS Glue. The data engineer notices that the Glue job is failing with an OutOfMemory error. Which step should be taken to resolve this issue?

A.Reduce the volume of incoming data
B.Configure the job to use a larger memory setting
C.Use a smaller file size for input
D.Increase the number of DPUs allocated to the Glue job
AnswerD

More DPUs provide more memory and compute.

Why this answer

AWS Glue jobs run on Apache Spark, which distributes data processing across multiple executors. An OutOfMemory error typically indicates that the data being processed exceeds the memory available to the executors. Increasing the number of DPUs (Data Processing Units) allocates more memory and compute resources to the job, allowing it to handle larger datasets without running out of memory.

Exam trap

The trap here is that candidates may think they can directly increase memory settings (Option B) or reduce data volume (Option A), but AWS Glue abstracts memory management through DPUs, and the correct approach is to increase DPU allocation to provide more resources.

How to eliminate wrong answers

Option A is wrong because reducing the volume of incoming data is not a scalable solution and may not be feasible; the job should be able to handle the required data volume. Option B is wrong because AWS Glue does not allow direct configuration of memory settings per executor; memory is tied to DPU allocation, and increasing DPUs is the correct way to increase total memory. Option C is wrong because using a smaller file size for input does not address the root cause of memory exhaustion; Glue can process many small files efficiently, but the issue is the total data volume or skewed partitions, not file size.

183
MCQhard

A company is using AWS Glue to process data stored in Amazon S3. The data includes personally identifiable information (PII) that must be masked before being written to a separate output bucket. Which AWS service or feature can be used to automatically detect and mask sensitive data in the Glue ETL job?

A.Configure CloudWatch Logs to filter and mask PII.
B.Use Amazon Macie to identify sensitive data and apply masking logic in the Glue job.
C.Use an IAM policy to restrict access to the PII columns.
D.Enable S3 Object Lock on the output bucket.
AnswerB

Amazon Macie can detect sensitive data, and the Glue job can use that information to mask it.

Why this answer

Amazon Macie can be integrated with AWS Glue to automatically detect sensitive data like PII and apply masking logic within a Glue ETL job. Option A is incorrect because CloudWatch Logs are for monitoring and logging, not for data masking. Option C is incorrect because IAM policies control access permissions but do not mask data.

Option D is incorrect because S3 Object Lock prevents object deletion or modification, not masking.

184
Multi-Selectmedium

A data engineering team is using AWS DMS to migrate a 2 TB Oracle database to Amazon RDS for PostgreSQL. The migration must have minimal downtime and needs to capture ongoing changes after the full load. Which THREE resources are required for this task? (Choose three.)

Select 3 answers
A.A DMS source endpoint configured for Oracle.
B.An AWS DMS replication instance.
C.An AWS Snowball Edge device for initial data transfer.
D.An Amazon S3 bucket for staging the data.
E.A DMS target endpoint configured for Amazon RDS PostgreSQL.
AnswersA, B, E

Connects to the source Oracle database.

Why this answer

A source endpoint for Oracle is required to connect to the source Oracle database. Option B is correct because an AWS DMS replication instance is needed to run the migration tasks. Option E is correct because a target endpoint for Amazon RDS PostgreSQL is required.

Option C is incorrect because an AWS Snowball Edge device is used for offline data transfer, not for DMS ongoing replication. Option D is incorrect because an Amazon S3 bucket is not required for a direct DMS migration; it would be used only if staging in S3.

185
MCQmedium

A company uses AWS Glue ETL to process data from Amazon S3 and write results to Amazon Redshift. The job fails with a memory error when processing large files. Which action should the data engineer take to resolve this issue?

A.Reduce the number of partitions in the Glue job.
B.Increase the number of DPUs allocated to the Glue job.
C.Switch to a smaller instance type in the Glue job configuration.
D.Use S3 Select to filter columns before reading into Glue.
AnswerB

More DPUs provide additional memory and compute resources.

Why this answer

Increasing the number of DPUs (Data Processing Units) allocated to the AWS Glue job provides more memory and compute resources, which directly addresses the out-of-memory error when processing large files. Glue jobs run on Apache Spark, and insufficient DPUs can cause executors to run out of memory during shuffle or aggregation operations on large datasets.

Exam trap

The trap here is that candidates may confuse memory errors with I/O bottlenecks and incorrectly choose S3 Select (Option D) to reduce data volume, when the real issue is insufficient compute memory for Spark transformations.

How to eliminate wrong answers

Option A is wrong because reducing the number of partitions would increase the data size per partition, worsening memory pressure and likely causing the same or a more severe memory error. Option C is wrong because switching to a smaller instance type would reduce available memory per executor, directly contradicting the need to resolve a memory error. Option D is wrong because S3 Select can reduce the amount of data read from S3, but it does not increase the memory available to the Glue job's Spark executors; the memory error occurs during processing, not during data ingestion.

186
MCQmedium

A company uses AWS Glue to run ETL jobs on a schedule. Recently, a job failed with the error: 'AnalysisException: cannot resolve '`column_name`' given input columns: ...'. The job reads from an Amazon S3 source that has a schema defined in the AWS Glue Data Catalog. What is the MOST likely cause?

A.The schema of the source data has changed and is not reflected in the Data Catalog.
B.The source data file is corrupted and cannot be parsed.
C.The IAM role associated with the Glue job does not have permissions to read the S3 bucket.
D.The data type of the column in the source does not match the Data Catalog definition.
AnswerA

Schema evolution without updating catalog causes column resolution errors.

Why this answer

The error 'cannot resolve column_name' indicates that the Spark SQL query is trying to reference a column that does not exist in the schema provided by the AWS Glue Data Catalog. This typically happens when the source data schema has changed (e.g., column renamed or dropped) but the Data Catalog schema is not updated accordingly. Option B is incorrect because a corrupted file would cause a read or parse error, not a schema resolution error.

Option C is incorrect because an IAM permissions issue would result in an AccessDenied error. Option D is incorrect because a data type mismatch would cause a type casting error, not a 'cannot resolve' error which is about column names.

187
MCQmedium

A company is using Amazon S3 to store large amounts of archival data. The data is accessed infrequently but must be immediately retrievable when needed. Which storage class is the most cost-effective choice?

A.S3 Standard
B.S3 Standard-IA
C.S3 Glacier Deep Archive
D.S3 Intelligent-Tiering
AnswerB

Designed for infrequently accessed data with immediate retrieval.

Why this answer

S3 Standard-IA (Infrequent Access) is the most cost-effective choice because it offers lower storage costs than S3 Standard while still providing millisecond first-byte latency for immediate retrieval. The data is accessed infrequently but requires instant availability, which matches the IA use case exactly.

Exam trap

The trap here is that candidates confuse 'immediately retrievable' with 'lowest cost' and choose Glacier Deep Archive, overlooking the critical requirement for instant access versus the 12-48 hour retrieval time of Deep Archive.

How to eliminate wrong answers

Option A is wrong because S3 Standard is designed for frequently accessed data and has higher storage costs than Standard-IA, making it less cost-effective for archival data with infrequent access. Option C is wrong because S3 Glacier Deep Archive has the lowest storage cost but retrieval times range from 12 to 48 hours, failing the 'immediately retrievable' requirement. Option D is wrong because S3 Intelligent-Tiering automatically moves data between tiers based on access patterns but incurs a monthly monitoring and automation fee per object, making it less cost-effective than Standard-IA for a predictable infrequent access pattern.

188
MCQmedium

A company wants to ingest data from a SaaS application into Amazon S3. The SaaS application supports streaming data via HTTP POST requests. The data volume is approximately 100 MB per hour, and the company needs to store the raw data in S3 for archival and later analysis. Which approach is the most cost-effective and operationally efficient?

A.Launch a t3.nano EC2 instance that runs a script to receive HTTP POST requests and write to S3.
B.Use Amazon Kinesis Data Firehose with HTTP endpoint as the source, and configure S3 as the destination.
C.Use Amazon Simple Queue Service (SQS) to queue the HTTP POST data and have an AWS Lambda function read from SQS and write to S3.
D.Use Amazon API Gateway to create a REST API that receives the data and triggers an AWS Lambda function to store it in S3.
AnswerD

API Gateway provides a fully managed HTTP endpoint to receive the POST data, then triggers a Lambda function that writes to S3. This is serverless, cost-effective for low volumes, and operationally efficient.

Why this answer

Amazon API Gateway combined with AWS Lambda is the most appropriate and cost-effective approach for this use case. API Gateway provides a fully managed HTTP endpoint that can receive the HTTP POST requests from the SaaS application. The data is then passed to a Lambda function, which writes the raw data directly to Amazon S3.

This serverless architecture eliminates the need to manage servers, scales automatically, and incurs cost only when data is processed. Option B is incorrect because Amazon Kinesis Data Firehose does not natively support HTTP endpoints as a source; it can ingest data from Kinesis Data Streams, AWS IoT, or custom agents, but not directly via HTTP POST.

Exam trap

The trap is that candidates may incorrectly believe Amazon Kinesis Data Firehose can directly accept HTTP POST data. While Firehose is a great service for streaming data to S3, it does not support HTTP as a source. The correct serverless pattern for ingesting HTTP POST data is API Gateway + Lambda.

How to eliminate wrong answers

Option A is wrong because a t3.nano EC2 instance requires ongoing management (patching, scaling, monitoring) and incurs fixed hourly costs even at low data volumes, making it less cost-effective and operationally efficient than a serverless solution. Option C is wrong because SQS is a message queue, not a streaming ingestion endpoint; it would require additional components (e.g., an HTTP endpoint to receive POSTs and put to SQS) and the Lambda function adds latency and complexity, whereas Firehose directly accepts HTTP POSTs. Option D is wrong because API Gateway + Lambda introduces per-request costs and cold start latency, and it is over-engineered for simple streaming ingestion; Firehose provides built-in buffering, compression, and direct S3 delivery without custom code.

189
MCQhard

A data engineer is setting up an Amazon Kinesis Data Analytics application to process streaming data from a Kinesis data stream named "input-stream". The application uses a reference data source from an S3 bucket. The engineer has attached the IAM policy shown in the exhibit to the application's IAM role. When starting the application, the engineer receives an 'AccessDeniedException' error. Which additional permission is required?

A.kinesis:PutRecord on the input stream
B.s3:GetObject on the S3 bucket containing the reference data
C.kinesis:CreateStream on the input stream
D.kinesis:PutRecords on the input stream
AnswerB

The application needs to read reference data from S3, so GetObject is required.

Why this answer

The Kinesis Data Analytics application needs to read reference data from the S3 bucket, which requires the s3:GetObject permission on the bucket and its objects. The error 'AccessDeniedException' indicates the IAM role lacks this specific permission to retrieve the reference data file. Option B correctly adds the missing s3:GetObject action to allow the application to fetch the reference data from S3.

Exam trap

The trap here is that candidates often confuse the direction of data flow and assume the application needs write permissions (PutRecord/PutRecords) to the input stream, when in fact it only needs read permissions (kinesis:DescribeStream, kinesis:GetShardIterator, kinesis:GetRecords) and the missing permission is for the separate S3 reference data source.

How to eliminate wrong answers

Option A is wrong because kinesis:PutRecord is used to write data to a Kinesis stream, but the application reads from the input stream as a source, not writes to it; the error is not about writing. Option C is wrong because kinesis:CreateStream is an administrative action to create a new stream, which is irrelevant to an existing stream used as input. Option D is wrong because kinesis:PutRecords is for batch writing to a stream, not for reading or for accessing reference data from S3.

190
MCQeasy

A data engineer is ingesting CSV files from an Amazon S3 bucket into a Glue Data Catalog table. The files have headers, but some files have extra columns not present in the first file. The engineer wants the Glue crawler to automatically detect the schema. Which crawler configuration option should be used?

A.Configure the crawler to 'Inherit schema from table' and set the table name.
B.Configure the crawler to 'Create a single schema for each S3 path' and enable 'Merge tables'.
C.Configure the crawler to 'Create a single schema for each S3 path' without enabling 'Merge tables'.
D.Configure the crawler to 'Create a single schema for each S3 path' and set 'Each file as a separate table'.
AnswerB

This merges schemas from all files in the path.

Why this answer

When CSV files have varying schemas (extra columns), the Glue crawler must be configured to 'Create a single schema for each S3 path' with 'Merge tables' enabled. This configuration instructs the crawler to union the schemas from all files in the S3 path, adding new columns as they appear, rather than creating separate tables for each schema variation.

Exam trap

The trap here is that candidates often assume 'Merge tables' is about combining multiple tables into one, when in fact it merges schemas from multiple files within the same S3 path into a single table definition.

How to eliminate wrong answers

Option A is wrong because 'Inherit schema from table' is not a valid Glue crawler configuration; crawlers do not inherit schemas from existing tables automatically. Option C is wrong because without enabling 'Merge tables', the crawler will create multiple tables for each distinct schema, not a single unified table. Option D is wrong because 'Each file as a separate table' would create a separate table per CSV file, which defeats the goal of having a single table with all columns merged.

191
MCQeasy

A company is designing a data pipeline that ingests data from an on-premises database to Amazon S3. The data contains personally identifiable information (PII) that must be masked before storage. Which AWS service can be used to mask the data in transit?

A.AWS Database Migration Service (DMS)
B.AWS Data Pipeline
C.Amazon Kinesis Data Firehose
D.AWS Glue
AnswerC

Correct. Kinesis Data Firehose can use Lambda functions to perform data transformation, including masking PII, as data flows through the pipeline.

Why this answer

Amazon Kinesis Data Firehose can invoke an AWS Lambda function to transform and mask data in transit before delivering to Amazon S3. This makes it suitable for masking PII in a streaming pipeline. AWS Glue is designed for batch ETL jobs, not real-time masking during transit.

AWS DMS is for database migration, and AWS Data Pipeline orchestrates workflows without native masking capabilities.

192
Multi-Selectmedium

A company is designing a data lake on Amazon S3. Which TWO strategies improve query performance for Amazon Athena?

Select 2 answers
A.Enable S3 Versioning on the bucket.
B.Use server-side encryption with AWS KMS (SSE-KMS).
C.Partition the data by frequently queried columns such as date or region.
D.Use columnar file formats like Parquet or ORC.
E.Store data in CSV format with header rows.
AnswersC, D

Partitioning prunes the data scanned.

Why this answer

Partitioning data by frequently queried columns (e.g., date or region) allows Athena to prune the data scanned by only reading the relevant partitions, reducing the amount of data scanned and improving query performance. This is a core optimization for Athena, which charges based on data scanned and performs better with less I/O.

Exam trap

The trap here is that candidates often confuse data management features (like versioning or encryption) with performance optimizations, or assume that simpler formats like CSV are sufficient for analytics, ignoring the significant performance benefits of partitioning and columnar storage.

193
MCQhard

A company uses AWS KMS to encrypt sensitive data stored in S3. To meet compliance requirements, they need to ensure that the encryption keys are automatically rotated every year. Which type of KMS key should they use?

A.Customer managed key with manual rotation
B.AWS managed key
C.Custom key store (CloudHSM) key
D.Customer managed key with automatic rotation enabled
AnswerD

Customer managed keys can have automatic rotation enabled, which rotates the key annually.

Why this answer

Customer managed keys with automatic rotation enabled support automatic annual rotation, meeting the compliance requirement. AWS managed keys rotate automatically every year, but they cannot be controlled or customized by the customer, so they are not the best choice when the customer needs to manage the key policy or rotation schedule. Custom key stores (CloudHSM) do not support automatic rotation.

Option A (customer managed key with manual rotation) requires manual intervention to rotate, not automatic. Therefore, D is the correct answer.

194
Multi-Selecthard

A company uses AWS KMS to encrypt data in Amazon Redshift. The data engineer needs to rotate the customer-managed KMS key annually. Which TWO actions must be taken to successfully rotate the key without data loss?

Select 2 answers
A.Create a new KMS key and update the Redshift cluster to use the new key
B.Keep the old KMS key enabled to allow decryption of existing encrypted data
C.Use AWS CloudTrail to verify the key rotation was successful
D.Store the new key in Amazon S3 for backup
E.Enable automatic KMS key rotation on the existing key
AnswersA, B

Needed to re-encrypt data with new key.

Why this answer

You must create a new KMS key and update the Redshift cluster to use the new key for encrypting future data. Option B is correct because the old key must remain enabled to allow decryption of data that was encrypted with it; without the old key, existing data becomes inaccessible. Option C is incorrect because CloudTrail is used for auditing API calls, not as a required action for key rotation.

Option D is incorrect because storing the key in Amazon S3 is unnecessary; KMS already securely stores keys. Option E is incorrect because automatic key rotation on the existing key does not create a new key; it rotates the key material automatically, which is not the scenario described (a new key must be created and the cluster updated).

195
MCQeasy

Refer to the exhibit. A data engineer applies this S3 bucket policy to the bucket 'example-bucket'. What is the effect of this policy?

A.PutObject requests are denied unless they include the x-amz-server-side-encryption header set to AES256
B.All PutObject requests are denied regardless of encryption
C.All PutObject requests are allowed only if they use SSE-KMS
D.The policy has no effect because it does not allow any action
AnswerA

The condition StringNotEquals denies if the header is not AES256, so only requests with AES256 are allowed.

Why this answer

The policy denies s3:PutObject if the encryption header is not set to AES256 (SSE-S3). It does not enforce a specific KMS key. It allows uploads with SSE-S3.

It denies uploads without encryption or with other encryption types.

196
Multi-Selectmedium

A company uses AWS Glue to run ETL jobs daily. The jobs consume data from an Amazon RDS for MySQL database and write results to Amazon S3. The company wants to minimize the impact on the source database during extraction. Which THREE actions should the data engineer take to achieve this? (Choose THREE.)

Select 3 answers
A.Schedule the Glue job to run during off-peak hours.
B.Configure the Glue job to connect to a read replica of the RDS instance.
C.Increase the number of Glue DPUs to process data faster.
D.Disable Glue job bookmarks to force full refresh.
E.Use a JDBC connection with a WHERE clause to extract only incremental data.
AnswersA, B, E

Runs when database load is naturally low.

Why this answer

Scheduling the Glue job to run during off-peak hours minimizes the load on the source RDS for MySQL database by avoiding high-traffic periods, reducing contention for CPU, memory, and I/O resources. This is a straightforward operational practice to reduce impact on production databases during extraction.

Exam trap

The trap here is that candidates often assume increasing DPUs (parallelism) always improves performance without realizing it can amplify the load on the source database, and they may overlook that disabling bookmarks forces full refreshes, which is the opposite of minimizing impact.

197
MCQmedium

A data engineer is troubleshooting a failed AWS Glue job that reads from an Amazon RDS for MySQL table. The error message indicates 'java.sql.SQLException: No suitable driver'. What is the most likely cause?

A.The MySQL JDBC driver JAR is not included in the Glue job's dependencies.
B.The Glue job is using the wrong JDBC driver class name.
C.The Glue job's VPC subnet does not have a route to the RDS instance.
D.The RDS instance is not publicly accessible.
AnswerA

Glue needs the JDBC driver in its classpath to connect to MySQL.

Why this answer

The MySQL JDBC driver must be included in the Glue job's dependent JARs or as a Python module. Option B is incorrect because the driver class name is correct; the driver JAR is missing. Option C is incorrect because the error is about driver, not connection.

Option D is incorrect because subnet routing does not affect driver loading.

198
Multi-Selectmedium

Which TWO actions are required to enforce encryption in transit for data being loaded into Amazon Redshift from Amazon S3? (Choose two.)

Select 2 answers
A.Configure Redshift to require SSL connections
B.Use client-side encryption for data in S3
C.Enable encryption at rest on Redshift cluster
D.Enable S3 server-side encryption
E.Use S3 VPC endpoints with HTTPS
AnswersA, E

Ensures data in transit to Redshift is encrypted.

Why this answer

To enforce encryption in transit for data loaded from S3 into Redshift, you need SSL connections on Redshift (option A) to encrypt the connection between the client and Redshift, and S3 VPC endpoints with HTTPS (option E) to encrypt data transfer from S3 to Redshift via the VPC endpoint. Option B is client-side encryption, which encrypts data before it reaches S3 and is not required for transit. Option C enables encryption at rest on the Redshift cluster, not in transit.

Option D is about server-side encryption at rest in S3, not transit.

199
Multi-Selectmedium

A data engineer is designing a pipeline to ingest daily CSV files from an SFTP server into Amazon S3. The files are large (up to 10 GB) and must be encrypted in transit. The pipeline should be fully managed and serverless where possible. Which TWO services should be used together to achieve this? (Choose TWO.)

Select 2 answers
A.Amazon Kinesis Data Firehose
B.AWS Lambda
C.AWS Glue
D.AWS Transfer Family
E.Amazon Athena
AnswersC, D

Glue can process CSV files in S3.

Why this answer

Options C and D are correct. AWS Transfer Family provides a fully managed SFTP service that can transfer files directly to S3 with encryption in transit, meeting the requirement for serverless, managed file ingestion. AWS Glue can then be used to process the CSV files in S3, as it is a serverless ETL service suitable for batch processing large files.

Option A (Kinesis Data Firehose) is for streaming data, not batch file transfers. Option B (Lambda) has a 15-minute timeout and is not ideal for large files up to 10 GB. Option E (Athena) is a query service, not a transfer or processing service.

200
Multi-Selecthard

A company is using Amazon Redshift for its data warehouse. The data engineering team needs to improve query performance for a large fact table that is frequently joined with multiple dimension tables. Which THREE strategies should be considered?

Select 3 answers
A.Define sort keys on columns used in WHERE clauses.
B.Use DISTSTYLE EVEN to distribute data evenly.
C.Increase the number of nodes in the cluster.
D.Choose an appropriate distribution key based on join columns.
E.Apply columnar compression to reduce storage and I/O.
AnswersA, D, E

Improves filter efficiency.

Why this answer

Defining sort keys on columns used in WHERE clauses allows Amazon Redshift to use zone maps to skip large blocks of data that do not satisfy the filter condition, dramatically reducing the amount of data scanned. This is especially effective for large fact tables where selective filters can prune entire disk blocks, improving query performance without additional hardware.

Exam trap

The trap here is that candidates often assume DISTSTYLE EVEN is always the best choice for performance, but for frequently joined fact tables, a distribution key aligned with the join columns is critical to avoid network-heavy data shuffling.

201
MCQmedium

A data engineer needs to store sensitive data in Amazon S3 and automatically classify the data using a managed service. The data is uploaded via an S3 bucket. Which AWS service can automatically detect and classify sensitive data?

A.Amazon Macie
B.AWS WAF
C.Amazon Inspector
D.AWS Shield
AnswerA

Macie automatically discovers and classifies sensitive data.

Why this answer

Amazon Macie is the correct answer because it is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover, monitor, and protect sensitive data in Amazon S3. Option B, AWS WAF, is a web application firewall for protecting web applications, not for data classification. Option C, Amazon Inspector, is an automated vulnerability management service for EC2 instances and containers, not for S3 data classification.

Option D, AWS Shield, is a managed DDoS protection service, unrelated to data classification.

202
MCQhard

A data engineer is designing a data pipeline that ingests streaming data from Kinesis Data Streams, transforms it using AWS Lambda, and writes to S3. The Lambda function sometimes fails due to transient errors, and the engineer wants to ensure no data is lost. Which approach should be used?

A.Use the Kinesis Client Library to process records with checkpointing
B.Increase the Lambda function's timeout and memory
C.Use Kinesis Data Firehose as the delivery stream with Lambda for transformation and configure error handling with retries and a backup S3 bucket
D.Configure a dead-letter queue (DLQ) on Lambda to capture failed records
AnswerC

Firehose automatically retries on errors and can send failed records to a backup S3 bucket.

Why this answer

Kinesis Data Firehose natively integrates with Lambda for data transformation and provides built-in error handling with retries. If transformation fails after the retry limit, Firehose can automatically redirect failed records to a backup S3 bucket, ensuring no data is lost. This approach handles transient errors without requiring custom checkpointing or manual retry logic.

Exam trap

The DEA-C01 exam often tests the distinction between Kinesis Data Streams with Lambda triggers (which require custom error handling via DLQs or KCL) and Kinesis Data Firehose (which provides built-in retry and backup S3 for failed transformations), leading candidates to incorrectly choose DLQ or KCL options.

How to eliminate wrong answers

Option A is wrong because the Kinesis Client Library (KCL) is used for consuming data from Kinesis Data Streams with checkpointing in DynamoDB, but it does not integrate with Lambda as a trigger; the question specifies using Lambda for transformation, and KCL is a separate consumer model that would require managing EC2 instances or containers. Option B is wrong because increasing timeout and memory only reduces the likelihood of timeouts or out-of-memory errors but does not handle transient errors like network glitches or service throttling; it does not provide a mechanism to retry or capture failed records. Option D is wrong because a dead-letter queue (DLQ) on Lambda captures records that fail after all retries, but it does not automatically write to S3; the engineer would need additional logic to process the DLQ and write to S3, and the question specifically requires writing to S3 with no data loss, which Firehose handles directly.

203
Multi-Selecthard

A company stores sensitive data in Amazon S3. The security team requires encryption at rest and that the encryption keys are managed by the company using AWS KMS. The data is frequently accessed by multiple AWS services. Which THREE steps should be taken to meet these requirements?

Select 3 answers
A.Use client-side encryption with the KMS key before uploading to S3
B.Configure the KMS key policy to allow the necessary AWS services to use the key for decryption
C.Enable default encryption on the S3 bucket using SSE-S3
D.Create a bucket policy that denies s3:PutObject if the object is not encrypted with SSE-KMS
E.Enable default encryption on the S3 bucket using SSE-KMS
AnswersB, D, E

Services must have decrypt permissions to access the encrypted objects.

Why this answer

The security team requires that encryption keys be managed by the company using AWS KMS, and that multiple AWS services can access the data. To allow those services to decrypt objects encrypted with a customer-managed KMS key, the KMS key policy must explicitly grant the necessary AWS services (e.g., AWS Lambda, Amazon Athena) permission to use the key for decryption (kms:Decrypt). Without this policy, even if the bucket is configured for SSE-KMS, the services will fail to read the encrypted objects.

Exam trap

AWS often tests the distinction between enforcing encryption (bucket policy) and enabling access to encrypted data (KMS key policy), leading candidates to overlook the KMS key policy step when multiple services need to decrypt objects.

204
MCQmedium

An AWS Glue job that performs data transformation on large Parquet files in Amazon S3 is taking a long time to complete. The job uses the default number of DPUs. Which change would most likely improve the job's performance?

A.Increase 'Max capacity' (number of DPUs) for the job.
B.Use 'coalesce' to reduce the number of output files.
C.Reduce the number of partitions in the source data.
D.Change the input format from Parquet to CSV.
AnswerA

More DPUs provide more compute resources.

Why this answer

Increasing the number of DPUs (Option A) adds more parallelism and memory, which directly improves the performance of the Glue job when processing large Parquet files. Option B (coalesce) reduces the number of output files but does not speed up the transformation itself. Option C (reduce partitions) may lead to data skew or out-of-memory errors.

Option D (change to CSV) would make processing slower because CSV is less efficient than Parquet.

205
MCQmedium

A data engineer runs the above AWS CLI command and receives the output. The object is part of an S3 Lifecycle policy that transitions objects to Glacier Instant Retrieval after 30 days. The object was created on January 1, 2023. Why is the object still in STANDARD_IA storage class?

A.The Lifecycle policy has a filter that excludes this object's prefix
B.Versioning is enabled and the current version is not the oldest
C.The object has not reached the transition age of 30 days yet
D.The metadata timestamp is used for lifecycle transitions instead of LastModified
AnswerC

The LastModified is Jan 2, so as of Jan 3, it is only 1 day old.

Why this answer

The S3 Lifecycle rule transitions objects to Glacier Instant Retrieval after 30 days, but the object was created on January 1, 2023, and the current date (implied by the command output) is before January 31, 2023. The transition age is calculated from the object's LastModified date, not from any other timestamp, and the object must be at least 30 days old before S3 applies the transition. Since the object is only 20 days old (as of January 21, 2023, based on the output showing STANDARD_IA), it has not yet met the 30-day threshold.

Exam trap

The trap here is that candidates assume the object's current storage class (STANDARD_IA) means the 30-day transition to Glacier Instant Retrieval has already failed or been misconfigured, when in fact the object simply hasn't aged enough yet.

How to eliminate wrong answers

Option A is wrong because the AWS CLI command output shows the object's storage class as STANDARD_IA, which indicates the Lifecycle policy has already transitioned it from STANDARD to STANDARD_IA, proving the filter does not exclude this prefix. Option B is wrong because versioning being enabled does not prevent lifecycle transitions; S3 Lifecycle policies apply to all versions unless explicitly filtered, and the current version's age is based on its own LastModified date, not the oldest version. Option D is wrong because S3 Lifecycle transitions are based on the object's LastModified date, not any metadata timestamp; the LastModified field is the authoritative timestamp for age calculations.

206
Multi-Selecteasy

Which THREE AWS services can be used to centrally manage and govern data across multiple AWS accounts? (Select THREE.)

Select 3 answers
A.Amazon S3
B.AWS Control Tower
C.AWS Organizations
D.Amazon Redshift
E.AWS Lake Formation
AnswersB, C, E

Control Tower provides a governance framework for multi-account environments.

Why this answer

The correct answers are AWS Control Tower, AWS Organizations, and AWS Lake Formation. AWS Control Tower provides a pre-configured environment for governance and compliance across accounts. AWS Organizations enables centralized management of multiple accounts.

AWS Lake Formation helps manage and govern data lake permissions across accounts. Amazon S3 (Option A) is a storage service, not a central governance service. Amazon Redshift (Option D) is a data warehouse, not a governance service.

207
MCQmedium

A company is using Amazon Kinesis Data Firehose to deliver streaming data to Amazon S3. The data must be transformed from JSON to Parquet format before landing in S3. The transformation logic is simple: convert the JSON schema to Parquet. Which approach meets the requirements with the least operational overhead?

A.Use the built-in data format conversion feature of Firehose with an AWS Glue Data Catalog table
B.Use an AWS Lambda function to transform records to Parquet before sending to Firehose
C.Use Amazon Kinesis Data Analytics to convert the stream to Parquet
D.Provision an Amazon EMR cluster to convert the data in micro-batches
AnswerA

Firehose can convert to Parquet automatically.

Why this answer

Amazon Kinesis Data Firehose provides a built-in data format conversion feature that can automatically convert incoming JSON data to Parquet format using an AWS Glue Data Catalog table as the schema reference. This approach requires no custom code, no additional infrastructure, and no manual transformation logic, making it the simplest solution with the least operational overhead for a straightforward JSON-to-Parquet conversion.

Exam trap

The trap here is that candidates often overcomplicate the solution by choosing Lambda or EMR, not realizing that Firehose's built-in format conversion with Glue Data Catalog is the simplest, fully managed option for JSON-to-Parquet conversion without any custom code.

How to eliminate wrong answers

Option B is wrong because using an AWS Lambda function to transform records to Parquet before sending to Firehose introduces unnecessary complexity, additional cost, and operational overhead (e.g., managing Lambda concurrency, packaging Parquet libraries, handling record size limits), whereas Firehose's built-in conversion handles this natively. Option C is wrong because Amazon Kinesis Data Analytics is designed for real-time analytics and stream processing using SQL or Flink, not for simple format conversion; it adds latency, complexity, and cost without benefit for a straightforward schema conversion. Option D is wrong because provisioning an Amazon EMR cluster to convert data in micro-batches is a heavy, over-engineered solution that requires cluster management, scaling, and job orchestration, far exceeding the operational overhead needed for a simple format conversion that Firehose can perform automatically.

208
MCQeasy

Refer to the exhibit. A Lambda function named 'IngestionProcessor' is failing. The engineer checks CloudWatch Logs and sees the log group exists but storedBytes is 0. Why might the logs show no data?

A.The Lambda execution role does not have permission to write logs to CloudWatch
B.The Lambda function is configured with a dead letter queue
C.The Lambda function has not been invoked yet
D.The log group is encrypted with a KMS key and the Lambda function lacks decrypt permission
AnswerA

Without logs:CreateLogGroup, CreateLogStream, PutLogEvents, logs are not written.

Why this answer

The Lambda execution role must have the `logs:CreateLogStream` and `logs:PutLogEvents` permissions to write logs to CloudWatch Logs. If the role lacks these permissions, the log group will be created (if it doesn't exist) but no log events will be written, resulting in `storedBytes` being 0. This is a common misconfiguration when the IAM policy does not include the necessary CloudWatch Logs actions.

Exam trap

The DEA-C01 exam often tests the distinction between log group creation (which requires `logs:CreateLogGroup`) and log writing (which requires `logs:CreateLogStream` and `logs:PutLogEvents`), leading candidates to confuse the existence of a log group with successful log delivery.

How to eliminate wrong answers

Option B is wrong because a dead letter queue (DLQ) is used to capture failed events for asynchronous invocations, not to prevent logs from being written; it does not affect CloudWatch Logs permissions. Option C is wrong because if the Lambda function had not been invoked, the log group would not exist at all; the presence of the log group with `storedBytes` of 0 indicates the function was invoked but failed to write logs. Option D is wrong because if the log group were encrypted with a KMS key and the Lambda function lacked decrypt permission, the function would fail with an access denied error when trying to write logs, but the log group would still show `storedBytes` as 0; however, the question states the log group exists and `storedBytes` is 0, which is consistent with missing write permissions, not KMS decryption issues (KMS errors would typically produce a different error message in CloudWatch).

209
Multi-Selectmedium

A data engineer is designing a data pipeline that processes PII data using AWS Glue and stores results in S3. Which TWO actions should be taken to protect the data? (Choose 2)

Select 2 answers
A.Use S3 default encryption with SSE-S3 for the output bucket.
B.Store database credentials in AWS Secrets Manager and reference them in Glue connections.
C.Enable S3 object deletion protection by setting a retention policy.
D.Configure AWS Glue to use a KMS key for encrypting data written to S3.
E.Use HTTPS for all data transfer between Glue and S3.
AnswersB, D

Secrets Manager secures credentials.

Why this answer

Options B and D are correct. Option B: Storing database credentials in AWS Secrets Manager and referencing them in AWS Glue connections ensures that sensitive credentials are not hard-coded or exposed in plaintext, following security best practices for PII data. Option D: Configuring AWS Glue to use a KMS key for encrypting data written to S3 ensures that data at rest in S3 is encrypted with customer-managed keys, providing additional control over encryption.

Option A is incorrect because S3 default encryption with SSE-S3 uses Amazon-managed keys and does not provide the same level of control as KMS; more importantly, the question asks for actions to protect PII, and using SSE-S3 alone is not sufficient for compliance with many regulations that require encryption with customer-managed keys. Option C is incorrect because enabling S3 object deletion protection with a retention policy is about preventing accidental deletion, not directly about protecting data from unauthorized access or encryption. Option E is incorrect because HTTPS encrypts data in transit, but the question also requires encryption at rest; HTTPS alone does not protect data at rest in S3.

210
MCQhard

A data engineer is designing a data pipeline that ingests data from an on-premises system into Amazon S3 using AWS Transfer Family. The data must be encrypted at rest using a customer-managed key in AWS KMS. The S3 bucket policy must allow only encrypted connections. Which policy condition should be used?

A.aws:SecureTransport
B.kms:EncryptionContext
C.s3:x-amz-server-side-encryption-aws-kms-key-id
D.s3:x-amz-server-side-encryption
AnswerA

This condition enforces that connections use TLS.

Why this answer

The condition aws:SecureTransport is used to enforce that connections to S3 are encrypted in transit using TLS/HTTPS. This ensures data is encrypted during transmission. Option B is incorrect because kms:EncryptionContext is used to add encryption context to KMS operations, not to enforce encrypted connections.

Option C is incorrect because s3:x-amz-server-side-encryption-aws-kms-key-id enforces the use of a specific KMS key for server-side encryption, not in-transit encryption. Option D is incorrect because s3:x-amz-server-side-encryption enforces server-side encryption (SSE) for objects at rest, not in-transit encryption.

211
MCQeasy

A company is using Amazon Kinesis Data Firehose to deliver data to an Amazon S3 bucket. The data is delivered in 5-minute intervals. The company wants to reduce the delivery frequency to 1 minute to get data faster. Which parameter should be changed in the Firehose delivery stream configuration?

A.Reduce the buffer interval from 300 seconds to 60 seconds.
B.Increase the buffer size to trigger delivery sooner.
C.Enable dynamic partitioning to deliver data more frequently.
D.Enable compression to reduce data size and speed up delivery.
AnswerA

The buffer interval controls the maximum time between deliveries.

Why this answer

The buffer interval determines how often data is delivered to the destination. Changing it from 300 seconds to 60 seconds will deliver data every minute. Option B (buffer size) affects delivery based on data volume, not time.

Option C (compression) does not affect frequency. Option D (partitioning) does not affect delivery frequency.

212
MCQmedium

A data pipeline uses AWS Step Functions to orchestrate multiple Lambda functions for data transformation. The pipeline occasionally fails with a 'StateMachineExecutionLimitExceeded' error. What is the MOST likely cause?

A.The API Gateway endpoint used by Step Functions has a rate limit.
B.The Lambda functions have reached their concurrent execution limit.
C.The account has reached the maximum number of concurrent state machine executions.
D.The state machine definition has a syntax error causing infinite loops.
AnswerC

Step Functions has a limit on concurrent executions; increase the limit or reduce concurrency.

Why this answer

Step Functions has a default limit on concurrent executions (e.g., 1 million per account per region). Option A is wrong because Lambda concurrency limits would produce a different error. Option B is wrong because API Gateway is not involved.

Option D is wrong because state machine definition does not affect execution limits.

213
MCQeasy

A company uses Amazon RDS for PostgreSQL. The data engineer needs to ensure that the database is automatically backed up and that backups are retained for 35 days. What is the simplest way to achieve this?

A.Use AWS Backup to schedule daily backups with a 35-day retention.
B.Enable automated backups with a retention period of 35 days in the RDS instance configuration.
C.Create a manual snapshot every day and delete them after 35 days using a script.
D.Enable automatic export of transaction logs to Amazon S3 and use S3 lifecycle policies.
AnswerB

RDS automated backups run daily and retain backups for the specified period, up to 35 days.

Why this answer

Amazon RDS for PostgreSQL allows you to enable automated backups directly in the instance configuration. By setting the backup retention period to 35 days, RDS automatically performs daily snapshots and retains transaction logs for point-in-time recovery within that window. This is the simplest method because it requires no external services or custom scripting.

Exam trap

The trap here is that candidates may overcomplicate the solution by choosing AWS Backup (Option A) or manual scripting (Option C), not realizing that RDS native automated backups already provide the simplest, fully managed way to achieve the required retention period.

How to eliminate wrong answers

Option A is wrong because AWS Backup is an additional service that adds complexity and cost; RDS native automated backups already support retention up to 35 days without needing AWS Backup. Option C is wrong because manual snapshots require custom scripting to create and delete daily, which is not the simplest approach and does not provide automated point-in-time recovery. Option D is wrong because automatic export of transaction logs to S3 is not a native RDS feature for PostgreSQL; RDS handles transaction logs internally for point-in-time recovery, and using S3 lifecycle policies would not replace the need for automated backups.

214
MCQhard

Refer to the exhibit. A Lambda function with this IAM policy is used to process records from a Kinesis stream and write to S3. The function is failing with access denied errors when writing to S3. What is the issue?

A.The function needs to use Kinesis Data Analytics for transformation.
B.The Kinesis stream ARN is incorrect.
C.The Lambda function does not have permission to read from the Kinesis stream.
D.The S3 bucket name in the policy does not match the actual bucket used by the function.
AnswerD

Common cause of access denied.

Why this answer

The IAM policy grants s3:PutObject permission on the resource 'my-bucket/*', but the Lambda function is attempting to write to an S3 bucket with a different name. Since the bucket name in the policy does not match the actual bucket used by the function, access is denied. Option A is incorrect because the function does not need Kinesis Data Analytics for transformation.

Option B is incorrect because the policy includes GetRecords and other Kinesis actions, so the Kinesis stream ARN is not the issue (if it were invalid, the error would occur when reading, not writing). Option C is incorrect because the policy explicitly allows Kinesis actions like GetRecords and DescribeStream, so the function does have permission to read from the stream.

215
MCQmedium

A company uses Amazon Kinesis Data Analytics to process real-time data. The application needs to aggregate data over a 10-minute window. The team notices that late-arriving events are being dropped. Which configuration should they adjust?

A.Configure a Kinesis Firehose delivery stream to buffer the late events.
B.Increase the shard count of the source Kinesis stream.
C.Set the allowed_lateness parameter in the application's windowed aggregation.
D.Increase the RecordColumn count in the input stream mapping.
AnswerC

Kinesis Data Analytics (now part of Amazon Managed Service for Apache Flink) provides an `allowed_lateness` parameter in windowed aggregations to handle late-arriving events.

Why this answer

Kinesis Data Analytics (now part of Amazon Managed Service for Apache Flink) provides an `allowed_lateness` parameter in windowed aggregations to handle late-arriving events. Option A is incorrect because Kinesis Firehose is used for data delivery and buffering, not for handling late events within Kinesis Data Analytics; the application itself must manage lateness. Option B is incorrect because increasing shard count increases parallelism and throughput but does not affect how late events are treated; they will still be dropped unless a lateness tolerance is set.

Option D is incorrect because `RecordColumn` count defines the schema of the input stream and has no impact on late-arriving event handling.

216
MCQhard

A data engineer is designing a streaming pipeline using Amazon Kinesis Data Streams with a shard count of 10. The incoming data rate is 1 MB/second. The consuming application uses the Kinesis Client Library (KCL) with a single worker. What is the most likely performance bottleneck?

A.The Lambda function invoked by the stream has a cold start issue
B.The data stream has insufficient write capacity
C.The single KCL worker cannot process all shards in parallel
D.The shard count is too low to handle the data rate
AnswerC

KCL workers should be scaled to match shard count for parallel processing.

Why this answer

The Kinesis Client Library (KCL) uses a 1:1 mapping between shards and record processors by default. With 10 shards and only a single KCL worker, that worker must run all 10 record processors sequentially on a single host, creating a bottleneck. The worker cannot process records from multiple shards in parallel, so the throughput is limited by the single worker's processing capacity, not the stream's write capacity.

Exam trap

The trap here is that candidates often assume the bottleneck is on the write side (insufficient shards or write capacity) because they focus on the incoming data rate, but the question specifically tests the consumer-side limitation of a single KCL worker unable to parallelize across multiple shards.

How to eliminate wrong answers

Option A is wrong because Lambda cold starts are a potential issue only if the consuming application uses Lambda as a consumer, but the question specifies a KCL worker, not a Lambda function. Option B is wrong because the incoming data rate is 1 MB/second, and a single Kinesis shard supports up to 1 MB/second write capacity, so 10 shards provide 10 MB/second—far more than needed. Option D is wrong because the shard count of 10 is more than sufficient to handle the 1 MB/second data rate; the bottleneck is on the consumer side, not the stream's capacity.

217
MCQeasy

A company wants to ingest real-time clickstream data from a website into Amazon S3 with a maximum latency of 60 seconds. The data volume peaks at 500 MB/s. Which service should they use to buffer and deliver the data to S3?

A.Amazon Kinesis Data Firehose
B.Amazon Simple Queue Service (SQS)
C.Amazon Kinesis Data Streams
D.AWS Lambda
AnswerA

Firehose is designed for streaming ingestion into S3 with configurable buffering.

Why this answer

Amazon Kinesis Data Firehose is the correct choice because it is designed to ingest streaming data, buffer it, and deliver it to destinations like Amazon S3 with configurable buffer intervals (e.g., 60 seconds) and buffer sizes (e.g., up to 128 MB). It can handle the peak throughput of 500 MB/s by automatically scaling, and it meets the maximum latency requirement of 60 seconds by flushing data to S3 based on time or size thresholds.

Exam trap

The trap here is that candidates often confuse Kinesis Data Streams (a real-time processing stream requiring custom consumers) with Kinesis Data Firehose (a fully managed delivery service), leading them to pick Data Streams for its real-time capabilities, even though Firehose is the correct choice for direct S3 delivery with minimal latency.

How to eliminate wrong answers

Option B (Amazon Simple Queue Service) is wrong because SQS is a message queue for decoupling application components, not a streaming buffer designed for high-throughput data delivery to S3; it lacks native integration to automatically write data to S3 with configurable latency. Option C (Amazon Kinesis Data Streams) is wrong because it is a real-time data streaming service that requires custom consumers (e.g., Lambda or Kinesis Client Library) to read and write data to S3, adding complexity and latency beyond the 60-second requirement; it does not natively buffer and deliver to S3. Option D (AWS Lambda) is wrong because Lambda is a serverless compute service for running code in response to events, not a buffer or delivery mechanism; it cannot handle sustained 500 MB/s ingestion without additional services and would require custom orchestration to meet latency goals.

218
MCQmedium

A company is using Kinesis Data Firehose to deliver data to an S3 bucket. The delivery stream is failing with 'S3 bucket access denied' errors. The bucket policy allows the Firehose service principal. What could be the issue?

A.The S3 bucket is in a different VPC
B.The S3 bucket uses SSE-KMS and Firehose does not have KMS permissions
C.The S3 bucket name contains invalid characters
D.The IAM role assigned to Firehose lacks s3:PutObject permission
AnswerD

Correct. The IAM role assigned to the Firehose delivery stream must have the s3:PutObject permission to write objects to the S3 bucket. The bucket policy allowing the service principal is not sufficient; the role also needs the appropriate S3 action.

Why this answer

Even though the S3 bucket policy allows the Firehose service principal, Kinesis Data Firehose uses an IAM role to write data. This role must have the s3:PutObject permission. Without it, Firehose will receive an access denied error.

Option A is incorrect because VPC differences affect network connectivity, not IAM permissions. Option B is incorrect because SSE-KMS requires KMS permissions, but the error here is specifically about S3 access. Option C is incorrect because bucket name validation occurs during stream creation, not during data delivery.

Exam trap

Candidates often confuse the bucket policy and the IAM role permissions. The bucket policy allowing the service principal is necessary but not sufficient; the delivery role must also have s3:PutObject.

219
MCQmedium

A company is using Amazon RDS for PostgreSQL and wants to minimize downtime during a major version upgrade. Which approach best meets this requirement?

A.Perform an in-place upgrade using the AWS Management Console.
B.Modify the DB instance class to a larger size to handle the upgrade.
C.Create a read replica of the current instance, upgrade the replica, and then promote it to primary.
D.Use pg_dump and pg_restore to migrate data to a new upgraded instance.
AnswerC

This minimizes downtime by switching over after upgrade.

Why this answer

Creating a read replica, upgrading it to the new major version, and then promoting it to primary minimizes downtime by allowing the replica to be upgraded while the original instance remains operational. The promotion process is fast, typically taking only a few seconds to redirect traffic, and avoids the longer downtime associated with in-place upgrades or full data migrations.

Exam trap

The trap here is that candidates often assume an in-place upgrade (Option A) is the simplest and fastest method, but they overlook the fact that major version upgrades in RDS PostgreSQL require a longer downtime window due to the need for a database restart and potential compatibility checks, making the read replica promotion strategy the superior choice for minimizing downtime.

How to eliminate wrong answers

Option A is wrong because an in-place major version upgrade for RDS PostgreSQL requires a database restart and can take significant time (often 10-30 minutes or more) depending on instance size and data volume, leading to unacceptable downtime. Option B is wrong because modifying the DB instance class to a larger size does not perform a version upgrade; it only changes compute and memory resources, leaving the PostgreSQL version unchanged. Option D is wrong because using pg_dump and pg_restore involves exporting the entire database to a file and then importing it into a new instance, which can take hours for large datasets and requires the source database to be unavailable or read-only during the process, resulting in extended downtime.

220
Multi-Selecthard

A company is migrating an on-premises Apache Hadoop cluster to Amazon EMR. The data is stored in HDFS and must be moved to Amazon S3. Which THREE considerations are important when designing the migration? (Choose THREE.)

Select 3 answers
A.S3 supports POSIX file system semantics
B.HDFS can be directly mounted as an S3 bucket
C.EMR can read data directly from S3 using EMRFS
D.S3 provides eventual consistency for overwrite PUTS and DELETES
E.Using S3 as the data store allows independent scaling of compute and storage
AnswersC, D, E

EMRFS allows EMR to access S3 as a filesystem.

Why this answer

Amazon EMR uses the EMR File System (EMRFS) to directly read and write data stored in Amazon S3, treating S3 as a scalable, durable data lake without needing to first copy data into HDFS. This allows EMR clusters to process data directly from S3, enabling decoupled compute and storage.

Exam trap

The trap here is that candidates often assume S3 supports POSIX semantics or that HDFS can be directly mounted as an S3 bucket, confusing the object storage model with a traditional filesystem, leading them to select options A or B.

221
Multi-Selecthard

A data engineer is designing an Amazon Redshift data warehouse for a high-traffic analytics workload. The engineer needs to ensure fast query performance and minimize data movement. Which THREE design decisions should be made? (Choose THREE.)

Select 3 answers
A.Choose DISTSTYLE KEY for tables that are frequently joined.
B.Use the default distribution style for all tables.
C.Use DISTSTYLE ALL for all large fact tables.
D.Apply appropriate compression encodings to columns.
E.Define SORT KEYs on columns used in WHERE clauses.
AnswersA, D, E

KEY distribution collocates rows based on join keys, reducing data movement.

Why this answer

Correct answers are A, D, and E. DISTSTYLE KEY on frequently joined tables collocates data on the same node, reducing data movement during joins. Applying compression encodings reduces storage and I/O, improving performance.

SORT KEYs on columns used in WHERE clauses enable efficient range-restricted scans. Option B is incorrect because the default distribution style (AUTO) may not be optimal; explicit distribution is better for performance. Option C is incorrect because DISTSTYLE ALL stores a copy of the table on every node, which increases storage and load time; it is suitable only for small dimension tables, not large fact tables.

222
Multi-Selecteasy

A data engineer is setting up an Amazon RDS for MySQL database. The database must be highly available and automatically failover in case of an AZ outage. Which TWO configurations should the engineer enable? (Choose TWO.)

Select 2 answers
A.Multi-AZ deployment
B.A DB subnet group with subnets in at least two Availability Zones
C.Enhanced Monitoring
D.Automated backups with a retention period of 30 days
E.Read replicas in a different Region
AnswersA, B

Multi-AZ creates a standby instance in a different Availability Zone for automatic failover.

Why this answer

Multi-AZ deployment (Option A) automatically provisions and maintains a synchronous standby replica in a different Availability Zone (AZ). In the event of an AZ outage, Amazon RDS automatically fails over to the standby, ensuring high availability with minimal downtime. This is the core mechanism for automatic failover in RDS for MySQL.

Exam trap

The trap here is that candidates often confuse read replicas or automated backups with high availability failover, but only Multi-AZ deployment provides automatic, synchronous failover within the same region.

223
MCQmedium

A data engineer is monitoring an AWS Glue ETL job that processes data from an S3 bucket and writes to a Redshift table. The job completes successfully but takes longer than expected. The engineer notices that the job uses 10 DPUs and the data size is 500 GB. The job runs in standard mode. Which change would MOST reduce job duration?

A.Increase the number of DPUs to 20.
B.Use a smaller worker type like G.1X.
C.Change the output format from Parquet to CSV.
D.Reduce the number of partitions in the data.
AnswerA

More DPUs provide more parallelism, reducing job execution time.

Why this answer

Increasing the number of DPUs from 10 to 20 allows the job to process data in parallel, reducing execution time. AWS Glue standard mode scales linearly with DPUs for ETL jobs that are not I/O bound. In this case, with 500 GB of data and 10 DPUs, the job is likely CPU-bound and can benefit from additional parallelism.

Option B is incorrect because using a smaller worker type (G.1X) reduces available memory and CPU, worsening performance. Option C is incorrect because changing the output from Parquet (columnar, compressed) to CSV (row-based, uncompressed) increases data size and I/O, slowing the job. Option D is incorrect because reducing partitions can cause data skew and reduce parallelism, increasing runtime.

Exam trap

Candidates may assume that increasing DPUs always helps, but for small datasets or I/O-bound jobs, diminishing returns occur. However, for large datasets like 500 GB in standard mode, increasing DPUs typically reduces duration linearly up to a point.

224
MCQhard

A company uses Amazon Kinesis Data Firehose to ingest log data from web servers into Amazon S3. The data is in JSON format and each record is approximately 2 KB. The delivery stream is configured to buffer incoming records for 60 seconds or 5 MB, whichever comes first. The company notices that the data in S3 is delayed by up to 5 minutes during peak hours. Which action would most effectively reduce the delivery latency?

A.Increase the buffer size to 10 MB to allow more records per delivery.
B.Decrease the buffer interval to 15 seconds.
C.Enable compression (GZIP) on the delivery stream.
D.Enable data transformation with AWS Lambda to convert JSON to Parquet.
AnswerB

Shorter buffer interval triggers more frequent deliveries, reducing latency.

Why this answer

The observed delay of up to 5 minutes during peak hours indicates that the buffer size threshold (5 MB) is rarely reached because each record is only ~2 KB, so the delivery stream relies on the buffer interval (60 seconds) to trigger delivery. By decreasing the buffer interval to 15 seconds, Kinesis Data Firehose will push data to S3 more frequently, directly reducing the maximum latency from 60 seconds to 15 seconds per batch, which eliminates the compounding delays caused by queuing during high-throughput periods.

Exam trap

The trap here is that candidates assume increasing buffer size or enabling compression will speed up delivery, but they fail to recognize that with small records, the buffer interval is the bottleneck, and only reducing that interval directly lowers latency.

How to eliminate wrong answers

Option A is wrong because increasing the buffer size to 10 MB would actually increase the time needed to fill the buffer, worsening the latency issue during peak hours when records are small and the buffer interval is the primary trigger. Option C is wrong because enabling GZIP compression reduces storage size and cost but does not affect the delivery frequency or buffer flush timing, so it has no impact on latency. Option D is wrong because converting JSON to Parquet via Lambda adds processing overhead and introduces additional latency from the transformation invocation, which would increase rather than reduce delivery delay.

225
MCQmedium

A company uses Amazon Redshift for analytics. The data engineer notices that queries are slow due to many small inserts. Which technique would improve write performance?

A.Use the COPY command to load data from Amazon S3.
B.Define DISTKEY and SORTKEY on the table.
C.Increase the number of nodes in the cluster.
D.Configure workload management (WLM) queues.
AnswerA

Bulk loading is more efficient than small inserts.

Why this answer

The COPY command is the recommended way to load data into Amazon Redshift because it performs bulk inserts in parallel across all nodes, leveraging the cluster's distributed architecture. Small individual INSERT statements cause high overhead due to transaction logging and commit processing, leading to slow write performance. By loading data from Amazon S3 using COPY, you bypass these per-row overheads and achieve optimal throughput.

Exam trap

The trap here is that candidates often confuse performance tuning for reads (DISTKEY/SORTKEY) or general scaling (adding nodes) with the specific write performance bottleneck caused by many small inserts, overlooking the COPY command as the primary solution for bulk data loading.

How to eliminate wrong answers

Option B is wrong because defining DISTKEY and SORTKEY improves query read performance by optimizing data distribution and sort order, but does not directly address the write performance issue caused by many small inserts. Option C is wrong because increasing the number of nodes adds compute and storage capacity, but does not solve the fundamental problem of per-insert overhead; small inserts will still be slow on a larger cluster. Option D is wrong because configuring workload management (WLM) queues manages concurrency and prioritizes queries, but does not reduce the overhead of individual small INSERT statements.

Page 2

Page 3 of 23

Page 4