Courseiva

AWS Certified Data Engineer Associate DEA-C01 (DEA-C01) — Questions 451525

1711 questions total · 23pages · All types, answers revealed

Page 6

Page 7 of 23

Page 8
451
MCQhard

A company uses Kinesis Data Analytics for SQL-based real-time analytics on streaming data. They notice that the application is processing data slower than the incoming rate, causing increased latency. Which action is MOST likely to improve the throughput?

A.Increase the number of Kinesis Processing Units (KPUs) for the application
B.Increase the number of shards in the Kinesis data stream
C.Enable auto-scaling on the Kinesis data stream
D.Decrease the retention period of the Kinesis data stream
AnswerA

More KPUs increase parallelism and throughput.

Why this answer

Kinesis Data Analytics for SQL applications processes data using Kinesis Processing Units (KPUs), which define the compute and memory resources available. When the incoming data rate exceeds the processing capacity, increasing the number of KPUs directly scales the application's parallelism and throughput, allowing it to keep up with the stream. This is the most direct way to reduce latency caused by insufficient processing power.

Exam trap

The trap here is that candidates often confuse scaling the source stream (shards) with scaling the analytics application (KPUs), assuming that more shards automatically improve processing throughput, when in fact the application's compute resources are the limiting factor.

How to eliminate wrong answers

Option B is wrong because increasing the number of shards in the Kinesis data stream increases the ingestion capacity and parallelism of the source stream, but it does not directly increase the processing capacity of the Kinesis Data Analytics application; the application must also be scaled (e.g., via KPUs) to consume the additional shards. Option C is wrong because enabling auto-scaling on the Kinesis data stream only adjusts the number of shards based on throughput, which again does not address the application's processing bottleneck. Option D is wrong because decreasing the retention period of the Kinesis data stream only reduces how long data is stored in the stream; it does not affect the processing rate or throughput of the analytics application.

452
MCQhard

A data engineer ran the command shown in the exhibit on the bucket 'my-data-lake'. The engineer then tries to delete an object version but receives an 'AccessDenied' error. The engineer has full S3 permissions via IAM. What is the most likely reason for the error?

A.Versioning is suspended on the bucket
B.MFA Delete is enabled, requiring multi-factor authentication
C.The bucket policy denies s3:DeleteObjectVersion
D.An S3 Object Lock retention policy is in effect
AnswerB

MFA Delete requires additional authentication to delete versions.

Why this answer

The command shown in the exhibit (likely `aws s3api put-bucket-versioning --bucket my-data-lake --versioning-configuration Status=Enabled,MFADelete=Enabled`) enables both versioning and MFA Delete on the bucket. When MFA Delete is enabled, any operation that permanently deletes an object version or changes the versioning state requires the request to include a multi-factor authentication token. Even though the engineer has full S3 permissions via IAM, the missing MFA token causes the 'AccessDenied' error.

This is a bucket-level setting that overrides IAM permissions for these specific operations.

Exam trap

The trap here is that candidates assume 'full S3 permissions via IAM' guarantees all operations succeed, but MFA Delete is a bucket-level condition that overrides IAM permissions for version deletion and versioning state changes, requiring explicit MFA authentication.

How to eliminate wrong answers

Option A is wrong because suspending versioning does not prevent deletion of existing object versions; it only stops new versions from being created, and the engineer would still be able to delete versions with appropriate IAM permissions. Option C is wrong because the engineer has full S3 permissions via IAM, and there is no indication of a bucket policy explicitly denying s3:DeleteObjectVersion; the error is not caused by a deny statement. Option D is wrong because an S3 Object Lock retention policy prevents deletion or overwrite of objects during the retention period, but the error message is 'AccessDenied' specifically due to missing MFA, not a retention-based block.

453
MCQhard

A company uses AWS Glue to run ETL jobs that process data from Amazon RDS for MySQL and load it into Amazon S3. The job runs daily and processes incremental changes using the JDBC connection. Recently, the job has been failing with a 'Communications link failure' error. The RDS instance is in a private subnet. Which step should the engineer take first to diagnose the issue?

A.Verify that the IAM role used by Glue has the correct permissions to access RDS.
B.Change the Glue job type from Spark to Python shell.
C.Check the security group and network ACL rules for the RDS instance and the Glue connection.
D.Check that the JDBC driver is compatible with the Glue version.
AnswerC

Network misconfiguration is the most common cause of link failure.

Why this answer

The 'Communications link failure' error typically indicates a network connectivity issue between AWS Glue and the RDS instance. Since the RDS instance is in a private subnet, the Glue job must be able to reach it via a VPC endpoint or a Glue connection that uses network configuration. Checking the security group (inbound rules for the RDS instance allowing traffic from Glue's elastic network interfaces) and network ACLs (ensuring ephemeral ports are open) is the first logical step to diagnose connectivity.

Exam trap

The trap here is that candidates often jump to IAM permissions or JDBC driver issues first, but the 'Communications link failure' error is a classic network connectivity symptom that requires checking security groups and network ACLs before anything else.

How to eliminate wrong answers

Option A is wrong because IAM permissions control authentication and authorization to AWS services, not network-level connectivity; a 'Communications link failure' is a network error, not an access denied error. Option B is wrong because changing the job type from Spark to Python shell does not resolve network connectivity issues; it only changes the execution environment and may even introduce new limitations for JDBC connections. Option D is wrong because JDBC driver compatibility would cause a different error (e.g., 'No suitable driver' or class not found), not a 'Communications link failure', which is a network timeout or connection reset.

454
MCQhard

A company uses Amazon Redshift for data warehousing. The security team requires that all data stored in Redshift be encrypted at rest. The current cluster is unencrypted. Which approach should the data engineer take to meet this requirement with minimal downtime?

A.Modify the cluster to enable encryption.
B.Unload data to S3 and reload into a new encrypted cluster.
C.Use the COPY command to load data into a new encrypted table.
D.Take a snapshot of the existing cluster and restore it to a new encrypted cluster.
AnswerD

Snapshot restore allows creating an encrypted cluster with minimal downtime.

Why this answer

Redshift allows restoring a snapshot to a new encrypted cluster. The engineer can take a snapshot of the existing cluster, restore it to a new cluster with encryption enabled, and then redirect traffic to the new cluster. Option A is wrong because encryption cannot be enabled on an existing cluster.

Option B is wrong because COPY command does not encrypt the cluster. Option C is wrong because unloading and reloading data would cause significant downtime.

455
MCQhard

A data engineer is designing a multi-Region disaster recovery solution for an Amazon DynamoDB table. The table must be available in a secondary Region with minimal data loss and automatic failover. Which feature should be used?

A.DynamoDB on-demand backup and restore in the secondary Region
B.DynamoDB global tables
C.DynamoDB point-in-time recovery (PITR)
D.DynamoDB cross-Region snapshot export to S3
AnswerB

Global tables replicate data across Regions and support automatic failover.

Why this answer

DynamoDB global tables provide a fully managed, multi-Region, multi-active database solution that replicates data automatically across selected AWS Regions. This ensures automatic failover with eventual consistency and minimal data loss, meeting the disaster recovery requirements for high availability and automatic failover without manual intervention.

Exam trap

The trap here is that candidates often confuse point-in-time recovery (PITR) with cross-Region disaster recovery, but PITR is a single-Region feature that does not provide automatic failover or multi-Region replication.

How to eliminate wrong answers

Option A is wrong because on-demand backup and restore is a manual process that requires user intervention to initiate a restore in the secondary Region, not providing automatic failover or minimal data loss in real time. Option C is wrong because point-in-time recovery (PITR) protects against accidental writes or deletes within a single Region by restoring to a point in time, but it does not replicate data across Regions or enable automatic failover. Option D is wrong because cross-Region snapshot export to S3 is a manual, batch-oriented process that exports table data to Amazon S3 in another Region, requiring manual import and setup for failover, and does not provide automatic, continuous replication or failover.

456
MCQmedium

A company uses Amazon Athena to query data stored in an S3 bucket. The data is partitioned by year, month, day, and hour. The data engineer notices that queries are scanning a large amount of data even with a WHERE clause on the partition columns. What is the MOST likely cause?

A.The data has too many partitions, causing overhead.
B.The table does not have partitions defined in the AWS Glue Data Catalog.
C.The S3 bucket uses the S3 Glacier storage class.
D.The data files are compressed with GZIP.
AnswerB

If partitions are not defined in the AWS Glue Data Catalog, Athena cannot perform partition pruning, leading to full table scans.

Why this answer

If partitions are not defined in the table, Athena cannot perform partition pruning. Option A is wrong because too many partitions improve pruning, not hinder scanning. Option C is wrong because S3 storage class does not affect scanning.

Option D is wrong because compressed files reduce scan size, not increase.

457
Multi-Selectmedium

A company is building a data lake on Amazon S3. Data arrives from multiple sources in JSON, CSV, and Avro formats. The data must be transformed to Parquet and partitioned by date and source. Which TWO services can perform this transformation with minimal custom code? (Choose TWO.)

Select 2 answers
A.Amazon EMR with Spark
B.AWS Lake Formation
C.Amazon Athena CTAS queries
D.AWS Glue ETL jobs
E.Amazon Kinesis Data Firehose
AnswersA, D

EMR can run Spark for large-scale transformations.

Why this answer

Both Amazon EMR with Spark and AWS Glue ETL jobs can perform the transformation with minimal custom code. Spark natively supports reading JSON, CSV, and Avro formats and writing Parquet with partitioning by date and source, requiring only a concise PySpark or Scala script. Similarly, AWS Glue provides a managed Spark environment with built-in transforms and crawlers, allowing users to write Spark scripts or use visual ETL jobs with minimal code.

The other options either lack native transformation capabilities (Lake Formation, Athena CTAS queries) or are designed for streaming data (Kinesis Data Firehose).

Exam trap

The trap here is that candidates often confuse AWS Lake Formation's data catalog and permission features with actual data transformation capabilities, or they assume Kinesis Data Firehose can transform existing S3 objects when it only processes streaming data in transit.

458
MCQmedium

A social media company ingests user activity data from multiple sources using Amazon Kinesis Data Firehose. The data is delivered to Amazon S3 in near-real-time. The company wants to transform the data by adding a timestamp and masking email addresses before storing it in S3. The transformation should be applied to all records. What is the most cost-effective way to implement this transformation?

A.Use Amazon Athena to run a CTAS query that transforms the data and writes to a new location.
B.Use AWS Glue to schedule a batch job every 5 minutes to transform the data.
C.Use Amazon S3 Events to trigger a Lambda function whenever a new object is created.
D.Configure the Firehose delivery stream to invoke a Lambda function for data transformation.
AnswerD

Firehose supports built-in Lambda transformation for real-time processing.

Why this answer

The most cost-effective way is to configure the Kinesis Data Firehose delivery stream to invoke an AWS Lambda function for data transformation before the data is delivered to S3. This approach is serverless and only runs when data is flowing, so you pay only for the compute time used during transformation. Option A (Athena CTAS) would require querying after storage, adding cost and latency.

Option B (Glue batch job) runs on a schedule regardless of data volume, leading to idle costs, and introduces latency. Option C (S3 Events with Lambda) triggers after data is already stored, meaning the data is first stored in raw form, then transformed, doubling storage costs and adding complexity. Therefore, the Firehose-integrated Lambda is the most cost-effective and low-latency option.

459
Multi-Selecthard

A data engineer is designing a disaster recovery plan for an Amazon Redshift data warehouse. The cluster is in us-east-1 and must be recoverable in us-west-2 with minimal data loss. Which THREE actions should the engineer take? (Choose THREE)

Select 3 answers
A.Create manual snapshots and copy them to us-west-2
B.Deploy Redshift in a multi-AZ configuration
C.Enable Redshift concurrent scaling
D.Schedule automated snapshots with a retention period
E.Configure automated snapshot copy to us-west-2
AnswersA, D, E

Manual snapshots can be copied across regions.

Why this answer

Options A, D, and E are correct. To recover an Amazon Redshift cluster in a different region (us-west-2) from us-east-1, you need to have snapshots available in the target region. Manual snapshots (option A) can be copied to us-west-2 and are retained even if the cluster is deleted.

Automated snapshots with a retention period (option D) ensure regular backups, and by configuring automated snapshot copy to us-west-2 (option E), these snapshots are automatically replicated to the target region for cross-region recovery. Option B (multi-AZ) provides high availability within a single region but does not help with cross-region disaster recovery. Option C (concurrent scaling) improves query performance under load, not disaster recovery.

460
MCQeasy

A data engineering team is ingesting streaming data from IoT devices using AWS IoT Core and needs to process the data in near real-time with minimal code. Which AWS service should they use to transform the data before storing it in Amazon S3?

A.Amazon Kinesis Data Analytics
B.AWS Glue
C.Amazon Redshift
D.Amazon Athena
AnswerA

Kinesis Data Analytics can run SQL queries on streaming data from IoT Core in near real-time.

Why this answer

Amazon Kinesis Data Analytics (now part of Amazon Managed Service for Apache Flink) is the correct choice because it allows you to transform streaming data in near real-time using SQL or Apache Flink with minimal code. It can directly consume data from AWS IoT Core via Kinesis Data Streams or Amazon MSK, apply transformations like filtering, aggregation, or enrichment, and then output the processed data to Amazon S3 without requiring custom application servers.

Exam trap

The trap here is that candidates often confuse AWS Glue's streaming ETL capability (which still requires writing Scala or Python code and managing checkpointing) with the 'minimal code' requirement, or they mistakenly think Amazon Athena can transform data before it lands in S3, when in fact Athena only queries data already stored.

How to eliminate wrong answers

Option B (AWS Glue) is wrong because it is a serverless ETL service designed for batch processing and schema discovery, not for near real-time streaming transformations with minimal code. Option C (Amazon Redshift) is wrong because it is a data warehouse for analytical queries on structured data, not a streaming transformation engine, and it cannot directly ingest from IoT Core without an intermediary. Option D (Amazon Athena) is wrong because it is an interactive query service for analyzing data already stored in S3 using SQL, not a service for transforming data in flight before storage.

461
MCQhard

A company uses Amazon DynamoDB to store session data. The security team requires that all data be encrypted at rest using a customer-managed KMS key. The data engineer has enabled encryption with a KMS key, but discovers that old data remains encrypted with the previous AWS-managed key. How can the engineer re-encrypt all existing data with the new key?

A.Disable and re-enable encryption with the new KMS key
B.Use AWS Backup to back up the table and restore it with the new encryption key
C.Use the DynamoDB console to change the encryption key and select 'Apply to existing data'
D.Export the table to S3 using DynamoDB Export to S3, then import using DynamoDB Import from S3 with the new encryption key specified
AnswerD

Export/Import re-encrypts data.

Why this answer

Exporting the table to S3 and then importing it with a new KMS key re-encrypts all data at rest using the new key. Option A is wrong because disabling and re-enabling encryption does not re-encrypt existing data; DynamoDB does not support in-place re-encryption of existing items. Option B is wrong because AWS Backup restores the table with the original encryption; it does not allow specifying a new key for existing data.

Option C is wrong because changing the encryption key only applies to new writes; there is no 'Apply to existing data' option in the DynamoDB console.

462
MCQeasy

A company needs to ingest data from Amazon S3 into Amazon Redshift for analytics. The data arrives in CSV format with headers and may contain duplicate rows. Which Redshift command should be used to load the data while handling duplicates?

A.COPY command with the `REMOVEDUPLICATES` option
B.INSERT INTO ... SELECT DISTINCT from S3 via Spectrum
C.Use a staging table with COPY and then MERGE into the target table
D.CREATE TABLE AS SELECT DISTINCT from the S3 bucket
AnswerC

MERGE allows handling duplicates.

Why this answer

The correct approach to handle duplicates when loading data from S3 into Redshift is to use a staging table with the COPY command, followed by a MERGE (or UPSERT) operation to insert distinct rows into the target table. Option A is incorrect because `REMOVEDUPLICATES` is not a valid COPY option. Option B is incorrect because INSERT INTO ...

SELECT DISTINCT via Spectrum does not use Redshift's native ingestion and may be slower. Option D is incorrect because CREATE TABLE AS SELECT DISTINCT does not integrate with existing tables and is not a standard loading pattern.

463
MCQhard

A data engineer at a financial services company manages an AWS Glue ETL pipeline that processes transaction data from Amazon S3 to Amazon Redshift for reporting. The pipeline runs every hour and uses a Glue job that reads Parquet files, performs transformations in Spark, and writes to Redshift using the JDBC connector. Recently, the job has been failing intermittently with the error: 'java.sql.BatchUpdateException: ERROR: null value in column "transaction_id" violates not-null constraint'. The data engineer has verified that the source Parquet files do contain non-null values for transaction_id. The job uses a DynamicFrame and applies a mapping to rename columns. The engineer also noticed that the failure occurs only during peak hours when there is high concurrency on Redshift. Which course of action should the engineer take to resolve this issue?

A.Add a filter in Glue to remove rows with null transaction_id.
B.Increase the Redshift WLM concurrency scaling to handle more queries.
C.Review the Glue job's mapping transformation to ensure transaction_id is correctly mapped and not dropped.
D.Increase the number of Glue workers to handle peak-hour load.
AnswerC

The error shows that transaction_id is being written as null to Redshift despite source files having non-null values. Reviewing and correcting the Glue job's mapping transformation to ensure transaction_id is correctly mapped and not dropped will resolve the issue.

Why this answer

The error indicates that transaction_id is being nullified or dropped during the Glue job's mapping transformation. Even though source files have non-null values, the mapping could be incorrectly mapping or omitting the column, causing nulls to be written to Redshift. The failure during peak hours is coincidental; the root cause is the mapping logic.

Option A is incorrect because filtering nulls would not fix the mapping error and could discard valid data. Option B is incorrect because increasing Redshift WLM concurrency scaling does not address the null constraint violation. Option D is incorrect because more Glue workers do not fix the transformation issue; the problem is data quality, not capacity.

464
MCQeasy

A company needs to ensure that data stored in Amazon RDS is encrypted at rest. Which action should the data engineer take?

A.Enable encryption at rest by modifying the existing RDS instance.
B.Encrypt the underlying EBS volumes using AWS KMS.
C.Create a new RDS instance with encryption enabled using AWS KMS.
D.Enable SSL/TLS for connections to the RDS instance.
AnswerC

Encryption at rest must be enabled at launch time for RDS.

Why this answer

Amazon RDS encryption at rest must be enabled when the DB instance is created, using AWS KMS. It cannot be added later. Option A is incorrect because encryption cannot be enabled on an existing RDS instance; you must create a new one with encryption enabled.

Option B is incorrect because encrypting the underlying EBS volumes does not encrypt the RDS database; RDS encryption at rest is separate and must be configured at the instance level. Option D is incorrect because SSL/TLS secures data in transit, not at rest.

465
MCQmedium

A company is using an Amazon RDS for MySQL database for its e-commerce platform. During a recent flash sale, the database experienced high read traffic, causing slow query performance. The company needs a solution that offloads read traffic with minimal application changes. Which action should be taken?

A.Enable DynamoDB Accelerator (DAX) on the RDS instance.
B.Migrate the database to Amazon Aurora and enable Aurora Global Database.
C.Implement Amazon ElastiCache for Redis to cache database queries.
D.Create an Amazon RDS read replica in the same region.
AnswerD

Read replicas offload read traffic from the primary instance with minimal application changes.

Why this answer

Creating an Amazon RDS read replica in the same region offloads read traffic from the primary DB instance by directing read queries to a read-only copy. This requires minimal application changes—only modifying the database connection string to point read queries to the replica endpoint. RDS read replicas use MySQL's native asynchronous replication, making them ideal for scaling read-heavy workloads like flash sales.

Exam trap

The trap here is that candidates may choose ElastiCache (Option C) because it is a caching solution, but they overlook the explicit requirement for minimal application changes, which caching typically does not satisfy without code modifications.

How to eliminate wrong answers

Option A is wrong because DynamoDB Accelerator (DAX) is an in-memory cache for Amazon DynamoDB, not for RDS for MySQL; it cannot be enabled on an RDS instance. Option B is wrong because migrating to Aurora and enabling Aurora Global Database is designed for cross-region disaster recovery and global reads, not for offloading read traffic within a single region, and it requires significant application and migration effort. Option C is wrong because while ElastiCache for Redis can cache query results, it requires application code changes to implement caching logic (e.g., cache-aside pattern), which contradicts the requirement for minimal application changes.

466
Multi-Selectmedium

Which TWO actions can help optimize Amazon S3 storage costs for a data lake? (Choose two.)

Select 2 answers
A.Enable S3 Replication to another region
B.Use S3 Intelligent-Tiering for unpredictable access patterns
C.Use S3 Select to retrieve only needed data
D.Enable S3 Transfer Acceleration
E.Implement S3 Lifecycle policies to transition objects to Glacier
AnswersB, E

Intelligent-Tiering automatically optimizes costs based on access patterns.

Why this answer

S3 Intelligent-Tiering automatically moves objects between two access tiers (frequent and infrequent) when access patterns change, with no retrieval fees and a small monthly monitoring fee. This is ideal for a data lake where access patterns are unpredictable, as it optimizes costs without requiring manual lifecycle rule adjustments.

Exam trap

The trap here is that candidates confuse cost optimization for storage (reducing stored data cost) with cost optimization for data transfer or retrieval, leading them to select options like S3 Select or Transfer Acceleration that address different cost dimensions.

467
MCQmedium

A company uses Amazon RDS for MySQL to store financial data. A compliance requirement mandates that all database connections must be encrypted. Which configuration step is necessary?

A.Set the RDS parameter require_secure_transport to 1.
B.Create the RDS DB instance in a private subnet.
C.Enable encryption for the RDS DB instance at creation time.
D.Configure the VPC security group to only allow traffic from certain IPs.
AnswerA

This is correct. To enforce encrypted connections for RDS MySQL, you must modify the DB parameter group to require SSL/TLS by setting parameters such as 'require_secure_transport' to 1. While the exact parameter name may vary, the intent is to enforce encryption in transit.

Why this answer

To enforce encrypted connections in transit for RDS MySQL, you need to configure the DB parameter group to require SSL/TLS. Setting the parameter 'require_secure_transport' to 1 forces all connections to use encryption. Option C is incorrect because enabling encryption at rest (at creation time) encrypts stored data, not connections in transit, which does not satisfy the compliance requirement for encrypted connections.

Exam trap

Encryption at rest (enabled at creation) does not encrypt database connections in transit. A common trap is confusing encryption at rest with encryption in transit. For encrypted connections, you must configure the DB parameter group (e.g., require_secure_transport=1 for MySQL).

468
Multi-Selecteasy

A company wants to ingest streaming data from social media feeds into AWS for real-time analytics. Which TWO services can directly ingest streaming data without writing custom code? (Choose TWO.)

Select 2 answers
A.AWS Glue
B.Amazon AppFlow
C.Amazon Kinesis Data Firehose
D.Amazon Kinesis Data Streams
E.Amazon S3 Transfer Acceleration
AnswersB, C

AppFlow can ingest data from SaaS applications (including social media) directly into AWS.

Why this answer

Amazon Kinesis Data Firehose can directly ingest streaming data and deliver to destinations. AWS Glue can stream from Kafka but not directly ingest from social media without custom connectors. Kinesis Data Streams requires producers to send data, not direct ingestion.

AppFlow can ingest from SaaS applications including social media.

469
MCQeasy

A company uses Amazon S3 to store customer documents. The data engineer needs to ensure that all objects uploaded to a specific S3 bucket are automatically encrypted with a customer-managed AWS KMS key. What should the data engineer do?

A.Use pre-signed URLs for all uploads that include encryption parameters.
B.Create a bucket policy that denies uploads without encryption.
C.Enable S3 Versioning on the bucket.
D.Set default encryption on the bucket to use SSE-KMS with the customer-managed key.
AnswerD

Default encryption automatically encrypts all objects with the specified KMS key.

Why this answer

Setting default encryption on the S3 bucket to SSE-KMS with the customer-managed key ensures that all objects uploaded without explicit encryption headers are automatically encrypted using that KMS key. This satisfies the requirement without relying on client-side behavior, as S3 applies the encryption server-side at the time of write.

Exam trap

The trap here is that candidates often confuse bucket policies that deny unencrypted uploads (which only reject non-compliant requests) with default encryption (which automatically encrypts objects), leading them to choose Option B instead of D.

How to eliminate wrong answers

Option A is wrong because pre-signed URLs only grant temporary access to upload or download objects; they do not enforce encryption on the uploaded data, and including encryption parameters in the URL is optional and client-dependent. Option B is wrong because a bucket policy that denies uploads without encryption can enforce that clients must include encryption headers, but it does not automatically encrypt objects; if the client fails to include the header, the upload is denied rather than encrypted. Option C is wrong because S3 Versioning preserves multiple versions of an object but has no effect on encryption; it does not encrypt objects or enforce encryption policies.

470
Multi-Selecthard

A company is migrating its on-premises data warehouse to Amazon Redshift. The data includes tables with up to 100 columns and 500 million rows. The migration involves a full load followed by incremental updates. The company needs to minimize downtime during the final cutover. Which THREE strategies should the data engineer use to facilitate the migration? (Choose THREE.)

Select 3 answers
A.Increase the number of WLM queues to allow more concurrent loads.
B.Use the COPY command to load data from Amazon S3.
C.Use columnar format (e.g., Parquet) for the data files in S3.
D.Run VACUUM and ANALYZE commands after loading the data.
E.Disable distribution keys on the target tables to simplify loading.
AnswersB, C, D

COPY is optimized for bulk data loading into Redshift.

Why this answer

The COPY command is the most efficient way to load data from Amazon S3 into Redshift, enabling high-speed parallel ingestion. Option C is correct because using columnar formats like Parquet minimizes data scanned and reduces storage costs, speeding up data transfer. Option D is correct because running VACUUM and ANALYZE after loading reorganizes data and updates statistics, optimizing query performance.

Option A is incorrect because increasing WLM queues does not improve COPY performance; COPY operations bypass WLM. Option E is incorrect because disabling distribution keys can cause data skew and degraded performance; proper distribution keys are essential for efficient cluster operation.

471
MCQmedium

A data engineer is designing a data pipeline that processes sensitive personal data. The data is ingested via Amazon Kinesis Data Firehose and stored in Amazon S3. The pipeline must ensure that the data is encrypted at rest and in transit. The engineer also needs to audit access to the data. Which combination of services meets these requirements?

A.AWS KMS for encryption at rest, Kinesis Data Analytics for in-transit encryption, and AWS CloudTrail for auditing.
B.AWS KMS for encryption at rest, Amazon CloudWatch Logs for auditing, and TLS for in-transit encryption.
C.S3 server-side encryption (SSE-S3) for at-rest encryption, HTTPS for in-transit encryption, and AWS CloudTrail for auditing.
D.S3 client-side encryption, AWS Config for auditing, and TLS for in-transit encryption.
AnswerC

SSE-S3 encrypts objects at rest, HTTPS encrypts data in transit, and CloudTrail logs S3 API operations for auditing.

Why this answer

S3 server-side encryption (SSE-S3) encrypts data at rest in S3. HTTPS (TLS) encrypts data in transit between the data source and Kinesis Data Firehose, and between Firehose and S3. AWS CloudTrail logs S3 API calls (e.g., GetObject, PutObject) for auditing data access.

Option A is incorrect because Kinesis Data Analytics does not provide encryption in transit; it processes data but does not handle encryption. Option B is incorrect because CloudWatch Logs is for monitoring and storing logs, not for auditing data access; CloudTrail is the appropriate service for auditing. Option D is incorrect because client-side encryption requires manual key management and does not use AWS-managed encryption; AWS Config tracks configuration changes, not data access.

472
MCQeasy

A company uses AWS Lambda to process events from an S3 bucket. The Lambda function writes transformed data to another S3 bucket. Occasionally, the Lambda invocation fails with 'ResourceNotFoundException'. What is the MOST likely cause?

A.The Lambda function timed out.
B.The destination S3 bucket does not exist or the Lambda function's IAM role lacks permissions.
C.The S3 event notification is misconfigured.
D.The source S3 bucket has versioning disabled.
AnswerB

ResourceNotFoundException indicates missing resource or access denial.

Why this answer

The destination bucket may not exist or the Lambda function's IAM role lacks permissions to write to it. Option A is wrong because Lambda timeouts would cause 'Timeout' error. Option C is wrong because S3 event notifications are reliable.

Option D is wrong because the source bucket exists since it triggered the event.

473
MCQmedium

Refer to the exhibit. A data engineer runs the AWS CLI command and gets the output shown. The engineer wants to grant a data analyst read-only access to the 'sales_db' database in AWS Glue Data Catalog using IAM. Which IAM policy statement is required?

A.{"Effect": "Allow", "Action": "glue:GetTable", "Resource": "arn:aws:glue:us-east-1:123456789012:table/sales_db/*"}
B.{"Effect": "Allow", "Action": "glue:GetDatabase", "Resource": "arn:aws:glue:us-east-1:123456789012:database/sales_db"}
C.{"Effect": "Allow", "Action": "glue:GetDatabases", "Resource": "*"}
D.{"Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::data-lake-sales/*"}
AnswerB

Grants read access to the specific database.

Why this answer

To grant read-only access to a database in AWS Glue Data Catalog, the required IAM action is glue:GetDatabase. Option B correctly specifies this action and targets the specific database resource. Option A uses glue:GetTable, which is for tables, not databases.

Option C uses glue:GetDatabases, which is for listing databases and requires broader permissions. Option D uses s3:GetObject, which is for S3 data access, not Glue catalog operations.

474
Multi-Selectmedium

A data engineer needs to encrypt data at rest in Amazon S3 using server-side encryption with a customer-managed KMS key. Which TWO steps are required to ensure that the KMS key can be used for S3 object encryption?

Select 2 answers
A.Configure a VPC endpoint for KMS to allow S3 to access the key.
B.Set the S3 bucket policy to require SSE-KMS for all PutObject requests.
C.Add a statement in the KMS key policy that allows the S3 service to use the key.
D.Grant the IAM role that writes objects the kms:GenerateDataKey and kms:Decrypt permissions.
E.Create a service-linked role for S3 to access KMS.
AnswersC, D

The key policy must allow S3 to call GenerateDataKey and Decrypt.

Why this answer

Options C and D are correct. For SSE-KMS with a customer-managed key, the KMS key policy must include a statement that allows the S3 service to use the key (e.g., kms:GenerateDataKey and kms:Decrypt). Additionally, the IAM role writing objects must have kms:GenerateDataKey and kms:Decrypt permissions.

Option A is not required because a VPC endpoint for KMS is not mandatory for S3 to access the key. Option B is not required because enforcing SSE-KMS via bucket policy is a separate configuration, not a prerequisite for using the key. Option E is not required because S3 does not use a service-linked role for KMS access.

475
MCQhard

A data engineer is troubleshooting an Amazon Redshift cluster that is running out of disk space. The engineer runs STV_PARTITIONS and notices that some slices have significantly more data than others. What is the most likely cause and solution?

A.Poorly chosen sort keys; redefine sort keys
B.Data distribution skew due to uneven distribution style; change distribution style to EVEN or correct KEY
C.Some nodes are underutilized; add more nodes
D.Concurrency scaling is disabled; enable concurrency scaling
AnswerB

Uneven distribution can cause some slices to fill up faster.

Why this answer

B is correct because STV_PARTITIONS shows per-slice disk usage, and significant variation indicates data distribution skew. Uneven distribution causes some slices to fill faster, leading to premature disk-full errors. Changing the distribution style to EVEN (for tables without join keys) or correcting the KEY distribution style (using a high-cardinality, evenly distributed column) rebalances data across slices.

Exam trap

The trap here is that candidates confuse sort keys (which improve query performance via zone maps) with distribution keys (which control data placement across slices), leading them to incorrectly select sort key redefinition as the fix for disk space skew.

How to eliminate wrong answers

Option A is wrong because sort keys affect query performance (min/max zone maps and block pruning), not how data is distributed across slices; disk space skew is a distribution issue, not a sort key issue. Option C is wrong because adding nodes increases total cluster capacity but does not fix existing data skew; the problem is uneven data placement, not insufficient total nodes. Option D is wrong because concurrency scaling handles workload bursts by adding transient compute capacity, not disk space; it does not affect how data is stored on existing slices.

476
MCQmedium

A company uses AWS Glue to run ETL jobs that transform data from an Amazon S3 bucket (raw) to another S3 bucket (curated). The jobs run on a schedule and process data incrementally. The data engineer notices that the jobs are taking longer to complete each day, and the job metrics show that the number of DPUs (Data Processing Units) is underutilized. The engineer wants to improve job performance. What should the data engineer do?

A.Increase the number of DPUs allocated to the Glue job to enable more parallelism.
B.Switch from batch processing to streaming using AWS Glue Streaming.
C.Enable job bookmarks to skip already processed data more efficiently.
D.Decrease the number of DPUs to reduce resource contention.
AnswerA

Increasing DPUs can improve parallelism and reduce job duration if the workload is parallelizable and DPUs are underutilized.

Why this answer

Increasing the number of DPUs can improve parallelism and reduce job duration when the workload is parallelizable and DPUs are underutilized. Option B is wrong because AWS Glue Streaming is designed for real-time data, not scheduled batch processing, and would not address the performance issue. Option C is wrong because job bookmarks are already used for incremental processing and do not directly impact job speed.

Option D is wrong because decreasing DPUs would reduce parallelism and likely increase job duration.

477
MCQeasy

A data engineering team needs to transform CSV files to Parquet format after they land in an S3 bucket. The transformation should be triggered automatically as soon as a new file arrives. Which AWS service is best suited for this task?

A.AWS Batch job submitted by S3 event
B.Amazon EMR cluster running continuously
C.AWS Lambda function triggered by S3 event
D.AWS Glue ETL job scheduled every 5 minutes
AnswerC

Lambda can be triggered immediately on S3 PUT events and perform the transformation.

Why this answer

AWS Lambda functions can be directly triggered by S3 events (e.g., `s3:ObjectCreated:*`) to process newly uploaded CSV files. This serverless approach provides near-instantaneous, event-driven transformation to Parquet without managing any infrastructure, making it the most cost-effective and simplest solution for this specific use case.

Exam trap

The trap here is that candidates often choose AWS Glue (Option D) because it is a dedicated ETL service, but they overlook the requirement for immediate, event-driven processing, which Glue's scheduled jobs cannot provide without additional event-bridge triggers.

How to eliminate wrong answers

Option A is wrong because AWS Batch requires provisioning compute resources and a job queue, adding latency and complexity for a simple file transformation that can be handled by a lightweight Lambda function. Option B is wrong because an Amazon EMR cluster running continuously incurs ongoing costs and management overhead, and is overkill for a simple CSV-to-Parquet conversion triggered by file arrival. Option D is wrong because a scheduled AWS Glue ETL job every 5 minutes introduces unnecessary polling and potential latency (up to 5 minutes), whereas the requirement is for immediate, event-driven processing.

478
MCQmedium

Refer to the exhibit. An S3 bucket policy is shown. A data engineer using the DataEngineerRole tries to upload an object to s3://example-bucket/data/report.csv with SSE-S3 encryption. The upload fails. What is the most likely cause?

A.The resource ARN does not match the object.
B.The role does not have s3:PutObject permission.
C.The condition requires SSE-S3 encryption header, but the upload did not include it.
D.The principal is not authorized.
AnswerC

The condition requires the encryption header to be present and set to AES256.

Why this answer

The bucket policy includes a condition that the request must include the `x-amz-server-side-encryption` header with value `AES256` (SSE-S3). The upload did not include this header, so the policy condition was not met, resulting in a failed upload. Option A is incorrect because the resource ARN matches the object path.

Option B is incorrect because the role has the `s3:PutObject` permission. Option D is incorrect because the principal (DataEngineerRole) is allowed by the policy.

479
Multi-Selectmedium

A company uses Amazon Kinesis Data Firehose to deliver data to Amazon S3. The data engineer needs to transform the data before delivery. Which THREE options can be used to perform the transformation?

Select 3 answers
A.Amazon Athena queries
B.AWS Glue ETL job
C.Amazon Kinesis Data Firehose data format conversion (e.g., JSON to Parquet)
D.AWS Lambda function
E.Amazon Kinesis Data Firehose dynamic partitioning with Lambda
AnswersC, D, E

Firehose can convert data formats natively.

Why this answer

Amazon Kinesis Data Firehose can transform data natively using data format conversion (e.g., converting JSON to Parquet or ORC) without requiring external services. This is a built-in capability that applies schema-based conversion using AWS Glue tables, enabling efficient storage and querying in Amazon S3.

Exam trap

The trap here is that candidates often confuse AWS Glue ETL jobs (which are separate, batch-oriented) with the Glue Data Catalog schema used by Firehose's built-in format conversion, leading them to incorrectly select Glue ETL as a valid Firehose transformation option.

480
Multi-Selecthard

Which THREE factors should be considered when selecting a data ingestion service for a high-volume, real-time streaming pipeline that requires exactly-once processing semantics? (Choose 3.)

Select 3 answers
A.Ability to replay records from a checkpoint
B.Support for idempotent record processing
C.Integration with Amazon S3 for checkpoint storage
D.Support for schema evolution
E.Ability to transform data in-flight
AnswersA, B, C

Replay allows recovery without duplication.

Why this answer

In high-volume streaming pipelines, the ability to replay records from a checkpoint is essential for achieving exactly-once processing semantics. Services like Amazon Kinesis Data Streams and Apache Kafka allow consumers to reset to a specific sequence number or offset, enabling reprocessing of unacknowledged records after a failure without data loss or duplication.

Exam trap

The DEA-C01 exam often tests the misconception that schema evolution or in-flight transformation are required for exactly-once semantics, when in fact they are unrelated to delivery guarantees and instead belong to data quality or processing domains.

481
MCQhard

A company stores data in Amazon S3 with server-side encryption using AWS KMS (SSE-KMS). The data engineer needs to give a third-party auditor read-only access to the encrypted objects. The auditor has an AWS account. Which strategy should be used?

A.Generate a presigned URL for each object the auditor needs to access.
B.Copy the objects to a new bucket encrypted with SSE-S3 and share that bucket.
C.Grant the auditor's IAM role permission to use the KMS key.
D.Update the S3 bucket policy to allow access from the auditor's account and update the KMS key policy to allow the auditor's account to decrypt.
AnswerD

Both policies are required for cross-account access with SSE-KMS.

Why this answer

Cross-account access to SSE-KMS encrypted objects requires both an S3 bucket policy allowing the auditor's account and a KMS key policy granting the auditor's account decrypt permissions. Option A is wrong because presigned URLs don't solve the cross-account KMS issue. Option B is wrong because simply granting access to the KMS key is insufficient without S3 permissions.

Option C is wrong because copying objects with SSE-S3 changes encryption and may not be allowed.

482
Multi-Selectmedium

Which TWO actions can improve the performance of an AWS Glue ETL job that processes large datasets in Amazon S3? (Choose two.)

Select 2 answers
A.Increase the frequency of the Glue crawler.
B.Use a single Availability Zone for the S3 bucket.
C.Increase the number of DPUs allocated to the job.
D.Use columnar file formats like Parquet or ORC.
E.Use a single large file instead of many small files.
AnswersC, D

More DPUs increase parallelism and memory.

Why this answer

Increasing the number of DPUs allocates more processing power to the Glue job, which can speed up data processing for large datasets. Option D is correct because columnar file formats like Parquet or ORC are more efficient for analytical queries, reduce I/O, and allow better compression compared to row-based formats. Option A is incorrect: increasing crawler frequency only affects the metadata catalog update frequency, not the ETL job performance.

Option B is incorrect: using a single Availability Zone for the S3 bucket does not improve performance and may reduce availability. Option E is incorrect: using a single large file can reduce parallelism, as distributed processing benefits from splitting data into multiple files to be processed in parallel by different executors.

483
MCQeasy

A data engineer needs to ensure that an Amazon Redshift cluster encrypts data at rest using a customer-managed AWS KMS key. Which configuration step is required?

A.Create a new cluster and select the default AWS managed key for encryption.
B.Create a new cluster and specify a customer-managed KMS key for encryption.
C.Use AWS CloudHSM to generate a key and attach it to the cluster.
D.Enable encryption on the existing cluster by modifying the cluster configuration.
AnswerB

Encryption must be set at cluster creation with a KMS key.

Why this answer

To use a customer-managed KMS key for encryption at rest in Amazon Redshift, you must specify the key when creating a new cluster. Encryption cannot be enabled on an existing cluster (option D is incorrect). Option A is incorrect because the default AWS managed key is not customer-managed.

Option C is incorrect because AWS CloudHSM is not used for Redshift encryption; Redshift integrates directly with AWS KMS for key management.

484
Multi-Selecthard

A company runs an Amazon Redshift cluster for data warehousing. The data engineering team notices that the 'Amazon Redshift Data API' is timing out when executing long-running queries. The queries typically take more than 10 minutes to complete. The team wants to ensure that the queries can complete without timeout and that the results are retrievable. Which TWO steps should the team take? (Choose TWO.)

Select 2 answers
A.Set the 'QueryExecutionTimeout' parameter in the Data API call to 30 minutes.
B.Increase the 'timeout' parameter in the Redshift cluster configuration.
C.Use the 'GetStatementResult' operation to retrieve results after the query completes.
D.Set the 'max_execution_time' parameter in the Redshift parameter group to 30 minutes.
E.Use the 'StatementName' parameter to run the query asynchronously and poll for completion.
AnswersC, E

This is the correct way to get results after the statement finishes.

Why this answer

Options C and E are correct. The Amazon Redshift Data API has a default timeout of 10 minutes for a single API call. To handle queries that take longer, you can run the query asynchronously by using the StatementName parameter (option E).

This allows the query to continue running even if the initial API call times out, and you can poll for completion using the DescribeStatement operation. Once the query completes, you can retrieve the results using the GetStatementResult operation (option C). Option A is incorrect because QueryExecutionTimeout is not a valid parameter for the Data API.

Option B is incorrect because increasing the timeout parameter in the Redshift cluster configuration does not affect the Data API timeout. Option D is incorrect because there is no max_execution_time parameter in Redshift; the relevant parameter is statement_timeout, which controls how long a query can run before being canceled, but it does not address the Data API timeout.

485
Multi-Selecteasy

A data engineer needs to audit data access in Amazon S3 for compliance. Which TWO services can be used to capture and analyze S3 access logs? (Choose TWO.)

Select 2 answers
A.Amazon CloudWatch Logs
B.AWS CloudTrail
C.S3 server access logs
D.Amazon Macie
E.AWS Config
AnswersB, C

Correct. AWS CloudTrail can be enabled to record S3 data events, providing a record of API calls made to S3.

Why this answer

Options B and C are correct. AWS CloudTrail can be configured to record S3 data events, capturing API calls made to S3 buckets. S3 server access logs provide detailed records of all requests made to an S3 bucket, including source IP, requester, and operation.

Option A (Amazon CloudWatch Logs) is used for monitoring and storing logs from various sources, but it does not natively generate S3 access logs. Option D (Amazon Macie) is for sensitive data discovery and classification. Option E (AWS Config) is for tracking resource configuration changes.

486
MCQmedium

A data engineer is responsible for ingesting log files from a fleet of on-premises servers into Amazon S3 for central analysis. Each server generates log files that are rotated every hour, resulting in files of about 500 MB each. The total daily data volume is approximately 1 TB. The network connection between the on-premises data center and AWS is a 100 Mbps VPN. The engineer needs to ensure that all log files are transferred to S3 within 24 hours of generation without data loss. The engineer is considering using AWS DataSync. However, the initial setup shows that the transfer speed is insufficient to meet the 24-hour SLA. What should the engineer do to meet the requirement?

A.Use AWS CLI with multipart uploads and parallel threads to maximize throughput.
B.Contact the network team to upgrade the VPN bandwidth to at least 1 Gbps.
C.Order an AWS Snowball Edge device to transfer the initial data and then use DataSync for incremental changes.
D.Configure AWS DataSync to run on a schedule with incremental transfers and enable data compression.
AnswerD

Incremental transfers reduce the amount of data transferred each day; compression further reduces size, meeting the SLA.

Why this answer

AWS DataSync can be configured for incremental transfers after an initial full sync, which reduces the amount of data transferred on a daily basis. Additionally, enabling data compression reduces the size of the log files during transfer, making it feasible to meet the 24-hour SLA over a 100 Mbps VPN. Option A is incorrect because while AWS CLI with multipart uploads can improve throughput, it still requires manual scripting and does not provide the same optimization as DataSync.

Option B is incorrect because upgrading the VPN bandwidth may not be immediately feasible or cost-effective. Option C is incorrect because ordering an AWS Snowball Edge device is intended for large initial data migrations, not for ongoing daily transfers; it would introduce delays and is not suitable for recurring incremental transfers.

487
Multi-Selecthard

A data engineer is designing a data store for a real-time analytics application that requires sub-millisecond read and write latency. The data is accessed via a REST API. Which AWS services should the engineer consider? (Choose THREE.)

Select 3 answers
A.Amazon S3
B.Amazon RDS for MySQL
C.Amazon ElastiCache for Redis
D.Amazon DynamoDB
E.DynamoDB Accelerator (DAX)
AnswersC, D, E

Redis provides sub-millisecond latency.

Why this answer

Amazon ElastiCache for Redis is correct because it provides an in-memory data store that delivers sub-millisecond read and write latency, ideal for real-time analytics. Redis supports data structures like strings, hashes, and sorted sets, and can be accessed via REST API through a caching layer or directly with Redis commands. This makes it suitable for low-latency, high-throughput workloads where disk-based storage would introduce unacceptable delays.

Exam trap

The trap here is that candidates may overlook DAX as a separate service and assume DynamoDB alone provides sub-millisecond latency, but DynamoDB's base latency is typically 1-10 milliseconds for strongly consistent reads, and DAX is required to achieve sub-millisecond performance for read-heavy workloads.

488
Multi-Selectmedium

A company uses Amazon EMR to run Spark jobs on data stored in Amazon S3. The data engineer notices that the jobs are running slower than expected. The engineer suspects that the S3 storage class might be affecting performance. Which THREE factors can impact read performance from S3? (Choose three.)

Select 3 answers
A.Use of S3 Transfer Acceleration.
B.Use of S3 Select to retrieve only a subset of data.
C.Use of S3 Object Lock.
D.Average object size in S3 bucket.
E.Data stored in compressed format (e.g., GZIP, Snappy).
AnswersB, D, E

S3 Select can retrieve only a subset of data (e.g., using SQL expressions), reducing data scanned and improving read performance.

Why this answer

Options B, D, and E are correct. B: S3 Select can retrieve only a subset of data, reducing the amount scanned and improving read performance. D: Larger average object sizes allow better throughput by leveraging parallel requests and reducing overhead.

E: Storing data in compressed formats reduces the amount of data transferred, improving read performance. Option A is incorrect because S3 Transfer Acceleration is designed to improve upload speed over long distances, not read performance. Option C is incorrect because S3 Object Lock prevents object deletion or overwrite but does not affect read performance.

Exam trap

A common mistake is thinking S3 Transfer Acceleration improves read performance, but it only speeds up uploads.

489
MCQmedium

A financial services company uses Amazon Redshift for its data warehouse. The compliance team requires that all access to the database be logged, including the SQL queries executed, and that the logs be stored in a separate S3 bucket that is encrypted with a customer-managed KMS key. Additionally, the logs must be retained for 7 years. The data engineer has enabled audit logging on the Redshift cluster and configured it to deliver logs to an S3 bucket. However, the compliance team reports that the logs are not being delivered. The S3 bucket policy allows the Redshift service to write logs. What is the most likely reason for the failure?

A.The S3 bucket is in a different region than the Redshift cluster.
B.The S3 bucket has versioning enabled, which blocks log delivery.
C.The KMS key policy does not grant the Redshift service principal decrypt permissions.
D.The S3 bucket policy does not include a statement allowing the Redshift service principal to write objects.
AnswerD

Redshift requires explicit bucket policy for audit logging.

Why this answer

Amazon Redshift audit logging requires a specific S3 bucket policy that grants the Redshift service principal permission to write objects. Without this policy statement, log delivery fails. Option A is incorrect because the S3 bucket can be in a different region.

Option B is incorrect because versioning does not block log delivery. Option C is incorrect because the issue is the bucket policy, not the KMS key policy; the Redshift service principal needs s3:PutObject permission, not KMS decrypt.

490
MCQmedium

A company stores sensitive data in an S3 bucket. To meet compliance requirements, they must ensure that all objects are encrypted at rest using server-side encryption with AWS KMS. Which bucket policy statement should be applied to deny uploads that do not use the required encryption?

A.{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucketname/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"}}}
B.{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucketname/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"AES256"}}}
C.{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucketname/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"arn:aws:kms:us-east-1:123456789012:key/abc123"}}}
D.{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucketname/*","Condition":{"Null":{"s3:x-amz-server-side-encryption":"true"}}}
AnswerA

Correctly denies PutObject if the encryption is not SSE-KMS.

Why this answer

It uses the `s3:x-amz-server-side-encryption` condition key with `StringNotEquals` set to `aws:kms`, which denies any `s3:PutObject` request where the encryption header does not specify `aws:kms`. This ensures all uploaded objects are encrypted at rest using server-side encryption with AWS KMS, meeting the compliance requirement.

Exam trap

The trap here is that candidates often confuse the condition keys for encryption type (`s3:x-amz-server-side-encryption`) with the specific KMS key ID (`s3:x-amz-server-side-encryption-aws-kms-key-id`), or mistakenly use `Null` to check for the presence of encryption instead of enforcing the correct encryption algorithm.

How to eliminate wrong answers

Option B is wrong because it checks for `AES256`, which corresponds to SSE-S3 (Amazon S3-managed keys), not SSE-KMS (AWS KMS keys), so it would allow objects encrypted with SSE-S3 instead of enforcing KMS encryption. Option C is wrong because it uses the `s3:x-amz-server-side-encryption-aws-kms-key-id` condition key to require a specific KMS key ID, but the requirement is only to use KMS encryption, not a particular key; this would deny uploads using any other KMS key, even if they use KMS encryption. Option D is wrong because it uses the `Null` condition to deny uploads where the `s3:x-amz-server-side-encryption` header is not present (i.e., null), but it does not enforce that the encryption must be `aws:kms`; it would also allow uploads with `AES256` or other encryption values, failing to meet the KMS-specific requirement.

491
Multi-Selectmedium

A company is designing a data ingestion pipeline for real-time clickstream data. The data must be ingested with low latency (< 1 second) and then processed for real-time analytics. The processed data should be stored in Amazon S3 for batch analytics. Which THREE services should be used together?

Select 3 answers
A.Amazon Managed Streaming for Apache Kafka (MSK)
B.Amazon Kinesis Data Analytics
C.Amazon Kinesis Data Firehose
D.Amazon Kinesis Data Streams
E.AWS Glue ETL job
AnswersB, C, D

Performs real-time processing and analytics on streaming data.

Why this answer

Amazon Kinesis Data Analytics is correct because it enables real-time processing of streaming data using SQL or Apache Flink, allowing the company to perform real-time analytics on clickstream data with sub-second latency. It directly consumes data from Kinesis Data Streams and can output results to Kinesis Data Firehose for storage in Amazon S3, fulfilling the requirement for both real-time analytics and batch analytics storage.

Exam trap

The trap here is that candidates often confuse Kinesis Data Firehose as a real-time analytics service, but it is only a delivery stream for loading data into destinations like S3, not for performing real-time computations; the real-time analytics requirement is fulfilled by Kinesis Data Analytics, not Firehose.

492
MCQmedium

A data engineer needs to encrypt data at rest in an Amazon Redshift cluster. The company requires that the encryption key be managed by the customer and rotated annually. Which solution meets these requirements?

A.Use S3 server-side encryption with customer-provided keys (SSE-C).
B.Use AWS Secrets Manager to store the encryption key and configure Redshift to reference it.
C.Use AWS KMS with automatic key rotation enabled.
D.Use AWS CloudHSM to create and manage the encryption key, and configure Redshift to use it.
AnswerC

KMS with a customer-managed key allows you to manage the key and enables automatic annual rotation, meeting the requirement. Redshift natively supports KMS for encryption at rest.

Why this answer

AWS KMS with a customer-managed key (CMK) allows you to control the encryption key and enables automatic annual rotation. Amazon Redshift natively integrates with KMS for encryption at rest, making this a straightforward solution. Option D is incorrect because CloudHSM is not directly integrated with Redshift for encryption at rest; it requires custom configuration and is typically overkill for the requirement of annual rotation.

Option A is incorrect because SSE-C is used for S3 objects, not Redshift. Option B is incorrect because Secrets Manager is designed for secrets like database credentials, not for encryption keys used by Redshift.

493
Multi-Selectmedium

A company is using Amazon S3 to store sensitive data. They need to ensure that all objects are encrypted at rest. Which combination of actions should be taken? (Choose TWO.)

Select 2 answers
A.Enable S3 Versioning on the bucket.
B.Enable MFA Delete on the bucket.
C.Configure S3 Access Points with network policies.
D.Use a bucket policy to deny PutObject requests that do not include the x-amz-server-side-encryption header.
E.Enable default encryption on the S3 bucket.
AnswersD, E

Policy enforces encryption at upload time.

Why this answer

A bucket policy that denies PutObject requests lacking the `x-amz-server-side-encryption` header enforces encryption at the time of upload, ensuring that any object written without explicit encryption headers is rejected. Option E is correct because enabling default encryption on the S3 bucket automatically applies server-side encryption (SSE-S3 or SSE-KMS) to any object uploaded without specifying encryption headers, providing a fallback that covers all objects. Together, these actions ensure that every object stored in the bucket is encrypted at rest, either by explicit client request or by default bucket settings.

Exam trap

The trap here is that candidates often confuse data protection features like Versioning or MFA Delete with encryption controls, or assume that network policies (Access Points) somehow enforce encryption, when in reality only explicit bucket policies and default encryption settings directly ensure objects are encrypted at rest.

494
MCQhard

A data pipeline uses Amazon Kinesis Data Streams with enhanced fan-out consumers. The team notices that one consumer falls behind and data accumulates. Which action will help this consumer catch up without affecting other consumers?

A.Increase the retention period of the stream.
B.Register an enhanced fan-out consumer for the slow consumer.
C.Increase the number of shards in the stream.
D.Use a Lambda consumer instead of an enhanced fan-out consumer.
AnswerB

Enhanced fan-out provides dedicated throughput per consumer, allowing the slow consumer to catch up without impacting others.

Why this answer

Registering a new enhanced fan-out consumer with its own dedicated read throughput allows it to catch up independently. Increasing shards affects all consumers, and increasing iterator age may help but doesn't increase throughput.

495
MCQeasy

A data engineer needs to store semi-structured JSON logs from multiple sources in a centralized data store for querying using SQL. The logs are immutable and need to be retained for 90 days. Which AWS service should be used?

A.Amazon RDS for MySQL.
B.Amazon DynamoDB.
C.Amazon S3 with Amazon Athena.
D.Amazon ElastiCache for Redis.
AnswerC

S3 stores JSON logs, Athena enables SQL queries.

Why this answer

Amazon S3 with Amazon Athena is the correct choice because S3 provides durable, cost-effective storage for immutable semi-structured JSON logs, and Athena enables serverless SQL querying directly against the data in S3 without needing to load or transform it. This combination meets the 90-day retention requirement and supports querying semi-structured data using standard SQL via Athena's built-in JSON SerDe.

Exam trap

The trap here is that candidates may choose DynamoDB for its JSON support and querying flexibility, overlooking that it is not designed for cost-effective long-term retention of immutable logs and lacks native SQL querying, while S3 with Athena directly addresses both requirements.

How to eliminate wrong answers

Option A is wrong because Amazon RDS for MySQL is a relational database designed for structured data with predefined schemas, not optimized for storing large volumes of immutable semi-structured JSON logs, and it incurs higher costs for long-term retention. Option B is wrong because Amazon DynamoDB is a NoSQL key-value and document database that can store JSON, but it is not cost-effective for 90-day retention of immutable logs due to per-request pricing and storage costs, and it lacks native SQL querying capabilities without additional services like DynamoDB Accelerator or PartiQL. Option D is wrong because Amazon ElastiCache for Redis is an in-memory cache designed for low-latency access to transient data, not for durable, long-term storage of immutable logs, and it does not support SQL querying.

496
Multi-Selectmedium

A company is designing a data lake on Amazon S3. The security team requires granular access control based on data classifications. Which TWO AWS services can be used together to implement attribute-based access control (ABAC) for objects in S3?

Select 2 answers
A.AWS Secrets Manager
B.AWS Lake Formation
C.Amazon S3 object tags
D.AWS Identity and Access Management (IAM)
E.AWS Key Management Service (KMS)
AnswersC, D

Amazon S3 object tags can be used as condition keys in IAM policies to implement attribute-based access control (ABAC) for S3 objects.

Why this answer

IAM policies support ABAC by using condition keys based on resource tags. S3 object tags allow you to attach metadata to objects, and these tags can be referenced in IAM policy conditions to control access. This combination enables granular, attribute-based access control for S3 objects.

AWS Lake Formation also supports ABAC, but it is primarily used for managing permissions on a data lake catalog, not directly on S3 objects; the most direct and commonly used services for ABAC on S3 objects are IAM and S3 object tags. AWS Secrets Manager is for managing secrets, KMS is for encryption keys, and neither provides access control based on object attributes.

497
MCQmedium

A company has an Amazon S3 bucket with versioning enabled. They want to automatically delete noncurrent versions of objects after 30 days. Which lifecycle rule action should be used?

A.Expiration
B.NoncurrentVersionExpiration
C.NoncurrentVersionTransition
D.AbortIncompleteMultipartUpload
AnswerB

This action deletes noncurrent versions after a specified number of days.

Why this answer

The NoncurrentVersionExpiration lifecycle action is specifically designed to remove noncurrent object versions after a specified number of days. Since versioning is enabled and the requirement is to delete noncurrent versions after 30 days, this action directly meets the goal without affecting current versions or other lifecycle aspects.

Exam trap

The trap here is confusing NoncurrentVersionExpiration with Expiration, as candidates often mistakenly apply the standard Expiration action to delete old versions, not realizing it only affects the current version.

How to eliminate wrong answers

Option A is wrong because Expiration deletes the current version of an object (or marks it for deletion in non-versioned buckets), not noncurrent versions. Option C is wrong because NoncurrentVersionTransition moves noncurrent versions to a different storage class (e.g., S3 Glacier), but does not delete them. Option D is wrong because AbortIncompleteMultipartUpload only aborts incomplete multipart uploads that are older than a specified number of days, and has no effect on existing object versions.

498
MCQhard

An e-commerce company uses AWS Glue to run ETL jobs that transform clickstream data from Amazon S3. The job reads Parquet files, performs aggregations, and writes the results to Amazon Redshift. The job runs successfully but takes longer than expected. The data volume is increasing. Which design change would MOST improve the job's performance?

A.Write the aggregated results to a single large file instead of multiple partitions.
B.Convert the Parquet files to CSV to simplify the schema.
C.Replace the Redshift target with Amazon Redshift Spectrum.
D.Increase the number of Glue worker nodes (DPUs) for the job.
AnswerD

More workers parallelize tasks and reduce runtime.

Why this answer

Increasing the number of Glue worker nodes (DPUs) directly scales the distributed processing capacity of the ETL job, allowing it to process larger volumes of Parquet data in parallel. This is the most straightforward way to reduce execution time when data volume is growing, as AWS Glue automatically partitions the workload across the additional workers.

Exam trap

The trap here is that candidates assume increasing DPUs always increases cost without considering that the job's runtime reduction often lowers total cost, and they mistakenly choose a data format or target change that does not address the core parallelism issue.

How to eliminate wrong answers

Option A is wrong because writing to a single large file eliminates parallelism in downstream reads and can cause bottlenecks in Redshift's COPY operation, which benefits from multiple files for concurrent loading. Option B is wrong because converting Parquet to CSV increases file size and I/O overhead due to lack of columnar compression and predicate pushdown, degrading performance. Option C is wrong because replacing Redshift with Redshift Spectrum would offload query processing to S3 but does not address the ETL job's performance bottleneck; the job still writes to Redshift, and Spectrum is a query engine, not a write target.

499
Multi-Selecthard

A company is ingesting streaming data from social media feeds using Amazon Kinesis Data Streams. The data is consumed by multiple applications: one for real-time sentiment analysis and another for archival to S3. The data must be processed in order for each social media post. Which TWO approaches meet the requirements? (Choose TWO.)

Select 2 answers
A.Use Amazon Kinesis Data Firehose to buffer and deliver to S3
B.Use Amazon SQS FIFO queues between the stream and consumers
C.Use a single shard in the Kinesis Data Streams and have all consumers read from that shard
D.Use a partition key that ensures related records go to the same shard
E.Use multiple shards and assign each consumer to a specific shard
AnswersC, D

Single shard guarantees ordering.

Why this answer

Using a single shard ensures that all records are processed in the exact order they are ingested, as Kinesis Data Streams guarantees ordering within a shard. Since both consumers (real-time sentiment analysis and archival to S3) read from the same shard, they will each receive records in the same sequence, meeting the requirement for ordered processing of each social media post.

Exam trap

The trap here is that candidates often assume multiple shards are always better for throughput, but they overlook that ordering guarantees are per-shard only, so without a proper partition key, records across shards can be processed out of order.

500
MCQeasy

A data engineer needs to audit who accessed specific objects in an S3 bucket over the past 30 days. Which AWS service should be used?

A.AWS Config
B.Amazon CloudWatch Logs
C.Amazon S3 server access logs
D.AWS CloudTrail
AnswerC

Amazon S3 server access logs capture detailed information about every request made to a bucket, including object access, making it the correct choice.

Why this answer

Amazon S3 server access logs provide detailed records of requests made to an S3 bucket, including object-level access (e.g., who accessed which object, when, and from where). Option A (AWS Config) is used for resource inventory and compliance, not access auditing. Option B (Amazon CloudWatch Logs) can store and monitor logs but does not generate S3 access logs.

Option D (AWS CloudTrail) logs API calls to S3, but by default it records bucket-level operations, not object-level access; CloudTrail can be enabled for data events to log object-level operations, but S3 server access logs are specifically designed for detailed object access auditing and are simpler to enable for this requirement.

501
MCQhard

Refer to the exhibit. A company has an S3 bucket 'my-data-lake' with the lifecycle policy shown. Objects under the 'logs/' prefix are being moved to GLACIER after 30 days and expire after 365 days. A data engineer notices that objects older than 365 days are still present in the bucket and are not being deleted. What is the most likely cause?

A.Lifecycle expiration does not apply to objects in GLACIER storage class
B.The rule status is disabled
C.The prefix filter does not match the objects
D.The expiration days count from the transition date, not the object creation date
AnswerD

Correct. The expiration days are counted from the transition date, so objects transitioned after 30 days will expire 365 days later (395 days from creation), causing objects older than 365 days from creation to still be present.

Why this answer

When a lifecycle rule includes both transition to GLACIER and expiration, the expiration days count from the transition date, not from the object creation date. In this scenario, objects transition to GLACIER at 30 days, so the expiration at 365 days actually triggers after 395 days from creation (30 + 365). Therefore, objects older than 365 days from creation but younger than 395 days are not yet expired, explaining why they remain.

Exam trap

A common trap is to assume that expiration days always count from the object creation date. However, when a transition action is present, the expiration counter resets to the transition date.

502
MCQeasy

A company wants to store data from thousands of IoT devices with varying data rates. The data must be stored in a schema-on-read fashion and support SQL queries. Which AWS service should be used?

A.Amazon RDS for MySQL
B.Amazon S3 with Amazon Athena
C.Amazon DynamoDB
D.Amazon Redshift
AnswerB

S3 provides scalable storage, and Athena enables SQL queries with schema-on-read.

Why this answer

Amazon S3 stores data in its native format (e.g., JSON, Parquet) without requiring a predefined schema, enabling schema-on-read. Amazon Athena uses Presto-based SQL to query data directly from S3, making it ideal for IoT data with varying rates and ad-hoc SQL analysis without provisioning servers.

Exam trap

The trap here is that candidates confuse schema-on-read with schema-on-write, assuming DynamoDB's flexible schema or Redshift's SQL support fits, but they miss that DynamoDB lacks native SQL and Redshift requires upfront table definitions, while Athena directly queries raw files in S3 with SQL.

How to eliminate wrong answers

Option A is wrong because Amazon RDS for MySQL requires a fixed schema defined before writing data, which contradicts the schema-on-read requirement and cannot handle the high write throughput of thousands of IoT devices without scaling limitations. Option C is wrong because Amazon DynamoDB is a NoSQL key-value and document database that does not support SQL queries natively (it uses PartiQL with limited SQL compatibility) and is not designed for schema-on-read. Option D is wrong because Amazon Redshift is a columnar data warehouse that requires schema-on-write (tables must be defined before loading data) and is optimized for structured, batch-loaded analytics rather than streaming IoT ingestion with varying data rates.

503
Multi-Selecteasy

Which TWO of the following are features of Amazon RDS Multi-AZ deployments? (Choose 2.)

Select 2 answers
A.Read replicas in the same region for offloading read traffic.
B.Automatic failover to a standby instance in case of an AZ failure.
C.A standby instance that is not accessible for reads or writes.
D.Automatic storage scaling based on usage.
E.Synchronous replication across AWS Regions.
AnswersB, C

Multi-AZ automatically fails over to the standby in another AZ.

Why this answer

Amazon RDS Multi-AZ deployments automatically handle failover to a standby instance in a different Availability Zone when the primary instance fails or the AZ becomes unavailable. This synchronous replication ensures zero data loss and minimal downtime, with the standby instance automatically promoted to primary without manual intervention.

Exam trap

The DEA-C01 exam often tests the distinction between Multi-AZ (high availability with a passive standby) and read replicas (scaling reads with active replicas), leading candidates to incorrectly associate read offloading with Multi-AZ deployments.

504
MCQmedium

Refer to the exhibit. An IAM policy allows kms:Decrypt and kms:GenerateDataKey on a specific KMS key. A data engineer is unable to upload an object to an S3 bucket that uses SSE-KMS with that key. What is the MOST likely missing permission?

A.kms:Decrypt permission on the key.
B.s3:PutObject permission on the bucket.
C.kms:Encrypt permission on the key.
D.kms:CreateGrant permission on the key.
AnswerB

Correct. The user lacks s3:PutObject permission on the S3 bucket.

Why this answer

The user is unable to upload an object to an S3 bucket that uses SSE-KMS. The IAM policy currently allows kms:Decrypt and kms:GenerateDataKey on the KMS key. However, to upload an object to an S3 bucket, the user also needs the s3:PutObject permission on the bucket.

Therefore, the missing permission is s3:PutObject. Option A is incorrect because kms:Decrypt is already allowed. Option C is incorrect because kms:Encrypt is not required; GenerateDataKey is sufficient.

Option D is incorrect because kms:CreateGrant is not required for uploading.

505
MCQhard

A company runs a data lake on Amazon S3 with AWS Lake Formation for access control. The data lake contains sensitive customer information. A data scientist needs to query the data using Amazon Athena. The data scientist has been granted SELECT permission on the database and tables via Lake Formation. However, when the data scientist runs a query in Athena, they receive an error: 'Access denied. Please check your permissions.' The IAM role used by Athena has the following permissions: s3:GetObject, s3:ListBucket, and lakeformation:GetDataAccess. The Lake Formation admin has verified that the data scientist is a member of a Lake Formation data lake location and has been granted 'Describe' and 'Select' permissions on the table. What is the most likely reason for the access denied error?

A.The data scientist is not assigned to the correct Lake Formation tag.
B.The S3 bucket policy does not grant the Athena IAM role access to the S3 location.
C.The Athena IAM role is missing lakeformation:GetEffectivePermissions permission.
D.The data scientist's IAM user lacks the necessary S3 permissions.
AnswerB

Lake Formation permissions are separate from S3 bucket policies; the bucket policy must allow the IAM role to read the data.

Why this answer

The access denied error occurs because the IAM role used by Athena lacks the necessary S3 permissions, even though Lake Formation has granted SELECT and DESCRIBE permissions. Lake Formation handles permissions at the metadata level, but the actual data access still requires S3 bucket policy or IAM policy to allow s3:GetObject and s3:ListBucket for the specific S3 location. If the bucket policy does not grant the Athena IAM role access to the S3 location, the request will be denied.

Option B correctly identifies this issue. Option A is incorrect because Lake Formation tag-based access control is not required for this scenario; the data scientist already has direct table permissions. Option C is incorrect because lakeformation:GetEffectivePermissions is not needed; the role already has lakeformation:GetDataAccess.

Option D is incorrect because Athena uses the IAM role assigned to the workgroup, not the data scientist's individual IAM user.

506
MCQeasy

A company needs to ingest data from multiple SaaS applications (e.g., Salesforce, Marketo) into Amazon S3 for centralized analytics. The data volume is several GB per day. Which AWS service is most suitable for this ingestion?

A.Amazon Kinesis Data Firehose
B.AWS Glue
C.Amazon Athena
D.AWS Data Pipeline
AnswerB

Glue can connect to SaaS sources via JDBC and perform ETL to S3.

Why this answer

AWS Glue is the most suitable service because it provides a fully managed ETL (Extract, Transform, Load) capability with built-in connectors for SaaS applications like Salesforce and Marketo. Glue can extract data from these sources, transform it as needed, and write it to Amazon S3, handling the several GB per day volume efficiently without requiring custom code for each source.

Exam trap

The trap here is that candidates often confuse AWS Glue with a data catalog or transformation-only service, overlooking its robust ETL ingestion capabilities with native SaaS connectors, and mistakenly choose Kinesis Data Firehose because it 'ingests' data, but it lacks the necessary source integrations for batch SaaS extraction.

How to eliminate wrong answers

Option A is wrong because Amazon Kinesis Data Firehose is designed for streaming data ingestion (e.g., real-time events, logs) and lacks native connectors for SaaS applications like Salesforce or Marketo; it would require custom producers to push data. Option C is wrong because Amazon Athena is an interactive query service for analyzing data already in S3, not an ingestion tool; it cannot pull data from external SaaS sources. Option D is wrong because AWS Data Pipeline is a legacy orchestration service that requires more manual setup and lacks the modern, pre-built SaaS connectors and serverless scalability that AWS Glue offers for this use case.

507
Multi-Selecthard

A data pipeline uses AWS Glue to process large CSV files. The team notices that some jobs fail with out-of-memory errors. Which TWO configuration changes can help mitigate this issue?

Select 2 answers
A.Reduce the number of DPUs to limit concurrency.
B.Increase the number of DPUs for the Glue job.
C.Enable Glue job autoscaling.
D.Convert input files from CSV to Parquet.
E.Enable job bookmarks.
AnswersB, C

More DPUs provide more memory.

Why this answer

Options B and C are correct: increasing the number of DPUs provides more memory, and enabling autoscaling allows the job to automatically scale resources as needed. Option A (reducing DPUs) would worsen the problem by limiting resources. Option D (converting to Parquet) can improve performance but is not a direct configuration change for the Glue job itself.

Option E (job bookmarks) is for incremental processing and does not affect memory.

508
MCQmedium

A data engineer is designing a data store for a real-time leaderboard application that requires sub-millisecond read and write latency. The leaderboard stores scores for millions of users and needs to be sorted by score. Which AWS service should the engineer use?

A.Amazon RDS for PostgreSQL with an index on score
B.Amazon DynamoDB with a global secondary index on score
C.Amazon ElastiCache for Redis with a sorted set
D.Amazon Neptune with a graph model
AnswerC

Redis sorted sets provide O(log N) operations and sub-millisecond latency.

Why this answer

Amazon ElastiCache for Redis provides a sorted set data structure (ZADD/ZRANGE commands) that maintains elements ordered by a numeric score with O(log N) complexity for both writes and reads, enabling sub-millisecond latency for real-time leaderboard updates and queries. This is the only option purpose-built for in-memory, sorted, real-time leaderboards at scale.

Exam trap

The trap here is that candidates often choose DynamoDB (Option B) because it is a common NoSQL choice for high-performance applications, but they overlook that DynamoDB lacks a native sorted data structure and requires costly scan operations to retrieve a globally sorted leaderboard, whereas Redis sorted sets are purpose-built for this exact use case.

How to eliminate wrong answers

Option A is wrong because Amazon RDS for PostgreSQL, even with an index on score, is a disk-based relational database that cannot guarantee sub-millisecond read/write latency under high concurrency due to disk I/O and transaction overhead. Option B is wrong because Amazon DynamoDB with a global secondary index on score does not natively maintain a globally sorted order; it requires expensive scan operations to retrieve the top scores, and write latency can exceed sub-millisecond under heavy load due to throughput limits and index propagation. Option D is wrong because Amazon Neptune is a graph database designed for traversing relationships, not for sorted, real-time score retrieval, and its query latency is not optimized for sub-millisecond leaderboard operations.

509
Multi-Selecthard

Which THREE steps are recommended for migrating an on-premises Oracle database to Amazon RDS for Oracle with minimal downtime? (Choose 3.)

Select 3 answers
A.Set up a VPN or Direct Connect between on-premises and AWS
B.Disable archiving on the source database
C.Use AWS Schema Conversion Tool (SCT) to convert the schema
D.Perform a full load migration without change data capture
E.Use AWS Database Migration Service (DMS) for ongoing replication
AnswersA, C, E

Secure connectivity is essential.

Why this answer

Establishing a VPN or Direct Connect provides a secure, private, and low-latency network connection between the on-premises environment and AWS. This is essential for minimizing downtime during a migration, as it ensures reliable and fast data transfer for both the initial full load and ongoing replication, reducing the risk of network interruptions that could extend the migration window.

Exam trap

The trap here is that candidates often think disabling archiving simplifies the migration, but they miss that CDC requires archived logs for minimal downtime, and they may also assume a full load alone is sufficient without realizing it forces a longer outage to ensure data consistency.

510
MCQeasy

A company needs to ingest data from an on-premises Oracle database into Amazon Redshift for analytics. The data volume is 500 GB and the network bandwidth is limited. Which AWS service should be used for the initial one-time data migration?

A.AWS Snowball
B.AWS Direct Connect
C.Amazon S3 Transfer Acceleration
D.AWS Database Migration Service (DMS)
AnswerA

Snowball allows physical transfer of data, bypassing network limitations.

Why this answer

AWS Snowball is the correct choice for the initial one-time migration of 500 GB of data from an on-premises Oracle database to Amazon Redshift when network bandwidth is limited. Snowball provides a physical storage device that bypasses network constraints entirely, allowing you to transfer large volumes of data securely and quickly by shipping the device to AWS for ingestion into Amazon S3, which can then be loaded into Redshift. This approach avoids the prolonged transfer times and potential bottlenecks associated with limited bandwidth, making it ideal for a one-time, large-scale data migration.

Exam trap

The trap here is that candidates often choose AWS DMS (Option D) because it is a common database migration tool, but they overlook the explicit constraint of limited network bandwidth, which makes a physical appliance like Snowball the only practical solution for a one-time, large-volume migration.

How to eliminate wrong answers

Option B (AWS Direct Connect) is wrong because it establishes a dedicated network connection from on-premises to AWS, but it does not solve the limited bandwidth problem for a one-time 500 GB migration; the transfer would still be constrained by the available bandwidth, potentially taking days or weeks. Option C (Amazon S3 Transfer Acceleration) is wrong because it speeds up uploads to S3 over the public internet using optimized network paths, but it still relies on the existing limited bandwidth and does not eliminate the network bottleneck for a large initial load. Option D (AWS Database Migration Service (DMS)) is wrong because it is designed for ongoing replication and continuous data migration over a network connection, not for a one-time bulk transfer of 500 GB when bandwidth is limited; DMS would still be constrained by the network speed and is better suited for smaller or incremental migrations.

511
Multi-Selecteasy

A data engineer is setting up Amazon S3 bucket policies for a data lake. The security team requires that all objects uploaded to the bucket be encrypted at rest using server-side encryption. Which TWO methods can enforce encryption at upload time?

Select 2 answers
A.Enable S3 Transfer Acceleration.
B.Enable AWS CloudTrail to monitor uploads.
C.Enable AWS KMS automatic key rotation.
D.Enable S3 default encryption on the bucket.
E.Create a bucket policy that denies PutObject if the x-amz-server-side-encryption header is missing.
AnswersD, E

Default encryption automatically encrypts objects.

Why this answer

Enabling S3 default encryption on the bucket automatically applies server-side encryption (SSE-S3 or SSE-KMS) to all objects uploaded without an encryption header, ensuring encryption at rest. Option E is correct because a bucket policy with a Deny effect on PutObject when the x-amz-server-side-encryption header is missing enforces encryption at upload time by rejecting unencrypted uploads, providing a complementary enforcement mechanism.

Exam trap

The trap here is that candidates often confuse default encryption (which applies encryption automatically but does not block unencrypted uploads) with a bucket policy that explicitly denies unencrypted uploads, thinking either alone is sufficient, when both are needed for full enforcement.

512
MCQmedium

A data engineer applies the bucket policy shown in the exhibit to an S3 bucket. The bucket contains sensitive data that must be encrypted at rest and accessed only over HTTPS. Which of the following statements is true?

A.The policy allows both HTTP and HTTPS access.
B.The policy allows anonymous access to list objects in the bucket.
C.The policy enforces that all PutObject requests must include the x-amz-server-side-encryption header with value AES256.
D.The policy requires the use of AWS KMS for server-side encryption.
AnswerC

The Allow statement requires the condition s3:x-amz-server-side-encryption equals AES256 for PutObject.

Why this answer

The bucket policy includes a condition that denies PutObject requests unless the `s3:x-amz-server-side-encryption` header is present and set to `AES256`. This enforces server-side encryption with S3-managed keys (SSE-S3) for all uploads, ensuring data at rest is encrypted.

Exam trap

AWS often tests the distinction between SSE-S3 (`AES256`) and SSE-KMS (`aws:kms`) in bucket policy conditions, and candidates may mistakenly think the policy requires KMS when it actually specifies AES256.

How to eliminate wrong answers

Option A is wrong because the policy includes a `Deny` statement that blocks requests when `aws:SecureTransport` is `false`, which effectively denies HTTP access and allows only HTTPS. Option B is wrong because the policy does not grant any `s3:ListBucket` permission to anonymous principals; it only denies requests that fail encryption or transport conditions, but does not allow anonymous listing. Option D is wrong because the policy requires the `x-amz-server-side-encryption` header with value `AES256`, which corresponds to SSE-S3, not AWS KMS (which would require `aws:kms`).

513
MCQmedium

A data engineer is designing a data ingestion pipeline to load millions of small JSON files from an on-premises FTP server into Amazon S3. The pipeline should minimize cost and operational overhead. Which approach is most suitable?

A.Use S3 Transfer Acceleration to upload files directly from the FTP server
B.Deploy AWS DataSync to transfer files from the FTP server to S3
C.Use AWS Snowball Edge to ship the data to AWS
D.Set up an AWS Direct Connect connection and use AWS CLI to copy files
AnswerB

AWS DataSync is designed for efficient data transfer from on-premises to AWS, handling small files well with minimal operational overhead.

Why this answer

AWS DataSync is the most suitable option because it is designed to efficiently transfer large volumes of data from on-premises storage (including FTP servers) to AWS, handling millions of small files with minimal operational overhead. It automates data transfer, retries, and validation, and it is cost-effective as you pay only for the data transferred, with no need for additional infrastructure or complex scripting.

Exam trap

The trap here is that candidates often assume S3 Transfer Acceleration is a general-purpose acceleration tool for any source, but it only accelerates the upload leg from the client to AWS and does not address the FTP-to-S3 protocol conversion or the orchestration of millions of small files.

How to eliminate wrong answers

Option A is wrong because S3 Transfer Acceleration is a feature that speeds up uploads over the internet by using AWS edge locations, but it does not handle the protocol mismatch between FTP and S3; you would still need a client to read from FTP and write to S3, and it adds cost per GB transferred without solving the file ingestion logic. Option C is wrong because AWS Snowball Edge is designed for large-scale, offline data transfers (typically terabytes to petabytes) and is overkill and costly for millions of small files; it also introduces significant latency for shipping and manual handling. Option D is wrong because AWS Direct Connect provides a dedicated network connection but does not automate the transfer of files from an FTP server; you would still need to write custom scripts using AWS CLI to copy files, increasing operational overhead and complexity.

514
MCQmedium

A data engineering team notices that an Amazon Kinesis Data Stream is frequently exceeding its shard write throughput limit, causing throttling. The team needs a long-term solution to handle variable write traffic without manual intervention. Which action should the team take?

A.Configure the Kinesis Client Library to throttle consumption.
B.Increase the number of shards manually during peak hours.
C.Use Amazon Kinesis Data Firehose to buffer records before delivery to the stream.
D.Implement a buffer using Amazon S3 and AWS Lambda that aggregates records and writes to Kinesis in batches.
AnswerD

This buffers writes and reduces throttling.

Why this answer

Using Amazon S3 and AWS Lambda to buffer and batch records before writing to Kinesis smooths out traffic spikes, reducing throttling without manual intervention. Option A is incorrect because the Kinesis Client Library (KCL) is used by consumers, not producers; it cannot throttle write throughput. Option B is incorrect because manually increasing shards during peak hours requires manual intervention and is not a long-term automated solution.

Option C is incorrect because Amazon Kinesis Data Firehose is designed to deliver streaming data to destinations like S3, Redshift, or Elasticsearch, not to buffer records before writing to a Kinesis stream.

515
MCQmedium

A company is migrating its on-premises PostgreSQL database to Amazon RDS for PostgreSQL. The database is 5 TB in size and supports a critical application that requires less than 30 minutes of downtime. The company has a 1 Gbps network connection to AWS. The data engineering team plans to use AWS Database Migration Service (DMS) with change data capture (CDC) to keep the target in sync. During the full load phase, DMS is taking longer than expected, and the team is concerned about meeting the downtime window. Which action should the team take to speed up the full load?

A.Increase the compute capacity of the target RDS instance.
B.Enable DMS validation to ensure data integrity.
C.Use AWS Snowball Edge to transfer the data offline.
D.Create multiple DMS tasks to load different tables in parallel.
AnswerD

Parallel tasks increase throughput.

Why this answer

Creating multiple DMS tasks to load different tables in parallel (Option D) is the correct action because DMS performs full load sequentially within a single task. By splitting tables across multiple tasks, the team can parallelize the data transfer, utilizing the 1 Gbps network more efficiently and reducing the overall full load time to meet the 30-minute downtime window.

Exam trap

The trap here is that candidates assume increasing target instance size (Option A) will speed up the full load, but they overlook that DMS's single-task architecture is the primary bottleneck, not the target's write capacity.

How to eliminate wrong answers

Option A is wrong because increasing the compute capacity of the target RDS instance does not address the bottleneck of DMS's sequential full load process; the target can ingest data faster, but DMS still processes tables one at a time. Option B is wrong because enabling DMS validation adds overhead by comparing source and target records, which would slow down the full load further, not speed it up. Option C is wrong because AWS Snowball Edge is designed for offline data transfer over multiple days, not for a migration requiring less than 30 minutes of downtime; the 1 Gbps network connection is sufficient if parallelism is used.

516
MCQeasy

Refer to the exhibit. A data engineer is troubleshooting an IAM policy attached to a user who cannot list objects in the S3 bucket 'example-bucket'. What is the most likely reason?

A.The bucket policy explicitly denies access to the user.
B.The resource ARN for the bucket is incorrect; it should be 'arn:aws:s3:::example-bucket/*'.
C.The policy includes s3:GetObject but not s3:ListObjects.
D.The policy does not include the s3:ListBucket action.
AnswerA

An explicit deny overrides the IAM policy.

Why this answer

The IAM policy shown in the exhibit grants s3:ListBucket on the bucket and s3:GetObject on objects, which should allow listing. However, if the user still cannot list objects, the most likely reason is that a bucket policy explicitly denies access to that user. Bucket policies are evaluated separately from IAM policies, and an explicit deny in a bucket policy overrides any allow.

Options B, C, and D are incorrect because the IAM policy in the exhibit includes the correct resource ARN (arn:aws:s3:::example-bucket for the bucket and arn:aws:s3:::example-bucket/* for objects), includes s3:ListBucket action, and does not require s3:GetObject for listing.

517
MCQhard

A company uses AWS Lake Formation to manage access to data in S3. A data analyst reports being unable to query a table in Amazon Athena, receiving an 'Access Denied' error. The analyst has SELECT permission on the table in Lake Formation. What additional configuration is MOST likely causing the issue?

A.Athena does not have permission to access the Glue Data Catalog
B.The IAM role used by Athena does not have S3 GetObject permission on the underlying data
C.The analyst does not have DESCRIBE permission
D.The table is not registered with Lake Formation
AnswerB

Lake Formation grants SELECT, but S3 bucket policies or IAM may still block access.

Why this answer

In AWS Lake Formation, even when a user has SELECT permission on a table, the IAM role that Athena uses must have S3 GetObject permission on the underlying data files. Lake Formation manages permissions at the metadata level, but the actual data access is enforced by S3 bucket policies and IAM. Without GetObject permission, Athena fails with 'Access Denied'.

Option A is incorrect because Athena typically has access to the Glue Data Catalog if the table is visible; the error is about data access. Option C is incorrect because SELECT permission usually includes DESCRIBE, and the error message is about access denied, not missing describe. Option D is incorrect because the table is registered with Lake Formation since the analyst has SELECT permission.

518
MCQhard

A data engineer is troubleshooting a daily batch ingestion pipeline that uses AWS Glue to read CSV files from Amazon S3 and write Parquet files to another S3 bucket. The job runs successfully but takes significantly longer than expected. The engineer notices that the input data is highly skewed with many small files. Which is the most effective optimization to reduce job duration?

A.Change the output format to JSON
B.Enable the 'groupFiles' option in the S3 source configuration
C.Increase the number of DPUs allocated to the job
D.Enable the 'use_glue_schema_registry' option
AnswerB

Grouping small files into larger splits reduces task overhead and improves performance.

Why this answer

The 'groupFiles' option in AWS Glue's S3 source configuration allows Glue to combine small files into larger splits, reducing the number of tasks and the overhead associated with processing many small files. This directly addresses the high skew and small file issue, significantly reducing job duration. Option A is incorrect because changing the output format from Parquet to JSON would likely increase file size and processing time, not reduce it.

Option C is incorrect because increasing DPUs may improve parallelism but does not solve the file-level overhead; it could even be wasteful if the bottleneck is task scheduling. Option D is incorrect because enabling the schema registry is unrelated to file grouping; it is used for schema management and validation.

519
MCQmedium

A retail company uses Amazon Kinesis Data Firehose to ingest clickstream data from its website into an Amazon S3 bucket. The data includes fields: user_id, event_type, timestamp, page_url. Recently, the data engineering team noticed that some records have malformed JSON (missing commas, extra brackets) causing delivery failures to S3. The Firehose delivery stream is configured to retry failed records for 300 seconds, after which the records are sent to an S3 bucket for failed records. The team wants to transform the data to correct malformed JSON before delivery to the main S3 bucket. They need a solution that does not require managing servers and can handle high throughput. What should the team do?

A.Configure an AWS Lambda function as a data transformation in Kinesis Data Firehose to correct malformed JSON.
B.Set up an Amazon EMR cluster with Apache Spark to process the data in micro-batches and fix JSON errors.
C.Use an AWS Glue streaming ETL job to read from Firehose and write corrected data to S3.
D.Use Amazon Kinesis Data Analytics with a SQL application to parse and fix JSON.
AnswerA

Firehose supports Lambda transformations for record-level processing; it scales automatically.

Why this answer

AWS Lambda can be used as a data transformation function within Kinesis Data Firehose to process each record individually, fixing malformed JSON without managing servers. The Lambda function receives records in batches, transforms them (e.g., parsing and correcting JSON syntax), and returns them to Firehose for delivery to S3. This serverless approach scales automatically with high throughput.

Option B (EMR with Spark) requires managing a cluster and adds latency, making it less suitable for real-time streaming. Option C (Glue streaming ETL) is serverless but introduces more complexity and potential latency compared to Firehose's built-in Lambda transformation. Option D (Kinesis Data Analytics) is designed for real-time analytics and not for record-level transformations like JSON correction.

520
Drag & Dropmedium

Arrange the steps to create an AWS Glue job that transforms data from Amazon S3 to Amazon Redshift in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First, catalog the source data with a crawler. Then, prepare the ETL script. Configure the job with connections, run it, and finally verify the results in Redshift.

521
MCQeasy

A data engineer needs to store semi-structured JSON logs from an application for up to 30 days, with infrequent access. Which storage solution is the most cost-effective?

A.Amazon S3 Glacier Deep Archive
B.Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA)
C.Amazon S3 Standard
D.Amazon S3 Standard-Infrequent Access (S3 Standard-IA)
AnswerD

Cost-effective for infrequently accessed data with rapid access needs.

Why this answer

Amazon S3 Standard-Infrequent Access (S3 Standard-IA) is the most cost-effective choice for storing semi-structured JSON logs for up to 30 days with infrequent access. It offers low storage cost (compared to S3 Standard) while providing low-latency retrieval and high durability (99.999999999%) across multiple Availability Zones, making it ideal for data that is accessed less frequently but needs immediate availability when requested.

Exam trap

The trap here is that candidates often choose S3 One Zone-IA (Option B) thinking it is cheaper due to single-AZ storage, but they overlook the durability and availability requirements for logs that may need to be recovered from an AZ failure, and the fact that S3 Standard-IA is actually more cost-effective for this 30-day retention scenario when considering retrieval costs and minimum storage charges.

How to eliminate wrong answers

Option A is wrong because Amazon S3 Glacier Deep Archive is designed for long-term archival (retrieval times of 12-48 hours) and has a minimum storage duration of 180 days, making it unsuitable for a 30-day retention period with infrequent but potentially immediate access needs. Option B is wrong because Amazon S3 One Zone-Infrequent Access stores data in a single Availability Zone, which does not provide the multi-AZ durability required for logs that may need to be recovered from failures; it is also not the most cost-effective for this use case due to its higher retrieval costs and lower resilience. Option C is wrong because Amazon S3 Standard is optimized for frequently accessed data with higher storage costs per GB, making it overpriced for logs that are accessed infrequently over a 30-day period.

522
MCQeasy

A company stores its application logs in an Amazon S3 bucket. The logs are accessed frequently for the first 30 days, after which they are rarely accessed but must be retained for 7 years for compliance. The company wants to optimize storage costs while maintaining immediate retrieval availability for the first 30 days and the ability to retrieve logs within 12 hours after that. Which lifecycle policy should the data engineer configure?

A.Delete objects after 30 days to minimize storage costs.
B.Transition objects to S3 Standard-IA after 30 days and then to S3 Glacier Deep Archive after 1 year.
C.Transition objects to S3 One Zone-IA after 30 days and delete after 7 years.
D.Transition objects to S3 Glacier Flexible Retrieval after 30 days and delete after 7 years.
AnswerB

Standard-IA provides immediate retrieval for the first 30 days, then Deep Archive for cost-effective long-term retention.

Why this answer

It uses S3 Standard-IA for the first 30 days (frequent access, immediate retrieval) and then transitions to S3 Glacier Deep Archive after 1 year, which provides retrieval within 12 hours at the lowest cost for long-term retention. This meets the compliance requirement of 7-year retention while optimizing costs by moving data to progressively cheaper storage classes based on access patterns.

Exam trap

The DEA-C01 exam often tests the misconception that S3 Glacier Flexible Retrieval is the cheapest option for long-term archival, but S3 Glacier Deep Archive is significantly cheaper for data that is rarely accessed and can tolerate a 12-hour retrieval time.

How to eliminate wrong answers

Option A is wrong because deleting objects after 30 days violates the 7-year compliance retention requirement. Option C is wrong because S3 One Zone-IA does not provide the durability (99.999999999% vs 99.9999999999%) or availability needed for compliance data, and it lacks the 12-hour retrieval capability required after 30 days. Option D is wrong because S3 Glacier Flexible Retrieval has a retrieval time of minutes to hours (typically 1-5 minutes for expedited, 3-5 hours for standard), but the requirement is for retrieval within 12 hours, which is met; however, transitioning directly to Glacier Flexible Retrieval after 30 days is more expensive than using Standard-IA first, and the option does not include a transition to Deep Archive for further cost optimization over 7 years.

523
Multi-Selectmedium

A company uses AWS Glue to transform data in S3. The Glue job fails with memory errors. Which THREE actions can help resolve this?

Select 3 answers
A.Optimize the transformation to use pushdown predicates.
B.Use a larger worker type (e.g., G.2X).
C.Increase the number of DPUs.
D.Increase the job timeout.
E.Decrease the number of DPUs.
AnswersA, B, C

Pushdown predicates reduce data loaded into memory.

Why this answer

Options A, B, and C are correct. Using pushdown predicates (A) reduces the amount of data read by filtering at the data source, which can alleviate memory pressure. Using a larger worker type (B), such as G.2X, increases the memory available per worker, directly addressing out-of-memory errors.

Increasing the number of DPUs (C) adds more workers, distributing the memory load. Option D (increasing job timeout) does not solve memory issues, and Option E (decreasing DPUs) would reduce available memory, making the problem worse.

524
MCQeasy

A data engineer needs to grant an IAM user the ability to view Amazon CloudWatch Logs log groups and stream log events from a specific log group. Which IAM policy action should be used?

A.logs:DescribeLogGroups and logs:GetLogEvents
B.logs:PutLogEvents
C.logs:CreateLogGroup
D.logs:DeleteLogGroup
AnswerA

These allow listing and reading logs.

Why this answer

Logs:DescribeLogGroups and logs:GetLogEvents are the required actions. Option B is wrong because logs:PutLogEvents is for writing. Option C is wrong because logs:CreateLogGroup is for creation.

Option D is wrong because logs:DeleteLogGroup is for deletion.

525
Multi-Selecteasy

A data engineer needs to transfer 50 TB of data from an on-premises Hadoop cluster to Amazon S3. The network bandwidth is limited to 500 Mbps. Which TWO methods are appropriate for this transfer? (Choose TWO.)

Select 2 answers
A.Set up an AWS Direct Connect connection for higher bandwidth.
B.Order an AWS Snowball Edge device to physically ship the data.
C.Use S3 Transfer Acceleration to upload over the internet.
D.Use Amazon Kinesis Data Firehose to stream the data.
E.Use AWS DataSync to transfer data over the network.
AnswersB, E

Snowball is ideal for large datasets with low bandwidth.

Why this answer

Options B and E are correct. AWS Snowball Edge is a physical device suitable for transferring large amounts of data (like 50 TB) when network bandwidth is limited (500 Mbps). AWS DataSync can also transfer data over the network with built-in optimization, making it appropriate for this scenario.

Options A and C are incorrect: AWS Direct Connect provides a dedicated connection but does not increase bandwidth beyond 500 Mbps, and S3 Transfer Acceleration speeds up transfers but still relies on the same limited bandwidth. Option D is incorrect: Amazon Kinesis Data Firehose is designed for real-time streaming, not bulk data transfer.

Page 6

Page 7 of 23

Page 8