Knowledge + Practice

AWS Certified Data Engineer Associate DEA-C01 (DEA-C01) — Questions 226–300

1711 questions total · 23pages · All types, answers revealed

Take a mock exam Exam hub

Page 4 of 23

226

MCQhard

A data engineering team uses AWS Glue ETL jobs to process data from an S3 data lake and load it into an Amazon Redshift cluster. The security policy mandates that all data in transit between AWS Glue and Redshift must be encrypted using TLS. The team uses a JDBC connection. Currently, the connection is failing with an SSL-related error. Which configuration change should the team make to ensure encrypted connectivity?

A.Modify the Redshift security group to allow inbound traffic on port 5439 from the Glue subnet.

B.Update the JDBC connection string to include ssl=true and sslmode=require.

C.Enable server-side encryption on the S3 bucket using AWS KMS.

D.Set the Redshift cluster parameter group to require_ssl=ON.

AnswerB

Ensures the JDBC driver uses SSL encryption.

Why this answer

To enforce TLS encryption for JDBC connections to Amazon Redshift, the connection string must include ssl=true and often sslmode=require. This is a client-side configuration that tells the JDBC driver to use SSL. Option A is incorrect because security groups control network access, not encryption.

Option C is incorrect because server-side encryption on S3 secures data at rest, not data in transit. Option D is incorrect because setting require_ssl=ON in the cluster parameter group enforces SSL on the server side, but the client (Glue) must still specify ssl=true in the JDBC URL to establish an encrypted connection. Therefore, the correct change is option B.

Full explanation →

227

MCQmedium

A data engineering team is responsible for ingesting streaming data from a fleet of IoT devices into Amazon S3 using Kinesis Data Firehose. The data volume spikes unpredictably, and the team has configured Kinesis Data Firehose with a buffer size of 5 MB and buffer interval of 60 seconds. During spikes, the team notices that the delivery to S3 is delayed, and some records are lost due to exceeding the service limits. The team needs to ensure no data loss and reduce delivery latency. What should the team do?

A.Implement an AWS Lambda function to pre-process the data and send it to Firehose in a throttled manner.

B.Increase the buffer size to 10 MB and buffer interval to 120 seconds to allow more data accumulation before delivery.

C.Use Amazon Kinesis Data Streams as the data source for Firehose to decouple ingestion and delivery.

D.Enable S3 Transfer Acceleration on the destination bucket.

AnswerC

Using Kinesis Data Streams as the data source decouples ingestion from delivery, providing a durable buffer that absorbs spikes. Firehose can be configured with smaller buffer settings for lower latency, and data is retained in the stream until delivered, preventing data loss.

Why this answer

Using Kinesis Data Streams as the data source for Firehose decouples ingestion and delivery. The stream acts as a durable buffer that can absorb unpredictable spikes, preventing data loss due to Firehose service limits. Firehose can then be configured with smaller buffer size/interval to reduce delivery latency, as the stream retains data until successful delivery.

Option B increases buffer size and interval, which would increase latency, contradicting the requirement. Option A adds complexity and does not directly address buffering. Option D is unrelated to Firehose buffering.

Full explanation →

228

MCQhard

A company uses AWS Glue to process data from multiple S3 buckets. The Glue job runs daily and reads data from a bucket that contains millions of small files (each < 1 MB). The job has been running for hours and is often close to the 8-hour timeout limit. Which optimization would MOST reduce the job's runtime?

A.Pre-process the data to consolidate small files into larger files before the Glue job.

B.Convert the source data from CSV to Parquet format.

C.Increase the number of DPUs allocated to the Glue job.

D.Use a larger Spark shuffle partition size.

AnswerA

Fewer, larger files reduce the overhead of opening and reading files.

Why this answer

The most impactful optimization for reducing the runtime of a Glue job that reads millions of small files is to consolidate those files into larger files prior to processing. Each small file incurs overhead for listing, opening, and reading, and Spark's task scheduler must create a separate task for each file or partition. By grouping small files (e.g., via S3 batch operations or a compaction job), the number of files decreases dramatically, reducing scheduling overhead and I/O operations.

While converting to Parquet (Option B) and increasing DPUs (Option C) can improve performance, their benefits are limited if the underlying file count remains high. A larger Spark shuffle partition size (Option D) only affects shuffle operations, not the initial file read overhead. Therefore, file consolidation is the most effective single change.

Full explanation →

229

MCQhard

A company runs an Amazon EMR cluster that processes sensitive data stored in Amazon S3. The security team requires that all data in transit between the EMR cluster and S3 be encrypted. Which configuration ensures this requirement is met?

A.Enable in-transit encryption within the EMR cluster using EMRFS.

B.Enable server-side encryption with S3 managed keys (SSE-S3) on the S3 bucket.

C.Configure the S3 endpoint to use TLS and ensure the EMR cluster uses HTTPS for S3 access.

D.Use an S3 access point with a bucket policy that denies HTTP requests.

AnswerC

TLS encrypts data in transit between EMR and S3.

Why this answer

Configuring the S3 endpoint to use TLS and ensuring the EMR cluster uses HTTPS for S3 access enforces encryption in transit between the cluster and S3. Option A is incorrect because enabling in-transit encryption within the EMR cluster using EMRFS encrypts data within the cluster, not data between the cluster and S3. Option B is incorrect because SSE-S3 encrypts data at rest on S3, not data in transit.

Option D is incorrect because an S3 access point with a bucket policy denying HTTP requests does not directly configure encryption in transit from the EMR cluster; it only denies non-HTTPS requests, but the cluster could still use HTTPS, and this is a bucket-level enforcement, not a direct configuration for the cluster.

Full explanation →

230

MCQhard

A data engineer uses AWS Glue to catalog data from an S3 bucket. The data is partitioned by year, month, day. After adding new partitions, the Glue Crawler does not detect them. What is the MOST likely reason?

A.The crawler is configured to only add new partitions to existing tables, but the table schema has changed.

B.The crawler runs only once and does not schedule subsequent runs.

C.The IAM role lacks permission to write to the Glue Data Catalog.

D.The partition depth exceeds the crawler's default limit.

AnswerA

If the schema changed, the crawler may skip partitions; or if the crawler is set to not update new partitions, it won't add them.

Why this answer

The Glue Crawler, by default, is configured to add new partitions only if the table schema remains unchanged. When new partitions are added to an S3 bucket, if the underlying data schema has changed (e.g., new columns, different data types), the crawler will not add those partitions to the existing table. This is a common safeguard to prevent schema drift from corrupting the cataloged table structure.

Exam trap

The trap here is that candidates often assume partition detection failures are due to permissions or depth limits, but AWS Glue's default schema-change protection is the subtle and less obvious cause.

How to eliminate wrong answers

Option B is wrong because even if the crawler runs only once, it should still detect new partitions during that single run; the issue is about detection failure, not scheduling frequency. Option C is wrong because if the IAM role lacked permission to write to the Glue Data Catalog, the crawler would fail entirely or produce an error, not silently skip new partitions. Option D is wrong because the default partition depth limit in AWS Glue Crawlers is 10 levels, and the given path (year/month/day) is only 3 levels deep, well within the limit.

Full explanation →

231

Multi-Selectmedium

A company is designing a data lake on Amazon S3. The data engineering team needs to implement a lifecycle policy to manage costs. Which TWO actions should be taken to reduce storage costs?

Select 2 answers

A.Transition objects to S3 Glacier Deep Archive after 90 days.

B.Transition objects to S3 One Zone-IA after 30 days.

C.Enable S3 Intelligent-Tiering.

D.Transition objects to S3 Standard-IA after 30 days.

E.Delete incomplete multipart uploads after 7 days.

AnswersA, E

Deep Archive is lowest cost for rarely accessed data.

Why this answer

Transitioning objects to S3 Glacier Deep Archive after 90 days significantly reduces storage costs for data that is rarely accessed and can tolerate a retrieval time of 12 hours. This lifecycle policy is a standard cost-optimization strategy for data lakes where historical or cold data does not require immediate access.

Exam trap

The trap here is that candidates often choose S3 Intelligent-Tiering or S3 Standard-IA as cost-saving measures without considering that the question specifically asks for lifecycle policy actions to reduce costs, and that Glacier Deep Archive and deleting incomplete multipart uploads are the most direct and effective actions for a data lake scenario.

Full explanation →

232

MCQeasy

A company uses Amazon DynamoDB as its primary data store for a web application. The application experiences high latency during peak hours. The data engineer notices that the table has a large number of items with the same partition key. Which DynamoDB feature should the engineer use to improve performance?

A.Redesign the partition key to use a composite key that includes a timestamp or random suffix.

B.Enable DynamoDB Accelerator (DAX) to cache read requests.

C.Create a global table to replicate data across multiple Regions.

D.Enable auto scaling on the table to increase write capacity.

AnswerA

A well-designed partition key prevents hot spots by distributing writes evenly.

Why this answer

The high latency is caused by a hot partition, where many items share the same partition key, overwhelming a single DynamoDB partition. Redesigning the partition key to include a timestamp or random suffix distributes the workload evenly across partitions, improving throughput and reducing latency. This directly addresses the root cause of the performance issue.

Exam trap

The trap here is that candidates often confuse caching solutions (DAX) or scaling mechanisms (auto scaling) with the need to fix the data model itself, which is the only way to resolve a hot partition caused by a skewed partition key.

How to eliminate wrong answers

Option B is wrong because DynamoDB Accelerator (DAX) caches read requests, which can reduce read latency but does not solve the underlying hot partition issue caused by skewed write or read traffic on a single partition key. Option C is wrong because creating a global table replicates data across multiple Regions for disaster recovery or low-latency global access, but it does not distribute load within a single table's partitions. Option D is wrong because enabling auto scaling increases the table's provisioned capacity, but if the workload is concentrated on one partition, the partition's throughput limit (3000 RCU or 1000 WCU) will still be exceeded, causing throttling and high latency.

Full explanation →

233

MCQmedium

A company uses AWS Glue DataBrew to clean and prepare data for machine learning. The source data is in an S3 bucket with server-side encryption using AWS KMS (SSE-KMS). The DataBrew project is set up with an IAM role that has permissions to read from the S3 bucket and use the KMS key. When the DataBrew job runs, it fails with an error indicating that it cannot access the data. The IAM role has the following policy: { 'Version': '2012-10-17', 'Statement': [ { 'Effect': 'Allow', 'Action': ['s3:GetObject', 's3:ListBucket'], 'Resource': ['arn:aws:s3:::my-bucket', 'arn:aws:s3:::my-bucket/*'] }, { 'Effect': 'Allow', 'Action': 'kms:Decrypt', 'Resource': 'arn:aws:kms:us-east-1:123456789012:key/my-key' } ] }. What is the most likely cause of the failure?

A.The IAM role is missing s3:PutObject permission on the DataBrew output bucket.

B.The IAM role is missing s3:ListBucket permission on the source bucket.

C.The S3 bucket is in a different region than the DataBrew project.

D.The IAM role is missing kms:GenerateDataKey permission for the KMS key.

AnswerA

DataBrew writes to its own S3 bucket for job outputs; missing write permission causes failure.

Why this answer

The IAM role has permissions to read from the source S3 bucket (s3:GetObject, s3:ListBucket) and to decrypt using the KMS key (kms:Decrypt). However, DataBrew needs to write intermediate results to a separate output S3 bucket. The error indicates that the job cannot access data, which in the context of DataBrew often means it cannot write to the output bucket.

Therefore, the role is missing s3:PutObject permission on the output bucket. Option B is incorrect because the role already has s3:ListBucket on the source bucket. Option C is incorrect because the S3 bucket being in a different region would not cause an access denied error if the role has proper cross-region permissions; DataBrew can access buckets in any region.

Option D is incorrect because kms:Decrypt is sufficient for reading encrypted objects; kms:GenerateDataKey is needed for writing.

Full explanation →

234

MCQmedium

A company uses Kinesis Data Streams to ingest real-time clickstream data. The data is processed by a Lambda function that writes to an S3 bucket. Recently, the Lambda function has been failing with 'ProvisionedThroughputExceededException' errors. Which action should be taken to resolve this issue?

A.Increase the Lambda function's memory allocation.

B.Increase the number of shards in the Kinesis stream.

C.Enable enhanced fan-out for the stream.

D.Reduce the batch size in the Lambda event source mapping.

AnswerB

More shards increase throughput capacity.

Why this answer

The 'ProvisionedThroughputExceededException' error indicates that the Lambda function is reading data from the Kinesis stream faster than the stream's shard-level throughput limits allow. Each shard in a Kinesis Data Stream supports up to 2 MB/s read throughput or 5 read transactions per second. Increasing the number of shards distributes the read load across more shards, raising the total available read throughput and resolving the throttling.

Exam trap

The trap here is that candidates confuse ProvisionedThroughputExceededException (a read-side throttling error) with write-side throttling, leading them to choose options like reducing batch size or increasing memory, which do not address the shard-level read throughput limit.

How to eliminate wrong answers

Option A is wrong because increasing Lambda memory allocation improves compute performance (CPU, network) but does not affect the read throughput limits of the Kinesis stream shards, which is the root cause of the throttling. Option C is wrong because enhanced fan-out provides dedicated 2 MB/s read throughput per consumer per shard, which reduces contention between consumers but does not increase the total read capacity of the stream; the error is from exceeding shard-level limits, not from consumer contention. Option D is wrong because reducing the batch size decreases the number of records per invocation, but the Lambda function still reads from the same shard at the same rate; the throttling is caused by exceeding the shard's read throughput, not by batch size.

Full explanation →

235

Multi-Selecthard

A data engineer is designing a data pipeline that ingests data from multiple sources into Amazon S3, then processes it with AWS Glue and loads it into Amazon Redshift. Which THREE practices should be implemented to ensure data quality?

Select 3 answers

A.Implement data validation checks at the ingestion stage

B.Use AWS Glue DataBrew for data profiling and schema enforcement

C.Compress data files to reduce storage costs

D.Use manual sampling to check data quality periodically

E.Set up Amazon CloudWatch alarms for pipeline failures and data anomalies

AnswersA, B, E

Early validation catches errors before processing.

Why this answer

Implementing data validation checks at the ingestion stage ensures that only valid data enters the pipeline, catching issues early. Option B is correct because AWS Glue DataBrew provides data profiling and schema enforcement capabilities that help maintain data quality by identifying anomalies and enforcing schemas. Option E is correct because setting up Amazon CloudWatch alarms allows proactive monitoring of pipeline failures and data anomalies, enabling timely responses.

Option C is incorrect because compressing data files reduces storage costs but does not directly address data quality. Option D is incorrect because manual sampling is not scalable and cannot consistently ensure data quality in large-scale pipelines.

Full explanation →

236

MCQeasy

A company needs to store JSON documents that are accessed by a key-value pattern. The data is 500 GB and requires single-digit millisecond latency. Which AWS database is most suitable?

A.Amazon Redshift

B.Amazon DynamoDB

C.Amazon Neptune

D.Amazon RDS for MySQL

AnswerB

DynamoDB is a NoSQL key-value and document database with low latency.

Why this answer

Amazon DynamoDB is the most suitable choice because it is a fully managed NoSQL key-value and document database that delivers single-digit millisecond latency at any scale, making it ideal for storing and retrieving JSON documents via a key-value access pattern. It supports document data types natively and can handle 500 GB of data efficiently with consistent low-latency performance.

Exam trap

The trap here is that candidates may choose Amazon RDS for MySQL because they associate JSON documents with relational databases, overlooking that DynamoDB is purpose-built for key-value and document workloads with guaranteed single-digit millisecond latency, while RDS introduces schema rigidity and higher latency for this pattern.

How to eliminate wrong answers

Option A is wrong because Amazon Redshift is a petabyte-scale data warehouse optimized for complex analytical queries using SQL, not for low-latency key-value lookups on JSON documents; it incurs higher latency and is not designed for single-digit millisecond access patterns. Option C is wrong because Amazon Neptune is a graph database optimized for highly connected data and graph queries (e.g., using Gremlin or SPARQL), not for simple key-value access to JSON documents; it would add unnecessary complexity and cost. Option D is wrong because Amazon RDS for MySQL is a relational database that requires predefined schemas and is not optimized for key-value access patterns on JSON documents; while it can store JSON, it lacks the native partitioning and low-latency throughput of DynamoDB for this use case.

Full explanation →

237

MCQmedium

A company needs to monitor and record all changes to IAM policies in their AWS account. Which AWS service should be used?

A.Amazon CloudWatch Logs

B.Amazon GuardDuty

C.AWS CloudTrail

D.AWS IAM Access Analyzer

AnswerC

AWS CloudTrail records API calls, including IAM policy changes, making it the correct service for monitoring and recording changes to IAM policies.

Why this answer

AWS CloudTrail records API calls, including IAM policy changes, making it the correct choice for monitoring and recording changes to IAM policies. Option A is wrong because Amazon CloudWatch Logs is primarily for storing and monitoring log files, not for directly recording IAM changes. Option B is wrong because Amazon GuardDuty is a threat detection service, not designed for recording configuration changes.

Option D is wrong because AWS IAM Access Analyzer analyzes resource policies for public or cross-account access, not for recording changes.

Full explanation →

238

Multi-Selectmedium

A company wants to use AWS CloudTrail to monitor data events for an S3 bucket. Which TWO configurations are required to capture object-level API operations?

Select 2 answers

A.Configure the CloudTrail trail to log data events for the S3 bucket.

B.Enable management events in the CloudTrail trail.

C.Enable S3 server access logs on the bucket.

D.Create a CloudTrail trail in the same AWS Region as the S3 bucket.

E.Set up an Amazon CloudWatch Events rule to capture S3 events.

AnswersA, D

Data events capture object-level operations like GetObject, PutObject.

Why this answer

And Option D are correct. To capture object-level API operations for an S3 bucket, you must configure the CloudTrail trail to log data events for the bucket (Option A). Additionally, the CloudTrail trail must be created in the same AWS Region as the S3 bucket (Option D) because CloudTrail trails are region-specific.

Option B is incorrect because management events capture bucket-level operations, not object-level. Option C is incorrect because S3 server access logs are a separate logging mechanism, not part of CloudTrail. Option E is incorrect because CloudWatch Events is not required for CloudTrail to capture events.

Full explanation →

239

Multi-Selectmedium

A company uses Amazon Kinesis Data Firehose to ingest data into an S3 bucket. The data is in JSON format and the team wants to convert it to Parquet before storage. Which TWO configurations are required?

Select 2 answers

A.Use Kinesis Data Analytics to transform data to Parquet.

B.Create a Glue table with the schema of the data.

C.Configure a Lambda function to convert data on the fly.

D.Set up an Athena table to read the data.

E.Enable data format conversion in Firehose and set Output format to Parquet.

AnswersB, E

Firehose needs a schema for Parquet conversion.

Why this answer

Amazon Kinesis Data Firehose can automatically convert JSON data to Parquet format before delivery to S3. To enable this, you must: (1) Enable data format conversion in the Firehose delivery stream settings and set the output format to Parquet (Option E). (2) Provide a schema for the data, which is done by referencing an AWS Glue table that defines the schema (Option B). Option A is incorrect because Kinesis Data Analytics is not required; Firehose handles conversion natively.

Option C (Lambda) is a valid way to transform data but is not required and not listed as a configuration for this purpose. Option D (Athena) is for querying data already in S3, not for conversion during ingestion.

Full explanation →

240

MCQmedium

A company runs a production Amazon Redshift cluster. The data engineering team notices that queries are running slowly during peak hours. The cluster's CPU utilization is consistently above 80%. Which action should the engineer take to improve query performance?

A.Move some tables to Amazon Redshift Spectrum.

B.Re-distribute the tables using a different distribution key.

C.Enable concurrency scaling.

D.Perform an elastic resize to add more nodes.

AnswerD

Elastic resize adds nodes and CPU capacity quickly.

Why this answer

Performing an elastic resize allows adding nodes to the Redshift cluster, increasing CPU capacity and resolving the CPU bottleneck. Option A is incorrect: moving tables to Redshift Spectrum offloads queries to S3 but does not reduce CPU usage on the cluster for existing queries. Option B is incorrect: re-distributing tables might improve data distribution but does not directly address high CPU utilization.

Option C is incorrect: concurrency scaling helps with many concurrent queries by adding transient capacity, but it does not reduce CPU usage on the main cluster; it may even increase it.

Full explanation →

241

MCQhard

A company uses AWS Glue DataBrew for data preparation. The data source is an S3 bucket with millions of small CSV files (each < 1 MB). The DataBrew project takes a long time to load the sample data. What is the most likely cause and solution?

A.Use Amazon Athena to query the data instead of DataBrew

B.The DataBrew job is under-provisioned; increase the number of DPUs

C.The large number of small files causes S3 LIST overhead; concatenate files into larger files

D.Use AWS Glue ETL instead of DataBrew for this volume

AnswerC

S3 performance degrades with many small files; combining them reduces API calls.

Why this answer

DataBrew loads a sample of the data by listing objects in the S3 bucket. With millions of small CSV files, the S3 LIST API call becomes a bottleneck because each list operation has a 1000-object limit per response, requiring multiple paginated requests. Concatenating the small files into larger files reduces the number of objects, dramatically decreasing LIST overhead and speeding up sample loading.

Exam trap

The DEA-C01 exam often tests the misconception that increasing DPUs or switching to a different AWS service will fix performance issues, when the real root cause is S3's small-file overhead and the LIST API's pagination limit.

How to eliminate wrong answers

Option A is wrong because Athena is a query engine, not a data preparation tool; it would still suffer from the same small-file overhead when reading data, and it does not solve the DataBrew sample loading issue. Option B is wrong because DataBrew projects do not use DPUs for sample loading; DPUs are only relevant for running DataBrew jobs (recipes), and the bottleneck here is S3 LIST latency, not compute capacity. Option D is wrong because switching to Glue ETL would not inherently solve the small-file problem; Glue ETL also incurs overhead from listing and processing many small files, and the question specifically asks about DataBrew sample loading, not ETL job performance.

Full explanation →

242

Multi-Selecthard

A company uses Amazon Redshift for its data warehouse and needs to enforce column-level security on sensitive columns. Which TWO approaches can achieve this?

Select 2 answers

A.Apply an S3 bucket policy to the underlying data files.

B.Create views that expose only non-sensitive columns and grant access to the views.

C.Use Redshift Spectrum to query external tables and restrict columns via the external schema.

D.Use Redshift column-level security to grant or revoke permissions on specific columns.

E.Use Redshift row-level security policies to restrict column access.

AnswersB, D

Views can limit column visibility.

Why this answer

Options B and D are correct. Amazon Redshift natively supports column-level security, allowing you to grant or revoke permissions on specific columns (option D). Additionally, you can create views that include only non-sensitive columns and grant access to those views (option B), effectively achieving column-level access control.

Option A (S3 bucket policy) does not control access within Redshift. Option C (Redshift Spectrum) pertains to external tables and is not a column-level security feature. Option E (row-level security) controls rows, not columns.

Full explanation →

243

Multi-Selecteasy

Which TWO methods can be used to enforce least-privilege access to an Amazon S3 bucket? (Choose two.)

Select 2 answers

A.Use IAM policies to grant specific permissions to users and roles.

B.Set bucket ACLs to allow full control to the bucket owner only.

C.Use an S3 bucket policy that explicitly denies actions not required.

D.Configure a VPC endpoint to restrict access to the bucket.

E.Generate pre-signed URLs for all access.

AnswersA, C

IAM policies allow granular permissions.

Why this answer

IAM policies allow you to grant granular, specific permissions to individual users and roles, adhering to the principle of least privilege by explicitly allowing only the actions required. This avoids granting broad or default permissions, ensuring that each identity has only the access necessary for its function.

Exam trap

The trap here is that candidates often confuse network-level controls (like VPC endpoints) with identity-based access controls, or they mistakenly think that granting full control to the owner is a form of least privilege, when in fact it violates the principle by providing excessive permissions.

Full explanation →

244

Multi-Selecteasy

A data analytics company uses Amazon Athena to query data stored in an S3 bucket. The data contains personally identifiable information (PII). The security team wants to ensure that only authorized users can access the data through Athena, and that the data is encrypted at rest in S3. Which combination of actions should the company take? (Choose two.)

Select 2 answers

A.Attach an IAM policy to users that grants Athena access and S3 read access to the bucket.

B.Use AWS Lake Formation to define data lake permissions.

C.Use AWS Kinesis to stream data to Athena.

D.Create an S3 Access Point with a restricted policy.

E.Enable server-side encryption (SSE-S3) on the S3 bucket.

AnswersA, E

Controls access to Athena and underlying data.

Why this answer

Attaching an IAM policy that grants Athena access and S3 read access to the bucket ensures that only authorized users can access the data through Athena via IAM permissions. Option E is correct because enabling server-side encryption (SSE-S3) on the S3 bucket ensures data is encrypted at rest. Option B is incorrect because while Lake Formation can be used for data lake permissions, it is not required for this scenario; IAM policies are sufficient.

Option C is incorrect because Kinesis is a streaming service, not used for querying data in Athena. Option D is incorrect because an S3 Access Point with a restricted policy could be used but is not necessary when IAM policies already provide the required access control.

Full explanation →

245

MCQmedium

A data engineering team needs to load data from an on-premises Oracle database to Amazon S3 daily. The data volume is about 50 GB per day, and the network bandwidth is 100 Mbps. The team wants to minimize operational overhead and use AWS managed services. Which solution should they choose?

A.Use AWS Database Migration Service (DMS) to migrate the data to S3.

B.Use AWS DataSync to copy the database files directly to S3.

C.Use AWS Glue with a JDBC connection and schedule a crawler to load data into S3.

D.Use Amazon Kinesis Data Firehose to stream data from Oracle to S3.

AnswerA

DMS supports ongoing replication and scheduled migrations from Oracle to S3.

Why this answer

AWS DMS is the correct choice because it is purpose-built for migrating databases to AWS with minimal operational overhead. It can connect to an on-premises Oracle database via a JDBC or native Oracle connection, perform a full load, and then continuously replicate changes to an S3 target in Parquet or CSV format. With 50 GB/day over 100 Mbps (about 10.8 GB/hour theoretical max), the full load can complete in under 5 hours, and ongoing replication handles daily increments without manual intervention.

Exam trap

The trap here is that candidates confuse AWS DataSync's ability to transfer files with database migration, overlooking that DataSync cannot interpret database schemas or perform logical replication, while DMS is the only managed service that directly handles database-to-S3 ingestion with CDC.

How to eliminate wrong answers

Option B is wrong because AWS DataSync is designed for file-based data transfers (e.g., NFS, SMB) and cannot directly read Oracle database files or perform logical replication; it would require exporting the database to flat files first, adding operational overhead. Option C is wrong because AWS Glue with a JDBC connection and a scheduled crawler is intended for cataloging and ETL, not for continuous or scheduled data ingestion; Glue crawlers do not perform incremental loads or handle change data capture, and running them daily on 50 GB would be inefficient and costly. Option D is wrong because Amazon Kinesis Data Firehose requires a streaming data source (e.g., from an application or CDC tool) and cannot directly connect to an Oracle database; it would need an intermediary like DMS or a custom producer to stream data, adding complexity.

Full explanation →

246

MCQmedium

A company wants to centrally manage encryption keys for multiple AWS services and automatically rotate them every year. Which AWS service should be used?

A.AWS CloudHSM

B.AWS Certificate Manager (ACM)

C.AWS Secrets Manager

D.AWS Key Management Service (KMS)

AnswerD

KMS can automatically rotate customer managed keys yearly.

Why this answer

AWS KMS manages encryption keys and supports automatic key rotation annually. Option A is wrong because CloudHSM provides hardware-based key storage but does not offer automatic key rotation. Option B is wrong because ACM manages SSL/TLS certificates, not encryption keys.

Option C is wrong because Secrets Manager is designed to manage secrets like database credentials, not encryption keys.

Full explanation →

247

MCQmedium

A team uses Amazon Redshift for analytics. They notice that some queries are slow and the system shows high disk usage. The team wants to improve query performance without adding more nodes. Which action should they take first?

A.Run the VACUUM and ANALYZE commands on the tables.

B.Enable compression on all columns.

C.Redistribute the tables by changing the distribution key to a column with high cardinality.

D.Modify the workload management (WLM) queue to increase concurrency.

AnswerA

VACUUM reclaims space, ANALYZE updates statistics.

Why this answer

VACUUM and ANALYZE are the first actions to take because they reclaim disk space from deleted rows and update table statistics, which can significantly improve query performance and reduce disk usage. Option B is incorrect because enabling compression on all columns is not a first step; compression is typically set during table creation and may not address current disk usage issues. Option C is incorrect: redistributing tables by changing the distribution key requires recreating the table, which is an invasive operation and not the first troubleshooting step.

Option D is incorrect: modifying the WLM queue affects concurrency management, not disk usage or query performance directly related to high disk usage.

Full explanation →

248

Multi-Selectmedium

Which TWO actions can help improve query performance in Amazon Redshift? (Choose two.)

Select 2 answers

A.Use appropriate sort keys for tables.

B.Disable SSL encryption for connections.

C.Use VARCHAR instead of CHAR for fixed-length strings.

D.Apply compression encodings to columns.

E.Increase the number of nodes in the cluster.

AnswersA, D

Sort keys help the query optimizer scan less data.

Why this answer

Defining appropriate sort keys in Amazon Redshift enables the query optimizer to use zone maps to skip irrelevant data blocks during table scans, significantly reducing the amount of data read from disk. Sort keys also improve the effectiveness of merge joins and the performance of range-restricted queries by physically co-locating rows with similar sort key values on disk.

Exam trap

The trap here is that candidates often assume scaling out (adding nodes) always speeds up individual queries, but in Redshift, query performance is more dependent on data layout (sort keys, distribution, compression) than on cluster size, and adding nodes primarily benefits concurrent workloads rather than single-query latency.

Full explanation →

249

MCQeasy

Refer to the exhibit. A data engineer creates an external table in AWS Glue Data Catalog pointing to an S3 bucket that contains encrypted objects (SSE-S3). The CREATE TABLE statement fails with an error. What change should be made to fix the error?

A.Change the SERDE to 'org.apache.hadoop.hive.serde2.lazy.LazySimpleSerDe'.

B.Add 'aws_iam_role' as a table property.

C.Include the KMS key ARN in the LOCATION.

D.Set 'has_encrypted_data' to 'true'.

AnswerD

The property tells the catalog that data is encrypted.

Why this answer

When creating an external table in AWS Glue Data Catalog that references an S3 bucket with SSE-S3 encrypted objects, you must set the table property 'has_encrypted_data' to 'true'. This allows Glue to properly read the encrypted data. Option A is unnecessary; Option B is not required for encryption; Option C is for SSE-KMS, not SSE-S3.

Therefore, Option D is the correct change.

Full explanation →

250

Multi-Selecthard

A company is using AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that only specific IAM roles can decrypt the data. Which TWO steps should the data engineer take? (Choose two.)

Select 2 answers

A.Use the default AWS managed KMS key for S3 (aws/s3)

B.Use SSE-S3 encryption instead of KMS

C.Create a customer-managed KMS key with a key policy that grants kms:Decrypt only to the allowed IAM roles

D.Add an IAM policy to the role that requires MFA for kms:Decrypt

E.Configure the S3 bucket to use SSE-KMS with the customer-managed key

AnswersC, E

Correct. The key policy on a customer-managed key can explicitly list which IAM roles are allowed to perform kms:Decrypt.

Why this answer

To ensure only specific IAM roles can decrypt data in S3 using KMS, you must create a customer-managed KMS key with a key policy that grants kms:Decrypt only to those roles (C). Then, configure the S3 bucket to use SSE-KMS with that key (E). This restricts decryption to only the allowed roles because the key policy explicitly controls access.

Option A uses the default AWS managed key which cannot be restricted to specific roles. Option B (SSE-S3) does not use KMS and hence cannot provide role-based decryption control. Option D, requiring MFA for decryption, adds an extra authentication factor but does not by itself restrict which roles can decrypt; it only strengthens the security of the roles that already have permission.

Therefore, D is not a step to ensure only specific roles can decrypt.

Full explanation →

251

Multi-Selecthard

A company ingests IoT sensor data into Amazon Kinesis Data Streams. The data must be enriched with device metadata from Amazon DynamoDB and then stored in Amazon S3 in Apache Parquet format. The solution must minimize latency and cost. Which THREE steps should a data engineer implement? (Choose three.)

Select 3 answers

A.Deliver the enriched data to Amazon Kinesis Data Firehose and enable Parquet conversion.

B.Configure an AWS Lambda function to read from the stream, enrich, and write to S3.

C.Use AWS Glue streaming ETL to enrich and convert data to Parquet.

D.Use Amazon EMR with Spark Streaming to process and store the data.

E.Perform a DynamoDB lookup in the Flink application for each record.

.Use Amazon Kinesis Data Analytics for Apache Flink to enrich the stream with data from DynamoDB.

AnswersA, E

This step is correct because Kinesis Data Firehose is a fully managed service that can automatically convert incoming data to Parquet format before delivering to S3, reducing latency and operational overhead.

Why this answer

The correct three steps are: using Amazon Kinesis Data Analytics for Apache Flink to enrich the stream with data from DynamoDB (null), performing a DynamoDB lookup in the Flink application for each record (E), and delivering the enriched data to Amazon Kinesis Data Firehose with Parquet conversion enabled (A). Kinesis Data Analytics for Apache Flink reads from Kinesis Data Streams, enriches each record via DynamoDB lookups, and outputs the enriched stream to Kinesis Data Firehose. Firehose automatically converts data to Apache Parquet before writing to S3, minimizing latency and cost by leveraging managed services without custom code or additional infrastructure.

Exam trap

The trap here is that candidates often assume Lambda is the simplest and cheapest option for stream enrichment, but they overlook Lambda's concurrency limits, execution duration constraints, and lack of native Parquet conversion, which increases both latency and cost compared to using Kinesis Data Firehose with Flink for enrichment.

Full explanation →

252

MCQmedium

A company wants to monitor and alert on unauthorized API calls in their AWS account. Which AWS service should be used to detect and notify on such events?

A.Amazon GuardDuty and AWS Security Hub

B.Amazon VPC Flow Logs and Amazon CloudWatch Logs

C.AWS Config and AWS Systems Manager

D.AWS CloudTrail and Amazon CloudWatch Events

AnswerD

AWS CloudTrail and CloudWatch Events: CloudTrail logs API calls, and CloudWatch Events can create rules to trigger notifications on specific API calls, such as unauthorized ones.

Why this answer

D is correct because AWS CloudTrail records all API calls in the AWS account, and Amazon CloudWatch Events (or EventBridge) can be configured with rules to detect specific API calls (e.g., unauthorized actions) and trigger notifications. Option A is incorrect because Amazon GuardDuty and AWS Security Hub are threat detection and security management services, not primarily for monitoring all API calls. Option B is incorrect because Amazon VPC Flow Logs capture network traffic metadata, not API calls.

Option C is incorrect because AWS Config monitors resource configuration changes, not API calls.

Exam trap

Candidates often assume GuardDuty is the go-to for API call monitoring, but GuardDuty focuses on threat detection, not comprehensive API logging. CloudTrail is the correct service for logging all API calls.

Full explanation →

253

MCQhard

A data engineer runs the describe-stream command and sees the output above. The stream has a retention period of 24 hours. The engineer needs to ensure that consumers can replay data for up to 7 days. Which action is required?

A.Increase the number of shards to allow more data storage.

B.Delete the stream and recreate it with a longer retention period.

C.Use the IncreaseStreamRetentionPeriod API to set retention to 168 hours.

D.Create new consumer applications that read from the stream.

AnswerC

The API can increase retention up to 365 days.

Why this answer

The describe-stream output shows a retention period of 24 hours, but the requirement is to allow consumers to replay data for up to 7 days (168 hours). Amazon Kinesis Data Streams supports modifying the retention period dynamically without recreating the stream, using the IncreaseStreamRetentionPeriod API or the update-shard-count command. Option C correctly uses this API to set retention to 168 hours, which is the maximum supported retention period for Kinesis Data Streams.

Exam trap

The trap here is that candidates often confuse shard count with storage capacity, assuming that more shards allow more data to be stored, when in fact shards only control throughput and retention is a separate, configurable parameter.

How to eliminate wrong answers

Option A is wrong because increasing the number of shards increases the stream's throughput capacity (read/write operations per second), not the data retention period; shards do not affect how long data is stored. Option B is wrong because deleting and recreating the stream is unnecessary and disruptive; Kinesis allows you to modify the retention period on an existing stream without data loss or downtime. Option D is wrong because creating new consumer applications does not change the retention period; consumers can only replay data within the existing retention window, so they would still be limited to 24 hours of replay.

Full explanation →

254

MCQhard

A company uses Amazon Kinesis Data Streams with a shard count of 10 to ingest clickstream data. The data is consumed by a Lambda function that transforms the records and writes to Amazon S3. Recently, the Lambda function started failing with 'ProvisionedThroughputExceededException' errors. The average record size is 5 KB, and the incoming data rate is 15 MB/s. What is the most likely cause and solution?

A.Increase the number of shards in the Kinesis data stream to 15.

B.Decrease the batch size of the Lambda event source mapping.

C.Increase the Lambda function's memory allocation to 3008 MB.

D.Increase the Lambda function's reserved concurrency.

AnswerA

Each shard provides 1 MB/s write capacity; 15 shards would support 15 MB/s.

Why this answer

The ProvisionedThroughputExceededException indicates that the total write throughput to the Kinesis stream is exceeding the provisioned capacity. With 10 shards, the maximum write throughput is 10 MB/s (1 MB/s per shard). The incoming data rate is 15 MB/s, which exceeds this limit, causing the error.

Increasing the shard count to 15 raises the write throughput to 15 MB/s, matching the incoming rate and resolving the issue.

Exam trap

The trap here is that candidates may focus on Lambda-side fixes (batch size, memory, concurrency) instead of recognizing that the error originates from the Kinesis stream's throughput capacity, which must be scaled horizontally by increasing shards.

How to eliminate wrong answers

Option B is wrong because decreasing the batch size of the Lambda event source mapping reduces the number of records per invocation but does not address the root cause of exceeding the stream's write throughput limit. Option C is wrong because increasing Lambda memory allocation improves compute performance but does not affect Kinesis stream throughput or the ProvisionedThroughputExceededException. Option D is wrong because increasing Lambda reserved concurrency allows more concurrent invocations but does not increase the stream's write capacity, which is the bottleneck.

Full explanation →

255

MCQeasy

A data engineer needs to ingest streaming data from a social media API into Amazon S3 for batch analytics. The data arrives at a rate of 500 records per second. Which service should be used to capture the stream?

A.Amazon Simple Notification Service (SNS)

B.Amazon Simple Queue Service (SQS)

C.Amazon Kinesis Data Streams

D.Amazon MQ

AnswerC

Kinesis Data Streams is designed for real-time streaming data ingestion.

Why this answer

Amazon Kinesis Data Streams is designed for real-time streaming data ingestion at scale, supporting throughput of up to 1 MB/s or 1,000 records per second per shard. With 500 records per second, Kinesis can reliably capture and store the social media API data for up to 365 days, enabling batch analytics via S3 delivery through Kinesis Firehose or custom consumers.

Exam trap

The trap here is that candidates confuse SQS's message queueing with Kinesis's stream processing, overlooking that SQS lacks ordered, replayable, and high-throughput streaming capabilities required for real-time data ingestion into S3.

How to eliminate wrong answers

Option A is wrong because Amazon SNS is a pub/sub messaging service for push notifications and fan-out, not designed for persistent, ordered streaming data ingestion or high-throughput record capture. Option B is wrong because Amazon SQS is a message queue for decoupling microservices with at-least-once delivery, but it lacks the shard-based parallelism, replay capability, and long-term retention needed for streaming data to S3. Option D is wrong because Amazon MQ is a managed message broker for ActiveMQ or RabbitMQ protocols, optimized for JMS and enterprise messaging, not for high-velocity stream ingestion or direct integration with S3 batch analytics.

Full explanation →

256

Multi-Selecthard

A data engineer needs to set up a data ingestion pipeline that reads from Amazon MSK (Managed Streaming for Kafka) and writes to Amazon S3 with transformations. The data is in Avro format and must be converted to Parquet. Which THREE components should be used together? (Choose THREE.)

Select 3 answers

A.AWS Lambda function to convert Avro to Parquet as a Firehose transformation

B.Amazon Athena to convert the data format

C.Amazon Kinesis Data Firehose delivery stream with MSK as source

D.Amazon MSK cluster as the data source

E.AWS Glue ETL job to read from MSK

AnswersA, C, D

Lambda can be used in Firehose to perform data transformation.

Why this answer

AWS Lambda can be used as a transformation function within a Kinesis Data Firehose delivery stream to convert Avro records to Parquet format before delivery to S3. This is a serverless, real-time approach that integrates directly with Firehose's transformation capabilities, avoiding the need for separate compute resources.

Exam trap

The trap here is that candidates often think AWS Glue ETL is required for format conversion in streaming pipelines, but Firehose with Lambda provides a simpler, real-time alternative for Avro-to-Parquet conversion without the overhead of a full ETL job.

Full explanation →

257

MCQmedium

A company is streaming IoT data from thousands of devices into Amazon Kinesis Data Streams. The data must be transformed in real time before being stored in Amazon S3. Which service should be used to perform the transformation as the data streams through Kinesis?

A.AWS Glue

B.Amazon Kinesis Data Analytics for Apache Flink

C.Amazon EMR

D.AWS Lambda

AnswerB

Correctly processes streaming data in real time with Flink.

Why this answer

Amazon Kinesis Data Analytics for Apache Flink is the correct choice because it is purpose-built for running Apache Flink applications that can perform real-time transformations, filtering, and enrichment on data streaming through Kinesis Data Streams before outputting the results to destinations like Amazon S3. It integrates natively with Kinesis Data Streams as a source and can write transformed data directly to S3 using a Flink sink, making it ideal for this streaming ETL use case.

Exam trap

The trap here is that candidates often choose AWS Lambda because it is a familiar serverless option for event-driven processing, but they overlook its limitations in execution time, payload size, and lack of native state management for complex transformations, which makes Kinesis Data Analytics for Apache Flink the more robust and scalable choice for continuous streaming ETL.

How to eliminate wrong answers

Option A is wrong because AWS Glue is primarily a batch ETL service that processes data in job runs, not a real-time streaming transformation engine; while Glue Streaming exists, it is based on Spark Streaming and requires a separate Glue job with a streaming source, not a native Kinesis Data Streams integration for real-time transformations. Option C is wrong because Amazon EMR is a managed Hadoop/Spark cluster platform that can process streaming data but requires manual cluster management, provisioning, and configuration of Spark Streaming or Flink, adding operational overhead that is unnecessary for a simple transformation before S3 storage. Option D is wrong because AWS Lambda can process Kinesis Data Streams records in near real-time, but it has a maximum execution timeout of 15 minutes and a payload limit of 6 MB per invocation, making it unsuitable for high-throughput, continuous transformations of thousands of devices' data without risk of throttling or data loss.

Full explanation →

258

Multi-Selecteasy

Which TWO AWS services can be used as sources for AWS Glue ETL jobs? (Choose two.)

Select 2 answers

A.Amazon Route 53

B.Amazon CloudFront

C.Amazon API Gateway

D.Amazon S3

E.Amazon RDS

AnswersD, E

S3 is a common source for Glue jobs.

Why this answer

Amazon S3 is a fully managed object storage service that serves as a common source for AWS Glue ETL jobs. Glue can read data from S3 using its built-in crawlers and connectors, supporting formats like Parquet, JSON, CSV, and Avro. The Glue Data Catalog can reference S3 locations, and ETL scripts can directly read from S3 buckets via the s3:// protocol.

Exam trap

The DEA-C01 exam often tests the misconception that any AWS service that stores or serves data (like Route 53 for DNS records or CloudFront for cached content) can be a Glue source, but Glue only supports sources that provide a direct data access interface (e.g., object storage, databases, or streaming services like Kinesis).

Full explanation →

259

Multi-Selectmedium

A company is using Amazon Redshift for data warehousing. They need to ensure that data is encrypted at rest and in transit. Which TWO configurations are required to meet these requirements?

Select 2 answers

A.Enable encryption on the Redshift cluster using AWS KMS.

B.Configure the Redshift cluster to require SSL connections.

C.Use AWS CloudHSM to manage encryption keys for Redshift.

D.Enable VPC Flow Logs on the Redshift subnet.

E.Enable EBS encryption on the Redshift cluster nodes.

AnswersA, B

KMS encrypts data at rest.

Why this answer

To encrypt data at rest in Amazon Redshift, you must enable encryption on the cluster using AWS KMS (Option A). To encrypt data in transit, you must configure the cluster to require SSL connections (Option B). Option C (CloudHSM) can be used for key management but is not a required configuration.

Option D (VPC Flow Logs) captures network metadata and does not encrypt traffic. Option E (EBS encryption) is not applicable to Redshift's managed storage.

Full explanation →

260

Multi-Selecthard

A company runs an Amazon EMR cluster processing data from S3. The data engineer notices that the cluster's task nodes are underutilized while core nodes are fully utilized. Which TWO steps should the engineer take to improve resource utilization?

Select 2 answers

A.Consolidate multiple small tasks into larger tasks.

B.Increase the number of core nodes.

C.Add more task nodes using Spot Instances.

D.Reduce the number of core nodes and increase the number of task nodes.

E.Move HDFS data from EBS to instance store volumes.

AnswersB, C

More core nodes distribute processing load.

Why this answer

The core nodes are fully utilized, indicating a need for more processing capacity. Increasing the number of core nodes (Option B) adds more resources for HDFS and processing. Adding task nodes with Spot Instances (Option C) provides additional compute capacity without increasing HDFS storage, offloading work from core nodes.

Option A (consolidating tasks) might reduce overhead but does not add capacity; Option D (reducing core nodes) would worsen utilization; Option E (moving HDFS from EBS to instance store) is not related to utilization and risks data loss.

Full explanation →

261

MCQeasy

A company is using AWS Glue to catalog data stored in Amazon S3. The data is partitioned by year, month, and day. A data analyst reports that new partitions are not automatically discovered by the Glue crawler. The crawler runs on a schedule every hour. What is the MOST likely reason for the missing partitions?

A.The IAM role used by the crawler does not have permission to list the S3 bucket.

B.The Glue Data Catalog is not configured to use a Hive metastore.

C.The number of partitions exceeds the Glue catalog limit of 100,000.

D.The crawler schedule is set to run too frequently.

AnswerA

Without s3:ListBucket permission, the crawler cannot see new partitions.

Why this answer

The IAM role used by the crawler must have permissions to list the S3 bucket and read its objects. Without s3:ListBucket permission, the crawler cannot discover new partitions in the bucket, even if it runs on schedule. Option B is incorrect because the crawler does not need a Hive metastore connection to discover partitions in S3; it can update the Glue Data Catalog directly.

Option C is incorrect because the partition limit is 1,000,000 (not 100,000) per table, and the scenario does not indicate that limit is reached. Option D is incorrect because running the crawler every hour is a reasonable frequency; if permissions are correct, it should discover new partitions at that interval.

Full explanation →

262

MCQmedium

Refer to the exhibit. A data engineer is running an AWS Glue job that reads data from an S3 source. The job fails with the error shown. What is the MOST likely cause?

A.The IAM role does not have s3:GetObject permission.

B.One of the source files is empty or corrupted.

C.The file is in JSON format but the schema expects Parquet.

D.The Glue job has insufficient memory allocated.

AnswerB

Empty file can return None when read, causing 'NoneType' has no attribute 'read'.

Why this answer

The error message indicates that the Glue job encountered a 'NullPointerException' or similar parsing failure when reading from S3. This typically occurs when a source file is empty or corrupted, causing the Spark DataFrame reader to fail during schema inference or data parsing. AWS Glue jobs rely on Spark's ability to read files; an empty or malformed file triggers a runtime error because Spark cannot extract any records or infer a valid schema from it.

Exam trap

The trap here is that candidates often assume permission errors (Option A) are the default cause of any S3-related failure, but the specific error message (NullPointerException) points to data corruption or empty files, not access control issues.

How to eliminate wrong answers

Option A is wrong because the error shown is a parsing or runtime exception, not an access denied error; if the IAM role lacked s3:GetObject permission, the job would fail with an AmazonS3Exception or AccessDenied error, not a NullPointerException. Option C is wrong because a mismatch between file format and expected schema (e.g., JSON vs. Parquet) would produce a format-specific parsing error (like 'Cannot parse JSON' or 'Parquet column not found'), not a generic NullPointerException.

Option D is wrong because insufficient memory typically causes an OutOfMemoryError or Spark executor failures, not a NullPointerException during file reading.

Full explanation →

263

Matchingmedium

Match each AWS service to its primary purpose in data engineering.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Serverless ETL and data catalog

Data warehousing and SQL analytics

Big data processing using Hadoop/Spark

Building and managing data lakes

Real-time streaming data ingestion

Why these pairings

The correct matches are: Amazon S3 → object storage for data lakes (A), AWS Glue → serverless ETL (B), Amazon Athena → interactive SQL queries on S3 (C), and Amazon Redshift → data warehousing (D). Common confusions involve mixing up services like Kinesis (streaming) with Glue (ETL) or Data Pipeline (orchestration) with Kinesis (ingestion).

Full explanation →

264

MCQhard

A company runs a real-time analytics platform on Amazon ECS that ingests streaming data from Amazon Kinesis Data Streams, processes it, and stores results in Amazon DynamoDB. The data volume spikes unpredictably, causing DynamoDB to throttle write requests. The application uses on-demand capacity mode. The data engineer notices that the throttling occurs on a specific partition due to a hot key. The hot key is a customer ID that receives a disproportionate number of writes. The application cannot change the partition key design immediately. The engineer needs to reduce throttling while maintaining low latency. Which solution is most effective?

A.Switch to provisioned capacity with auto scaling and increase the write capacity units.

B.Implement a write buffer using Amazon SQS, and have consumers write to DynamoDB at a controlled rate.

C.Enable DynamoDB Accelerator (DAX) to cache the hot key writes.

D.Use DynamoDB Streams to trigger a Lambda function that retries throttled writes.

AnswerB

SQS decouples the producers from the writes, allowing batch processing and reducing throttling.

Why this answer

Buffering writes through Amazon SQS decouples the ingestion rate from DynamoDB's capacity, allowing consumers to write at a controlled pace. This directly mitigates throttling on the hot key without requiring a partition key redesign, and SQS provides low-latency, durable buffering suitable for real-time analytics.

Exam trap

The trap here is that candidates often assume on-demand capacity eliminates all throttling, but it does not protect against hot key skew; they may also confuse DAX's read caching with write buffering, or think retrying throttled writes is a viable solution rather than a reactive fix that increases latency.

How to eliminate wrong answers

Option A is wrong because switching to provisioned capacity with auto scaling does not solve the hot key issue; throttling occurs on a specific partition regardless of total capacity, and increasing write capacity units would not prevent a single partition from exceeding its 1,000 WCU limit. Option C is wrong because DAX is a caching layer for reads, not writes; it cannot buffer or absorb write throttling on a hot key. Option D is wrong because using DynamoDB Streams to retry throttled writes introduces latency and does not prevent throttling; it only retries failed writes, which can lead to backlog and increased latency, not a controlled rate.

Full explanation →

265

MCQhard

A company is using an Amazon RDS for PostgreSQL database to store personally identifiable information (PII). The security team wants to ensure that database administrators cannot view the plaintext PII data. Which solution should a data engineer implement?

A.Use IAM policies to restrict DBA access to the RDS instance

B.Enable Dynamic Data Masking in RDS to obfuscate PII for all users

C.Enable encryption at rest for the RDS instance using AWS KMS

D.Use client-side encryption with AWS KMS to encrypt PII before inserting into the database

AnswerD

Client-side encryption ensures data is encrypted before reaching the database, so DBAs cannot see the plaintext.

Why this answer

Using AWS KMS with client-side encryption ensures that data is encrypted before being sent to RDS, so database administrators cannot read the plaintext. Dynamic data masking in RDS is not natively supported; application-level masking would be needed. RDS encryption at rest protects data on disk but DBAs with access can still query plaintext.

Using IAM policies to restrict access does not prevent DBAs with database credentials from viewing data.

Full explanation →

266

Multi-Selectmedium

Which TWO services can be used to ingest streaming data into Amazon S3? (Choose two.)

Select 2 answers

A.Amazon Athena

B.AWS Glue

C.Amazon Kinesis Data Streams

D.AWS Database Migration Service (DMS)

E.Amazon Kinesis Data Firehose

AnswersC, E

Data Streams can be consumed and written to S3 via a consumer application.

Why this answer

Amazon Kinesis Data Streams is a real-time streaming service that can ingest and store streaming data, which can then be consumed and written to Amazon S3 using a Kinesis Data Analytics or a custom consumer application. Amazon Kinesis Data Firehose is a fully managed service that can directly load streaming data into Amazon S3, Amazon Redshift, or Amazon Elasticsearch Service, with optional data transformation and compression.

Exam trap

The trap here is that candidates often confuse AWS Glue's ETL capabilities with real-time streaming ingestion, or mistakenly think Amazon Athena can ingest data because it queries S3, but neither service is designed for streaming data ingestion.

Full explanation →

267

MCQhard

A data engineer is designing a data lake on Amazon S3. The data is partitioned by year, month, day, and hour. The engineer needs to ensure that queries using Amazon Athena are cost-effective and performant. The data is written in Parquet format, and the total volume is 50 TB. Which approach minimizes query costs?

A.Use AWS Glue Data Catalog to catalog the data

B.Convert data to CSV format

C.Partition the data by year, month, day, and hour

D.Use S3 Intelligent-Tiering storage class

AnswerC

Partitioning allows Athena to scan only relevant partitions, reducing cost.

Why this answer

Partitioning by year, month, day, and hour allows Athena to use partition pruning, reading only the relevant S3 prefixes instead of scanning the entire 50 TB dataset. This drastically reduces the amount of data scanned per query, which directly lowers query costs (Athena charges per TB scanned). The existing Parquet format further optimizes performance through columnar storage and compression.

Exam trap

AWS often tests the misconception that simply cataloging data (Option A) or using a storage tier (Option D) directly improves query performance, when in fact only partitioning and efficient file formats reduce the data scanned by Athena.

How to eliminate wrong answers

Option A is wrong because using AWS Glue Data Catalog to catalog the data is a prerequisite for Athena to query the data, but it does not by itself reduce query costs or improve performance; it only provides schema and partition metadata. Option B is wrong because converting data to CSV format would increase the amount of data scanned (CSV is not columnar and lacks compression compared to Parquet), leading to higher query costs and slower performance. Option D is wrong because S3 Intelligent-Tiering is a storage class that optimizes storage costs based on access patterns, but it has no impact on Athena query costs or performance, which depend on data format and partitioning, not storage tier.

Full explanation →

268

MCQhard

A company runs a nightly Amazon EMR job that processes data from S3 and writes results back to S3. The job fails with 'OutOfMemoryError' in the reduce phase. The cluster currently uses 5 m5.xlarge instances. Which cost-effective change should the data engineer make?

A.Increase the number of core nodes to 10.

B.Increase the number of reducers (mapreduce.reduce.tasks) and keep the same instance type.

C.Reduce the input data size by filtering early in the job.

D.Switch to r5.xlarge instances for more memory per instance.

AnswerB

More reducers reduce memory per reducer, preventing OOM.

Why this answer

Increasing the number of reducers (mapreduce.reduce.tasks) distributes the memory load across the existing 5 m5.xlarge instances, reducing the per-reducer memory pressure and preventing OutOfMemoryError without adding cost. Option A (adding more core nodes) increases cost without directly addressing reducer memory. Option C (reducing input data) may affect completeness and is not a proper fix.

Option D (switching to r5.xlarge) is more expensive per instance, making it less cost-effective.

Full explanation →

269

MCQmedium

A financial services company uses Amazon Redshift for its data warehouse. The cluster has two nodes and is used for complex analytical queries. The company recently migrated from a single-node cluster to a two-node cluster to improve performance. After the migration, the data engineer notices that query performance has not improved as expected. Some queries are even slower than before. The engineer checks the workload management (WLM) queue configuration and sees that there is only one queue with a concurrency level of 5. The queries are mostly large scans and aggregations. The cluster's CPU utilization is low, but disk I/O is high. What should the data engineer do to improve query performance?

A.Apply compression to the tables to reduce the amount of data scanned.

B.Increase the concurrency level in the WLM queue to allow more queries to run simultaneously.

C.Add more nodes or upgrade to a larger node type to increase memory and reduce disk spills.

D.Change the distribution style of large tables to DISTSTYLE ALL to avoid data redistribution.

AnswerC

More memory reduces disk I/O by allowing intermediate results to stay in memory.

Why this answer

The high disk I/O and low CPU utilization indicate that queries are spilling to disk because the cluster lacks sufficient memory for large scans and aggregations. Adding more nodes or upgrading to larger node types (e.g., from dc2.large to dc2.8xlarge) increases the total memory, reducing disk spills and improving performance. Option A is incorrect because applying compression reduces the amount of data scanned, but the bottleneck here is memory, not scan volume.

Option B is incorrect because increasing the concurrency level would allow more queries to run simultaneously, increasing contention and likely worsening performance. Option D is incorrect because changing distribution style to DISTSTYLE ALL can help with data redistribution but does not directly address memory spilling; the primary issue is insufficient memory.

Full explanation →

270

MCQeasy

A data engineer is troubleshooting a failed Amazon Kinesis Data Firehose delivery stream. The stream is configured to deliver data to an Amazon S3 bucket. The error log shows: 'The destination S3 bucket's bucket policy does not allow the firehose to put objects.' What is the MOST likely issue?

A.The S3 bucket's ACL is configured to deny write access to the firehose.

B.The IAM role used by Firehose does not have the necessary permissions.

C.The S3 bucket policy does not include an Allow statement for the firehose to put objects.

D.The IAM role's trust policy does not allow Firehose to assume the role.

AnswerC

The bucket policy must explicitly grant s3:PutObject to the firehose's IAM role.

Why this answer

The error states the bucket policy does not allow the firehose to put objects. The solution is to add an Allow statement in the bucket policy granting the firehose's IAM role permission to execute s3:PutObject. Option A is incorrect because the error is about bucket policy, not ACLs.

Option B is incorrect because the error is already about permissions. Option D is incorrect because the issue is at the S3 bucket policy level, not IAM role trust policy.

Full explanation →

271

MCQhard

An IAM policy is attached to a role assumed by authenticated users via Amazon Cognito. What does this policy allow?

A.Users can read and write items in the Orders table where the partition key matches their Cognito identity ID.

B.Users can read any item in the Orders table using GetItem and Query.

C.Users can scan the entire Orders table but only if they use a filter expression.

D.Users can read items in the Orders table only if the partition key matches their Cognito identity ID.

AnswerD

The LeadingKeys condition restricts based on the partition key equal to the Cognito sub.

Why this answer

The policy uses a condition key like `dynamodb:LeadingKeys` with a value referencing `${cognito-identity.amazonaws.com:sub}`. This restricts DynamoDB actions to items where the partition key matches the user's Cognito identity ID, ensuring fine-grained access control. Option D correctly states that users can read items only when the partition key equals their identity ID, which is the intended behavior for row-level security.

Exam trap

The trap here is that candidates often assume the policy grants full read access (Option B) or includes write permissions (Option A), overlooking the critical condition that restricts access to only items matching the user's Cognito identity ID.

How to eliminate wrong answers

Option A is wrong because it claims both read and write permissions, but the policy only grants read actions (e.g., GetItem, Query) and does not include write actions like PutItem or UpdateItem. Option B is wrong because it says users can read any item, but the condition restricts access to items where the partition key matches the user's Cognito identity ID, not all items. Option C is wrong because it suggests scanning the entire table with a filter expression, but the condition on the partition key applies before any filter, and Scan is typically not allowed or would be blocked by the leading key restriction.

Full explanation →

272

MCQeasy

A company uses Amazon DynamoDB as the primary data store for a web application. The application experiences occasional throttling on write requests. The data engineer needs to implement a solution that handles throttling gracefully without losing data. Which approach should the engineer use?

A.Increase the provisioned write capacity to a higher value

B.Use an Amazon SQS queue to buffer write requests before sending to DynamoDB

C.Implement exponential backoff in the application's write retry logic

D.Enable DynamoDB Accelerator (DAX) to cache writes

AnswerC

Exponential backoff is a best practice to handle throttling effectively.

Why this answer

Implementing exponential backoff in the application's write retry logic is the standard AWS-recommended approach for handling DynamoDB throttling (ProvisionedThroughputExceededException). Exponential backoff gradually increases the wait time between retries, reducing the retry rate and allowing the throttling condition to subside, while ensuring no write data is lost as long as the retries eventually succeed. This approach is lightweight, requires no additional AWS services, and aligns with best practices for building resilient applications against DynamoDB throttling.

Exam trap

The trap here is that candidates often confuse DAX as a write cache or assume SQS is the only way to buffer writes, but the question specifically asks for handling throttling gracefully without losing data, and exponential backoff is the direct, built-in mechanism for retrying throttled requests in DynamoDB.

How to eliminate wrong answers

Option A is wrong because simply increasing provisioned write capacity may reduce throttling but does not handle throttling gracefully when it occurs; it also incurs higher costs and does not address the root cause of occasional spikes. Option B is wrong because using an SQS queue to buffer write requests introduces eventual consistency and potential data loss if the queue messages expire or are not processed before the DynamoDB write; it also adds complexity and latency, and is not the standard pattern for handling DynamoDB throttling directly. Option D is wrong because DynamoDB Accelerator (DAX) is an in-memory cache for reads only, not writes; it cannot cache write requests or mitigate write throttling.

Full explanation →

273

MCQhard

A company uses AWS DMS to migrate data from an on-premises Oracle database to Amazon Redshift. The migration is successful, but after a few days, data in Redshift becomes inconsistent with the source due to ongoing changes. The company needs to keep Redshift synchronized with minimal latency. Which approach should the data engineer use?

A.Configure DMS with ongoing replication using change data capture (CDC).

B.Use Amazon Redshift COPY with S3 staging and AWS Lambda triggers.

C.Schedule a full DMS load every night.

D.Set up Amazon Redshift Spectrum to query the Oracle database directly.

AnswerA

CDC captures changes continuously and applies them to Redshift.

Why this answer

AWS DMS supports ongoing replication using change data capture (CDC), which captures incremental changes from the Oracle source (via Oracle LogMiner or binary logs) and applies them to Amazon Redshift in near real-time. This approach ensures that Redshift remains synchronized with the source database with minimal latency, meeting the requirement for ongoing consistency after the initial full load.

Exam trap

The trap here is that candidates may confuse Amazon Redshift Spectrum's federated querying capability with actual data replication, or assume that nightly batch loads (Option C) are sufficient for 'minimal latency' requirements, when DMS CDC is the only option that provides continuous, low-latency synchronization.

How to eliminate wrong answers

Option B is wrong because Amazon Redshift COPY with S3 staging and AWS Lambda triggers requires manual or event-driven extraction of data from Oracle, which introduces latency and complexity, and does not provide native CDC-based continuous replication. Option C is wrong because scheduling a full DMS load every night would result in significant data loss between loads (up to 24 hours of inconsistency) and does not achieve minimal latency. Option D is wrong because Amazon Redshift Spectrum queries external data directly from Oracle via federated querying, but it does not replicate or synchronize data into Redshift; it only provides a query-time view, which incurs high latency and does not maintain a consistent local copy.

Full explanation →

274

MCQmedium

A company uses AWS Lake Formation to manage data lake permissions. The data lake contains sensitive customer data in the 'customer' database. The security team wants to ensure that only users with a specific tag 'access_level=analyst' can query the 'customer' table. Which combination of steps should the data engineer take to enforce this?

A.In Lake Formation, create an LF-tag 'access_level' with values 'analyst' and 'admin'. Grant 'SELECT' permission on the 'customer' table to the tag value 'analyst'. Associate the LF-tag with the 'customer' table.

B.Create an IAM policy that conditionally allows 'glue:GetTable' based on the tag 'access_level=analyst'.

C.Apply a bucket policy on the S3 location of the 'customer' table that allows access only if the request carries the tag 'access_level=analyst'.

D.Use Lake Formation column-level filters to restrict access to columns based on the tag 'access_level=analyst'.

AnswerA

This uses Lake Formation TBAC to restrict access based on the user's tag.

Why this answer

Lake Formation LF-tags allow you to define metadata tags (key-value pairs) and grant permissions to those tags. By creating an LF-tag 'access_level' with values 'analyst' and 'admin', granting SELECT on the 'customer' table to the tag value 'analyst', and associating that LF-tag with the table, only principals who have the tag 'access_level=analyst' (or are granted via the tag) can query the table. This enforces tag-based access control at the Lake Formation permission layer, which is the intended mechanism for fine-grained, attribute-based access control in Lake Formation.

Exam trap

The trap here is that candidates often confuse IAM tag-based policies (Option B) or S3 bucket policies (Option C) with Lake Formation's native LF-tag mechanism, not realizing that LF-tags are a Lake Formation-specific construct that must be managed within Lake Formation itself, not at the IAM or S3 level.

How to eliminate wrong answers

Option B is wrong because an IAM policy conditionally allowing 'glue:GetTable' based on a tag controls access to the Glue Data Catalog API, but it does not enforce Lake Formation permissions on the underlying data; Lake Formation permissions override IAM policies for registered locations, and this approach would not prevent a user with the tag from querying the table if Lake Formation grants are not also configured. Option C is wrong because S3 bucket policies operate at the object storage layer and cannot evaluate Lake Formation LF-tags; they can use IAM tags via the 'aws:RequestTag' condition key, but this would require the request to carry the tag, which is not how Lake Formation principals are identified, and it would bypass Lake Formation's centralized permission model. Option D is wrong because column-level filters in Lake Formation restrict access to specific columns based on a filter expression, not based on LF-tags; LF-tags are used for row-level or table-level permission grants, not for column-level filtering.

Full explanation →

275

MCQmedium

A company is using Amazon DynamoDB for a high-traffic web application. They notice increased read latency during peak hours. Which design change would best reduce read latency without increasing cost?

A.Increase read capacity units

B.Use DynamoDB global tables

C.Switch to strongly consistent reads

D.Enable DynamoDB Accelerator (DAX)

AnswerD

DAX is a caching layer that reduces read latency.

Why this answer

DynamoDB Accelerator (DAX) is an in-memory cache that reduces read latency from single-digit milliseconds to microseconds for eventually consistent reads, without requiring any changes to provisioned capacity. Since the question specifies reducing latency without increasing cost, DAX is ideal because it offloads read traffic from the underlying table, allowing you to potentially lower read capacity units (RCUs) while maintaining performance.

Exam trap

The trap here is that candidates often confuse increasing provisioned capacity (Option A) with reducing latency, but DynamoDB's internal latency is dominated by storage I/O and network round trips, not capacity units—DAX addresses the actual bottleneck by caching hot data in memory.

How to eliminate wrong answers

Option A is wrong because increasing read capacity units (RCUs) would directly increase cost, and while it can reduce throttling, it does not inherently reduce per-request latency caused by internal DynamoDB overhead or hot partitions. Option B is wrong because global tables are designed for multi-region replication and disaster recovery, not for reducing read latency within a single region; they would increase cost due to replication writes and cross-region traffic. Option C is wrong because switching to strongly consistent reads actually increases latency (as they require a quorum read from multiple storage nodes) and consumes twice the RCUs, thus increasing cost without improving performance.

Full explanation →

276

MCQmedium

A data engineer is designing a data store for real-time analytics on high-velocity clickstream data. The data must be stored in a schema-on-read format and support SQL queries with sub-second latency. Which service should be used?

A.Amazon Redshift

B.Amazon Kinesis Data Firehose to S3 with Athena

C.Amazon Kinesis Data Analytics

D.Amazon DynamoDB

AnswerB

Firehose streams data to S3, Athena queries with schema-on-read and partitioning for low latency.

Why this answer

Amazon Kinesis Data Firehose can ingest high-velocity clickstream data and deliver it to Amazon S3, where it is stored in a schema-on-read format (e.g., Parquet or ORC). Amazon Athena then allows SQL queries directly on the data in S3 with sub-second latency when using partitions, columnar formats, and optimizations like AWS Glue Catalog. This combination meets the requirements for real-time analytics without predefining a schema.

Exam trap

The trap here is that candidates confuse Amazon Kinesis Data Analytics (which processes streams but does not store data) with a storage solution, or they assume Amazon Redshift is suitable for real-time streaming without recognizing its schema-on-write requirement and higher latency for ad-hoc queries.

How to eliminate wrong answers

Option A is wrong because Amazon Redshift requires a predefined schema (schema-on-write) and is optimized for batch analytics, not sub-second latency on high-velocity streaming data without significant preprocessing. Option C is wrong because Amazon Kinesis Data Analytics processes streaming data in real time using SQL but does not store the data persistently in a schema-on-read format; it is for transient analytics, not a data store. Option D is wrong because Amazon DynamoDB is a NoSQL key-value and document database that does not support SQL queries natively (it uses PartiQL with limitations) and is schema-on-write, not schema-on-read, making it unsuitable for ad-hoc SQL analytics on clickstream data.

Full explanation →

277

Multi-Selectmedium

A data engineer needs to audit all access to an S3 bucket containing sensitive data. The engineer must capture who accessed the bucket, from which IP address, and what actions were performed. Which AWS services should be used together to meet this requirement? (Choose THREE.)

Select 3 answers

A.Amazon CloudWatch Logs

B.AWS Config

C.Amazon S3 server access logs

D.AWS CloudTrail

E.VPC Flow Logs

AnswersA, C, D

Amazon CloudWatch Logs can ingest and analyze log data from various sources.

Why this answer

Amazon CloudWatch Logs (A) can ingest and analyze log data from various sources. Amazon S3 server access logs (C) provide detailed records of requests made to the S3 bucket, including the requester, IP address, and actions. AWS CloudTrail (D) records API calls with identity and source IP, enabling auditing of who accessed the bucket.

AWS Config (B) tracks resource configuration changes, not access logs. VPC Flow Logs (E) capture network traffic, not S3 API details.

Full explanation →

278

MCQhard

A company runs a time-series forecasting model that writes results to an S3 bucket every 5 minutes. A downstream ETL job reads this data, but sometimes fails because it encounters incomplete files (zero bytes). What is the MOST reliable way to ensure the ETL job only processes complete files?

A.Set an S3 Lifecycle policy to delete files smaller than 1 MB.

B.Use S3 Copy to move files to a 'processed' folder after the ETL job reads them.

C.Configure S3 Select to query the files and only return rows if the file is complete.

D.Use S3 Event Notifications to trigger a Lambda function that checks file size and then moves the file to a 'ready' prefix.

AnswerD

Lambda can verify completeness before moving, ensuring only complete files are processed.

Why this answer

S3 Event Notifications can trigger a Lambda function upon object creation, which can check the file size (e.g., > zero bytes) and then copy the file to a 'ready' prefix, ensuring the ETL job only processes complete files. Option A is wrong because an S3 Lifecycle policy can delete small files but does not prevent the ETL from reading incomplete files. Option B is wrong because S3 Copy does not verify completeness.

Option C is wrong because S3 Select still reads the file even if it is incomplete; it doesn't guarantee completeness.

Full explanation →

279

MCQmedium

A data engineering team needs to ingest streaming data from thousands of IoT devices and store it in Amazon S3 for batch processing. The data arrives at a rate of 10 MB/s, with occasional spikes up to 50 MB/s. The data must be processed in near real-time with minimal latency. Which AWS service should be used for ingestion?

A.Amazon DynamoDB Streams

B.Amazon Kinesis Data Streams

C.Amazon SQS

D.Amazon S3

AnswerB

Designed for real-time data streaming with high throughput and S3 integration via Kinesis Firehose.

Why this answer

Amazon Kinesis Data Streams is designed for real-time streaming data ingestion at scale, handling throughput from megabytes to gigabytes per second with low latency. It can absorb the described 10 MB/s baseline and 50 MB/s spikes by sharding, and integrates directly with AWS Lambda or Kinesis Data Firehose to land data into Amazon S3 for batch processing.

Exam trap

The trap here is that candidates confuse Amazon SQS with a streaming service, but SQS is a pull-based queue with no ordering guarantees across multiple consumers, whereas Kinesis Data Streams provides ordered, replayable, and near-real-time data ingestion.

How to eliminate wrong answers

Option A is wrong because DynamoDB Streams captures changes to DynamoDB tables, not arbitrary streaming data from IoT devices, and its throughput is limited by the table's capacity, making it unsuitable for high-volume, low-latency ingestion. Option C is wrong because Amazon SQS is a message queue for decoupling components, not a streaming ingestion service; it does not support real-time processing with sub-second latency for continuous data streams and has a 256 KB message size limit. Option D is wrong because Amazon S3 is an object storage service, not a real-time ingestion endpoint; writing directly to S3 from thousands of devices would cause high latency due to HTTP overhead and lack of streaming semantics, and it cannot handle the required near-real-time processing.

Full explanation →

280

MCQeasy

Refer to the exhibit. A data engineer creates an IAM policy for a service role used by AWS Glue. What does the condition in the policy enforce?

A.The role can use the KMS key from any AWS service

B.The role can only use the KMS key when the request comes from Glue

C.The role can only use the KMS key for decrypting data

D.The role can only use the KMS key when the request comes from S3

AnswerD

kms:ViaService limits to S3 endpoints.

Why this answer

The condition uses the `kms:ViaService` key with value `s3.amazonaws.com`, which restricts KMS actions to requests originating from Amazon S3. Therefore, the role can only use the KMS key when the request comes from S3, making option D correct. Option A is incorrect because it does not allow any service; option B is incorrect because it specifies Glue instead of S3; option C is incorrect because it limits to decrypting only, but the condition does not specify the action.

Full explanation →

281

MCQeasy

A data engineer needs to store semi-structured JSON logs from multiple microservices in a cost-effective manner for later analysis using Amazon Athena. The logs are generated continuously, and the total volume is about 1 TB per day. The data must be queryable within minutes of arrival. Which storage solution is most appropriate?

A.Amazon DynamoDB table with JSON attribute

B.Amazon RDS for PostgreSQL table with JSON column

C.Amazon S3 bucket with partitioned folders

D.Amazon Redshift cluster with JSON ingestion

AnswerC

S3 is cost-effective, and Athena can query the data directly.

Why this answer

Amazon S3 with partitioned folders is the most appropriate solution because it provides a cost-effective, scalable storage layer for semi-structured JSON logs, and integrates natively with Amazon Athena for serverless querying. By partitioning the data by time (e.g., year/month/day/hour), Athena can use partition pruning to minimize scanned data, enabling queries within minutes of arrival. S3's low cost per GB and lifecycle policies further optimize storage for the 1 TB/day volume.

Exam trap

AWS often tests the misconception that a data warehouse (Redshift) or a NoSQL database (DynamoDB) is required for analytical queries on semi-structured data, when in fact S3 with Athena is the most cost-effective and scalable solution for serverless ad-hoc analysis on raw logs.

How to eliminate wrong answers

Option A is wrong because Amazon DynamoDB is optimized for key-value and document access patterns with low-latency reads/writes, not for ad-hoc analytical queries on large volumes of JSON logs; scanning 1 TB/day would be prohibitively expensive and slow, and it lacks native integration with Athena. Option B is wrong because Amazon RDS for PostgreSQL is a relational database designed for transactional workloads, not for storing and analyzing 1 TB/day of semi-structured logs; it would require manual partitioning, incur high storage costs, and cannot scale to petabyte-scale analytics efficiently. Option D is wrong because Amazon Redshift is a petabyte-scale data warehouse optimized for complex analytical queries, but it is overkill and more expensive than S3 for raw log storage; ingesting 1 TB/day of JSON logs into Redshift requires an ETL pipeline (e.g., COPY from S3) and incurs compute costs even when idle, whereas S3 with Athena is serverless and pay-per-query.

Full explanation →

282

MCQhard

A financial services company is building a real-time fraud detection system. Transaction data is ingested via Amazon Kinesis Data Streams and processed by an Amazon Kinesis Data Analytics for Apache Flink application that runs sliding window aggregations. The output is written to an Amazon S3 bucket for downstream analysis. The Flink application is configured with parallelism of 4 and checkpointing every minute. The company has noticed that the application is experiencing high latency and the checkpointing is frequently failing. The CloudWatch metrics show that the Flink application's CPU utilization is near 100% and the checkpoint duration is spiking to over 5 minutes. The data engineer needs to improve performance. Which action should the data engineer take?

A.Increase the number of shards in the source Kinesis stream to improve throughput.

B.Increase the parallelism of the Flink application to distribute the workload across more resources.

C.Increase the heap memory of the Flink application to handle larger state.

D.Decrease the checkpoint interval to 30 seconds to reduce the amount of state being checkpointed.

AnswerB

More parallelism can reduce CPU utilization and checkpoint time.

Why this answer

Increasing the parallelism of the Flink application allows the workload to be distributed across more resources, which reduces CPU pressure and checkpoint duration. The high CPU utilization and checkpoint spikes indicate that the current parallelism (4) is insufficient for the data volume. Option A is incorrect because increasing shards in the source stream without increasing parallelism may not help if the bottleneck is processing capacity, not ingestion throughput.

Option C is incorrect while increasing heap memory might help with state size, the primary issue here is CPU saturation, not memory. Option D is incorrect because decreasing the checkpoint interval would increase checkpoint frequency, potentially worsening failures and latency.

Full explanation →

283

Multi-Selectmedium

A company needs to protect sensitive data stored in Amazon S3 from unauthorized access. Which TWO actions should the data engineer take? (Choose two.)

Select 2 answers

A.Configure S3 bucket policies to require MFA for delete operations

B.Enable cross-region replication for all buckets

C.Set up an S3 Lifecycle policy to transition objects to Glacier

D.Enable S3 Block Public Access at the account level

E.Enable S3 Versioning on all buckets

AnswersA, D

Correct. Using S3 bucket policies with a condition that requires MFA for delete operations prevents unauthorized users from deleting objects, adding an additional security layer.

Why this answer

S3 Block Public Access at the account level prevents any public access to S3 buckets, ensuring data is not exposed. Requiring MFA for delete operations via bucket policies adds an extra layer of security by requiring a second factor. Cross-region replication is for disaster recovery, not security.

Lifecycle policies manage storage costs. Versioning protects against accidental deletion but does not prevent unauthorized access.

Full explanation →

284

MCQmedium

A company uses Amazon DynamoDB to store session data for a web application. The application experiences throttling errors during peak traffic. The data engineer observes that the table's read capacity is consistently at 100% and the write capacity is at 20%. The engineer needs to resolve the throttling with minimal cost. Which solution should the engineer implement?

A.Increase the provisioned read capacity units for the table.

B.Enable DynamoDB auto scaling for read capacity.

C.Implement DynamoDB Accelerator (DAX) to cache read-heavy workloads.

D.Decrease the provisioned write capacity units to free up budget for reads.

AnswerC

DAX reduces read load on the table by caching, lowering required read capacity.

Why this answer

The issue is read-heavy throttling with read capacity at 100% while write capacity is low. Implementing DynamoDB Accelerator (DAX) provides an in-memory cache that offloads read traffic from the table, reducing read capacity consumption and eliminating throttling without increasing provisioned capacity. This is the most cost-effective solution as it avoids scaling costs and leverages caching for repeated reads.

Exam trap

The trap here is that candidates may assume scaling (auto scaling or increasing capacity) is the only solution for throttling, overlooking that caching with DAX can resolve read-heavy throttling at a lower cost by reducing the actual read load on the table.

How to eliminate wrong answers

Option A is wrong because increasing provisioned read capacity units would resolve throttling but at a higher ongoing cost, which contradicts the requirement for minimal cost. Option B is wrong because enabling DynamoDB auto scaling for read capacity would dynamically adjust capacity but still incur costs for higher read units during peak traffic, not minimizing cost as effectively as caching. Option D is wrong because decreasing provisioned write capacity units does not free up budget for reads in a meaningful way—DynamoDB pricing is separate for read and write capacity, and reducing writes doesn't directly alleviate read throttling or reduce read costs.

Full explanation →

285

MCQhard

A company uses Amazon Redshift for data warehousing. The security team requires that all data be encrypted at rest using a key managed by the company. Which Redshift encryption option should be used?

A.Enable encryption using AWS managed key (default)

B.Use SSL/TLS encryption

C.Use hardware security module (HSM)

D.Specify a customer managed KMS key when enabling encryption

AnswerD

Redshift allows you to specify a customer managed KMS key for encryption.

Why this answer

Amazon Redshift supports encryption at rest using AWS KMS. To use a key managed by the company (customer managed key), you must specify a customer managed KMS key when enabling encryption. Option D is correct.

Option A uses an AWS managed key (default), which is not managed by the company. Option B refers to encryption in transit, not at rest. Option C: HSM is not directly supported for Redshift encryption; KMS is used.

Full explanation →

286

MCQhard

A company uses Amazon DynamoDB as the primary data store for a high-traffic application. Recently, read latency has increased significantly. The DynamoDB table has on-demand capacity mode. Which action is MOST effective to reduce read latency?

A.Add a DynamoDB Accelerator (DAX) cluster in front of the table

B.Switch the table to provisioned capacity mode with higher read capacity

C.Increase the read capacity units in the table's auto scaling settings

D.Enable DynamoDB Global Tables to distribute reads across regions

AnswerA

DAX caches reads, reducing latency.

Why this answer

DynamoDB Accelerator (DAX) is an in-memory cache that significantly reduces read latency for frequent reads, especially for high-traffic applications. Option B is incorrect because switching to provisioned capacity does not inherently reduce latency; it only manages throughput. Option C is incorrect because on-demand capacity mode does not use read capacity units or auto scaling settings for read capacity adjustments.

Option D is incorrect because Global Tables replicate data across regions for disaster recovery and global access, but do not reduce read latency for reads in the same region.

Full explanation →

287

MCQmedium

A company wants to grant cross-account access to an S3 bucket without using IAM roles. The data engineer needs to write a bucket policy that allows another AWS account to list objects. Which Principal should be specified in the bucket policy?

A.The AWS account ID that owns the bucket

B.The AWS account ID of the other account

C.The IAM user ARN in the other account

D.The root user of the other account

AnswerB

The Principal should be the other account's ID.

Why this answer

Specifying the AWS account ID of the other account as the Principal in the bucket policy grants cross-account access to all users and roles in that account, allowing them to list objects. Option A is incorrect because the owning account's ID would grant access to itself, not the other account. Option C is incorrect because specifying an IAM user ARN would restrict access to only that user, not the entire account.

Option D is incorrect because the root user is a specific principal, not the account-wide access needed for cross-account delegation.

Full explanation →

288

MCQeasy

A data engineer is reviewing the lifecycle configuration of an S3 bucket. The bucket stores log files. The engineer wants to ensure that objects are deleted after 365 days. What is the current behavior?

A.Objects are deleted after 365 days.

B.Objects are transitioned to S3 Standard-IA immediately.

C.Objects are transitioned to S3 Glacier after 365 days.

D.Noncurrent versions of objects are deleted after 365 days.

AnswerA

The expiration rule sets deletion after 365 days.

Why this answer

The lifecycle configuration is set to expire objects after 365 days, which means the S3 service will automatically delete the objects once they reach that age. Since the question states the engineer wants to ensure deletion after 365 days and the current behavior matches that, option A is correct. No transition actions are defined, so objects remain in the original storage class until expiration.

Exam trap

The trap here is that candidates often confuse expiration (deletion) with transition (moving to another storage class), or assume that a lifecycle rule for current versions automatically applies to noncurrent versions, which is not the case without explicit NoncurrentVersionExpiration configuration.

How to eliminate wrong answers

Option B is wrong because transitioning to S3 Standard-IA immediately would require a specific lifecycle rule with a transition action set to 0 days, which is not described in the scenario. Option C is wrong because transitioning to S3 Glacier after 365 days would require a transition action, not an expiration action, and the scenario only mentions deletion. Option D is wrong because deleting noncurrent versions after 365 days applies only to versioned buckets with a NoncurrentVersionExpiration action, which is not indicated in the current configuration.

Full explanation →

289

MCQhard

A data engineer is designing a data lake on Amazon S3 that must comply with a regulatory requirement to prevent any data from being overwritten or deleted for 7 years after creation. Which S3 feature should be used?

A.S3 bucket policy that denies s3:DeleteObject

B.S3 bucket versioning with MFA Delete

C.S3 Object Lock with retention mode set to COMPLIANCE

D.S3 bucket versioning only

AnswerC

COMPLIANCE retention prevents any deletion or overwrite during the retention period.

Why this answer

S3 Object Lock with retention mode set to COMPLIANCE ensures that objects cannot be overwritten or deleted for the specified retention period (7 years). The retention period cannot be shortened or removed by any user, including the root user, making it suitable for regulatory compliance. Option A is incorrect because a bucket policy that denies s3:DeleteObject can be modified or removed, and it does not prevent overwrites.

Option B is incorrect because MFA Delete requires an additional authentication factor but can still be disabled by an authorized user, and it does not enforce a retention period. Option D is incorrect because bucket versioning alone does not prevent deletion; it only creates delete markers, and objects can still be permanently deleted.

Full explanation →

290

Multi-Selecthard

A data engineer is troubleshooting a Kinesis Data Streams consumer application that is falling behind. The stream has 10 shards and is receiving 5 MB/s of data. The consumer uses the Kinesis Client Library (KCL) with a single worker. The worker is processing all 10 shards but is experiencing high latency and checkpointing delays. Which THREE actions should the engineer take to improve consumer performance? (Select THREE.)

Select 3 answers

A.Increase the number of KCL workers to match the number of shards.

B.Enable enhanced fan-out for the consumer.

C.Decrease the checkpoint interval to reduce checkpointing overhead.

D.Increase the KCL maxRecords parameter to process more records per call.

E.Increase the number of shards in the stream.

AnswersA, B, D

Multiple workers can process shards in parallel, reducing per-worker load.

Why this answer

The KCL worker is processing all 10 shards sequentially within a single worker, causing a bottleneck. By increasing the number of KCL workers to match the number of shards, each worker can process one shard in parallel, significantly improving throughput and reducing latency. This is a standard scaling pattern for KCL-based consumers.

Exam trap

The trap here is that candidates may think decreasing the checkpoint interval (Option C) reduces overhead, when in fact it increases the frequency of DynamoDB writes and can degrade performance; the correct approach is to increase the checkpoint interval or use asynchronous checkpointing.

Full explanation →

291

Multi-Selecthard

A company is migrating an on-premises Apache Hadoop cluster to Amazon EMR. The cluster uses HDFS for storage. Which THREE features of Amazon EMR help reduce storage costs compared to on-premises HDFS? (Choose THREE)

Select 3 answers

A.Leverage Amazon S3 storage classes like S3 Standard-IA for older data.

B.Use instance store volumes for intermediate data.

C.Enable automatic data compression in EMRFS.

D.Use EMR File System (EMRFS) to store data in Amazon S3.

E.Attach Amazon EBS volumes to cluster nodes for persistent storage.

AnswersA, C, D

S3 storage classes allow cost optimization for infrequently accessed data.

Why this answer

Amazon S3 Standard-IA (Infrequent Access) offers lower storage costs than S3 Standard for data that is accessed less frequently, making it ideal for older or archival data in a Hadoop migration. By using S3 as the primary storage layer via EMRFS, you decouple compute from storage and avoid the replication overhead of HDFS (which typically uses 3x replication), significantly reducing storage costs.

Exam trap

The trap here is that candidates often confuse instance store volumes or EBS volumes as cost-saving alternatives, but the exam tests the understanding that S3-based storage with EMRFS is the primary mechanism for reducing storage costs in EMR by eliminating HDFS replication and enabling lifecycle management.

Full explanation →

292

Multi-Selectmedium

A data engineer is using Amazon DynamoDB to store session data for a web application. The engineer wants to ensure that all data is encrypted at rest using an AWS managed key. Which step should the engineer take to achieve this?

Select 1 answer

A.Enable server-side encryption with S3-managed keys (SSE-S3) on the DynamoDB table. [wrong]

B.Disable encryption at rest to improve performance. [wrong]

C.Specify an AWS KMS customer managed key for encryption if required. [wrong]

D.Use client-side encryption before writing data to DynamoDB. [wrong]

E.Create the DynamoDB table with encryption at rest enabled using an AWS managed key. [CORRECT]

AnswersE

Correct. Creating the DynamoDB table with encryption at rest enabled using an AWS managed key (the default) ensures all data is encrypted with a key owned and managed by AWS.

Why this answer

Only option E is correct. DynamoDB encryption at rest is enabled by default for new tables using an AWS managed key (aws/dynamodb). Creating the table with encryption at rest enabled using an AWS managed key ensures all data is encrypted with a key managed by AWS.

Option C is incorrect because specifying a customer managed key would override the default AWS managed key, which does not meet the requirement to use an AWS managed key. Options A, B, and D are incorrect: SSE-S3 is for S3, disabling encryption is unsafe and does not meet the requirement, and client-side encryption is separate from at-rest encryption.

Exam trap

Candidates often confuse the encryption options across AWS services (e.g., applying S3-specific SSE-S3 to DynamoDB) or mistakenly think that specifying a customer managed key is equivalent to using an AWS managed key. The key distinction is that 'AWS managed key' means the key is owned and managed by AWS (e.g., aws/dynamodb), not a customer-managed KMS key.

Full explanation →

293

MCQeasy

A data engineer needs to ingest real-time clickstream data from a website into Amazon S3 for analytics. The data arrives as JSON records, each under 1 KB. The engineer wants to use a serverless solution with automatic scaling and minimal operational overhead. Which AWS service should be used as the ingestion endpoint?

A.Amazon S3 with presigned URLs

B.Amazon Kinesis Data Analytics

C.Amazon Kinesis Data Firehose

D.AWS Lambda function behind an API Gateway

AnswerC

Serverless, automatically scales, delivers to S3 with optional transformation.

Why this answer

Amazon Kinesis Data Firehose is the correct choice because it is a fully managed, serverless service designed to ingest streaming data and automatically load it into Amazon S3 with no ongoing administration. It handles automatic scaling, converts incoming JSON records to formats like Parquet or ORC if needed, and can batch data into S3 based on time or size intervals, making it ideal for real-time clickstream ingestion with minimal operational overhead.

Exam trap

The DEA-C01 exam often tests the distinction between Kinesis Data Firehose and Kinesis Data Streams, where candidates mistakenly choose Data Streams for S3 ingestion, but Firehose is the correct serverless option for direct S3 delivery with automatic scaling and no consumer management.

How to eliminate wrong answers

Option A is wrong because Amazon S3 with presigned URLs is intended for direct uploads from clients, not for continuous real-time streaming ingestion, and it lacks automatic scaling and built-in data transformation capabilities. Option B is wrong because Amazon Kinesis Data Analytics is a service for running SQL or Apache Flink queries on streaming data, not an ingestion endpoint for loading data into S3. Option D is wrong because while an AWS Lambda function behind an API Gateway can ingest data, it requires manual scaling configuration, has a maximum payload size of 6 MB for API Gateway and 256 KB for synchronous Lambda invocations, and introduces higher operational overhead compared to a purpose-built streaming ingestion service like Firehose.

Full explanation →

294

MCQeasy

Refer to the exhibit. A data engineer checks the versioning status of an S3 bucket and sees the above output. The bucket contains critical logs that must not be permanently deleted. What should the engineer do to enhance protection against accidental or malicious deletion?

A.Enable MFA Delete on the bucket

B.Enable versioning on the bucket

C.Enable cross-region replication

D.Configure a lifecycle policy to expire noncurrent versions

AnswerA

MFA Delete requires additional authentication to permanently delete versions, protecting against accidental or malicious deletion.

Why this answer

Enabling MFA Delete on the bucket requires multi-factor authentication to delete object versions, which adds protection. Versioning is already enabled, so that is not needed. Enabling Object Lock with retention mode is another option, but the question asks for enhancement using the current setup; MFA Delete is a direct enhancement.

A lifecycle policy does not prevent deletion. Cross-region replication is for disaster recovery, not deletion protection.

Full explanation →

295

MCQhard

A company uses Amazon Kinesis Data Firehose to deliver streaming data to Amazon S3. The data is in JSON format and each record is about 2 KB. The delivery stream is configured to buffer data for 60 seconds or 5 MB, whichever comes first. The team notices that the S3 objects are very small (around 1 MB) and numerous, causing high costs due to S3 PUT requests. Which configuration change should the team make to reduce the number of S3 objects?

A.Enable compression (GZIP) on the delivery stream.

B.Increase the buffer size to 50 MB and the buffer interval to 300 seconds.

C.Reduce the buffer interval to 30 seconds and keep buffer size at 5 MB.

D.Switch from Kinesis Data Firehose to Amazon Kinesis Data Streams and use a Lambda function to write to S3.

AnswerB

Larger buffer accumulates more data before writing, resulting in fewer, larger objects.

Why this answer

Increasing the buffer size to 50 MB and the buffer interval to 300 seconds allows Kinesis Data Firehose to accumulate more data before writing to S3, resulting in fewer, larger objects. The current configuration triggers a write every 60 seconds or when 5 MB is buffered, but since each record is only 2 KB, the 5 MB threshold is rarely met, causing frequent small writes. By raising both thresholds, the delivery stream will buffer more records and write larger objects, reducing the number of S3 PUT requests and associated costs.

Exam trap

The trap here is that candidates often think reducing the buffer interval or enabling compression will reduce object count, but in reality, compression reduces object size (increasing count) and a shorter interval increases write frequency, both worsening the problem.

How to eliminate wrong answers

Option A is wrong because enabling GZIP compression reduces the size of the data written to S3, which would make objects even smaller and potentially increase the number of PUT requests, not decrease them. Option C is wrong because reducing the buffer interval to 30 seconds would cause more frequent writes to S3, increasing the number of small objects and exacerbating the cost issue. Option D is wrong because switching to Kinesis Data Streams with a Lambda function adds complexity and does not inherently reduce the number of S3 objects; the Lambda function would still need to batch writes appropriately, and without proper buffering, it could produce even more small objects.

Full explanation →

296

MCQhard

A data engineer is troubleshooting a Kinesis Data Streams application that is experiencing high latency. The stream has 2 shards. The application is using a single Kinesis Client Library (KCL) worker to process all shards. Which change will MOST likely reduce latency?

A.Increase the number of shards to 4.

B.Deploy multiple KCL workers to process shards in parallel.

C.Use a larger instance type for the Kinesis stream.

D.Decrease the number of shards to 1.

AnswerB

Multiple workers can process shards concurrently, reducing latency.

Why this answer

The application uses a single KCL worker to process all 2 shards, which processes records sequentially and causes high latency. Deploying multiple KCL workers (ideally one per shard) enables parallel processing of shards, significantly reducing latency. Option A is incorrect because increasing shard count to 4 adds more capacity but does not address the bottleneck of a single worker; the same worker would process all 4 shards sequentially, potentially worsening latency.

Option C is incorrect because Kinesis Data Streams is a managed service; there is no instance type to change for the stream itself. The KCL worker runs on your compute resources, not on the stream. Option D is incorrect because decreasing shards to 1 reduces the level of parallelism, increasing the workload per shard and likely increasing latency further.

Full explanation →

297

Multi-Selectmedium

A company is using AWS Glue to run ETL jobs that read from Amazon S3 and write to Amazon Redshift. The jobs are failing intermittently with 'Out of Memory' errors. Which TWO actions should the data engineer take to resolve this issue? (Choose TWO.)

Select 2 answers

A.Switch the output to Amazon S3 instead of Redshift

B.Increase the number of DPUs allocated to the Glue job

C.Reduce the number of partitions in the input data

D.Increase the spark.sql.shuffle.partitions parameter

E.Enable job metrics in CloudWatch to monitor memory usage

AnswersB, E

More DPUs provide more memory.

Why this answer

Increasing the number of DPUs allocated to the Glue job (Option B) directly addresses the 'Out of Memory' errors by providing more memory and compute resources per executor. AWS Glue uses Apache Spark under the hood, where each DPU provides 4 vCPU and 16 GB of memory; adding more DPUs increases the total memory available for data processing, reducing the likelihood of OOM errors during shuffle or aggregation operations.

Exam trap

The trap here is that candidates often confuse increasing shuffle partitions (Option D) with a direct fix for OOM errors, when in fact it can increase memory pressure due to more concurrent tasks and metadata overhead, while the correct approach is to allocate more DPUs to scale memory and compute resources.

Full explanation →

298

MCQhard

A financial services company stores sensitive transaction data in an Amazon S3 bucket. Compliance requires that all objects be encrypted using SSE-KMS and that the bucket be protected from accidental deletion. Which combination of actions meets these requirements? (Select TWO.)

A.Enable MFA Delete on the bucket

B.Enable S3 Block Public Access

C.Add a bucket policy that denies PutObject if the object is not encrypted with SSE-KMS

D.Enable S3 Versioning on the bucket

E.Set default encryption to SSE-S3

AnswerC, D

This ensures all uploads use SSE-KMS.

Why this answer

A bucket policy with a condition denying PutObject unless the object's encryption status matches SSE-KMS (using the s3:x-amz-server-side-encryption-aws-kms-key-id condition key) enforces encryption at the upload level. This ensures that any object written to the bucket must be encrypted with a KMS key, meeting the compliance requirement.

Exam trap

The trap here is that candidates often confuse default encryption (which only applies when no encryption header is provided) with a bucket policy that enforces encryption on every upload, or they mistakenly think MFA Delete or Block Public Access can enforce encryption requirements.

How to eliminate wrong answers

Option A is wrong because MFA Delete protects against accidental deletion of objects and versions, but it does not enforce encryption requirements; it is a separate security control. Option B is wrong because S3 Block Public Access prevents public access to the bucket, but it has no effect on encryption enforcement. Option E is wrong because setting default encryption to SSE-S3 would encrypt objects at rest using Amazon S3-managed keys, not SSE-KMS, and it does not prevent users from uploading unencrypted objects via explicit overrides.

Full explanation →

299

MCQeasy

A data engineer needs to store semi-structured JSON files that are accessed infrequently but must be retrievable within minutes. The data is immutable and must be stored cost-effectively. Which AWS service should the engineer use?

A.Amazon DynamoDB with on-demand capacity

B.Amazon EBS with gp3 volume

C.Amazon S3 with S3 Standard-IA storage class

D.Amazon RDS for PostgreSQL with JSONB data type

AnswerC

S3 is designed for object storage, supports JSON, and Standard-IA is cost-effective for infrequent access with millisecond retrieval.

Why this answer

Amazon S3 Standard-IA (Infrequent Access) is designed for data that is accessed less frequently but requires rapid retrieval when needed, with retrieval times in milliseconds. It offers lower storage costs than S3 Standard while maintaining high durability and availability, making it ideal for storing immutable semi-structured JSON files that must be retrievable within minutes. The service is cost-effective for infrequently accessed data because it charges a retrieval fee per GB, but the storage price is significantly lower than standard tiers.

Exam trap

The trap here is that candidates often confuse 'infrequently accessed' with 'archival' and choose Glacier or Deep Archive, but the requirement for retrieval within minutes eliminates those options, while DynamoDB or RDS seem plausible for JSON but are not cost-effective for immutable, infrequently accessed data.

How to eliminate wrong answers

Option A is wrong because Amazon DynamoDB with on-demand capacity is a NoSQL database optimized for high-frequency, low-latency queries and is not cost-effective for infrequently accessed, immutable JSON files; it charges per read/write request unit and storage, which would be wasteful for archival-like data. Option B is wrong because Amazon EBS with gp3 volume is a block storage service designed for EC2 instances and requires an attached compute instance to access data, adding unnecessary cost and complexity; it is not a standalone object storage solution for infrequently accessed files. Option D is wrong because Amazon RDS for PostgreSQL with JSONB data type is a relational database service that incurs ongoing compute and storage costs, even when idle, and is overkill for storing immutable JSON files that are only occasionally retrieved; it is designed for transactional workloads and complex queries, not cost-effective archival storage.

Full explanation →

300

MCQmedium

A company uses Amazon EMR to run Spark jobs on a cluster of 20 nodes. The cluster stores intermediate data on Amazon S3 using EMRFS. The company's data engineering team notices that the Spark jobs are running slower than expected. Upon investigating, they find that the cluster is experiencing high network I/O and that the S3 storage costs have increased significantly. The team suspects that the Spark jobs are writing too much intermediate data to S3. The jobs are performing many shuffle operations. The team wants to optimize the job performance and reduce costs without modifying the Spark application code. What should the data engineer do?

A.Enable S3 server-side encryption on the S3 bucket to reduce storage costs.

B.Increase the size of the EBS root volumes on the cluster nodes to store more intermediate data locally.

C.Configure the EMR cluster to use instance store volumes for intermediate data instead of EMRFS.

D.Add more nodes to the cluster to distribute the shuffle load.

AnswerC

Instance store provides local ephemeral storage, reducing S3 dependency and network I/O.

Why this answer

Configuring the EMR cluster to use instance store volumes for intermediate data instead of EMRFS reduces the amount of data written to Amazon S3 during shuffle operations. Instance store volumes provide local, ephemeral storage that is faster and avoids network I/O and S3 costs associated with EMRFS. This directly addresses the high network I/O and increased S3 storage costs without modifying the Spark application code.

Option A is incorrect because enabling S3 server-side encryption does not affect performance or reduce the volume of data written; it only encrypts data at rest. Option B is incorrect because increasing the size of EBS root volumes does not change how shuffle data is stored; EMR uses instance store or EMRFS for shuffle, not EBS root volumes. Option D is incorrect because adding more nodes may increase network I/O and cost, and does not prevent the job from writing intermediate data to S3.

Full explanation →

Page 4 of 23

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23

Practice DEA-C01 by domain

Target a specific domain to shore up weak areas.

Data Ingestion and Transformation Data Operations and Support Data Security and Governance Data Store Management

See all domains with question counts →