Knowledge + Practice

AWS Certified Data Engineer Associate DEA-C01 (DEA-C01) — Questions 376–450

1711 questions total · 23pages · All types, answers revealed

Take a mock exam Exam hub

Page 6 of 23

376

MCQmedium

Refer to the exhibit. This KMS key policy is attached to a customer managed key. A data engineer finds that the DataEngineer role can encrypt but cannot decrypt data. What is the most likely cause?

A.The key policy does not include kms:Decrypt in the IAM policy section

B.The role does not have an IAM policy allowing kms:Decrypt

C.The key policy does not allow kms:Decrypt

D.The key policy does not allow kms:GenerateDataKey

AnswerB

The role needs an IAM policy that allows kms:Decrypt; the key policy alone is insufficient for IAM roles.

Why this answer

The key policy allows kms:Decrypt and kms:GenerateDataKey for the DataEngineer role, so the role can encrypt. However, KMS requires both key policy and IAM policy permissions for IAM roles. Since the role lacks an IAM policy that grants kms:Decrypt, it cannot decrypt.

Option A is incorrect because the key policy does include kms:Decrypt. Option C is incorrect because the key policy explicitly allows kms:Decrypt. Option D is incorrect because kms:GenerateDataKey is allowed in the policy; the issue is with decrypt.

Full explanation →

377

MCQmedium

A company uses Amazon Redshift for data warehousing. The security team requires that all data stored in Redshift be encrypted at rest using a customer-managed KMS key. How should the data engineer configure this?

A.Enable encryption using a KMS key when creating the Redshift cluster

B.Configure S3 SSE-KMS on the underlying S3 storage

C.Use the AWS KMS console to encrypt the Redshift cluster after creation

D.Set a cluster parameter group with encryption enabled

AnswerA

Encryption must be enabled at launch; you cannot add it later.

Why this answer

Redshift supports encryption at rest using KMS. You enable encryption when launching the cluster by choosing a KMS key. Option B is wrong because Redshift doesn't use S3 SSE-KMS for its own storage.

Option C is wrong because you cannot encrypt an existing cluster without restoring from snapshot. Option D is wrong because cluster parameter groups do not control encryption. Option A is correct.

Full explanation →

378

Multi-Selectmedium

A data engineer is troubleshooting an AWS Glue ETL job that fails with the error: 'An error occurred while calling o123.pyWriteDynamicFrame. Access Denied when writing to S3 bucket: my-bucket'. The job uses a Glue service role named 'GlueServiceRole'. Which TWO actions should the engineer take to resolve the issue? (Choose TWO.)

Select 2 answers

A.Disable S3 Block Public Access on the bucket.

B.Grant the GlueServiceRole permission to write to the AWS Glue Data Catalog.

C.Check if the S3 bucket policy denies access from the GlueServiceRole.

D.Verify that the IAM policy attached to GlueServiceRole includes s3:PutObject on the bucket.

E.Ensure the Glue job is in the same VPC as the S3 bucket.

AnswersC, D

Bucket policy may override IAM permissions.

Why this answer

The error message indicates an access denied when writing to S3, which can be caused by a bucket policy that explicitly denies the Glue service role's access, even if the IAM policy allows it. Option D is correct because the IAM policy attached to GlueServiceRole must include the s3:PutObject permission on the specific bucket to allow the Glue job to write data.

Exam trap

The trap here is that candidates may confuse S3 access errors with network or VPC issues, but S3 is a global service and access is governed by IAM and bucket policies, not VPC placement.

Full explanation →

379

Multi-Selectmedium

A data engineer needs to store event data from IoT devices that arrives in bursts. The data is key-value and requires single-digit millisecond read and write latency. The engineer also needs to run complex analytical queries on the data for reporting. Which TWO services should be used together? (Choose TWO.)

Select 2 answers

A.Amazon DynamoDB

B.Amazon ElastiCache for Redis

C.Amazon Redshift

D.Amazon S3

E.Amazon RDS for MySQL

AnswersA, C

Provides low-latency access for key-value data.

Why this answer

Amazon DynamoDB is correct because it provides single-digit millisecond read and write latency at any scale, making it ideal for IoT event data arriving in bursts. Its key-value data model matches the requirement, and it can serve as the operational data store for fast ingestion while supporting complex analytical queries when integrated with Amazon Redshift.

Exam trap

The trap here is that candidates often choose ElastiCache for Redis because of its low latency, forgetting that it is not a durable data store for analytical queries, or they pick S3 thinking it can serve as a primary database, ignoring its lack of single-digit millisecond latency for key-value access.

Full explanation →

380

MCQmedium

A data engineering team needs to encrypt data at rest in an Amazon S3 bucket that stores sensitive customer information. The team must use an AWS Key Management Service (AWS KMS) customer managed key with automatic rotation enabled. Which configuration meets these requirements?

A.Use default encryption with SSE-KMS and specify the customer managed key ID.

B.Use default encryption with SSE-S3.

C.Use default encryption with SSE-C and provide a customer-provided key.

D.Use default encryption with SSE-KMS and leave the key ID empty to use the AWS managed key.

AnswerA

SSE-KMS with a customer managed key allows automatic rotation and customer control.

Why this answer

It enables SSE-KMS with a customer managed key that supports automatic key rotation, meeting the requirement for a customer managed key with automatic rotation. Option B is incorrect because SSE-S3 uses AWS managed keys that are not customer-controlled and do not support automatic rotation. Option C is incorrect because SSE-C requires the customer to provide and manage their own keys, and does not support automatic rotation.

Option D is incorrect because leaving the key ID empty defaults to the AWS managed KMS key, which is not a customer managed key and does not support automatic rotation.

Full explanation →

381

Multi-Selectmedium

Which TWO options are valid ways to reduce storage costs for an Amazon S3 data lake that stores historical data rarely accessed after 30 days? (Choose TWO.)

Select 2 answers

A.Enable S3 Transfer Acceleration for all uploads.

B.Create a lifecycle policy to transition objects to S3 Standard-IA after 30 days.

C.Create a lifecycle policy to delete objects after 30 days.

D.Create a lifecycle policy to transition objects to S3 Glacier Deep Archive after 90 days.

E.Enable S3 Versioning to preserve all object versions.

AnswersB, D

Standard-IA reduces storage cost for infrequent access.

Why this answer

S3 Standard-IA (Infrequent Access) is designed for data accessed less frequently but requires rapid access when needed. Transitioning objects to Standard-IA after 30 days reduces storage costs compared to S3 Standard while maintaining low-latency retrieval, making it ideal for a data lake where historical data is rarely accessed after the first month.

Exam trap

The trap here is that candidates often confuse data protection features (like Versioning) with cost optimization, or they assume that deleting data is the only way to reduce costs, overlooking lifecycle transitions to lower-cost storage classes that retain data accessibility.

Full explanation →

382

MCQeasy

A data engineer is troubleshooting a failed AWS Glue ETL job that reads from Amazon S3 and writes to Amazon Redshift. The job fails with the error: 'ERROR: Cannot insert a duplicate key into unique index'. The Redshift table has a primary key on the 'id' column. The data in S3 contains multiple records with the same 'id'. The engineer needs to ensure that only the latest record for each 'id' is loaded into Redshift. The data has a 'timestamp' column. Which approach should the engineer take?

A.Use the 'dropDuplicates' transformation in the Glue ETL script, ordering by 'timestamp' descending to keep the latest record for each 'id'.

B.Set the write mode to 'overwrite' in the Glue job to replace the entire Redshift table.

C.Load data into a staging table in Redshift and then use a MERGE operation to insert only new records.

D.Disable primary key constraints on the Redshift table before loading.

AnswerA

This removes duplicate IDs while preserving the most recent record.

Why this answer

Using the AWS Glue 'dropDuplicates' transformation on the 'id' column, ordering by 'timestamp' descending, will remove duplicate 'id' values, keeping the latest record. This is the direct approach within the Glue ETL script. Option B is incorrect because using 'overwrite' mode would replace the entire Redshift table, which would discard existing data and is not a targeted solution for handling duplicates.

Option C is incorrect because loading into a staging table and using MERGE requires additional setup and is not directly part of the Glue ETL script, making it less efficient for the stated requirement. Option D is incorrect because disabling primary key constraints only defers the duplicate key error, and it would compromise data integrity rather than properly deduplicating records.

Full explanation →

383

MCQmedium

A data engineer applies the above bucket policy to an S3 bucket containing sensitive data. The goal is to allow only encrypted (HTTPS) requests. However, a user reports being able to access an object using an HTTP (non-HTTPS) request. What is the most likely reason?

A.The policy uses Allow instead of Deny

B.The resource ARN does not include the bucket itself

C.The condition key aws:SecureTransport is used with BoolIfExists instead of Bool

D.The principal is set to "*", which allows anonymous access

AnswerC

BoolIfExists allows access if the key is missing, which happens with HTTP.

Why this answer

The policy uses "BoolIfExists" instead of "Bool" for the aws:SecureTransport condition. "BoolIfExists" evaluates to true if the key is absent (as in HTTP requests), thus the Deny effect is not triggered, allowing HTTP access. Option A is wrong because using Allow or Deny is not the issue; the condition key's evaluation is the problem. Option B is incorrect because the resource ARN must include the bucket itself when using bucket policies, but this is not relevant here.

Option D is wrong because a principal of "*" includes all authenticated users (not anonymous).

Full explanation →

384

Drag & Dropmedium

Arrange the steps to implement a data lake on Amazon S3 with AWS Lake Formation.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Start by creating the S3 bucket. Then register it in Lake Formation, set up administrators, define the schema in Glue Catalog, and finally grant access to users.

Full explanation →

385

MCQmedium

A company uses Amazon RDS for MySQL to store transactional data. The database contains sensitive financial information. The company's security policy requires that all data at rest be encrypted using a customer-managed KMS key. The database was originally launched without encryption at rest. The security team now needs to enable encryption without significant downtime. What should they do?

A.Create a snapshot of the database, copy the snapshot with encryption enabled, and restore a new DB instance from the encrypted snapshot.

B.Enable encryption by modifying the DB instance's storage type to 'encrypted'.

C.Use the AWS DMS (Database Migration Service) to migrate data to a new encrypted RDS instance.

D.Modify the DB instance and enable encryption under the 'Storage' settings.

AnswerA

This is the standard procedure to enable encryption on an existing RDS instance.

Why this answer

You cannot enable encryption on an existing RDS instance directly. To encrypt an unencrypted RDS instance, you must create a snapshot, copy it with encryption enabled using a customer-managed KMS key, and then restore a new encrypted DB instance. This method minimizes downtime.

Options B and D are incorrect because modifying the DB instance's storage settings does not allow enabling encryption in place. Option C (using DMS) could also achieve encryption but involves more downtime and complexity than the snapshot approach.

Full explanation →

386

Multi-Selecthard

A data engineer is designing an ETL pipeline that uses AWS Glue to process data from an Amazon DynamoDB table and write results to an S3 bucket in Parquet format. The pipeline must handle schema changes in the source DynamoDB table. Which THREE steps should the engineer take to ensure the pipeline handles schema evolution? (Choose THREE.)

Select 3 answers

A.Use Glue's 'recast' transformation to handle type changes.

B.Set the Glue crawler to update the table's schema in the Data Catalog.

C.Convert the Parquet output to CSV to avoid schema constraints.

D.Partition the data by date and delete old partitions.

E.Use Spark's 'mergeSchema' option when writing to S3.

AnswersA, B, E

recast can change data types to match the target schema.

Why this answer

Options A, B, and E are correct. Option A: Glue's 'recast' transformation can handle type changes by converting data types as needed. Option B: Setting the Glue crawler to update the table's schema in the Data Catalog ensures that new columns or changes in the source DynamoDB table are reflected.

Option E: Using Spark's 'mergeSchema' option when writing to S3 allows Parquet files to have differing schemas, enabling schema evolution. Option C is incorrect because converting Parquet to CSV does not help with schema evolution and may introduce data loss or inefficiency. Option D is incorrect because partitioning by date and deleting old partitions is a data retention strategy, not a schema evolution technique.

Full explanation →

387

MCQeasy

A company stores sensitive data in Amazon S3. To meet compliance requirements, they need to ensure that any data older than 1 year is automatically moved to a lower-cost storage class. Which S3 feature should they use?

A.S3 Replication

B.S3 Lifecycle policies

C.S3 Glacier

D.S3 Intelligent-Tiering

AnswerB

Lifecycle policies can transition objects to lower-cost storage classes based on age.

Why this answer

S3 Lifecycle policies allow you to define rules to automatically transition objects between storage classes based on age. Option B is correct. Option A is incorrect because S3 Replication is used to replicate objects across buckets, not to transition storage classes.

Option C is incorrect because S3 Glacier is a storage class, not a feature that automates transitions. Option D is incorrect because S3 Intelligent-Tiering automatically moves data between access tiers based on usage, not on a fixed age threshold like 1 year.

Full explanation →

388

MCQmedium

A data engineer is configuring an S3 bucket to host sensitive data. The security policy requires that all objects be encrypted with a key that is generated and managed by the customer, and that the key be stored in AWS KMS. Which encryption option should be used?

A.Server-Side Encryption with S3-Managed Keys (SSE-S3)

B.Client-Side Encryption

C.Server-Side Encryption with Customer-Provided Keys (SSE-C)

D.Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS)

AnswerD

SSE-KMS allows using customer-managed keys in KMS.

Why this answer

SSE-KMS allows you to use customer-managed keys stored in AWS KMS, meeting the requirement for customer-generated and managed keys. Option A is incorrect because SSE-S3 uses AWS-managed keys, not customer-managed. Option B is incorrect because client-side encryption encrypts data outside S3, not using S3 server-side encryption.

Option C is incorrect because SSE-C uses customer-provided keys that you manage yourself, but they are not stored in AWS KMS—you must provide them with each request.

Full explanation →

389

Multi-Selecteasy

A data engineer is setting up a data pipeline to ingest streaming data from an IoT fleet. The data must be processed in near real-time and stored in Amazon S3 for analytics. Which THREE AWS services should the engineer consider using?

Select 3 answers

A.Amazon EMR

B.Amazon Kinesis Data Firehose

C.AWS Lambda

D.AWS Glue

E.Amazon Kinesis Data Streams

AnswersB, C, E

Delivers streaming data to S3.

Why this answer

The correct services are Amazon Kinesis Data Streams (option E) for real-time data ingestion, AWS Lambda (option C) for near real-time processing, and Amazon Kinesis Data Firehose (option B) for delivering data to S3. Options A and D are incorrect because Amazon EMR is a big data processing framework not optimized for real-time streaming ingestion, and AWS Glue is primarily a batch ETL service.

Full explanation →

390

MCQmedium

A data engineer is setting up a data pipeline that ingests streaming data from Amazon Kinesis Data Streams into an S3 data lake using Amazon Kinesis Data Firehose. The data contains personally identifiable information (PII). The security team requires that all data be encrypted at rest in S3 using an AWS KMS customer managed key (CMK) that is specific to the application. Additionally, the data must be encrypted in transit between all services. The engineer creates the KMS key and configures Firehose to use server-side encryption with the key for the S3 destination. However, Firehose delivery fails with an error indicating that the KMS key is not accessible. What is the most likely cause?

A.The KMS key policy does not grant the firehose.amazonaws.com service principal the required permissions.

B.The Kinesis data stream is not encrypted at rest.

C.The Firehose delivery stream is not in the same region as the KMS key.

D.The S3 bucket policy does not grant the Firehose delivery stream access to write objects.

AnswerA

Firehose must be allowed to use the key via the key policy.

Why this answer

Kinesis Data Firehose needs permission to use the KMS key. The key policy must grant the Firehose service principal (firehose.amazonaws.com) permission to call kms:GenerateDataKey and kms:Decrypt. Without this, Firehose cannot encrypt the data.

Full explanation →

391

MCQmedium

A data engineer is monitoring a Redshift cluster that is experiencing slow query performance. The cluster has 4 dc2.large nodes. The engineer notices that disk space usage is at 85% across all nodes. Which action would MOST likely improve query performance?

A.Change the table design to use DISTKEY and SORTKEY.

B.Enable compression on all columns.

C.Increase the number of nodes to 8.

D.Run the VACUUM command to reclaim space.

AnswerC

Adding nodes increases disk capacity and I/O throughput, reducing disk pressure and improving query performance.

Why this answer

At 85% disk usage on dc2.large nodes, the cluster is approaching the threshold where Redshift begins to automatically offload data to Amazon S3, causing significant performance degradation due to increased I/O and network latency. Adding more nodes (option C) increases both compute capacity and total disk space, reducing per-node disk pressure and allowing the cluster to keep more data local for faster query execution.

Exam trap

The DEA-C01 exam often tests the misconception that VACUUM or table design optimizations can resolve capacity-related performance issues, when in fact the immediate root cause is disk pressure triggering S3 offloading, which only scale-out or resize can fix.

How to eliminate wrong answers

Option A is wrong because while DISTKEY and SORTKEY improve query performance by reducing data shuffling and scan ranges, they do not address the immediate bottleneck of high disk usage causing offloading to S3. Option B is wrong because enabling compression reduces storage footprint and I/O, but it is already likely applied or requires a full table reload; it does not solve the immediate capacity issue at 85% usage. Option D is wrong because VACUUM reclaims space from deleted rows and sorts data, but it does not increase total disk capacity; at 85% usage, the fundamental problem is insufficient storage, not fragmentation.

Full explanation →

392

Multi-Selecteasy

A data engineer needs to monitor and log changes to IAM policies in an AWS account. Which TWO AWS services can be used together to achieve this?

Select 2 answers

A.Amazon GuardDuty

B.AWS Config

C.VPC Flow Logs

D.AWS CloudTrail

E.Amazon CloudWatch Logs

AnswersD, E

CloudTrail records all IAM API calls.

Why this answer

AWS CloudTrail logs all IAM API calls, including policy changes. Amazon CloudWatch Logs can be used to store, monitor, and alert on these log events. Option A (GuardDuty) is a threat detection service, not for logging policy changes.

Option B (AWS Config) tracks resource configuration changes but not API calls directly. Option C (VPC Flow Logs) captures network traffic, not IAM activities. Therefore, the correct combination is D and E.

Full explanation →

393

MCQmedium

A data engineer uses Amazon EMR to run a Spark job that reads from S3 and writes to HDFS on the cluster. The job fails with an 'OutOfMemoryError: Java heap space' error in the executors. Which parameter adjustment should be made to resolve this?

A.Increase spark.default.parallelism

B.Increase spark.sql.shuffle.partitions

C.Increase spark.executor.memory

D.Increase spark.driver.memory

AnswerC

This directly increases the heap size available to each executor.

Why this answer

The 'OutOfMemoryError: Java heap space' in executors indicates that the executor memory is insufficient for the data being processed. Increasing spark.executor.memory allocates more heap space to each executor, directly addressing the issue. Option A (spark.default.parallelism) controls the number of tasks, not memory.

Option B (spark.sql.shuffle.partitions) affects shuffle partitions but does not increase memory. Option D (spark.driver.memory) is for the driver, not executors.

Full explanation →

394

Multi-Selecteasy

Which TWO AWS services can be used to transform data in transit during ingestion? (Choose 2.)

Select 2 answers

A.Amazon S3 Transfer Acceleration

B.Amazon Kinesis Data Firehose with Lambda transformation

C.AWS Glue ETL

D.Amazon Athena

E.AWS Data Pipeline

AnswersB, C

Firehose can call Lambda to transform records.

Why this answer

Amazon Kinesis Data Firehose can invoke an AWS Lambda function to transform streaming data in real time before delivering it to a destination, making it suitable for transforming data in transit during ingestion. AWS Glue ETL can be used for both batch and streaming transformations; specifically, AWS Glue supports streaming ETL jobs that can transform data in transit as it is ingested from sources like Amazon MSK or Kinesis Data Streams. Therefore, both services can transform data during ingestion, albeit with different use cases and latency characteristics.

Exam trap

Candidates often mistakenly think that AWS Glue ETL is only for batch processing and cannot transform data in transit, but AWS Glue supports streaming ETL jobs that can transform data during ingestion, making it a valid choice for in-transit transformation.

Full explanation →

395

MCQhard

A company uses AWS DMS to migrate a 2 TB Oracle database to Amazon RDS for PostgreSQL. The migration completes successfully, but data validation shows some tables have missing rows. The task is configured for ongoing replication using change data capture (CDC). What is the MOST likely cause of the missing rows?

A.Source database archive log retention period too short

B.Large objects (LOBs) not supported by the target

C.Source tables missing primary keys

D.Insufficient storage on the DMS replication instance

AnswerC

Without primary keys, DMS cannot track changes for CDC, leading to missing rows.

Why this answer

If a table lacks a primary key, DMS cannot uniquely identify rows for CDC, leading to missed changes. Option A is wrong because the endpoint connection is valid (migration completed). Option B is wrong because CDC captures changes from redo logs, not the source database directly.

Option D is wrong because DMS supports large objects with proper configuration.

Full explanation →

396

MCQhard

A company stores IoT sensor data in an Amazon S3 bucket. The data is ingested every minute and each object is about 10 KB. The data must be stored for at least 7 years for compliance. Which lifecycle policy configuration minimizes storage costs?

A.Transition to S3 One Zone-IA after 30 days, then to S3 Glacier Deep Archive after 365 days, and expire after 2555 days.

B.Transition to S3 Glacier Flexible Retrieval after 90 days and expire after 2555 days.

C.Transition to S3 Glacier Deep Archive after 30 days and expire after 2555 days.

D.Transition to S3 Standard-IA after 30 days, then to S3 Glacier Deep Archive after 365 days, and expire after 2555 days.

AnswerC

This minimizes cost by moving to the cheapest storage class early and retaining for 7 years.

Why this answer

S3 Glacier Deep Archive is the lowest-cost storage class for long-term archival data, and transitioning directly after 30 days minimizes costs for 10 KB objects that are accessed infrequently. The 2555-day expiration (7 years) meets the compliance requirement. Other options incur higher costs by using more expensive intermediate tiers or by delaying the transition to the cheapest storage class.

Exam trap

The DEA-C01 exam often tests the misconception that using multiple intermediate transitions (e.g., Standard-IA then Glacier) is always more cost-effective, but for long-term archival of small objects, the cheapest path is to go directly to the lowest-cost storage class as soon as the minimum transition period allows.

How to eliminate wrong answers

Option A is wrong because transitioning to S3 One Zone-IA after 30 days is unnecessary and more expensive than going directly to Glacier Deep Archive, especially for 10 KB objects where minimum storage charges apply. Option B is wrong because S3 Glacier Flexible Retrieval is more expensive than Glacier Deep Archive for long-term archival, and the 90-day transition delay incurs higher costs than the 30-day transition in Option C. Option D is wrong because transitioning to S3 Standard-IA after 30 days adds unnecessary cost compared to directly transitioning to Glacier Deep Archive, and the intermediate tier does not provide cost savings for data that will be archived for 7 years.

Full explanation →

397

MCQmedium

A company uses AWS KMS to encrypt data at rest in Amazon S3. The security team requires that all encryption keys be automatically rotated every year. Which key type should be used to meet this requirement without manual intervention?

A.Use a customer managed key with automatic rotation enabled.

B.Use an imported key material because it supports automatic rotation.

C.Use a KMS key generated by S3 on each object upload.

D.Use an AWS managed key (aws/s3).

AnswerA

Correct. Customer managed keys with automatic rotation enabled rotate annually after the one-time manual enablement, meeting the requirement without ongoing manual intervention.

Why this answer

AWS customer managed keys (CMKs) with automatic rotation enabled rotate every year, meeting the requirement of annual rotation. While enabling automatic rotation requires a one-time manual configuration, after that no further manual intervention is needed, and the rotation occurs automatically. AWS managed keys (aws/s3) rotate automatically every three years, not annually, so they do not satisfy the yearly rotation requirement.

Imported key material cannot be rotated, and S3 does not generate a KMS key per upload. Therefore, option A is correct.

Full explanation →

398

MCQmedium

A data engineer needs to migrate an on-premises Apache Hadoop cluster to AWS. The cluster stores data in HDFS and runs MapReduce jobs. The company wants to minimize operational overhead and leverage serverless technologies where possible. Which AWS service should the data engineer use to replace HDFS storage?

A.Amazon EBS

B.Amazon EMR

C.Amazon S3

D.Amazon Redshift

AnswerC

S3 is the recommended storage for Hadoop on AWS, replacing HDFS with durable object storage.

Why this answer

Amazon S3 is the correct replacement for HDFS because it provides highly durable, scalable, and serverless object storage that can be used as the primary storage layer for Amazon EMR. Unlike HDFS, S3 decouples storage from compute, eliminating the need to manage cluster storage and allowing jobs to run on ephemeral clusters, which minimizes operational overhead. S3 integrates with EMR via the EMR File System (EMRFS), enabling MapReduce jobs to read/write data directly from S3 as if it were HDFS.

Exam trap

The trap here is that candidates confuse Amazon EMR (a compute service) with a storage service, assuming it replaces HDFS, when in fact EMR can use either HDFS or S3 for storage, and the question explicitly asks for the storage replacement.

How to eliminate wrong answers

Option A is wrong because Amazon EBS provides block-level storage volumes attached to EC2 instances, which is not serverless and requires manual management of volume size, snapshots, and replication; it also ties storage to a specific compute instance, defeating the purpose of decoupling storage from compute for a Hadoop migration. Option B is wrong because Amazon EMR is a managed big data platform that runs MapReduce jobs, not a storage service; it can use HDFS or S3 for storage, but the question specifically asks for a replacement of HDFS storage, not the compute framework. Option D is wrong because Amazon Redshift is a fully managed data warehouse optimized for SQL-based analytics and structured data, not a general-purpose distributed file system for Hadoop workloads; it does not support HDFS semantics or MapReduce jobs natively.

Full explanation →

399

MCQeasy

A data engineer has set up an AWS Lambda function that processes files uploaded to an S3 bucket. The function is triggered by S3 event notifications. However, the function is not being invoked when a file is uploaded. The engineer checks the Lambda function's CloudWatch Logs and finds no execution logs. What should the engineer check FIRST?

A.Check the Lambda function's code for errors.

B.Verify that the Lambda function's IAM role has permissions to read from S3.

C.Verify that the S3 bucket has an event notification configured for the Lambda function.

D.Check if the Lambda function is attached to a VPC.

AnswerC

Without event notification, S3 will not invoke the function.

Why this answer

The correct first step is to verify the S3 event notification configuration (Option C). Since there are no execution logs in CloudWatch, the Lambda function is not being triggered at all. This indicates a problem with the trigger mechanism, not with the function's code, permissions, or network configuration.

Option A (checking code) is premature because code errors would appear in logs after invocation. Option B (IAM role) affects what the function can do during execution, not whether it is invoked. Option D (VPC) affects network access but does not prevent triggering.

Therefore, the S3 bucket's event notification must be checked to ensure it is correctly set up to invoke the Lambda function.

Full explanation →

400

Multi-Selectmedium

Which TWO AWS services can be used to ingest streaming data into Amazon S3 with minimal code? (Choose two.)

Select 2 answers

A.AWS Lambda

B.Amazon Kinesis Data Firehose

C.Amazon Managed Streaming for Apache Kafka (MSK) with S3 sink connector

D.AWS Database Migration Service (DMS)

E.AWS DataSync

AnswersB, C

Firehose is serverless and delivers streaming data to S3 without code.

Why this answer

Amazon Kinesis Data Firehose (Option B) is a fully managed service that can ingest streaming data and deliver it to Amazon S3 with minimal configuration and no code required. Amazon MSK with the S3 sink connector (Option C) allows streaming data from Apache Kafka topics to be automatically written to S3 with minimal code, as the connector handles the integration. Option A (AWS Lambda) requires custom code to process and write data to S3.

Option D (AWS DMS) is designed for database migration, not streaming ingestion. Option E (AWS DataSync) is for batch file transfers, not real-time streaming.

Full explanation →

401

Multi-Selectmedium

A company is using Amazon Kinesis Data Streams to ingest clickstream data from a website. The data is consumed by an AWS Lambda function that enriches records and writes to Amazon S3. The Lambda function is experiencing high error rates due to records exceeding the 256 KB payload limit. Which TWO actions should the team take to resolve this issue?

Select 2 answers

A.Increase the Lambda function timeout.

B.Enable compression on the producer side before sending records to Kinesis.

C.Use the Kinesis Producer Library (KPL) to aggregate multiple small records into a single larger record.

D.Switch from Kinesis Data Streams to Kinesis Data Firehose.

E.Increase the number of shards in the Kinesis stream.

AnswersB, C

Compression reduces record size below the 256 KB limit.

Why this answer

Enabling compression on the producer side reduces the size of each record before it is sent to Kinesis Data Streams, directly addressing the 256 KB payload limit. Option C is correct because the Kinesis Producer Library (KPL) aggregates multiple small records into a single larger record, which is then stored as one Kinesis record, reducing the number of records that exceed the limit and improving throughput.

Exam trap

The trap here is that candidates may confuse increasing shards (which increases throughput) with reducing record size, or think that switching to Firehose bypasses the 256 KB limit, when in fact Firehose also has a per-record size limit and does not address the root cause.

Full explanation →

402

MCQmedium

A data engineer needs to transform CSV files arriving in an S3 bucket into Parquet format and store them in another S3 bucket. The transformation is simple and on-demand, triggered by data arrival. Which solution is the MOST cost-effective and requires the least operational overhead?

A.Use Amazon EMR with Spark streaming

B.Use Amazon Athena to create a new table with Parquet format

C.Use AWS Glue ETL jobs scheduled to run every hour

D.Use S3 Events to trigger an AWS Lambda function that transforms the data

AnswerD

Lambda is event-driven, cost-effective, and serverless.

Why this answer

Using S3 Events to trigger an AWS Lambda function is the most cost-effective and operationally lightweight solution for simple, on-demand CSV-to-Parquet transformations. Lambda scales automatically with each S3 PUT event, incurs no idle cost, and requires no cluster management, making it ideal for event-driven, low-volume transformations.

Exam trap

The DEA-C01 exam often tests the misconception that AWS Glue is always the best choice for ETL, but for simple, event-driven transformations with minimal overhead, Lambda is more cost-effective and operationally simpler than Glue's managed Spark environment.

How to eliminate wrong answers

Option A is wrong because Amazon EMR with Spark streaming introduces significant operational overhead (cluster provisioning, scaling, and management) and cost (even with auto-scaling, you pay for running instances) for a simple, on-demand transformation that does not require real-time streaming. Option B is wrong because Amazon Athena cannot transform data into Parquet format; it is a query engine that can read from and write to Parquet tables via CTAS statements, but it does not provide a direct, event-driven transformation trigger and incurs per-query costs that can be higher than Lambda for frequent small files. Option C is wrong because AWS Glue ETL jobs scheduled every hour introduce unnecessary latency (up to 1 hour delay) and cost (minimum billing per DPU hour) for an on-demand workload triggered by data arrival, and the scheduled polling approach is less efficient than event-driven invocation.

Full explanation →

403

MCQhard

A company uses Amazon Kinesis Data Firehose to deliver log data to Amazon S3. The data is transformed by a Lambda function that adds a timestamp field. Recently, the Firehose delivery stream has been failing with 'Lambda invocation failed' errors. The Lambda function's CloudWatch Logs show that the function is timing out. What is the MOST likely cause?

A.The Lambda function lacks permission to write to CloudWatch Logs.

B.The Firehose buffer size is too large, causing the Lambda function to receive too many records.

C.The Lambda function timeout is set to 1 minute, which is adequate.

D.The Lambda function is running out of memory.

AnswerB

Correct. A large Firehose buffer size causes Lambda to receive a large batch, leading to timeout if the function cannot process it within its configured timeout.

Why this answer

Kinesis Data Firehose sends batches of records to the Lambda function for transformation. If the buffer size (or batch size) is too large, the Lambda function receives too many records and exceeds its configured timeout, causing 'Lambda invocation failed' errors. The timeout errors in CloudWatch Logs confirm this.

Option A is incorrect because the function is being invoked, so Lambda permissions are working. Option C is incorrect because a 1-minute timeout may be insufficient for large batches. Option D is incorrect because the logs indicate a timeout, not an out-of-memory error.

Exam trap

Candidates often confuse timeout issues with permission or memory problems. Here, the CloudWatch Logs explicitly show timeouts, pointing to batch size or timeout configuration as the root cause.

Full explanation →

404

MCQmedium

A company uses Amazon Redshift for its data warehouse. A data engineer notices that queries are running slowly and the system's disk space is nearly full. The engineer runs the STV_PARTITIONS view and sees that many slices have high 'tossed' counts. What does this indicate, and what should the engineer do?

A.The tossed rows are permanent and cannot be reclaimed; the engineer should perform a deep copy to a new table.

B.The tossed rows indicate that the sort key is not optimal; redefining the sort key will reduce tossed rows.

C.The tossed rows are due to data skew; redistribute the table on a different distribution key.

D.The tossed rows are deleted rows that need to be reclaimed by running VACUUM.

AnswerD

VACUUM removes deleted rows and reclaims disk space, improving query performance.

Why this answer

The STV_PARTITIONS view shows 'tossed' rows, which are rows that have been deleted or updated and are waiting to be reclaimed by a VACUUM operation. High tossed counts indicate wasted disk space, and running VACUUM reclaims that space, improving performance. Option D correctly describes this.

Option A is incorrect because tossed rows are not permanent; they can be reclaimed. Option B is incorrect because tossed rows are not related to sort key optimization. Option C is incorrect because tossed rows are not caused by data skew; data skew is about uneven distribution.

Full explanation →

405

MCQmedium

A data engineering team is using Amazon DynamoDB to store user session data for a web application. The application experiences sudden spikes in traffic, causing throttling on the DynamoDB table. The team wants to minimize throttling without over-provisioning read/write capacity. Which solution should the team implement?

A.Enable DynamoDB Time to Live (TTL) to automatically delete expired items.

B.Disable auto scaling and manually set a high provisioned capacity.

C.Use Amazon RDS read replicas to offload read traffic.

D.Enable DynamoDB Accelerator (DAX) caching layer.

AnswerD

DAX caches frequently read items, reducing read capacity consumption and throttling.

Why this answer

DynamoDB Accelerator (DAX) is a fully managed, in-memory cache that reduces read latency from single-digit milliseconds to microseconds. By caching frequently accessed items, DAX offloads read requests from the DynamoDB table, directly reducing the read capacity consumption and thus minimizing throttling during traffic spikes without requiring over-provisioning of read capacity units.

Exam trap

The trap here is that candidates may confuse DynamoDB with relational databases and incorrectly assume RDS read replicas can offload DynamoDB traffic, or they may think TTL or manual provisioning are appropriate solutions for throttling, when the correct approach is to use a caching layer like DAX to absorb read spikes.

How to eliminate wrong answers

Option A is wrong because Time to Live (TTL) only deletes expired items to reduce storage costs and does not address read/write throttling caused by sudden traffic spikes. Option B is wrong because disabling auto scaling and manually setting a high provisioned capacity leads to over-provisioning and increased costs, which contradicts the goal of minimizing throttling without over-provisioning. Option C is wrong because Amazon RDS read replicas are designed for relational databases (RDS), not DynamoDB, and cannot offload traffic from a NoSQL DynamoDB table.

Full explanation →

406

Drag & Dropmedium

Order the steps to troubleshoot a failed AWS Glue job that reads from JDBC and writes to S3.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Start with logs to identify errors, then check connectivity, IAM permissions, test connection, and review script.

Full explanation →

407

MCQhard

A financial services company ingests real-time stock trade data from multiple exchanges into Amazon Kinesis Data Streams. Each trade record is a JSON object containing fields: trade_id, symbol, price, quantity, and timestamp. The data is consumed by an AWS Lambda function that performs data validation and enrichment, then writes the processed records to an Amazon DynamoDB table for low-latency querying. Recently, the Lambda function has been timing out and failing to process all records. The Lambda function is configured with a 5-second timeout and 128 MB memory. The average record size is 2 KB, and the stream receives about 1000 records per second. The Lambda function's concurrency limit is 1000. Which set of actions should the data engineer take to resolve the issue without losing data?

A.Increase the Lambda function timeout to 60 seconds and memory to 1024 MB. Set the batch size to 100 records and enable parallelization factor of 10.

B.Increase the number of shards in the Kinesis data stream to 20 and keep the Lambda configuration unchanged.

C.Replace the Lambda function with a Kinesis Data Firehose delivery stream that writes directly to DynamoDB using a Lambda transformation.

D.Increase the Lambda function timeout to 60 seconds and memory to 1024 MB. Set the batch size to 100 records.

AnswerA

This combination increases processing capacity and prevents timeouts.

Why this answer

Increasing the Lambda timeout and memory addresses the processing bottleneck, while setting the batch size to 100 and enabling a parallelization factor of 10 allows each shard to process up to 10 concurrent batches, dramatically increasing throughput to handle 1000 records/sec (each shard can process 10 batches of 100 records concurrently, yielding 1000 records/sec per shard if the stream has at least 1 shard). This combination ensures no data loss by keeping up with the ingestion rate without exceeding the Lambda concurrency limit of 1000.

Exam trap

The trap here is that candidates often overlook the parallelization factor setting, assuming that increasing batch size and Lambda resources alone will suffice, but without parallelization, each shard can only process one batch at a time, creating a throughput bottleneck that leads to data loss.

How to eliminate wrong answers

Option B is wrong because simply increasing shards to 20 does not resolve the Lambda timeout issue; the function still has only 5 seconds and 128 MB, so it will continue to fail even with more shards. Option C is wrong because Kinesis Data Firehose cannot write directly to DynamoDB; it only supports destinations like S3, Redshift, Elasticsearch, and Splunk, and using a Lambda transformation would still require sufficient timeout and memory. Option D is wrong because increasing timeout and memory alone without enabling parallelization factor means each shard can only process one batch at a time, which at 100 records per batch would only handle 100 records per second per shard, insufficient for the 1000 records/sec load.

Full explanation →

408

MCQhard

A company has an S3 bucket with versioning enabled and a bucket policy that denies access if the request does not include encryption. A data engineer notices that some objects are not encrypted. What is the most likely cause?

A.The bucket policy does not evaluate requests from the same account.

B.The policy only applies to new uploads; existing objects remain unencrypted.

C.Default encryption was not enabled at the bucket level.

D.Versioning was enabled after the objects were uploaded.

AnswerB

Correct. The policy only enforces encryption on new uploads; existing objects remain as they were before the policy was applied.

Why this answer

A bucket policy that denies unencrypted requests only applies to new uploads made after the policy is effective. Objects already in the bucket remain unencrypted. Option A is wrong because bucket policies apply to all requests, including those from the same account.

Option C is wrong because default encryption would only apply to new objects, not existing ones. Option D is wrong because versioning does not retroactively encrypt existing objects.

Full explanation →

409

MCQeasy

A data engineer notices that a nightly AWS Glue ETL job has been failing for the past three days with the error 'Unable to locate credentials'. The job uses an IAM role for execution. What is the most likely cause of this error?

A.The IAM role does not have an access key attached.

B.The S3 bucket name in the job parameters is misspelled.

C.The IAM role's trust policy does not include glue.amazonaws.com as a trusted entity.

D.The JDBC connection string contains an incorrect password.

AnswerC

Without the trust policy, Glue cannot assume the role and gets 'Unable to locate credentials'.

Why this answer

The error 'Unable to locate credentials' indicates that the AWS Glue job cannot obtain AWS credentials to authenticate API calls. Since the job uses an IAM role for execution, the most likely cause is that the trust policy of that IAM role does not include 'glue.amazonaws.com' as a trusted entity. Without this trust relationship, AWS Glue cannot assume the role and thus has no credentials to sign requests.

Exam trap

AWS often tests the distinction between IAM role trust policies (who can assume the role) and IAM role permission policies (what actions the role can perform), and candidates mistakenly focus on permission policies when the error is about credential acquisition.

How to eliminate wrong answers

Option A is wrong because IAM roles do not use access keys; they use temporary security credentials obtained via the AWS Security Token Service (STS). Option B is wrong because a misspelled S3 bucket name would cause a 'NoSuchBucket' or 'Access Denied' error, not a credentials-related error. Option D is wrong because an incorrect JDBC password would result in a connection failure or authentication error from the database, not an 'Unable to locate credentials' error from AWS.

Full explanation →

410

Multi-Selectmedium

A data engineering team uses AWS Glue to extract, transform, and load (ETL) data from Amazon RDS for MySQL to Amazon S3. The job runs daily and processes incremental data. The team notices that the job is taking longer than expected. Which TWO actions can improve the job performance? (Choose two.)

Select 2 answers

A.Change the worker type to Standard (single node).

B.Use pushdown predicates to filter data at the source.

C.Add more transformations to the ETL script to clean data.

D.Increase the number of DPUs for the Glue job.

E.Disable compression on the output data to reduce CPU usage.

AnswersB, D

Pushdown predicates filter data at the source, reducing data transfer and improving performance.

Why this answer

B is correct because pushdown predicates allow filtering at the source (RDS MySQL), reducing the amount of data transferred to the Glue job and thus speeding up processing. D is correct because increasing DPUs allocates more resources (CPU, memory) to the Glue job, enabling parallel processing and faster execution. A is wrong because changing to Standard (single node) reduces parallelism, slowing down the job.

C is wrong because adding more transformations increases processing time, not improving performance. E is wrong because disabling compression on output data increases I/O and storage costs, not improving performance.

Full explanation →

411

MCQhard

An Amazon RDS for PostgreSQL instance is experiencing high CPU utilization and slow query performance. The data engineer suspects that a specific query is causing the problem. The engineer wants to identify the query and analyze its execution plan. Which steps should the engineer take?

A.Enable CloudWatch Logs for the RDS instance and search for slow query logs.

B.Enable pg_stat_statements in the PostgreSQL parameter group and query the pg_stat_statements view.

C.Enable Enhanced Monitoring and analyze the CPU metrics.

D.Use RDS Performance Insights to identify the top queries.

AnswerB

Enabling pg_stat_statements allows collection of query execution statistics; querying the pg_stat_statements view identifies high‑load queries, and EXPLAIN provides the execution plan.

Why this answer

Enabling pg_stat_statements in the PostgreSQL parameter group and querying the pg_stat_statements view provides detailed query execution statistics (e.g., total execution time, calls, rows) and helps identify high‑load queries. The execution plan can then be obtained by running EXPLAIN on the identified query. Option A is incorrect because CloudWatch Logs captures logs but does not provide real‑time query performance details.

Option C is incorrect because Enhanced Monitoring shows OS‑level metrics (CPU, memory), not query‑level plans or statistics. Option D is incorrect because RDS Performance Insights identifies top queries by wait events and load but does not directly expose the execution plan; the execution plan is best obtained via EXPLAIN on the specific query identified from pg_stat_statements.

Full explanation →

412

MCQmedium

A data engineer is configuring Amazon S3 Lifecycle policies to transition objects between storage classes. The data is accessed frequently for the first 30 days, then rarely for the next 90 days, after which it must be archived. The engineer wants to minimize costs while ensuring immediate retrieval for the first 30 days. Which lifecycle policy should the engineer implement?

A.Transition to Glacier Flexible Retrieval after 30 days, then delete after 120 days

B.Transition to One Zone-IA after 30 days, then to Glacier Deep Archive after 120 days

C.Transition to Glacier Deep Archive after 30 days, then delete after 120 days

D.Transition to Standard-IA after 30 days, then to Glacier Deep Archive after 120 days

AnswerD

Standard-IA is cost-effective for rarely accessed data; Glacier Deep Archive is cheapest for archiving.

Why this answer

It transitions objects from S3 Standard (immediate retrieval, frequent access) to S3 Standard-IA (lower cost for infrequent access, immediate retrieval) after 30 days, then to S3 Glacier Deep Archive (lowest-cost archival storage) after 120 days. This matches the access pattern: frequent for 30 days, rare for 90 days, then archived, while minimizing cost and maintaining immediate retrieval for the first 30 days.

Exam trap

The trap here is that candidates often choose Glacier Deep Archive too early (e.g., after 30 days) to minimize cost, forgetting that the data must be immediately retrievable for the first 30 days and rarely accessed but still retrievable for the next 90 days, which requires a storage class with immediate retrieval (Standard-IA) before archiving.

How to eliminate wrong answers

Option A is wrong because transitioning to Glacier Flexible Retrieval after 30 days would incur retrieval delays (minutes to hours) for data that is still accessed rarely but may need immediate retrieval within the next 90 days, and it does not archive after 120 days (it deletes). Option B is wrong because transitioning to One Zone-IA after 30 days does not provide the durability or availability of Standard-IA for rarely accessed data that may still need immediate retrieval, and it is not cost-optimal for data that is not accessed frequently enough to justify the higher cost of One Zone-IA. Option C is wrong because transitioning to Glacier Deep Archive after 30 days would make retrieval impossible for the next 90 days (retrieval time is 12-48 hours), violating the requirement for immediate retrieval during the first 30 days and failing to minimize costs for the rare-access period.

Full explanation →

413

Multi-Selectmedium

A data engineer is designing a data ingestion pipeline for IoT sensor data. The sensors send JSON messages every second, and the data must be stored in Amazon S3 in near real-time (within 5 minutes). The engineer also needs to transform the data by adding a timestamp and filtering out malformed records. Which THREE services should be used together?

Select 3 answers

A.AWS Glue

B.Amazon Athena

C.Amazon Simple Queue Service (SQS)

D.AWS IoT Core

E.Amazon Kinesis Data Firehose

AnswersA, D, E

AWS Glue can be used for streaming ETL transformations, such as adding timestamps and filtering malformed records, making it a valid component of the pipeline.

Why this answer

AWS IoT Core (D) securely ingests sensor data via MQTT and routes it to a Kinesis data stream using a rule. AWS Glue Streaming ETL (A) consumes from the stream, adds a timestamp, filters malformed records, and writes the cleaned data to Kinesis Data Firehose (E). Firehose buffers and delivers the data to Amazon S3 within minutes, meeting the near-real-time requirement.

Exam trap

Candidates often mistakenly think that Kinesis Data Firehose can be consumed directly by Glue Streaming ETL, but Glue actually reads from a Kinesis Data Streams. The correct pipeline uses IoT Core to route to a Data Stream, Glue to transform, and Firehose to deliver to S3.

Full explanation →

414

Multi-Selectmedium

A data engineer is designing a data pipeline that ingests streaming data from IoT devices into Amazon S3 using Amazon Kinesis Data Firehose. The data must be transformed from JSON to Parquet format before storage. Which TWO actions should the data engineer take to achieve this?

Select 2 answers

A.Enable Firehose's built-in Parquet conversion without any additional configuration.

B.Use Amazon Kinesis Data Analytics to convert the data format.

C.Configure Firehose to convert the data to Apache Avro format.

D.Create a Glue Data Catalog table defining the schema and configure Firehose to use the table for Parquet conversion.

E.Create an AWS Lambda function to transform the data to Parquet and use it as a Firehose transformation.

AnswersD, E

Firehose can use the schema from Glue Data Catalog to convert to Parquet.

Why this answer

Amazon Kinesis Data Firehose can directly convert incoming JSON data to Parquet format by referencing a table schema defined in the AWS Glue Data Catalog. This allows Firehose to perform the schema-aware conversion without custom code, leveraging the Glue table's column definitions and SerDe for Parquet serialization.

Exam trap

The DEA-C01 exam often tests the misconception that Firehose can automatically convert to Parquet without a schema definition, leading candidates to select Option A, but in reality, Firehose requires an explicit schema (via Glue or Lambda) for Parquet conversion.

Full explanation →

415

MCQhard

A company runs a data lake on Amazon S3 with AWS Glue and Amazon Athena. The security team recently ran a report using Amazon Macie and found that multiple S3 objects containing PII are publicly accessible. The data engineer is tasked with remediating this issue immediately. The S3 bucket is configured with a bucket policy that grants public read access to all objects. The data engineer needs to ensure that no objects are publicly accessible while maintaining the ability for authorized IAM users and roles to access the data via Athena. The bucket must also remain accessible to the Glue crawler. What is the MOST effective course of action?

A.Use Amazon Macie to automatically remediate the public access by updating the object ACLs.

B.Remove the bucket policy granting public access and attach an IAM policy to the Glue and Athena roles to allow access to the bucket.

C.Set the bucket ACL to private and add a bucket policy that allows access to the Glue crawler and Athena.

D.Enable S3 Block Public Access on the bucket and use a bucket policy to allow access from the Glue and Athena service principals.

AnswerB

This removes public access while allowing authorized access.

Why this answer

The most effective because it removes the public access grant while using IAM policies to authorize only the necessary roles (Glue and Athena). Option A is incorrect because Amazon Macie only identifies PII and cannot remediate access controls. Option C is insufficient because setting the bucket ACL to private does not change existing object ACLs that may grant public access, and using a bucket policy alone does not address object ACL overrides.

Option D is incorrect because S3 Block Public Access prevents all public access but using service principals (like the Glue or Athena service principal) is not appropriate for intra-account access; IAM roles must be used to allow authorized users and services.

Full explanation →

416

MCQmedium

Refer to the exhibit. A data engineer has an IAM policy attached to an IAM role used by an AWS Glue job. The Glue job reads from S3 bucket 'example-bucket' and writes to an S3 bucket 'output-bucket'. The job fails with an 'Access Denied' error when writing to 'output-bucket'. What is the MOST likely cause?

A.The policy does not allow s3:PutObject on any bucket.

B.The policy does not allow s3:PutObject on 'output-bucket'.

C.The policy does not allow s3:GetObject on 'output-bucket'.

D.The policy has a condition that restricts s3:PutObject to 'example-bucket'.

AnswerB

The resource is only example-bucket/*.

Why this answer

The policy only allows s3:PutObject on 'example-bucket/*', not on 'output-bucket/*'. The job needs permission on the output bucket. Option A is incorrect because s3:PutObject is allowed on example-bucket, but not on output-bucket.

Option C is incorrect because there is no condition that restricts PutObject to example-bucket. Option D is incorrect because the policy allows s3:GetObject on example-bucket, which is for reading.

Full explanation →

417

Multi-Selecthard

A data engineer needs to ensure that an S3 bucket policy follows the principle of least privilege. Which of the following are valid conditions to restrict access based on the requester's identity? (Choose TWO.)

Select 2 answers

A.aws:PrincipalOrgID

B.s3:x-amz-server-side-encryption

C.aws:Referer

D.aws:SourceIp

E.aws:userId

AnswersA, E

Correct. This condition checks the organization ID of the requesting principal, which is an identity attribute.

Why this answer

Options A and E are correct. aws:PrincipalOrgID restricts access to IAM principals within a specific AWS Organization, directly tied to the requester's identity. aws:userId restricts access to a specific IAM user ID, also an identity attribute. Option D (aws:SourceIp) is a network condition based on IP address, not the requester's identity, so it does not meet the requirement. Options B (s3:x-amz-server-side-encryption) and C (aws:Referer) are not identity-based conditions.

Exam trap

The phrase 'based on the requester's identity' can be misleading. Network conditions like aws:SourceIp are not considered identity-based; only attributes like user ID, role ID, or organization ID qualify.

Full explanation →

418

MCQhard

A company uses Amazon S3 to store sensitive financial data. The security team requires that all objects be encrypted at rest using AWS KMS with a customer-managed key. Additionally, they want to audit all KMS decrypt calls for compliance. Which configuration should be used to meet these requirements?

A.Enable default encryption on the bucket with SSE-KMS using an AWS managed key.

B.Use SSE-S3 with a bucket policy that denies uploads without encryption.

C.Use SSE-KMS with a customer-managed KMS key and enable CloudTrail data events for the key.

D.Use SSE-C with client-managed keys and log S3 API calls.

AnswerC

SSE-KMS with customer-managed key and CloudTrail auditing meets requirements.

Why this answer

SSE-KMS with a customer-managed key allows the company to control the encryption key lifecycle and meet the requirement for customer-managed keys. Enabling CloudTrail data events for the KMS key captures all decrypt API calls, providing the necessary audit trail for compliance.

Exam trap

The trap here is that candidates may confuse enabling default encryption on the bucket (which can use SSE-KMS) with the need for a customer-managed key and CloudTrail data events, or they may think SSE-S3 or SSE-C can satisfy the audit requirement without KMS-specific logging.

How to eliminate wrong answers

Option A is wrong because it uses an AWS managed key, not a customer-managed key, so the security team cannot control key rotation or access policies. Option B is wrong because SSE-S3 uses server-side encryption with S3-managed keys, which does not provide customer-managed key control, and the bucket policy only enforces encryption, not auditing of decrypt calls. Option D is wrong because SSE-C requires the client to manage the encryption keys, which does not meet the requirement for AWS KMS, and logging S3 API calls alone does not capture KMS decrypt events.

Full explanation →

419

MCQeasy

A startup is building a mobile application that requires a database to store user profiles and preferences. The database must scale automatically with minimal administration. Which AWS service should they use?

A.Amazon Redshift

B.Amazon Aurora

C.Amazon DynamoDB

D.Amazon RDS for PostgreSQL

AnswerC

DynamoDB scales automatically with on-demand capacity.

Why this answer

Amazon DynamoDB is a fully managed NoSQL key-value and document database that delivers single-digit millisecond performance at any scale. It supports automatic scaling of throughput capacity and storage with no downtime, making it ideal for a mobile application that requires minimal administrative overhead. The serverless, pay-per-request billing model aligns perfectly with the startup's need for automatic scaling and low operational burden.

Exam trap

The trap here is that candidates often choose a relational database like Aurora or RDS because they assume user profiles require complex joins or ACID transactions, but DynamoDB's single-table design and conditional updates can handle most mobile app patterns with simpler, more scalable operations.

How to eliminate wrong answers

Option A is wrong because Amazon Redshift is a petabyte-scale data warehouse optimized for complex analytical queries, not for transactional user profile storage, and it requires manual scaling and cluster management. Option B is wrong because Amazon Aurora is a relational database that, while offering some auto-scaling for storage, still requires manual provisioning of compute resources and is not as fully serverless as DynamoDB for this use case. Option D is wrong because Amazon RDS for PostgreSQL is a managed relational database but requires manual scaling of instance size and storage, and does not offer the same level of automatic, seamless scaling as DynamoDB for a mobile app's unpredictable workload.

Full explanation →

420

Multi-Selecthard

Which TWO of the following are best practices for Amazon Redshift table design? (Choose TWO.)

Select 2 answers

A.Choose sort keys based on query patterns

B.Use INSERT statements for large data loads

C.Avoid compression encoding to reduce CPU overhead

D.Specify distribution keys to minimize data movement

E.Set distribution style to ALL for all tables

AnswersA, D

Sort keys improve query performance for range-filtered queries.

Why this answer

Options A and D are correct. Choosing sort keys based on query patterns optimizes data organization for faster retrieval, and specifying distribution keys minimizes data movement across nodes. Option B is wrong because large data loads should use the COPY command, not INSERT statements.

Option C is wrong because compression encoding reduces storage and I/O, improving performance despite slightly higher CPU overhead. Option E is wrong because setting distribution style to ALL for all tables can cause excessive data duplication and storage costs; distribution keys should be selected based on table size and join patterns.

Full explanation →

421

MCQeasy

Refer to the exhibit. A company uses S3 Event Notifications to trigger an AWS Lambda function whenever a new object is uploaded to an S3 bucket. The Lambda function processes the file and moves it to a different bucket. Recently, the function has been failing intermittently. The engineer checks the Lambda CloudWatch logs and sees the above event. What is the MOST likely cause of the intermittent failures?

A.The event JSON is malformed; the 'EventSource' should be 's3.amazonaws.com'.

B.The S3 bucket name contains a hyphen, which is not allowed.

C.The S3 event notifications are not guaranteed to be delivered exactly once, causing duplicate processing.

D.The event is missing the 'object:versionId' field.

AnswerC

At-least-once delivery can cause issues.

Why this answer

S3 Event Notifications are asynchronous and may be duplicated or delivered out of order, causing race conditions. Option A is wrong because the event has all required fields. Option B is wrong because the bucket name is valid.

Option D is wrong because the event format is correct.

Full explanation →

422

MCQmedium

A data engineer is designing a pipeline that ingests JSON logs from an application into Amazon S3. The logs contain a timestamp field. The pipeline must partition the data by date in S3 (e.g., year=2024/month=10/day=01). Which approach minimizes transformation effort?

A.Use Amazon Kinesis Data Firehose with dynamic partitioning

B.Use AWS Glue crawlers to infer schema and create partitions

C.Use AWS Lambda to process each object and copy to the appropriate prefix

D.Use Amazon Athena to create partitions on the existing data

AnswerA

Firehose can dynamically partition data based on the timestamp and deliver to S3 partitioned prefixes.

Why this answer

Amazon Kinesis Data Firehose with dynamic partitioning can automatically partition incoming JSON data based on the timestamp field without requiring custom transformation code. It evaluates the timestamp using a JQ expression or inline parsing, then writes records directly to S3 prefixes like year=2024/month=10/day=01. This minimizes transformation effort because the partitioning logic is configured declaratively in the Firehose delivery stream, eliminating the need for Lambda functions or post-ingestion processing.

Exam trap

The trap here is that candidates confuse metadata partitioning (e.g., using Glue crawlers or Athena) with physical partitioning in S3, assuming that catalog operations alone reorganize the data, when in fact only ingestion-time partitioning (like Firehose dynamic partitioning) creates the folder structure without extra transformation effort.

How to eliminate wrong answers

Option B is wrong because AWS Glue crawlers infer schema and create partition metadata in the Glue Data Catalog, but they do not physically reorganize data into partitioned S3 prefixes; they only add partition keys to the catalog after data is already stored. Option C is wrong because using AWS Lambda to process each object and copy it to the appropriate prefix introduces significant transformation effort, including writing custom code for parsing, partitioning logic, and handling retries, which contradicts the goal of minimizing effort. Option D is wrong because Amazon Athena can create partitions on existing data using ALTER TABLE ADD PARTITION or MSCK REPAIR TABLE, but this only updates the catalog metadata and does not physically partition the data in S3; the data remains in a flat structure, and Athena queries still scan all files unless partitions are manually created.

Full explanation →

423

Multi-Selecthard

A company is migrating a large Oracle data warehouse to Amazon Redshift. Which THREE considerations are important for optimizing the Redshift cluster?

Select 3 answers

A.Purchasing reserved instances for the cluster.

B.Using columnar storage format.

C.Defining appropriate sort keys for the tables.

D.Applying compression encoding to columns.

E.Choosing the right distribution style (KEY, ALL, EVEN).

AnswersC, D, E

Improves query performance by reducing scans.

Why this answer

Sort keys in Amazon Redshift determine the physical order of data on disk, which directly impacts the efficiency of range-restricted queries and compression. By defining appropriate sort keys (compound or interleaved), the query optimizer can use zone maps to skip large blocks of data that don't match the filter criteria, significantly reducing the number of blocks scanned and improving query performance.

Exam trap

The trap here is that candidates confuse cost-saving measures (reserved instances) or inherent architecture features (columnar storage) with active optimization choices, when in fact only sort keys, distribution styles, and compression encoding are configurable settings that directly impact query performance in Redshift.

Full explanation →

424

MCQhard

An e-commerce company uses AWS Glue to process clickstream data from its website. The data is stored in Amazon S3 in partitioned Parquet format by date and hour. A recent increase in traffic has caused the Glue job to fail with 'Java heap space' errors. The job runs with 10 DPUs and uses Spark's default configurations. The data engineer needs to resolve the memory issue without modifying the ETL script. What should the data engineer do?

A.Decrease the Spark configuration 'spark.sql.shuffle.partitions' to 50.

B.Change the worker type to G.1X.

C.Increase the Spark configuration 'spark.sql.shuffle.partitions' to 500.

D.Increase the number of DPUs to 20.

AnswerC

More shuffle partitions reduce the size of data per partition, mitigating memory issues.

Why this answer

Increasing 'spark.sql.shuffle.partitions' to 500 reduces the amount of data handled per partition during shuffle operations, which alleviates memory pressure and prevents 'Java heap space' errors. This is a configuration change that does not require modifying the ETL script. Option A is wrong because decreasing partitions increases data per partition, worsening memory issues.

Option B is wrong because changing worker type to G.1X (which has more memory per executor) might help but does not address the root cause if the issue is due to too few shuffle partitions; it is also not a direct fix for shuffle memory. Option D is wrong because increasing DPUs adds more executors but does not solve the per-executor memory issue caused by large shuffle partitions.

Full explanation →

425

MCQeasy

A data engineer is using AWS Glue to perform ETL on data stored in an S3 bucket. The source data is in CSV format with a header row, and the target is a set of Parquet files partitioned by date. The engineer notices that the Glue job is reading all files in the source prefix, including temporary files that should be ignored. What is the MOST efficient way to exclude these temporary files?

A.Change the source format from CSV to Parquet.

B.Set up an S3 event notification to trigger a Lambda function that moves temporary files.

C.Use an S3 prefix exclusion pattern in the Glue job's source path.

D.Create a custom classifier in the Glue Data Catalog.

AnswerC

Glue supports S3 include/exclude patterns to filter files.

Why this answer

AWS Glue supports S3 path exclusion patterns using glob-style syntax (e.g., `--exclude` or `excludePatterns` in the job parameters). By specifying a pattern like `**/_temporary/**` or `*.tmp`, the Glue job will skip those files during the read phase, avoiding unnecessary data processing and reducing costs. This is the most efficient approach as it requires no additional infrastructure or data movement.

Exam trap

The trap here is that candidates often assume Glue automatically ignores hidden or temporary files (like Spark's `_temporary` or Hadoop's `_SUCCESS`), but in reality, Glue reads all files under the specified prefix unless an explicit exclusion pattern is provided.

How to eliminate wrong answers

Option A is wrong because changing the source format from CSV to Parquet does not address the issue of excluding temporary files; it only changes the file format, and temporary files would still be read if they exist in the source prefix. Option B is wrong because setting up an S3 event notification to trigger a Lambda function that moves temporary files adds unnecessary complexity, latency, and cost; it also requires managing additional AWS resources and does not solve the problem at the Glue job level. Option D is wrong because a custom classifier in the Glue Data Catalog is used to infer schema from data formats (e.g., custom CSV delimiters), not to exclude files from being read during ETL processing.

Full explanation →

426

Multi-Selecthard

A company ingests streaming data from social media feeds into Amazon Kinesis Data Streams. The data is consumed by an AWS Lambda function that transforms and writes to Amazon S3. Recently, the Lambda function started timing out and dropping records. The data volume has tripled. Which actions should the data engineer take to resolve this? (Choose TWO.)

Select 2 answers

A.Increase the number of shards in the Kinesis data stream

B.Replace Lambda with Amazon Kinesis Data Firehose for the transformation

C.Increase the Lambda function timeout to 15 minutes

D.Set a reserved concurrency on the Lambda function

E.Increase the memory allocated to the Lambda function

AnswersA, E

More shards increase throughput capacity.

Why this answer

(increase shards) increases the Kinesis stream's throughput capacity to handle the tripled data volume, reducing backpressure on the Lambda consumer. Option E (increase Lambda memory) also increases CPU allocation, allowing the Lambda function to process each record faster, which helps prevent timeouts. Option B (replace Lambda with Firehose) could be an alternative but is not a direct fix for the existing Lambda-based architecture and may not be suitable for complex transformations.

Option C (increase timeout to 15 minutes) might allow more time but does not address the underlying root cause of insufficient throughput or processing power. Option D (reserved concurrency) prevents other functions from affecting this function's concurrency but does not increase total processing capacity; it could even limit scaling if set too low.

Full explanation →

427

Multi-Selectmedium

A data engineer is designing a disaster recovery strategy for an Amazon RDS for PostgreSQL database that is used in a data pipeline. The database must have a Recovery Point Objective (RPO) of less than 1 minute and a Recovery Time Objective (RTO) of less than 5 minutes. Which TWO actions should the engineer take?

Select 2 answers

A.Take frequent manual snapshots and copy them to another Region.

B.Enable automated backups with point-in-time recovery.

C.Enable Multi-AZ deployment with a standby instance.

D.Create a read replica in a different Availability Zone.

E.Use cross-Region replication with Amazon Aurora Global Database.

AnswersB, C

Allows recovery to any point within retention period, meeting RPO.

Why this answer

Options B and C are correct. Multi-AZ deployment with a standby instance enables automatic failover, typically achieving an RTO of under 1-2 minutes. Combined with automated backups and point-in-time recovery, which allow database restoration to any point within seconds (RPO of less than 1 minute), the requirements are met.

Option A is incorrect because manual snapshots are not frequent enough to guarantee RPO under 1 minute and restoring from a snapshot takes longer than 5 minutes. Option D is incorrect because a read replica in a different Availability Zone is not designed for automatic failover; it is for read scaling and requires manual promotion. Option E is incorrect because Amazon Aurora Global Database is a different service; this question is about Amazon RDS for PostgreSQL, and cross-Region replication for RDS does not provide automatic failover and typically has higher RTO.

Full explanation →

428

MCQhard

A data engineer is troubleshooting an access issue. A user has the IAM policy shown in the exhibit. The user attempts to upload an object to `s3://data-lake-bucket/confidential/report.pdf`. What will happen?

A.The upload will fail with an 'Access Denied' error.

B.The upload will succeed because the Deny statement is not valid without a condition.

C.The upload will succeed because the Allow statement is more specific than the Deny.

D.The upload will succeed because the user has s3:PutObject permission on the bucket.

AnswerA

The Deny statement explicitly denies all s3 actions on the confidential prefix, taking precedence over the Allow.

Why this answer

The explicit Deny statement in the IAM policy overrides the Allow statement, so the user is denied permission to upload to the 'confidential' path. Therefore, the upload will fail with an 'Access Denied' error, making option A correct.

Full explanation →

429

MCQhard

A data pipeline ingests streaming data from Kinesis Data Streams into S3 via Kinesis Data Firehose. Occasionally, small files are written to S3, increasing downstream processing costs. What is the most efficient way to reduce the number of small files?

A.Use a Lambda function to aggregate records before sending to Firehose.

B.Use the Kinesis Client Library (KCL) to write larger batches to S3 directly.

C.Run a daily AWS Glue job to concatenate small files.

D.Increase the Firehose buffering interval to 300 seconds and buffering size to 64 MB.

AnswerD

Firehose will buffer more data per file.

Why this answer

Kinesis Data Firehose allows you to configure buffering hints (size and interval) to control when data is delivered to S3. By increasing the buffering interval to 300 seconds and the buffering size to 64 MB, Firehose accumulates more records before writing, which reduces the number of small files. This is the most efficient approach as it requires no additional infrastructure or post-processing.

Exam trap

The trap here is that candidates may think a Lambda pre-aggregation (Option A) or a Glue job (Option C) is necessary, when in fact Firehose's built-in buffering configuration is the simplest and most cost-effective solution to control file sizes.

How to eliminate wrong answers

Option A is wrong because using a Lambda function to aggregate records before sending to Firehose adds latency and complexity, and Firehose already has built-in buffering capabilities that can be tuned without extra services. Option B is wrong because the Kinesis Client Library (KCL) is designed for consuming and processing records from a stream, not for writing directly to S3; it would require custom code to batch and write to S3, which is less efficient and not a managed solution. Option C is wrong because running a daily AWS Glue job to concatenate small files is a reactive, post-processing approach that does not prevent small files from being created in the first place, and it incurs additional compute costs and delays.

Full explanation →

430

MCQhard

Refer to the exhibit. A data engineer runs the AWS CLI command to look up GetObject events. The output shows an event from the DataEngineer role. However, the engineer suspects that some GetObject requests are not being logged. What is the MOST likely reason?

A.The IAM role does not have permission to read the CloudTrail logs.

B.The CloudTrail trail is not configured to log data events.

C.The trail is not enabled in the us-east-1 region.

D.The S3 bucket is in a different region than the CloudTrail trail.

AnswerB

By default, CloudTrail does not log data events for S3 objects; they must be enabled.

Why this answer

CloudTrail must have Data Events enabled for S3 object-level operations such as GetObject. Option A is wrong because the event is logged, so the trail exists. Option C is wrong because the engineer is looking up events, not configuring logging.

Option D is wrong because the lookup is for a specific region, but the bucket might be in a different region, but that would not cause missing logs if events are logged in the bucket's region.

Full explanation →

431

MCQhard

A company has an Amazon DynamoDB table with on-demand capacity mode. The table stores session data for a web application. Recently, the application experienced throttling errors during a traffic spike. The team wants to prevent future throttling while optimizing costs. What should they do?

A.Implement a DynamoDB Accelerator (DAX) cluster

B.Enable DynamoDB auto scaling on the table

C.Switch to provisioned capacity with auto scaling

D.Increase the read and write capacity of the table

AnswerA

DAX provides in-memory caching to reduce read throttling.

Why this answer

A DynamoDB Accelerator (DAX) cluster provides an in-memory cache that absorbs read-heavy traffic spikes, reducing the number of read requests that reach the underlying DynamoDB table. Since the throttling errors occurred during a traffic spike and the table uses on-demand capacity, which already scales automatically for writes and reads, the bottleneck is likely read-heavy traffic overwhelming the table's throughput. DAX offloads reads from the table, preventing throttling without requiring any changes to capacity mode, and it is cost-effective because it reduces read capacity unit consumption.

Exam trap

The trap here is that candidates assume throttling in on-demand mode must be fixed by switching to provisioned capacity or enabling auto scaling, but they overlook that on-demand already scales automatically and the real solution is to reduce read load via caching with DAX.

How to eliminate wrong answers

Option B is wrong because DynamoDB auto scaling is only available for provisioned capacity mode, not on-demand mode; on-demand already scales automatically, so enabling auto scaling is not applicable. Option C is wrong because switching to provisioned capacity with auto scaling would introduce management overhead and potential cost inefficiency compared to on-demand, and it does not address the root cause of read throttling during spikes as effectively as caching. Option D is wrong because increasing read and write capacity is only possible in provisioned mode; in on-demand mode, you cannot manually increase capacity, and doing so would not prevent throttling caused by read-heavy spikes without incurring unnecessary costs.

Full explanation →

432

Multi-Selecteasy

A company is using Amazon RDS for MySQL and wants to automate backups for point-in-time recovery. Which TWO actions should be taken? (Choose TWO.)

Select 2 answers

A.Enable automated backups with a retention period.

B.Use AWS Backup to schedule backups.

C.Set the backup retention period to the desired number of days.

D.Enable Multi-AZ deployment.

E.Take manual snapshots daily.

AnswersA, C

Automated backups provide point-in-time recovery and are enabled by default.

Why this answer

Enabling automated backups in Amazon RDS for MySQL allows point-in-time recovery (PITR) to any second within the retention period. Option C is correct because setting the backup retention period to the desired number of days (1–35 days) defines how far back you can perform PITR, and it must be explicitly configured to enable automated backups.

Exam trap

The trap here is that candidates often confuse Multi-AZ deployment (which provides failover) with backup automation, or assume AWS Backup is required for automated backups, when in fact RDS native automated backups are sufficient and the primary method for PITR.

Full explanation →

433

Drag & Dropmedium

Order the steps to query data in Amazon Redshift Spectrum from an external table in Athena.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Start by creating the external schema in Redshift, then the external table, grant permissions, run the query, and verify results.

Full explanation →

434

MCQhard

Refer to the exhibit. A data engineer is running an AWS Glue job that reads from an S3 bucket encrypted with a customer-managed KMS key. The job fails with the error shown. What is the most likely cause?

A.The S3 bucket policy denies the kms:Decrypt action.

B.The IAM role used by the Glue job is missing the kms:Decrypt permission.

C.The Glue job does not have permission to call kms:GenerateDataKey.

D.The KMS key policy does not grant the Glue service principal access.

AnswerB

The error says no identity-based policy allows kms:Decrypt.

Why this answer

The error indicates that the AWS Glue job cannot access the S3 bucket because it lacks the necessary KMS permissions. Since the bucket is encrypted with a customer-managed KMS key, the IAM role assigned to the Glue job must include the kms:Decrypt permission to read the encrypted objects. Without this permission, the job fails when attempting to decrypt the data.

Exam trap

AWS often tests the distinction between kms:Decrypt and kms:GenerateDataKey, leading candidates to mistakenly choose the latter when the job is only reading data, not writing or generating new encryption keys.

How to eliminate wrong answers

Option A is wrong because the S3 bucket policy denying kms:Decrypt would cause a different error (e.g., Access Denied), but the error shown specifically points to a missing permission, not a denial. Option C is wrong because kms:GenerateDataKey is used for encrypting new data, not for reading existing encrypted objects; the job only needs kms:Decrypt to read the encrypted data. Option D is wrong because the KMS key policy does not need to grant the Glue service principal directly; the IAM role used by the Glue job is the entity that requires the kms:Decrypt permission, and the key policy must allow that role (or the account) to use the key.

Full explanation →

435

Multi-Selecthard

A company uses AWS Glue to transform data from Amazon S3 into Parquet format. The job fails with an out-of-memory error for large files. Which TWO actions can resolve this issue? (Choose TWO.)

Select 2 answers

A.Change the input format from CSV to JSON.

B.Increase the number of DPUs allocated to the job.

C.Use the Glue streaming ETL feature.

D.Enable CloudWatch logs for detailed error analysis.

E.Split the input data into smaller files.

AnswersB, E

More DPUs provide more memory and processing power.

Why this answer

Increasing the number of DPUs (Data Processing Units) allocated to the Glue job provides more memory and compute capacity, which directly addresses out-of-memory errors when processing large files. AWS Glue uses Apache Spark under the hood, and each DPU provides 4 vCPU and 16 GB of memory, so adding DPUs scales the available resources for in-memory transformations.

Exam trap

The trap here is that candidates may think enabling logging (CloudWatch) or changing file formats will fix memory issues, but only resource scaling (DPUs) or data partitioning (smaller files) address the root cause of insufficient memory for large in-memory transformations.

Full explanation →

436

Multi-Selectmedium

A data engineer is configuring an S3 bucket policy to allow cross-account access for a partner organization to write data to a specific prefix. The partner's AWS account ID is 111111111111. The engineer wants to ensure that only the partner can write, and that the partner cannot read or delete objects. Which policy statements should be included? (Choose TWO.)

Select 2 answers

A.{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::111111111111:user/PartnerUser"},"Action":"s3:PutObject","Resource":"arn:aws:s3:::mybucket/partner/*"}

B.{"Effect":"Allow","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::mybucket/partner/*","Condition":{"StringEquals":{"aws:SourceAccount":"111111111111"}}}

C.{"Effect":"Allow","Principal":{"AWS":"111111111111"},"Action":"s3:PutObject","Resource":"arn:aws:s3:::mybucket/partner/*"}

D.{"Effect":"Allow","Principal":{"AWS":"111111111111"},"Action":["s3:GetObject","s3:DeleteObject"],"Resource":"arn:aws:s3:::mybucket/partner/*"}

E.{"Effect":"Deny","Principal":{"AWS":"111111111111"},"NotAction":"s3:PutObject","Resource":"arn:aws:s3:::mybucket/partner/*"}

AnswersC, E

Grants write access to the prefix.

Why this answer

The correct answers are C and E. Option C allows the partner account to perform s3:PutObject on the specified prefix, granting write access. Option E explicitly denies all actions except s3:PutObject, ensuring the partner cannot read or delete objects.

Option A is incorrect because it specifies a user ARN instead of the account ARN, which would not allow all users in the partner account. Option B grants access to any principal with a condition, but the condition uses aws:SourceAccount which is not appropriate for cross-account access via bucket policy. Option D grants read and delete, which violates the requirement.

Full explanation →

437

Multi-Selecthard

A company stores sensitive financial data in an Amazon Redshift cluster. The data engineer must ensure that all queries are logged for audit purposes and that the logs are stored in Amazon S3 with server-side encryption. Which THREE steps should the data engineer take to meet these requirements?

Select 3 answers

A.Configure audit logs to be stored in an Amazon S3 bucket.

B.Enable encryption on the Redshift cluster.

C.Enable AWS CloudTrail to log Redshift queries.

D.Enable audit logging on the Redshift cluster.

E.Enable default encryption on the S3 bucket using SSE-S3 or SSE-KMS.

AnswersA, D, E

Audit logs can be delivered to an S3 bucket.

Why this answer

Amazon Redshift audit logs can be configured to be stored directly in an Amazon S3 bucket, which is a native feature for exporting connection logs, user logs, and query logs. This satisfies the requirement to log all queries for audit purposes without relying on external services.

Exam trap

The trap here is confusing AWS CloudTrail (which logs control-plane API calls) with Redshift's native audit logging (which logs data-plane SQL queries), leading candidates to incorrectly select CloudTrail as a solution for query auditing.

Full explanation →

438

MCQmedium

Refer to the exhibit. A data engineer deploys this CloudFormation template to create an AWS Glue job. The job fails on the first run with an error: 'AccessDeniedException: User: arn:aws:sts::123456789012:assumed-role/GlueServiceRole/... is not authorized to perform: s3:GetObject on resource: s3://my-bucket/scripts/etl.py'. What is the most likely cause?

A.The ExecutionProperty MaxConcurrentRuns is set to 1, preventing the job from running.

B.The IAM role associated with the Glue job does not have an S3 GetObject permission for the script location.

C.The MaxRetries is set to 0, so the job does not retry on failure.

D.The script location is incorrectly specified; it should be an S3 URI with bucket and key.

AnswerB

Glue needs s3:GetObject on the script.

Why this answer

The error message indicates that the IAM role 'GlueServiceRole' assumed by the AWS Glue job does not have the s3:GetObject permission for the script object at s3://my-bucket/scripts/etl.py. AWS Glue requires the execution role to have read access to the script location specified in the 'ScriptLocation' parameter. Without this permission, the job fails immediately on startup because it cannot download and execute the ETL script.

Exam trap

The DEA-C01 exam often tests the distinction between permissions errors and configuration errors, where candidates might incorrectly focus on script location format or job parameters instead of recognizing that an AccessDeniedException is a clear IAM permissions issue.

How to eliminate wrong answers

Option A is wrong because ExecutionProperty MaxConcurrentRuns controls how many concurrent runs of the job are allowed, not whether the job can start; it would not cause an AccessDeniedException. Option C is wrong because MaxRetries determines how many times the job retries after a failure, but the job fails on the first run with an access denied error, not a retry-related issue. Option D is wrong because the script location is already specified as an S3 URI (s3://my-bucket/scripts/etl.py), which is the correct format; the error is about permissions, not format.

Full explanation →

439

MCQeasy

A data engineer is running an Amazon EMR cluster with Spark to process log files. The cluster uses instance fleets with m5.xlarge core nodes. The engineer observes that the Spark job is running slower than expected. CloudWatch metrics show that the cluster's CPU utilization is below 20% but memory utilization is near 90%. Which configuration change would most likely improve performance?

A.Use memory-optimized instances (r5.xlarge) for core nodes.

B.Increase the number of core nodes from 5 to 10.

C.Increase the number of Spark shuffle partitions.

D.Decrease the number of core nodes to reduce overhead.

AnswerA

r5 instances have higher memory-to-CPU ratio, reducing memory pressure and spills.

Why this answer

High memory utilization (90%) with low CPU (<20%) indicates that the data does not fit in memory, causing frequent spills to disk. Using memory-optimized instances (r5.xlarge) provides more memory per vCPU compared to m5.xlarge, allowing more data to be kept in memory and reducing spills. Option B is incorrect because increasing the number of core nodes adds more CPU and memory overall, but each node still has the same memory-to-CPU ratio (8 GB per 4 vCPUs for m5.xlarge), so memory pressure per node remains.

Option C is incorrect because the issue is insufficient memory, not the number of shuffle partitions; adjusting shuffle partitions does not increase available memory. Option D is incorrect because decreasing the number of core nodes reduces total cluster memory, worsening the memory bottleneck.

Full explanation →

440

MCQeasy

A company uses AWS Glue to run ETL jobs that process data from Amazon RDS to Amazon S3. The job runs successfully but the data in S3 is missing some records that exist in the source. The engineer notices that the job uses a JDBC connection and the query extracts data based on a timestamp column. What is the MOST likely cause of the missing records?

A.The timestamp column includes time portion and the job is using an exclusive upper bound.

B.The S3 bucket lacks write permissions.

C.The JDBC connection uses connection pooling, causing some records to be dropped.

D.The Glue job is configured to only read from one table.

AnswerA

Correct. When extracting data using a timestamp column, if the job uses an exclusive upper bound, records with timestamps equal to the boundary value may be missed, especially when the timestamp includes time portion.

Why this answer

The job extracts data based on a timestamp column and uses an exclusive upper bound (e.g., WHERE timestamp < some_value). If the timestamp includes a time portion, records with a timestamp exactly equal to the upper bound are excluded, causing them to be missing from S3. Option B is incorrect because S3 bucket permissions would cause the job to fail, not simply miss records.

Option C is incorrect because connection pooling does not cause records to be dropped. Option D is incorrect because the Glue job can be configured to read from multiple tables; this is unrelated to the missing records.

Full explanation →

441

MCQeasy

Refer to the exhibit. A data engineer runs the AWS CLI command and observes the output. The stream has two shards. A producer sends a record with a partition key that hashes to 150000000000000000000000000000000000000. To which shard will the record be written?

A.shardId-000000000001

B.The record will be rejected because it does not match any shard

C.shardId-000000000000

D.The record will be written to both shards

AnswerA

The hash key falls within the range of the second shard.

Why this answer

The record will be written to shardId-000000000001 because the hash key range for shardId-000000000000 is [0, 170141183460469231731687303715884105727) and for shardId-000000000001 is [170141183460469231731687303715884105727, 340282366920938463463374607431768211455). The partition key hash value of 150000000000000000000000000000000000000 falls within the second shard's range, so the record is routed to shardId-000000000001.

Exam trap

The DEA-C01 exam often tests the misconception that the shard ID (e.g., 000000000000) corresponds to the numeric order of the hash range, but in reality, the shard ID is a sequential identifier and the hash key range is what determines routing, not the shard ID itself.

How to eliminate wrong answers

Option B is wrong because the record's hash value falls within a valid shard's hash key range, so it will not be rejected; Kinesis Data Streams accepts any record with a valid partition key. Option C is wrong because the hash value 150000000000000000000000000000000000000 is greater than the upper bound of shardId-000000000000's range (170141183460469231731687303715884105727), so it does not belong to that shard. Option D is wrong because each record is written to exactly one shard based on its partition key hash; Kinesis does not write records to multiple shards.

Full explanation →

442

Multi-Selecteasy

A data engineer needs to store streaming data from multiple sources into Amazon S3. The data should be organized by source, date, and hour. The engineer wants to minimize processing overhead. Which THREE S3 features should the engineer use to achieve this? (Choose THREE.)

Select 3 answers

A.S3 Inventory to list objects and their metadata.

B.S3 Object Lock to prevent object modifications.

C.S3 Batch Operations to rename objects after upload.

D.S3 Event Notifications to invoke Lambda functions for data processing.

E.S3 prefixes to create a folder structure (e.g., source=.../date=.../hour=...).

AnswersA, D, E

Inventory helps audit and manage the stored data.

Why this answer

S3 prefixes organize objects into a hierarchy. S3 Inventory provides a list of objects. S3 Event Notifications trigger downstream processing.

Batch Operations are for bulk actions, not organization. Object Lock is for retention. S3 Select is for querying within files.

Full explanation →

443

MCQhard

A company runs a data pipeline using AWS Step Functions to orchestrate multiple AWS Lambda functions and AWS Glue jobs. The pipeline processes large CSV files from Amazon S3, transforms them, and loads them into Amazon Redshift. Recently, the pipeline has been failing intermittently with a 'StateMachineExecutionLimitExceeded' error. The error occurs when multiple pipeline runs are triggered simultaneously. The current execution limit for the state machine is 1000. The team expects up to 200 concurrent executions during peak hours. Which action should the team take to resolve the issue?

A.Increase the execution timeout for the state machine to 1 hour.

B.Increase the Lambda function concurrency limits to allow more parallel processing.

C.Implement a queue (e.g., Amazon SQS) to buffer the pipeline triggers and process them sequentially.

D.Request a service quota increase for the maximum number of state machine executions from AWS Support.

AnswerD

The default limit is 1000; increasing it to 2000 would accommodate the expected concurrency.

Why this answer

The error indicates the state machine execution limit has been reached. The team should request a limit increase from AWS Support. Option A is wrong because reducing concurrency does not solve the limit issue; it only reduces the number of concurrent executions.

Option B is wrong because increasing Lambda concurrency limits does not affect Step Functions execution limits. Option C is wrong because the error is not about execution timeout; it's about exceeding the maximum number of concurrent executions.

Full explanation →

444

MCQhard

A company uses Amazon Redshift for analytics. The data engineer notices that queries are slow and the system is experiencing high disk usage. The engineer suspects that the distribution style is suboptimal. Which action should the engineer take to improve query performance?

A.Convert all tables to use SORTKEY on the most frequently filtered column.

B.Increase the number of nodes in the cluster to distribute data across more slices.

C.Use the DISTSTYLE AUTO setting and analyze query patterns to let Redshift choose.

D.Set all tables to DISTSTYLE EVEN to distribute data evenly.

AnswerC

AUTO adapts distribution based on workload.

Why this answer

DISTSTYLE AUTO allows Amazon Redshift to automatically assign distribution styles (KEY, EVEN, or ALL) based on query patterns and table size, optimizing data distribution for improved query performance. This is particularly effective when the engineer suspects suboptimal distribution but lacks detailed knowledge of the ideal key, as Redshift analyzes workload patterns to reduce data movement and disk usage.

Exam trap

The trap here is that candidates often confuse distribution style with sort key or node scaling, leading them to choose options that address symptoms (e.g., disk usage via node count) rather than the root cause of suboptimal data distribution.

How to eliminate wrong answers

Option A is wrong because SORTKEY improves query performance by reducing the amount of data scanned via block-level filtering, but it does not address distribution style or high disk usage caused by data skew. Option B is wrong because increasing the number of nodes distributes data across more slices but does not fix the root cause of suboptimal distribution; it may even exacerbate disk usage if data is already skewed. Option D is wrong because setting all tables to DISTSTYLE EVEN distributes rows evenly across slices, which can eliminate data skew but may cause excessive data movement (broadcast or redistribution) during joins, degrading query performance for tables that are frequently joined on specific columns.

Full explanation →

445

MCQeasy

A company is using Amazon Redshift for data warehousing. They need to ensure that all queries are logged for audit purposes. Which AWS service should be used to capture query logs?

A.AWS CloudTrail

B.Amazon S3

C.Amazon CloudWatch Logs

D.Amazon Athena

AnswerC

Amazon CloudWatch Logs is the service used to capture Redshift query logs for audit purposes.

Why this answer

Amazon Redshift can be configured to publish audit logs, including query logs, to Amazon CloudWatch Logs, which provides a centralized log management service. Option A is incorrect because AWS CloudTrail captures API activity within your AWS account, not specific database query logs. Option B is incorrect because Amazon S3 is a storage service, not a logging service.

Option D is incorrect because Amazon Athena is an interactive query service used to analyze data in S3, not a logging service.

Full explanation →

446

MCQeasy

A data engineer is troubleshooting a slow Amazon Redshift query. The EXPLAIN plan shows a 'Seq Scan' on a large table. What is the most likely cause?

A.The cluster has too many nodes.

B.There are too many concurrent queries.

C.The table does not have a proper sort key defined.

D.The workload management (WLM) queue is misconfigured.

AnswerC

Without a sort key, Redshift performs a full table scan (Seq Scan) instead of a range-restricted scan.

Why this answer

A 'Seq Scan' in the EXPLAIN plan indicates a full table scan, which typically occurs when the table does not have a proper sort key defined. Without a sort key, Redshift cannot use zone maps to skip blocks, resulting in a sequential scan. Option A (too many nodes) would not cause a Seq Scan; it might improve performance if properly distributed.

Option B (concurrent queries) can cause slowdown but not specifically a Seq Scan. Option D (WLM queue misconfiguration) affects query queuing and concurrency, not the scan type.

Full explanation →

447

Multi-Selectmedium

A company ingests IoT data into an S3 bucket using AWS IoT Core rules. The data is in JSON format, and each record is about 500 bytes. The data volume is 5 GB per day. The company wants to convert the data to Parquet format and partition it by year/month/day. Which TWO AWS services can be used together to achieve this with minimal operational overhead?

Select 2 answers

A.Amazon Athena CTAS query

B.AWS Glue ETL job triggered by S3 event

C.AWS Lambda function triggered by S3 event

D.Amazon EMR with Spark job

E.Amazon Kinesis Data Firehose with Parquet conversion

AnswersB, C

Glue can be triggered by S3 events (via Lambda or EventBridge) and perform the conversion and partitioning.

Why this answer

(AWS Glue ETL job triggered by S3 event) is correct because it provides a serverless, fully managed ETL solution that can convert JSON to Parquet and partition by year/month/day with minimal operational overhead. The S3 event trigger automatically invokes the Glue job when new data arrives, eliminating the need for manual scheduling or infrastructure management.

Exam trap

The trap here is that candidates often choose Amazon Kinesis Data Firehose (Option E) thinking it's the simplest for Parquet conversion, but it is designed for streaming data, not for batch processing of S3-uploaded files, and it lacks native S3 event-driven partitioning for historical data.

Full explanation →

448

Multi-Selecteasy

A data engineer needs to ingest data from an Amazon RDS MySQL database into a data lake on Amazon S3. The engineer wants to perform an initial full load and then capture incremental changes. Which TWO AWS services can be combined to achieve this?

Select 2 answers

A.Amazon Kinesis Data Firehose

B.AWS Glue

C.Amazon S3

D.AWS Database Migration Service (DMS)

E.AWS Data Pipeline

AnswersC, D

S3 is the target for the data lake.

Why this answer

Amazon S3 is the target data lake storage layer, not a service that performs data ingestion or change data capture. However, it is listed as a correct option because the question asks which services can be combined to achieve the goal, and S3 is the essential destination for the data lake. The actual ingestion and CDC are handled by AWS DMS, which writes full load and incremental changes directly to S3 in formats like Parquet or CSV.

Exam trap

The trap here is that candidates assume Amazon S3 is only a storage service and not a correct answer, but the question asks for services that can be combined, and S3 is the required target for the data lake, making it a valid choice alongside DMS.

Full explanation →

449

MCQeasy

A company uses Amazon Athena to query data in S3. The security team wants to ensure that users can only query tables they have permissions to in the AWS Glue Data Catalog. Which service should be used to manage these permissions centrally?

A.AWS Lake Formation

B.AWS IAM

C.AWS CloudTrail

D.S3 bucket policies

AnswerA

Lake Formation provides fine-grained access control to Data Catalog resources.

Why this answer

Lake Formation provides centralized permissions management for the Glue Data Catalog. Option B (IAM) is too low-level and does not integrate directly with Data Catalog tables. Option C (S3 bucket policy) does not control table access.

Option D (CloudTrail) is for auditing, not access control.

Full explanation →

450

MCQmedium

A data engineer is migrating an on-premises PostgreSQL database to Amazon RDS for PostgreSQL. The database is 2 TB in size and has a tight migration window. Which migration approach minimizes downtime?

A.Use AWS Database Migration Service (DMS) with full load only.

B.Use pg_dump to export the database and pg_restore to import into RDS.

C.Create a read replica in RDS and promote it when ready.

D.Use AWS DMS with ongoing replication to capture changes during migration.

AnswerD

Ongoing replication syncs changes until cutover, minimizing downtime.

Why this answer

AWS DMS with ongoing replication (change data capture, CDC) allows you to perform a full load of the existing data and then continuously replicate incremental changes from the source PostgreSQL database to the target RDS for PostgreSQL. This minimizes downtime because you can keep the source database fully operational during the migration and only switch applications over after the target is fully synchronized, resulting in a very short cutover window.

Exam trap

The trap here is that candidates often confuse the concept of a read replica (which is an AWS-internal feature for RDS instances) with a migration tool, and mistakenly think they can replicate from an on-premises database to an RDS read replica, which is not supported.

How to eliminate wrong answers

Option A is wrong because using AWS DMS with full load only copies the current state of the database and does not capture any changes made during the migration, so you would need to stop writes on the source to ensure consistency, causing significant downtime. Option B is wrong because pg_dump and pg_restore are logical backup and restore tools that require the source database to be in a consistent state (often requiring a read-only or quiesced state) and do not support ongoing replication, leading to a longer downtime window for a 2 TB database. Option C is wrong because Amazon RDS for PostgreSQL does not support creating a read replica from an on-premises PostgreSQL instance; read replicas in RDS are only available within the AWS ecosystem and cannot be used for cross-environment migrations.

Full explanation →

Page 6 of 23

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23

Practice DEA-C01 by domain

Target a specific domain to shore up weak areas.

Data Ingestion and Transformation Data Operations and Support Data Security and Governance Data Store Management

See all domains with question counts →