Courseiva

AWS Certified Data Engineer Associate DEA-C01 (DEA-C01) — Questions 526–600

1711 questions total · 23pages · All types, answers revealed

Take a mock examExam hub
Page 7

Page 8 of 23

Page 9
526
MCQeasy

A data engineer notices that an Amazon S3 bucket policy is overly permissive. What is the best practice to restrict access while maintaining required permissions?

A.Grant full S3 access using a new IAM policy.
B.Write a new bucket policy that denies all actions.
C.Use an S3 blocklist to restrict access.
D.Attach the AWS managed policy AmazonS3ReadOnlyAccess to the IAM user.
AnswerB

Writing a new bucket policy that denies all actions directly restricts the overly permissive bucket policy. While this may be too restrictive initially, it is the only option that modifies the bucket policy to immediately stop the over-permissive access. You can then add specific allows to maintain required permissions.

Why this answer

The bucket policy is overly permissive, so writing a new bucket policy that denies all actions immediately restricts all access. While this may temporarily block required permissions, it is the most direct way to address the bucket policy issue; you can then refine the policy to allow only necessary actions. Option D does not change the bucket policy and thus does not resolve the problem.

Option A makes permissions even more permissive. Option C is not a standard AWS feature.

Exam trap

Do not confuse IAM policies with bucket policies. Attaching an IAM policy to a user does not override an overly permissive bucket policy; both must be considered together.

Full explanation →
527
MCQmedium

A company wants to migrate on-premises data to Amazon S3 using AWS DataSync. The data is 10 TB and the network bandwidth is 1 Gbps. The migration must be completed within 48 hours. What should the data engineer do to meet the deadline?

A.Use S3 Transfer Acceleration to speed up the transfer
B.Use AWS Snowball Edge to transfer the data physically
C.Use AWS DataSync with multiple agents and enable data compression
D.Request a bandwidth increase from the ISP
AnswerC

Multiple agents and compression maximize throughput to meet the deadline.

Why this answer

AWS DataSync can use multiple agents in parallel to increase throughput, and enabling data compression reduces the amount of data transferred over the network. With 10 TB at 1 Gbps, the theoretical minimum transfer time is about 22.2 hours, but real-world overhead (protocol, retransmissions) often exceeds 48 hours without parallelism and compression. Multiple agents and compression together can achieve the required throughput within the deadline.

Exam trap

The trap here is that candidates assume S3 Transfer Acceleration is a bandwidth booster, but it only reduces latency for small objects over long distances, not the total transfer time for large datasets constrained by bandwidth.

How to eliminate wrong answers

Option A is wrong because S3 Transfer Acceleration improves latency for long-distance transfers by routing traffic through AWS edge locations, but it does not increase bandwidth or reduce the total data volume; it cannot compensate for the fundamental 1 Gbps bottleneck for 10 TB within 48 hours. Option B is wrong because AWS Snowball Edge is a physical device used for offline data transfer, which is unnecessary when the network is available and the deadline can be met with DataSync optimizations; it also introduces shipping delays that may exceed 48 hours. Option D is wrong because requesting a bandwidth increase from the ISP is not a practical or immediate solution within the control of the data engineer, and it assumes the ISP can provision higher bandwidth instantly, which is unrealistic for a 48-hour window.

Full explanation →
528
MCQhard

Refer to the exhibit. A data engineer runs an AWS Glue job that fails with an 'Access Denied' error when writing to S3. The IAM role attached to the job has s3:PutObject permission on the output bucket. What additional configuration is most likely missing?

A.The Glue job is not configured to write to S3 with the correct prefix
B.The S3 bucket policy does not grant access to the Glue job's IAM role
C.The Glue job is running in a VPC without an S3 VPC endpoint
D.The S3 bucket is encrypted with AWS KMS and the IAM role lacks kms:Decrypt permission
AnswerB

Even if IAM allows, bucket policy can deny; this is a common misconfiguration.

Why this answer

The IAM role attached to the Glue job has s3:PutObject permission, but the S3 bucket policy must explicitly grant access to that IAM role (or its principal) for the write operation to succeed. Even if the IAM role allows the action, the bucket policy acts as a separate access control layer; if it denies or does not include the role, the request fails with 'Access Denied'. This is a common cross-account or service-specific permission issue where both identity-based and resource-based policies must align.

Exam trap

The DEA-C01 exam often tests the misconception that IAM permissions alone are sufficient for S3 access, ignoring that bucket policies (resource-based policies) are a separate authorization layer that must also grant the action, especially in cross-account or service-specific contexts.

How to eliminate wrong answers

Option A is wrong because the prefix configuration affects the object key path, not the fundamental permission to write; an incorrect prefix would cause a different error (e.g., 'NoSuchKey' or a path mismatch), not an 'Access Denied' error. Option C is wrong because a missing S3 VPC endpoint would cause a connectivity timeout or 'No route to host' error, not an 'Access Denied' error; the error message specifically indicates a permissions failure, not a network issue. Option D is wrong because if KMS encryption were the issue, the error would explicitly mention 'kms:Decrypt' or 'kms:GenerateDataKey' in the denial message, and the IAM role would need kms:Encrypt (not decrypt) for writing; the generic 'Access Denied' without KMS context points to a bucket policy mismatch.

Full explanation →
529
MCQeasy

A company streams clickstream data from websites to Amazon Kinesis Data Streams. A Lambda function processes each record and writes it to Amazon S3. Recently, the function has been timing out under high load. Which solution should a data engineer implement to handle the increased throughput?

A.Increase the Lambda function's timeout value.
B.Increase the number of shards in the Kinesis data stream.
C.Increase the memory allocated to the Lambda function.
D.Configure Amazon S3 Event Notifications to trigger Lambda directly.
AnswerB

More shards increase parallelism and allow Lambda to process more records concurrently.

Why this answer

Increasing the number of shards in the Kinesis data stream increases the level of parallelism. Each shard can be processed by a separate Lambda invocation, allowing more concurrent processing of records. This directly addresses the high load and timeout issue.

Option A is incorrect because increasing the timeout does not increase throughput; it only allows the function to run longer, but under high load it will still timeout. Option C is incorrect because increasing memory may improve performance per invocation but does not increase the number of concurrent invocations; the bottleneck is limited by the number of shards. Option D is incorrect because S3 Event Notifications are for object creation events in S3, not for real-time streaming; they do not help with Kinesis ingestion.

Full explanation →
530
MCQeasy

A company is streaming clickstream data from a website into Amazon Kinesis Data Streams. The data must be transformed in near real-time and stored in Amazon S3 for analytics. Which AWS service should be used to transform the data as it is ingested?

A.AWS Lambda (streaming function)
B.Amazon EMR (Spark Streaming)
C.AWS Glue (ETL jobs)
D.Amazon Kinesis Data Analytics
AnswerD

Amazon Kinesis Data Analytics can process and transform streaming data in real-time using SQL or Apache Flink.

Why this answer

Amazon Kinesis Data Analytics is the correct choice because it can process and transform streaming data in near real-time using SQL or Apache Flink, and then output the transformed data to destinations like Amazon S3. This service is specifically designed for real-time stream processing, making it ideal for transforming clickstream data as it is ingested into Kinesis Data Streams.

Exam trap

The trap here is that candidates often confuse AWS Glue's batch ETL capabilities with real-time streaming, or assume Lambda is always the best choice for stream processing, overlooking Kinesis Data Analytics' native support for continuous, stateful transformations.

How to eliminate wrong answers

Option A is wrong because AWS Lambda (streaming function) can process Kinesis streams but is not optimized for complex transformations or stateful operations, and it has a maximum execution time of 15 minutes, making it less suitable for continuous near real-time transformations. Option B is wrong because Amazon EMR (Spark Streaming) is a heavy-weight, cluster-based solution that introduces significant latency and operational overhead for simple transformations, and it is not the most efficient choice for near real-time processing of streaming data. Option C is wrong because AWS Glue (ETL jobs) is designed for batch processing and scheduled ETL, not for real-time stream transformations, and it cannot directly consume data from Kinesis Data Streams in a streaming fashion.

Full explanation →
531
MCQmedium

A data engineer is tasked with designing a disaster recovery solution for a data lake stored in Amazon S3. The data lake contains sensitive customer data that must be replicated to a different AWS Region. The engineer needs to ensure that all objects, including those with encryption using SSE-KMS, are replicated. Which solution meets the requirements?

A.Use S3 Batch Operations to copy objects to the destination bucket.
B.Enable S3 Cross-Region Replication (CRR) with the appropriate KMS key and IAM role.
C.Use S3 Transfer Acceleration to copy objects across regions.
D.Use the AWS CLI s3 sync command scheduled in a cron job.
AnswerB

CRR supports SSE-KMS with proper configuration.

Why this answer

S3 Cross-Region Replication (CRR) can replicate objects encrypted with SSE-KMS if the appropriate KMS key is configured and the IAM role has the necessary permissions for encryption operations. Option A (S3 Batch Operations) is designed for one-time bulk actions, not ongoing replication. Option C (S3 Transfer Acceleration) only speeds up data transfer but does not provide replication.

Option D (AWS CLI s3 sync) is a manual, scheduled copy process and does not offer automatic, continuous replication.

Full explanation →
532
MCQmedium

A retail company uses AWS Glue to process daily sales data from multiple CSV files stored in Amazon S3. The Glue job runs a PySpark script that reads the files, performs joins, and writes the output as Parquet. Recently, the job has been failing with 'Out of Memory' errors. The data volume has grown from 10 GB to 50 GB per day. The Glue job uses 10 DPUs and the standard worker type. The data engineer needs to fix the job without rewriting the script. What should the data engineer do?

A.Split the input CSV files into smaller partitions.
B.Change the worker type to G.2X to get more memory per worker.
C.Decrease the number of DPUs to reduce memory contention.
D.Increase the number of DPUs for the Glue job to 20.
AnswerB

Changing to G.2X worker type doubles the memory per DPU, which directly addresses Out of Memory errors by providing more per-executor memory for operations like joins.

Why this answer

Out of Memory errors in AWS Glue are typically caused by insufficient per-executor memory during operations like joins. Changing the worker type to G.2X doubles the memory per DPU (from 16 GB to 32 GB), directly addressing the OOM issue without rewriting the script. Option D is wrong because increasing the number of DPUs adds more executors but does not increase the memory per executor; it only increases parallelism, which may not resolve OOM if a single executor runs out of memory.

Option A (splitting input files) does not reduce the memory footprint of joins. Option C (decreasing DPUs) reduces resources and worsens the problem.

Full explanation →
533
MCQhard

A company needs to ingest real-time clickstream data from a web application into Amazon Redshift with minimal latency. The data volume is high and requires processing before loading. Which architecture is MOST appropriate?

A.AWS Glue ETL jobs scheduled every 5 minutes -> Redshift
B.S3 -> Lambda -> Redshift
C.DynamoDB Streams -> Lambda -> Redshift
D.Kinesis Data Streams -> Kinesis Data Firehose -> Redshift
AnswerD

Provides real-time ingestion with transformation capability.

Why this answer

D is correct because Kinesis Data Streams captures high-volume clickstream data in real time, and Kinesis Data Firehose can buffer, transform (e.g., with Lambda), and load the data directly into Amazon Redshift with near-zero latency. This architecture is purpose-built for streaming ingestion with minimal overhead, unlike batch or intermediary storage approaches.

Exam trap

The trap here is that candidates often confuse 'real-time' with 'near-real-time' and choose a batch option like Glue (A) or an indirect streaming path like S3 -> Lambda (B), failing to recognize that Kinesis Data Firehose is the only AWS service that natively integrates streaming ingestion with Redshift without additional latency or complexity.

How to eliminate wrong answers

Option A is wrong because AWS Glue ETL jobs scheduled every 5 minutes introduce batch latency, which violates the 'minimal latency' requirement for real-time clickstream data. Option B is wrong because S3 -> Lambda -> Redshift requires Lambda to write to Redshift, which is inefficient for high-volume streaming data due to Lambda's invocation limits and lack of native streaming buffering, plus S3 adds an unnecessary intermediate storage hop. Option C is wrong because DynamoDB Streams are designed for change data capture from DynamoDB tables, not for ingesting raw clickstream data from a web application; it would require an additional service to capture the data into DynamoDB first, adding complexity and latency.

Full explanation →
534
MCQhard

Refer to the exhibit. A data engineer creates this KMS key policy. An IAM role in account 123456789012 is granted decrypt access to the key. However, when the DataAnalystRole tries to decrypt an S3 object encrypted with this key, the operation fails. What is the most likely reason?

A.The S3 bucket policy does not allow the role to call s3:GetObject
B.The KMS key is in a different region than the S3 bucket
C.The role does not have permission to call kms:DescribeKey
D.The KMS key policy does not grant kms:Decrypt permission to the role
AnswerA

Even with decrypt permission, the role needs s3:GetObject permission on the encrypted object.

Why this answer

KMS key policies grant access to principals. However, if the S3 bucket policy does not allow the role to call kms:Decrypt, the combination of policies might still deny. But the key policy itself grants decrypt.

A common issue is that the S3 bucket policy might not allow the s3:GetObject action, or the role might not have S3 permissions. Another possibility is that the KMS key is in a different region (us-east-1) but the S3 object is in another region, causing cross-region access which is not allowed by default. However, the most likely reason based on typical exam scenarios is that the S3 bucket policy does not grant the necessary S3 permissions.

Full explanation →
535
MCQmedium

A company stores sensitive data in an Amazon S3 bucket. To comply with regulations, all data must be encrypted at rest using server-side encryption. The security team wants to ensure that any attempt to upload an unencrypted object is automatically denied. Which S3 bucket policy condition should be used?

A.s3:x-amz-server-side-encryption-aws-kms-key-id
B.s3:x-amz-acl
C.s3:x-amz-server-side-encryption
D.s3:x-amz-storage-class
AnswerC

Setting this condition to require 'AES256' enforces SSE-S3 encryption.

Why this answer

The s3:x-amz-server-side-encryption condition key enforces that objects must be encrypted with AES-256 (SSE-S3). s3:x-amz-server-side-encryption-aws-kms-key-id is for KMS key enforcement. s3:x-amz-acl controls access control lists, not encryption.

Full explanation →
536
MCQhard

A company uses AWS Glue to run ETL jobs that process data from Amazon S3 and write results to Amazon Redshift. The Glue job uses the JDBC connection to Redshift. Recently, the job has been failing intermittently with the error: 'java.sql.SQLException: [Amazon](500310) Invalid operation: INSERT has more expressions than target columns;' The Glue job writes to a staging table in Redshift before performing a merge into the final table. The staging table schema matches the source data. The error occurs only on some days and affects different columns each time. The data engineer suspects that the source data occasionally contains extra columns due to a schema drift in the upstream data producer. Which approach should the data engineer take to handle this issue robustly?

A.Skip any records that have extra columns by adding a conditional check in the Glue script.
B.Use a Glue DynamicFrame and apply the resolveChoice method to make the schema consistent.
C.Manually update the Redshift staging table schema whenever the source data changes.
D.Use a Glue DynamicFrame and apply the dropFields method to remove extra columns before writing.
AnswerB

resolveChoice can handle schema drift by casting or dropping columns, making the job resilient.

Why this answer

Glue DynamicFrames can automatically handle schema drift using the `resolveChoice` method, which allows you to specify how to handle columns that appear inconsistently across records (e.g., making them null, casting to a common type, or dropping them). This directly addresses the intermittent error caused by extra columns in the source data without requiring manual schema updates or fragile conditional logic.

Exam trap

The trap here is that candidates may confuse `dropFields` (which removes specific columns statically) with `resolveChoice` (which handles dynamic schema drift), leading them to choose Option D even though it cannot adapt to varying extra columns across different days.

How to eliminate wrong answers

Option A is wrong because skipping records with extra columns would result in data loss and does not address the root cause—the schema mismatch between the source and the staging table. Option C is wrong because manually updating the Redshift staging table schema whenever the source data changes is not scalable, error-prone, and defeats the purpose of an automated ETL pipeline. Option D is wrong because `dropFields` removes specific named columns statically at coding time, but the error occurs on different columns each day, so a dynamic approach like `resolveChoice` is needed.

Full explanation →
537
MCQeasy

A data engineer is migrating an on-premises PostgreSQL database to Amazon RDS for PostgreSQL. The database is 2 TB in size. The engineer needs to minimize downtime. Which AWS service should be used for the migration?

A.AWS Data Pipeline
B.AWS Database Migration Service (DMS)
C.AWS Snowball
D.Amazon S3
AnswerB

DMS supports continuous replication with minimal downtime.

Why this answer

AWS Database Migration Service (DMS) is the correct choice because it supports continuous replication (change data capture) from an on-premises PostgreSQL source to Amazon RDS for PostgreSQL, enabling near-zero downtime migration. DMS can handle a 2 TB database by using a large replication instance and tuning task settings, and it automatically converts the source schema to the target RDS engine.

Exam trap

The trap here is that candidates often choose AWS Snowball for large databases, mistakenly thinking physical transfer is faster, but they overlook that Snowball requires stopping writes to the source database during the export and shipping process, causing unacceptable downtime for a live migration.

How to eliminate wrong answers

Option A is wrong because AWS Data Pipeline is a batch-oriented workflow orchestration service for moving and transforming data between AWS services, but it does not support live, ongoing replication or schema conversion for database migrations, making it unsuitable for minimizing downtime. Option C is wrong because AWS Snowball is a physical data transfer device designed for large-scale offline data movement (e.g., petabyte-scale), but it introduces significant downtime due to shipping and manual transfer, and it cannot perform continuous replication for a live migration. Option D is wrong because Amazon S3 is an object storage service and cannot directly migrate a live PostgreSQL database to RDS; it would require an intermediate export/import process that causes extended downtime and lacks native change data capture.

Full explanation →
538
Matchingmedium

Match each AWS database service to its primary use case.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Relational database with managed operations

NoSQL key-value and document database

In-memory caching for low latency

Graph database for connected data

Time-series data for IoT and analytics

Why these pairings

Correct matches: RDS -> OLTP relational, DynamoDB -> NoSQL low-latency, Redshift -> data warehousing, ElastiCache -> in-memory caching. Common confusions include swapping RDS and DynamoDB use cases.

Full explanation →
539
MCQmedium

A team is designing a data lake on S3 and needs to enforce encryption at rest. They want to use server-side encryption with a KMS key that they manage. Which encryption option should they configure on the S3 bucket?

A.SSE-KMS
B.Client-side encryption
C.SSE-S3
D.SSE-C
AnswerA

SSE-KMS uses KMS keys that the customer manages.

Why this answer

SSE-KMS is the correct choice because it provides server-side encryption using a customer-managed KMS key. This allows the team to enforce encryption at rest with their own key, giving them control over key rotation, access policies, and audit trails via AWS CloudTrail, which aligns with the requirement to manage the encryption key themselves.

Exam trap

The trap here is that candidates often confuse SSE-S3 with SSE-KMS, assuming both use customer-managed keys, but SSE-S3 uses AWS-managed keys and does not provide the customer with key management control or audit capabilities.

How to eliminate wrong answers

Option B (Client-side encryption) is wrong because it encrypts data before it is sent to S3, not at rest on the server side, and does not involve configuring encryption on the S3 bucket itself. Option C (SSE-S3) is wrong because it uses an AWS-managed key, not a customer-managed KMS key, so the team would not have control over key management. Option D (SSE-C) is wrong because it requires the customer to provide their own encryption keys in each request, and the bucket configuration does not manage the key; instead, the key is supplied per-object, which is not a bucket-level encryption setting.

Full explanation →
540
MCQmedium

A data engineering team notices that an AWS Glue ETL job fails intermittently with a 'ThrottlingException' error. The job reads from an Amazon S3 bucket and writes to an Amazon Redshift table. What is the MOST likely cause of this error?

A.The S3 bucket's request rate is exceeding the bucket's performance limits.
B.The Redshift cluster's write throughput is exceeding its provisioned capacity.
C.The Glue job is exceeding the maximum number of concurrent runs allowed.
D.The Glue job's allocated memory is insufficient for the data volume.
AnswerB

Redshift throttles writes when the cluster's I/O capacity is exceeded.

Why this answer

The 'ThrottlingException' error occurs when the rate of API requests exceeds the allowed limit. In this scenario, the Glue job writes to Amazon Redshift. Redshift has a provisioned write throughput capacity; if the Glue job attempts to write data faster than Redshift can handle, Redshift throttles the requests, resulting in a ThrottlingException.

This is the most likely cause. Option A is incorrect because S3 throttling would manifest as a different error (e.g., 'SlowDown' or 'RequestTimeout'). Option C is incorrect because Glue job concurrency limits would cause a 'ConcurrentRunsExceededException' or similar, not ThrottlingException.

Option D is incorrect because insufficient memory would typically lead to an 'OutOfMemoryError' or job failure, not a ThrottlingException.

Full explanation →
541
MCQhard

A company uses Amazon Kinesis Data Firehose to deliver streaming log data to an Amazon S3 bucket. The delivery stream uses dynamic partitioning with a custom prefix. Recently, the delivery stream has been failing with the error 'InvalidArgumentException: The number of partitions exceeds the limit'. What is the likely cause?

A.The incoming data contains more distinct partition key values than the allowed limit.
B.The S3 bucket has a bucket policy that restricts the number of prefixes.
C.The buffer size and interval are set too low, causing many small files.
D.The data volume exceeds the maximum throughput of the delivery stream.
AnswerA

Firehose dynamic partitioning has a limit on distinct partition values per batch.

Why this answer

The error 'InvalidArgumentException: The number of partitions exceeds the limit' occurs when Kinesis Data Firehose dynamic partitioning receives more distinct partition key values than the allowed limit (default 500 distinct values per stream). Option A correctly identifies this cause. Option B is wrong because S3 bucket policy restrictions would cause AccessDenied errors, not partition limit errors.

Option C is wrong because buffer size and interval affect file size and delivery frequency, not partition count. Option D is wrong because throughput limits cause ProvisionedThroughputExceededException, not partition limit errors.

Full explanation →
542
MCQhard

A company is using AWS Database Migration Service (DMS) to migrate a 2 TB MySQL database to Amazon Aurora MySQL. The migration is taking longer than expected. The source database is in a different AWS region. Which change would MOST likely improve the migration speed?

A.Use a smaller DMS replication instance to reduce costs.
B.Use a Multi-AZ deployment for the DMS replication instance in the target region.
C.Increase the number of parallel tables being migrated.
D.Disable binary logging on the source MySQL database.
AnswerC

Increasing the number of parallel tables allows DMS to migrate multiple tables at once, utilizing more of the available bandwidth and reducing total migration time, especially for a large database.

Why this answer

Increasing the number of parallel tables allows DMS to migrate multiple tables simultaneously, leveraging available bandwidth and reducing overall migration time. This is particularly effective for large databases (2 TB) where serial migration would be slow. Option B is incorrect because Multi-AZ provides high availability, not performance improvement; it adds overhead and does not reduce network latency.

Option A reduces resources, making migration slower. Option D disables binary logging, which is needed for ongoing replication and can cause data loss or require a full re-sync.

Exam trap

Candidates often confuse Multi-AZ with performance improvement, but Multi-AZ is solely for high availability. For cross-region migrations, the bottleneck is network bandwidth; increasing parallelism is the most effective way to improve throughput.

Full explanation →
543
MCQmedium

A company is using Amazon Redshift Spectrum to query data in Amazon S3. The S3 bucket uses SSE-KMS encryption. The Redshift cluster has an IAM role that allows access to S3 and KMS. However, queries fail with an 'Access Denied' error. What is the most likely cause?

A.The Redshift cluster does not have the IAM role attached.
B.The external schema does not have the IAM role specified.
C.The IAM role does not have the kms:Decrypt permission.
D.The external table is not defined in the schema.
AnswerB

The schema must reference the IAM role for Redshift Spectrum to assume it.

Why this answer

When using Redshift Spectrum with SSE-KMS encrypted data in S3, the IAM role must be explicitly associated with the external schema via the `CREATE EXTERNAL SCHEMA` command using the `IAM_ROLE` parameter. Even if the cluster has the IAM role attached, Spectrum queries fail with 'Access Denied' if the role is not specified at the schema level, because Redshift needs to pass that role to S3 and KMS for each query execution. Option B correctly identifies this missing configuration as the most likely cause.

Exam trap

The trap here is that candidates assume attaching an IAM role to the Redshift cluster is sufficient for all Spectrum operations, but the DEA-C01 exam tests the specific requirement that the role must be declared in the external schema definition for Spectrum to use it.

How to eliminate wrong answers

Option A is wrong because the question states the Redshift cluster has an IAM role attached, so the role is present on the cluster; the issue is that it is not specified in the external schema. Option C is wrong because the IAM role is explicitly stated to allow access to KMS, and the 'Access Denied' error typically occurs before KMS permission checks if the role is not passed to Spectrum at all. Option D is wrong because the external table definition is irrelevant to the 'Access Denied' error; the error occurs at the schema or role association level, not due to missing table definitions.

Full explanation →
544
MCQhard

Refer to the exhibit. A data engineer reviews an Amazon S3 server access log entry for an object upload. The log shows a status of 200 and encryption status "AES256". The company policy requires that all data be encrypted with SSE-KMS. Which action should the engineer take to enforce this policy?

A.Attach an S3 bucket policy that denies s3:PutObject unless the request includes x-amz-server-side-encryption: aws:kms
B.Revoke the IAM role's s3:PutObject permission
C.Enable AWS CloudTrail data events to monitor future uploads
D.Enable S3 default encryption with SSE-KMS on the bucket
AnswerA

Enforces SSE-KMS.

Why this answer

The log shows the object was uploaded with SSE-S3 (AES256), not the required SSE-KMS. To enforce the policy, the engineer should attach an S3 bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header set to aws:kms. Option D (default encryption) would encrypt new objects with SSE-KMS, but it does not block uploads that explicitly use SSE-S3; default encryption only applies when no encryption header is specified.

Options B and C do not enforce the policy: revoking IAM permissions is too broad and CloudTrail only logs events.

Full explanation →
545
Multi-Selectmedium

A company uses AWS CloudTrail to log all API calls. The security team wants to ensure that log files are tamper-proof and cannot be deleted. Which TWO actions should the data engineer take? (Choose TWO.)

Select 2 answers
A.Enable CloudTrail log file validation
B.Enable S3 Object Lock on the S3 bucket
C.Enable MFA Delete on the S3 bucket
D.Enable S3 Versioning on the S3 bucket
E.Enable SSE-KMS encryption on the S3 bucket
AnswersA, B

Provides integrity verification to detect tampering.

Why this answer

To ensure CloudTrail log files are tamper-proof and cannot be deleted, enable CloudTrail log file validation (option A) to verify integrity and detect tampering, and enable S3 Object Lock on the S3 bucket (option B) to prevent deletion or overwrites. Option C (MFA Delete) requires additional setup and is not automatically enforced by CloudTrail; it is not the primary mechanism for preventing deletion. Option D (S3 Versioning) alone does not prevent deletion; it preserves older versions but allows deletion of current versions.

Option E (SSE-KMS) encrypts data but does not prevent deletion.

Full explanation →
546
MCQmedium

A company is using AWS Glue to process data from Amazon S3. The Glue job reads CSV files and writes Parquet files to a different S3 bucket. The job occasionally fails with 'java.lang.OutOfMemoryError: Java heap space'. The data size varies. Which change should the engineer make to avoid this error?

A.Increase the number of DPUs allocated to the Glue job.
B.Convert the CSV files to JSON format before processing.
C.Decrease the Spark shuffle partitions in the job script.
D.Increase the job timeout setting.
AnswerA

More DPUs provide more memory and compute resources.

Why this answer

The 'java.lang.OutOfMemoryError: Java heap space' error in AWS Glue indicates that the Spark executors ran out of memory while processing the data. Increasing the number of DPUs (Data Processing Units) allocated to the Glue job increases the total memory available across the cluster, allowing larger datasets to be processed without hitting the heap limit. Each DPU provides 4 vCPUs and 16 GB of memory, so adding more DPUs scales memory linearly.

Exam trap

The trap here is that candidates often confuse 'increasing DPUs' with 'increasing parallelism' and assume it only speeds up jobs, but in reality it also increases total memory, which directly mitigates heap space errors.

How to eliminate wrong answers

Option B is wrong because converting CSV to JSON does not reduce memory pressure; JSON is typically more verbose than CSV and would increase memory consumption. Option C is wrong because decreasing Spark shuffle partitions reduces parallelism and can cause each partition to hold more data, worsening memory issues and potentially increasing the risk of OutOfMemoryError. Option D is wrong because increasing the job timeout setting only extends the maximum runtime before the job is killed; it does not address memory constraints or prevent heap space errors.

Full explanation →
547
MCQeasy

A company needs to ingest data from a relational database into Amazon S3 for analytics. The database is an Amazon RDS MySQL instance. Which AWS service should be used for a one-time historical data load?

A.AWS Database Migration Service (DMS)
B.AWS Glue ETL
C.Amazon Athena
D.Amazon Kinesis Data Firehose
AnswerA

DMS supports full load from RDS to S3.

Why this answer

AWS Database Migration Service (DMS) is the correct choice for a one-time historical data load from Amazon RDS MySQL to Amazon S3. DMS supports full-load migrations from relational databases to S3, making it ideal for this use case. AWS Glue ETL can also perform similar tasks but is more suited for complex transformations and scheduled jobs, and DMS is the dedicated service for database migrations.

Amazon Athena is a query service, not an ingestion tool. Amazon Kinesis Data Firehose is designed for streaming data, not one-time loads.

Full explanation →
548
MCQhard

A data engineer needs to share a dataset stored in an Amazon S3 bucket with another AWS account. The dataset must remain encrypted at rest using AWS KMS. The data engineer creates a bucket policy that grants the other account access to the bucket. However, the other account reports that objects appear encrypted and they cannot decrypt them. What is the most likely cause?

A.The KMS key policy does not grant the other account the kms:Decrypt permission
B.The bucket policy does not grant the s3:GetObject permission
C.The other account must use the same KMS key to upload objects
D.The objects are encrypted with SSE-S3, which is not supported for cross-account access
AnswerA

Without decrypt permission on the KMS key, the other account cannot decrypt the objects even if they can download them.

Why this answer

When using SSE-KMS, the bucket policy alone is not enough; the KMS key policy must also grant the consuming account permission to use the key (kms:Decrypt). The bucket policy controls access to the S3 objects, but KMS key policy controls who can decrypt. Therefore, option A is correct.

Full explanation →
549
Multi-Selectmedium

Which TWO options are valid ways to encrypt data at rest in Amazon S3? (Choose two.)

Select 2 answers
A.Client-Side Encryption
B.SSL/TLS Encryption
C.Server-Side Encryption with S3-Managed Keys (SSE-S3)
D.IAM Policy Encryption
E.Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS)
AnswersC, E

SSE-S3 is a server-side encryption option.

Why this answer

Server-Side Encryption with S3-Managed Keys (SSE-S3) is a valid method for encrypting data at rest in Amazon S3 because it uses AES-256 encryption to automatically encrypt objects when they are written to S3 and decrypt them when accessed, with the encryption keys managed entirely by AWS. This option is correct as it directly addresses data at rest encryption within S3, requiring no client-side effort beyond setting the `x-amz-server-side-encryption` header to `AES256`.

Exam trap

The trap here is that candidates often confuse encryption in transit (SSL/TLS) or client-side encryption with data at rest encryption, or mistakenly think IAM policies can encrypt data, when only server-side encryption options (SSE-S3, SSE-KMS, SSE-C) are valid for encrypting data at rest in S3.

Full explanation →
550
MCQhard

A company has an Amazon Redshift cluster with a mix of frequently accessed hot data and rarely accessed cold data. They want to reduce storage costs without affecting query performance for the hot data. Which strategy is MOST effective?

A.Use RA3 nodes with managed storage to automatically offload cold data to Amazon S3.
B.Reduce the number of nodes and increase the number of slices.
C.Create external tables in Redshift Spectrum to query cold data in S3.
D.Use Dense Compute nodes and unload cold data to Amazon S3 manually.
AnswerA

RA3 nodes use managed storage that automatically moves cold data to S3, reducing local storage costs.

Why this answer

RA3 nodes with managed storage automatically separate compute and storage, offloading cold data to Amazon S3 while keeping hot data on local SSD for fast queries. This reduces storage costs without manual intervention or affecting hot data performance.

Exam trap

The trap here is that candidates may choose Redshift Spectrum (Option C) thinking it automatically offloads cold data, but Spectrum requires manual external table creation and does not integrate with the cluster's automatic storage tiering.

How to eliminate wrong answers

Option B is wrong because reducing nodes and increasing slices does not address cold data storage; it changes cluster configuration without reducing storage costs for cold data. Option C is wrong because creating external tables in Redshift Spectrum allows querying cold data in S3 but does not automatically offload cold data from the cluster; it requires manual data movement and schema management. Option D is wrong because Dense Compute nodes are compute-optimized and do not support managed storage offloading; manually unloading cold data to S3 adds operational overhead and does not leverage automatic tiering.

Full explanation →
551
MCQhard

A data engineer runs this CLI command. Which query is MOST efficient against this table?

A.Query the CustomerIndex GSI by CustomerID and OrderDate.
B.Scan the table to find all orders for a CustomerID.
C.Create a local secondary index on CustomerID.
D.Query by OrderID and filter by OrderDate.
AnswerA

The GSI is designed for this query pattern.

Why this answer

The CLI command likely created a global secondary index (GSI) named CustomerIndex on CustomerID and OrderDate. Querying this GSI directly is the most efficient because it uses the index's sort key to retrieve only the relevant items without scanning the entire table, minimizing read capacity consumption.

Exam trap

The trap here is that candidates often default to scanning or creating a local secondary index without recognizing that a GSI already exists and is purpose-built for the query pattern, leading to inefficient or invalid solutions.

How to eliminate wrong answers

Option B is wrong because scanning the entire table to find orders for a specific CustomerID is inefficient and costly, as it reads every item rather than using an index to directly locate the data. Option C is wrong because creating a local secondary index on CustomerID alone would require the table to have the same partition key as the base table (OrderID), which may not align with the query pattern, and it cannot be created after table creation if the table already exists without one. Option D is wrong because querying by OrderID and filtering by OrderDate is inefficient if OrderID is not the partition key for the query pattern; it would either require a scan or an index that supports the filter, and filtering after a query still consumes read capacity for all items returned by the query.

Full explanation →
552
MCQhard

A company is using Amazon DynamoDB with on-demand capacity for a gaming application that experiences unpredictable traffic spikes. The application consistently sees 'ProvisionedThroughputExceededException' errors during spikes. The data engineer needs to resolve this issue without changing the application code. What should the engineer do?

A.Switch the table to on-demand capacity mode
B.Enable DynamoDB Accelerator (DAX) to cache read requests
C.Increase the read capacity units
D.Enable auto scaling for the table with a higher maximum capacity
AnswerA

On-demand mode automatically scales to handle traffic spikes without throttling.

Why this answer

The application is already using on-demand capacity, but the error 'ProvisionedThroughputExceededException' indicates the table is actually in provisioned mode, not on-demand. Switching to on-demand capacity mode eliminates throttling by automatically scaling throughput to match traffic spikes, with no code changes required.

Exam trap

The trap here is that candidates assume the table is already on-demand because the question states 'on-demand capacity,' but the error message 'ProvisionedThroughputExceededException' reveals the table is actually in provisioned mode, testing whether you recognize the mismatch between the stated configuration and the error.

How to eliminate wrong answers

Option B is wrong because DynamoDB Accelerator (DAX) only caches read requests to reduce latency and read load, but it does not resolve write throttling or provisioned throughput exceptions, and the error occurs during spikes regardless of read caching. Option C is wrong because increasing read capacity units only addresses read throughput, not write throughput, and the error is generic to both reads and writes; also, it requires manual intervention and does not handle unpredictable spikes. Option D is wrong because enabling auto scaling with a higher maximum capacity still uses provisioned mode, which can throttle during rapid spikes before scaling triggers, and the question specifies the table is already on-demand (though the error suggests it is not), so auto scaling is unnecessary and would not eliminate throttling for unpredictable traffic.

Full explanation →
553
MCQmedium

A data engineer is using AWS Glue ETL to transform data from an S3 data lake. The job fails with a memory error. Which approach should be used to resolve this issue without major code changes?

A.Rewrite the ETL script in PySpark instead of Scala
B.Change the input file format from CSV to Parquet
C.Increase the number of DPUs allocated to the Glue job
D.Use Amazon EMR instead of AWS Glue
AnswerC

Increasing the number of DPUs allocated to the Glue job directly increases memory and parallelism, which helps resolve memory errors without major code changes.

Why this answer

Increasing the number of DPUs (Data Processing Units) allocated to the Glue job provides more memory and parallelism. Option A is wrong because rewriting in PySpark is a major code change. Option B is wrong because using a smaller file format may not address memory issues.

Option D is wrong because using a different service is unnecessary.

Full explanation →
554
MCQeasy

A company uses Amazon Kinesis Data Firehose to deliver data to an Amazon S3 bucket. The data delivery is delayed by up to 5 minutes. The engineer wants to reduce the delay to under 1 minute. Which parameter should be adjusted?

A.Enable error logging to CloudWatch.
B.Increase the buffer size in Kinesis Data Firehose.
C.Enable data compression.
D.Decrease the buffer interval in Kinesis Data Firehose.
AnswerD

Lower buffer interval triggers deliveries more frequently.

Why this answer

Decreasing the buffer interval reduces the time Kinesis Data Firehose waits before delivering a batch, thus lowering latency to under 1 minute. Option A is incorrect because error logging to CloudWatch does not affect delivery timing. Option B is incorrect because increasing the buffer size would actually increase the delay as Firehose waits for more data to accumulate.

Option C is incorrect because enabling data compression reduces storage size but has no impact on delivery frequency.

Full explanation →
555
MCQmedium

A company uses Amazon Kinesis Data Firehose to deliver streaming data to an Amazon S3 bucket. The data is then processed by a scheduled AWS Glue ETL job that loads it into an Amazon Redshift table. Recently, the Glue job has been failing with the error: 'S3ServiceException: Access Denied'. The Firehose delivery stream is configured with a prefix and error logging to the same S3 bucket. The Glue job uses the same IAM role that has s3:GetObject and s3:ListBucket permissions on the bucket. What is the most likely cause?

A.The Glue job expects a different data format than what Firehose writes.
B.The Glue job's IAM role does not have s3:GetObjectVersion permission.
C.The Glue job is using the wrong IAM role that does not have permissions to the S3 bucket.
D.The S3 bucket has default encryption enabled with AWS KMS (SSE-KMS), and the Glue job's IAM role lacks kms:Decrypt permission.
AnswerD

SSE-KMS requires kms:Decrypt permission; missing it causes access denied when reading.

Why this answer

Firehose uses SSE-S3 by default unless configured otherwise. If the S3 bucket has default encryption enabled with SSE-KMS, Firehose will use that encryption, but the Glue job's IAM role may lack kms:Decrypt permission for the KMS key. The error 'Access Denied' when reading from S3 often indicates encryption permission issues.

Option A is wrong because the Glue job can read from S3 with the current permissions if no encryption is involved. Option B is wrong because the error is about access, not schema. Option C is wrong because the Glue job can use the same role as Firehose, but the role may not have KMS permissions.

Full explanation →
556
MCQeasy

A data pipeline uses Amazon Kinesis Data Firehose to deliver data to Amazon S3. The delivery occasionally fails with 'Firehose is throttled'. What should be done to reduce throttling?

A.Enable compression on the Firehose delivery stream
B.Increase the buffer size and buffer interval
C.Decrease the buffer size to flush more frequently
D.Increase the number of shards in the Kinesis stream
AnswerB

Larger buffer reduces the number of write requests.

Why this answer

Increasing the buffer size and buffer interval gives Kinesis Data Firehose more time and data volume to accumulate before delivering to S3, reducing the frequency of PutRecord.Batch calls to the underlying Kinesis stream. This directly mitigates throttling by lowering the request rate, as Firehose throttling typically occurs when the per-shard write throughput limit (1,000 records/second or 1 MB/second) is exceeded.

Exam trap

The DEA-C01 exam often tests the misconception that Firehose throttling is resolved by scaling shards (like in Kinesis Data Streams), but Firehose manages its own internal shards and the correct fix is to adjust buffer settings to reduce API call frequency.

How to eliminate wrong answers

Option A is wrong because enabling compression reduces the data size sent to S3 but does not reduce the number of API calls or the request rate to the Kinesis stream, so it does not address throttling at the stream level. Option C is wrong because decreasing the buffer size causes more frequent flushes, which increases the request rate and exacerbates throttling rather than reducing it. Option D is wrong because Kinesis Data Firehose does not use a Kinesis data stream as its source by default; it uses its own internal stream with a fixed number of shards (default 1), and increasing shards is not a configurable option for Firehose—this option confuses Firehose with Kinesis Data Streams.

Full explanation →
557
MCQmedium

A data engineering team is designing a data ingestion pipeline that will receive millions of small JSON files per hour from external partners via API. The files should be stored in Amazon S3 and then transformed into Parquet for querying. Which approach is MOST cost-effective and scalable?

A.Use Amazon Kinesis Data Firehose to buffer and deliver data to S3, then use AWS Glue to convert to Parquet.
B.Use AWS Lambda to process each file as it arrives and write to S3.
C.Use AWS Direct Connect to establish a dedicated network for file uploads.
D.Use Amazon EMR to process the files as they arrive in S3.
AnswerA

Firehose can ingest high throughput, buffer, and deliver to S3; Glue can run scheduled conversions.

Why this answer

Amazon Kinesis Data Firehose is the most cost-effective and scalable approach because it can buffer millions of small JSON files per hour, automatically batch them, and deliver them to S3 without requiring any server management. After delivery, AWS Glue can efficiently convert the JSON data to Parquet format for optimized querying, leveraging its serverless, pay-per-use model that scales with data volume.

Exam trap

The trap here is that candidates often choose AWS Lambda for its simplicity, overlooking its concurrency limits, timeout constraints, and cost inefficiency when handling high-frequency, small-file ingestion at scale.

How to eliminate wrong answers

Option B is wrong because AWS Lambda has a maximum execution timeout of 15 minutes and a concurrency limit, making it impractical for processing millions of small files per hour; it would also incur high costs due to per-invocation charges and cold starts. Option C is wrong because AWS Direct Connect is a dedicated network connection for consistent bandwidth and low latency, not a data ingestion or transformation service; it does not handle file processing or format conversion. Option D is wrong because Amazon EMR is designed for large-scale batch processing using frameworks like Spark or Hadoop, and using it for continuous, real-time ingestion of small files would be over-provisioned, costly, and inefficient due to cluster startup times and idle resource costs.

Full explanation →
558
MCQeasy

A company is using Amazon S3 to store sensitive data. They need to automatically transition objects to S3 Glacier Deep Archive after 90 days and delete them after 7 years. Which S3 lifecycle configuration action should be used?

A.Transition
B.AbortIncompleteMultipartUpload
C.Expiration
D.NoncurrentVersionExpiration
AnswerA

Transition moves objects to another storage class based on age.

Why this answer

The S3 lifecycle 'Transition' action is specifically designed to move objects between storage classes. To automatically move objects to S3 Glacier Deep Archive after 90 days, you define a transition rule with a 'Days' value of 90 and a 'StorageClass' of 'DEEP_ARCHIVE'. This action directly meets the requirement for transitioning data to a colder storage tier.

Exam trap

The trap here is that candidates often confuse 'Expiration' with 'Transition', thinking that deleting objects after a period is the same as moving them to a colder storage class, but expiration deletes data while transition preserves it in a different tier.

How to eliminate wrong answers

Option B is wrong because 'AbortIncompleteMultipartUpload' is used to abort multipart uploads that are not completed within a specified number of days; it does not transition or delete objects. Option C is wrong because 'Expiration' is used to delete objects after a specified time period, but the question requires a transition to Glacier Deep Archive after 90 days, not deletion at that point; expiration would delete the objects prematurely. Option D is wrong because 'NoncurrentVersionExpiration' is used to delete noncurrent versions of versioned objects, not to transition or delete current objects based on age.

Full explanation →
559
Multi-Selectmedium

A data engineer is troubleshooting an AWS Glue job that fails with 'java.lang.OutOfMemoryError: Java heap space'. The job processes a large dataset. Which TWO configuration changes should the engineer consider to resolve this issue? (Choose TWO.)

Select 2 answers
A.Change the output format from Parquet to CSV.
B.Increase the Spark shuffle partitions configuration (spark.sql.shuffle.partitions).
C.Reduce the number of partitions in the source data.
D.Increase the number of DPUs allocated to the Glue job.
E.Disable job bookmarks to avoid incremental processing.
AnswersB, D

More partitions reduce data per partition, lowering memory usage.

Why this answer

Options B and D are correct. Increasing Spark shuffle partitions (B) reduces the amount of data shuffled per partition, lowering memory pressure and preventing heap overflow. Increasing the number of DPUs (D) allocates more memory and compute resources to the Glue job, directly addressing heap space limitations.

Option A is incorrect because changing the output format from Parquet to CSV does not reduce memory usage and may increase it due to lack of compression. Option C is incorrect because reducing the number of source partitions can increase partition size, worsening memory issues. Option E is incorrect because disabling job bookmarks does not affect memory usage; it may cause processing of already processed data but doesn't resolve heap space.

Full explanation →
560
MCQeasy

A data engineer is setting up a data pipeline to ingest data from an Amazon RDS for MySQL database into Amazon S3 using AWS Glue ETL. The Glue job uses a JDBC connection to read from the MySQL database. The job runs successfully, but the engineer notices that the job is taking longer than expected. The MySQL database is 500 GB in size and the Glue job uses 10 workers of type G.1X. The engineer wants to improve the performance of the extraction phase. The database is actively used by other applications, so the engineer must minimize the impact on the source database. Which approach should the engineer take?

A.Partition the table by a numeric column, such as the primary key, and use the 'hashex' or 'hashpar' partitioning option in the Glue JDBC connection.
B.Use an incremental extraction strategy with a watermark column to reduce the amount of data read each time.
C.Create a read replica of the MySQL database and configure the Glue job to read from the replica.
D.Increase the number of Glue workers to 20 to increase parallelism.
AnswerA

Partitioning the table by a numeric column (e.g., primary key) and using the 'hashex' or 'hashpar' partitioning option in the Glue JDBC connection enables parallel reads across multiple workers, reducing the load on the MySQL database and improving extraction performance.

Why this answer

Partitioning the table on a key column (e.g., primary key) allows Glue to read in parallel from multiple partitions, reducing the load on the database and improving performance. Option B is wrong because incremental extraction is for ongoing changes, not for an initial full load; it doesn't address the immediate performance issue of extracting 500 GB. Option C is wrong because using a read replica offloads read traffic but does not inherently improve parallelism; partitioning is still needed for performance.

Option D is wrong because simply increasing the number of workers may overwhelm the database with more simultaneous connections without partitioning, potentially causing performance degradation.

Full explanation →
561
MCQmedium

A company uses AWS Glue ETL jobs to transform data from Amazon RDS to Amazon S3 daily. The job recently started failing with memory errors. The data volume has grown 3x in the past month. Which change should the data engineer make to resolve the issue?

A.Increase the size of the Amazon RDS instance
B.Switch the Glue job type from Python Shell to Spark
C.Partition the output data in Amazon S3 by date
D.Increase the number of DPUs allocated to the Glue job
AnswerD

More DPUs provide more memory to handle larger data volumes.

Why this answer

The Glue job is failing with memory errors due to a 3x increase in data volume. Increasing the number of DPUs (Data Processing Units) allocated to the job provides more memory and compute resources, directly addressing the out-of-memory condition without changing the job logic or architecture.

Exam trap

The trap here is that candidates may confuse scaling the source database (RDS) with scaling the ETL compute (Glue), or assume that output partitioning (S3) will fix an in-memory processing error, when the actual solution is to increase the compute resources allocated to the Glue job.

How to eliminate wrong answers

Option A is wrong because increasing the RDS instance size does not affect the memory available to the Glue ETL job; the bottleneck is in the Glue execution environment, not the source database. Option B is wrong because switching from Python Shell to Spark would change the execution model but does not inherently resolve memory errors; Python Shell jobs are limited to a single executor with fixed memory, while Spark jobs distribute work but still require sufficient DPUs to handle the data volume. Option C is wrong because partitioning output data in S3 by date improves query performance and cost but does not reduce the memory footprint of the Glue job during the transformation phase; the memory error occurs during processing, not during writing.

Full explanation →
562
Multi-Selecthard

A company is streaming IoT sensor data from thousands of devices into Amazon Kinesis Data Firehose. The data is then delivered to Amazon S3 for long-term storage. Occasionally, some records fail to be delivered to S3. The company must capture and analyze these failed records. Which TWO actions should be taken? (Choose two.)

Select 2 answers
A.Configure an AWS Lambda function as a pre-processing step to catch and log failed records.
B.Use Amazon Kinesis Data Analytics to analyze the failed records in real time.
C.Send failed records to an Amazon Kinesis Data Stream for reprocessing.
D.Enable Amazon CloudWatch Logs for Kinesis Data Firehose to capture delivery errors.
E.Set up an S3 event notification to trigger a Lambda function to reprocess failed records.
AnswersA, D

Lambda can handle errors during transformation and log them.

Why this answer

Configuring an AWS Lambda function as a pre-processing step in Kinesis Data Firehose can catch and log failed records during data transformation. Option D is correct because enabling Amazon CloudWatch Logs for Kinesis Data Firehose captures delivery errors, allowing analysis of failed deliveries. Option B is incorrect because Amazon Kinesis Data Analytics is for real-time analytics, not for handling delivery failures from Firehose.

Option C is incorrect because sending failed records to a Kinesis Data Stream would require additional infrastructure and is not the direct way to capture failures; CloudWatch Logs provides the necessary error logging. Option E is incorrect because S3 event notifications are triggered after successful delivery, not for failed records.

Full explanation →
563
Multi-Selecthard

A company needs to enforce encryption at rest for all data stored in Amazon S3. The security team wants to ensure that no objects can be uploaded without encryption. Which THREE steps should be taken to meet this requirement?

Select 3 answers
A.Require all clients to use AWS CloudTrail for logging
B.Enable Amazon S3 Transfer Acceleration
C.Use AWS Key Management Service (KMS) to manage encryption keys
D.Create an S3 bucket policy that denies s3:PutObject if the x-amz-server-side-encryption header is not present
E.Enable default encryption on the S3 bucket using SSE-S3
AnswersC, D, E

SSE-KMS is a valid option for encryption at rest, and enforcing its use can be part of the policy.

Why this answer

A bucket policy denying s3:PutObject without the x-amz-server-side-encryption header enforces encryption. Using SSE-S3 or SSE-KMS ensures encryption at rest. SSE-C is not recommended for most cases.

Requiring HTTPS ensures encryption in transit, not at rest. CloudTrail is for auditing.

Full explanation →
564
Multi-Selecthard

A data engineer needs to transform data in Amazon S3 using AWS Glue. The job must handle schema evolution and partition pruning. Which THREE features should be used?

Select 3 answers
A.AWS Glue Data Catalog
B.AWS Glue job bookmarks
C.AWS Glue FindMatches transform
D.AWS Glue crawlers
E.Partition indexes
AnswersA, D, E

The Data Catalog stores schema and partition metadata.

Why this answer

AWS Glue Data Catalog (A) is correct because it acts as a central metadata repository that stores table definitions and schema information. When schema evolution occurs (e.g., new columns are added in Parquet or JSON data), the Data Catalog can be updated via crawlers or manual schema registration, allowing Glue ETL jobs to dynamically adapt to changing schemas without hardcoding column structures.

Exam trap

The DEA-C01 exam often tests the distinction between 'incremental processing' (job bookmarks) and 'schema evolution' (Data Catalog + crawlers), leading candidates to incorrectly select job bookmarks for schema changes.

Full explanation →
565
MCQhard

A data engineer is designing a data ingestion pipeline for a social media analytics platform. The pipeline must ingest tweets in real-time, perform sentiment analysis, and store results in Amazon S3. The sentiment analysis is compute-intensive and must be done as the data arrives. The estimated throughput is 10,000 tweets per second. Which architecture is most suitable?

A.Amazon SQS with AWS Lambda pollers to process tweets and store in S3.
B.Amazon EMR with Spark Streaming to process tweets and write to S3.
C.Amazon Kinesis Data Streams with Amazon Kinesis Data Analytics for sentiment analysis, then Kinesis Data Firehose to S3.
D.Amazon API Gateway with AWS Lambda to process each tweet and store in S3.
AnswerC

Scalable real-time stream processing.

Why this answer

The most suitable because Amazon Kinesis Data Streams can ingest up to 10,000 records per second per shard (with shard-level scaling), and Kinesis Data Analytics provides built-in, low-latency stream processing for compute-intensive sentiment analysis using SQL or Apache Flink. Kinesis Data Firehose then reliably buffers and writes the processed results to Amazon S3 without custom code, ensuring near-real-time delivery.

Exam trap

The trap here is that candidates often choose SQS+Lambda (Option A) for simplicity, underestimating the throughput ceiling and polling overhead, while overlooking Kinesis Data Analytics as the only AWS-managed service that natively supports real-time, compute-intensive stream processing without custom infrastructure.

How to eliminate wrong answers

Option A is wrong because Amazon SQS with Lambda pollers introduces polling latency and cannot efficiently handle 10,000 tweets per second; Lambda has a maximum concurrency limit and SQS batch sizes are capped at 10 messages, leading to throttling and backpressure. Option B is wrong because Amazon EMR with Spark Streaming is designed for large-scale batch and micro-batch processing, not for true real-time, per-record sentiment analysis at 10,000 TPS; it incurs startup overhead and is better suited for historical analysis. Option D is wrong because Amazon API Gateway with Lambda processes each tweet synchronously, which cannot sustain 10,000 requests per second without aggressive throttling and cold starts; it also lacks built-in stream buffering and ordering for real-time ingestion.

Full explanation →
566
MCQhard

A data engineer runs an AWS Glue crawler that is configured to crawl an S3 bucket named 'my-data-lake' and update the Glue Data Catalog. The crawler fails with an access denied error. The IAM role attached to the crawler has the policy shown in the exhibit. What is the likely cause of the failure?

A.The policy does not allow glue:CreateTable on the 'my-data-lake' database.
B.The policy does not allow s3:PutObject on the 'my-data-lake' bucket.
C.The policy does not allow logging to CloudWatch Logs.
D.The policy does not allow s3:ListBucket on the 'my-data-lake' bucket.
AnswerC

Glue crawlers require permissions to create log groups and streams and write logs; the policy lacks logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents.

Why this answer

AWS Glue crawlers require permissions to write logs to CloudWatch Logs for monitoring and debugging. Without the `logs:CreateLogGroup`, `logs:CreateLogStream`, and `logs:PutLogEvents` actions, the crawler fails with an access denied error even if it has S3 and Glue Data Catalog permissions. The IAM policy shown does not include these CloudWatch Logs permissions, making option C the correct answer.

Exam trap

The trap here is that candidates focus on S3 and Glue Data Catalog permissions, overlooking the mandatory CloudWatch Logs permissions required for AWS Glue crawlers to run successfully.

How to eliminate wrong answers

Option A is wrong because the policy includes `glue:CreateTable` on the `my-data-lake` database (as shown in the exhibit), so this is not the cause of the failure. Option B is wrong because the crawler does not need `s3:PutObject` on the bucket; it only reads data from S3, and the policy includes `s3:GetObject` and `s3:ListBucket` for the bucket. Option D is wrong because the policy explicitly allows `s3:ListBucket` on the `my-data-lake` bucket, so this permission is not missing.

Full explanation →
567
MCQeasy

A data engineer receives an alert that an AWS KMS key has been scheduled for deletion by mistake. What is the immediate action to prevent the key from being deleted?

A.Cancel the key deletion from the KMS console or API.
B.Create a new KMS key and re-encrypt the data.
C.Wait for the key to be deleted and restore it from backup.
D.Disable the key immediately to stop usage.
AnswerA

Canceling deletion restores the key.

Why this answer

When a KMS key is scheduled for deletion, the deletion can be canceled from the AWS KMS console or via the CancelKeyDeletion API during the pending deletion period. This immediate action restores the key to its previous state and prevents it from being deleted. Option B is incorrect because creating a new key does not cancel the deletion of the existing key.

Option C is incorrect because deleted KMS keys cannot be restored; the default waiting period of 7–30 days exists specifically to allow cancellation. Option D is incorrect because disabling the key does not affect the deletion schedule.

Full explanation →
568
MCQmedium

A logistics company ingests real-time GPS location data from thousands of delivery vehicles into Amazon Kinesis Data Streams. Each vehicle sends a JSON payload every 10 seconds containing vehicle_id, latitude, longitude, timestamp, and speed. The data must be stored in Amazon S3 for historical analysis, but the company wants to first aggregate the data per vehicle per minute (average speed, min/max coordinates) to reduce storage costs. The solution must be serverless and handle potential duplicate records without double-counting. What should the engineer do?

A.Use Amazon EMR with Spark Streaming to perform the aggregation and write to S3.
B.Use Amazon Kinesis Data Analytics for Apache Flink to aggregate data in a 1-minute tumbling window with deduplication logic, then output to Kinesis Data Firehose for delivery to S3.
C.Use Kinesis Data Firehose with a Lambda transformation to aggregate records in a 1-minute window.
D.Use an AWS Glue streaming ETL job with Spark Structured Streaming to aggregate and deduplicate.
AnswerB

Flink supports windowed aggregations and stateful deduplication; Firehose delivers to S3.

Why this answer

Amazon Kinesis Data Analytics for Apache Flink can process streaming data with tumbling windows (1-minute) to aggregate per vehicle per minute, and Flink's stateful processing allows deduplication to avoid double-counting. The output is then sent to Kinesis Data Firehose for persistent storage in Amazon S3, all serverless. Option A (EMR with Spark Streaming) is not serverless.

Option C (Kinesis Data Firehose with Lambda transformation) cannot perform stateful windowed aggregation and deduplication efficiently—it processes events individually without maintaining state across records. Option D (AWS Glue streaming ETL job) is serverless but adds higher latency and complexity compared to Kinesis Data Analytics, and is not as optimized for low-latency streaming aggregations with deduplication.

Full explanation →
569
MCQmedium

A data engineer is designing a data pipeline that ingests personally identifiable information (PII) into Amazon Redshift. The engineer needs to ensure that only authorized users can view the data, and that all queries are logged for auditing. Which combination of AWS services should the engineer use?

A.AWS CloudTrail and Amazon Redshift audit logging
B.AWS IAM Access Analyzer and Amazon Redshift audit logging
C.Amazon S3 access logs and AWS CloudTrail
D.AWS CloudTrail and Amazon CloudWatch Logs
AnswerD

CloudTrail logs API calls; CloudWatch Logs can capture Redshift audit logs.

Why this answer

AWS CloudTrail and Amazon CloudWatch Logs. CloudTrail logs API calls to Redshift for auditing administrative actions, while Amazon Redshift can be configured to send audit logs (including SQL queries) to Amazon CloudWatch Logs. This combination ensures both API activity and data access are logged.

Option A is incorrect because Amazon Redshift audit logging is not a separate service; audit logs can be sent to CloudWatch Logs. Option B is incorrect because IAM Access Analyzer does not log queries. Option C is incorrect because S3 access logs only capture access to S3 objects, not Redshift queries.

Full explanation →
570
MCQeasy

A data engineer needs to monitor the number of Amazon S3 PUT requests that result in a 403 AccessDenied error. Which AWS service should be used to capture the necessary data?

A.Amazon CloudWatch S3 request metrics
B.Amazon S3 server access logs
C.AWS Config
D.AWS CloudTrail data events
AnswerD

AWS CloudTrail data events capture API calls details, including error codes. You can create a CloudWatch metric filter on the CloudTrail log group to monitor specific errors like 403.

Why this answer

S3 request metrics do not provide filtering by status code; the 4xxErrors metric aggregates all 4xx errors. To monitor specific 403 AccessDenied errors, you should use AWS CloudTrail data events, which capture API call details including error codes. You can create a CloudWatch metric filter on the CloudTrail log group to emit a custom metric for 403 errors, enabling monitoring and alarming.

Exam trap

Candidates may assume that the built‑in S3 request metrics can be filtered by status code. In reality, the 4xxErrors metric cannot be segmented by individual error codes; CloudTrail must be used for this granularity.

How to eliminate wrong answers

Option A is wrong because `NumberOfObjects` with `ObjectType` dimension tracks the count of objects per storage class (e.g., Standard, Glacier), not error responses. Option B is wrong because `BucketSizeBytes` with `StorageType` dimension measures bucket storage size, not request errors. Option D is wrong because `AllRequests` with `BucketName` dimension counts all requests (including successful ones) but does not filter by HTTP status code, so it cannot isolate 403 errors.

Full explanation →
571
MCQeasy

Refer to the exhibit. An IAM policy is attached to a user. What is the security implication of this policy?

A.The policy only allows read access.
B.The policy is invalid because it uses asterisks.
C.The policy is too restrictive.
D.The policy grants excessive permissions, violating least privilege.
AnswerD

It grants full S3 access to all resources.

Why this answer

The policy, which grants full S3 access to all resources, violates the principle of least privilege by providing excessive permissions. Option A is incorrect because the policy does not only allow read access; it allows all actions. Option B is incorrect because the use of asterisks is valid syntax in IAM policies.

Option C is incorrect because the policy is overly permissive, not restrictive.

Full explanation →
572
MCQmedium

A company uses AWS Glue to process streaming data from Amazon Kinesis Data Streams. The data is JSON formatted and includes a timestamp field. The company wants to partition the output in Amazon S3 by date and hour, and ensure exactly-once processing semantics. Which combination of configurations should be used?

A.Disable checkpointing and use the 'exactly_once' delivery option in Kinesis Data Streams.
B.Enable checkpointing in the AWS Glue streaming job and specify an S3 location for checkpoint data.
C.Use Amazon DynamoDB as a checkpoint store by configuring the Glue job with a DynamoDB connection.
D.Use Kinesis Client Library (KCL) checkpointing with a DynamoDB table.
AnswerB

Glue streaming jobs support checkpointing to S3 for exactly-once processing.

Why this answer

AWS Glue streaming jobs require checkpointing to track the progress of data consumption from Kinesis Data Streams and to ensure exactly-once processing semantics. By enabling checkpointing and specifying an S3 location, Glue periodically saves the state of processed records, allowing it to resume from the last committed offset in case of failures, thus preventing duplicates or data loss.

Exam trap

The trap here is that candidates confuse the checkpointing mechanism of AWS Glue (which uses S3) with the Kinesis Client Library (KCL) pattern (which uses DynamoDB), leading them to select option D or C, even though Glue streaming jobs do not support DynamoDB for checkpointing.

How to eliminate wrong answers

Option A is wrong because disabling checkpointing removes the mechanism for tracking processed records, making exactly-once semantics impossible; the 'exactly_once' delivery option in Kinesis Data Streams refers to producer-side delivery guarantees, not consumer-side processing semantics. Option C is wrong because AWS Glue streaming jobs do not support DynamoDB as a checkpoint store; they only support S3 for checkpoint data. Option D is wrong because Kinesis Client Library (KCL) checkpointing with DynamoDB is a pattern for custom applications, not for AWS Glue streaming jobs, which manage checkpointing internally via S3.

Full explanation →
573
MCQmedium

A data engineer is troubleshooting a failed AWS Glue ETL job that reads from and writes to the S3 bucket 'example-bucket'. The job's IAM role has the policy shown in the exhibit. The job fails with an Access Denied error when writing to a prefix 'output/'. Which permission is MISSING?

A.s3:PutObjectAcl
B.s3:GetBucketAcl
C.s3:ListBucket on the output prefix
D.s3:DeleteObject
AnswerD

Glue often deletes temporary files and may need DeleteObject permission.

Why this answer

The IAM policy grants s3:GetObject and s3:PutObject on 'example-bucket/*', which includes the 'output/' prefix, so write access is sufficient. However, AWS Glue ETL jobs often create temporary files or need to clean up staging data, requiring s3:DeleteObject permission. Without it, the job may fail with an Access Denied error when attempting to delete objects during the write process or when cleaning up after a failure.

Option D (s3:DeleteObject) is the missing permission.

Full explanation →
574
MCQhard

A company uses Amazon Redshift for a data warehouse. They notice that queries are slow due to heavy data skew. Which optimization technique should be applied first?

A.Configure workload management (WLM) queues
B.Define sort keys on frequently filtered columns
C.Set an appropriate distribution style
D.Apply compression encodings to columns
AnswerC

Correct distribution style reduces data skew and improves query performance.

Why this answer

Data skew occurs when rows are distributed unevenly across Redshift slices, causing some nodes to process far more data than others. Setting an appropriate distribution style (e.g., KEY, EVEN, or ALL) redistributes the data to balance the workload, directly addressing the root cause of the slowness. This is the first optimization to apply because skew is a fundamental distribution issue that other tuning steps cannot fix.

Exam trap

The trap here is that candidates often confuse distribution skew with sort key optimization or compression, mistakenly believing that improving data organization on disk (sort keys) or reducing I/O (compression) will fix uneven data distribution across nodes.

How to eliminate wrong answers

Option A is wrong because WLM queues manage concurrency and memory allocation for query slots, not the physical distribution of data across nodes; they cannot fix performance degradation caused by data skew. Option B is wrong because sort keys optimize the order of data on disk to improve range-restricted scans and merge joins, but they do not redistribute data or alleviate skew across slices. Option D is wrong because compression encodings reduce storage footprint and I/O by compressing column data, but they have no effect on how rows are distributed across nodes or on query parallelism.

Full explanation →
575
Multi-Selecteasy

A company is using AWS Glue ETL jobs to process data from Amazon S3 and write results back to S3. The jobs are failing intermittently with 'ThrottlingException' errors. Which TWO configurations would help reduce these errors?

Select 2 answers
A.Decrease the number of DPUs for the job.
B.Enable GZIP compression on the output data.
C.Add retry logic with exponential backoff in the job script.
D.Change the job type from Spark to Python shell.
E.Increase the number of DPUs for the job.
AnswersC, E

Retries handle transient throttling gracefully.

Why this answer

Adding retry logic with exponential backoff in the job script directly addresses transient 'ThrottlingException' errors by automatically retrying failed API calls after increasing delays. This is a standard best practice for handling service throttling in AWS Glue, as it reduces the request rate to stay within service limits without requiring infrastructure changes.

Exam trap

The trap here is that candidates often confuse increasing DPUs (Option E) as a solution for all performance issues, but while it can reduce throttling by speeding up execution, it may also increase API call concurrency and require careful tuning; the question specifically asks for configurations that 'help reduce these errors,' and retry logic is a direct, reliable mitigation.

Full explanation →
576
Multi-Selectmedium

A company stores sensitive data in Amazon S3. The data engineer needs to implement a solution that automatically detects and redacts PII in new objects as they are uploaded. Which TWO AWS services should be used together?

Select 2 answers
A.AWS Glue ETL
B.Amazon Macie
C.Amazon DynamoDB
D.Amazon Comprehend
E.AWS Glue Data Catalog
AnswersB, D

Detects PII in S3.

Why this answer

Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect sensitive data in Amazon S3. Amazon Comprehend is a natural language processing (NLP) service that can be used to detect and redact PII entities from text. Together, they enable automated detection and redaction of PII in newly uploaded S3 objects by triggering Macie to identify sensitive data and then using Comprehend to redact the PII.

Exam trap

AWS often tests the distinction between data discovery (Macie) and data processing/redaction (Comprehend), leading candidates to incorrectly select only Macie or to confuse Glue ETL as a redaction tool.

Full explanation →
577
MCQmedium

A healthcare company uses AWS Glue to process patient data stored in Amazon S3. The data is encrypted at rest using SSE-KMS with a customer managed key. The Glue ETL job runs on a schedule and reads from an S3 bucket, transforms the data, and writes to another S3 bucket also encrypted with the same KMS key. Recently, the security team rotated the KMS key. After the rotation, the Glue job started failing with 'AccessDenied' errors when trying to read from the source bucket. The Glue job's IAM role has permissions to use the KMS key (kms:Decrypt, kms:GenerateDataKey). The S3 bucket policies allow the role to read/write. What is the MOST likely cause of the failure?

A.The KMS key rotation created a new backing key, but the Glue job's IAM role does not have permission to decrypt with the old backing key.
B.The Glue job's IAM role is missing the kms:Encrypt permission on the KMS key.
C.The Glue job is using the wrong encryption context when calling KMS.
D.The S3 bucket policy has a condition that requires the request to use the latest version of the KMS key.
AnswerA

If automatic rotation is enabled, old backing keys are retained, but if the key was manually rotated (new key created), the old key may be disabled. Also, the key policy may have been updated incorrectly.

Why this answer

When you rotate a customer managed KMS key, AWS KMS retains the old backing key to allow decryption of data encrypted before the rotation. However, the Glue job's IAM role must have permission to use the old backing key via the kms:Decrypt action. If the key policy or IAM policy does not explicitly allow decryption with the old backing key (or if the key policy was inadvertently updated to remove access to the old key material), the Glue job will fail with AccessDenied when reading SSE-KMS encrypted objects that were encrypted with the previous key version.

Exam trap

The trap here is that candidates assume KMS key rotation is seamless and never breaks existing access, but they overlook that the IAM role or key policy must still grant kms:Decrypt on the key resource, and that the old backing key remains in use for previously encrypted data.

How to eliminate wrong answers

Option B is wrong because the Glue job is failing on read (decrypt), not write; the error occurs when reading from the source bucket, so missing kms:Encrypt would only affect writes to the destination bucket. Option C is wrong because the encryption context is set by the S3 service when the object was uploaded; the Glue job does not control the encryption context used during decryption, and a mismatch would cause a different error (e.g., InvalidCiphertextException), not AccessDenied. Option D is wrong because S3 bucket policies cannot require the request to use the latest version of a KMS key; KMS key versioning is transparent to S3 policies, and there is no such condition key in S3 bucket policies.

Full explanation →
578
Multi-Selecthard

Which THREE factors should a data engineer consider when choosing between Amazon S3 and Amazon DynamoDB for storing time-series data? (Choose three.)

Select 3 answers
A.Required query complexity (simple key lookups vs. range scans)
B.Application latency requirements
C.Cost per GB of storage
D.Data access patterns (random vs. sequential)
E.Total data volume
AnswersA, B, D

DynamoDB excels at key lookups; S3 is better for scans.

Why this answer

Amazon S3 supports range scans via its ListObjectsV2 API with prefix and delimiter parameters, but it is not optimized for complex queries like filtering on non-key attributes or aggregations. DynamoDB, on the other hand, excels at simple key lookups and range scans on its sort key, but lacks native support for complex query patterns such as multi-attribute filtering or joins. Therefore, the required query complexity directly influences the choice: S3 is better for simple prefix-based scans, while DynamoDB is better for key-value lookups and sort-key range queries.

Exam trap

The DEA-C01 exam often tests the misconception that cost per GB is a primary factor for choosing between S3 and DynamoDB for time-series data, when in reality query complexity, latency, and access patterns are far more decisive due to the fundamentally different data models (key-value vs. object storage).

Full explanation →
579
MCQmedium

A company uses Amazon Redshift for its data warehouse. The data engineer notices that queries are running slower than expected. The system administrator reports that the cluster's disk space is 80% full. Which action should the engineer take to improve query performance?

A.Redesign the sort keys to optimize query performance.
B.Run the VACUUM command to reclaim space.
C.Add more nodes to the cluster to increase storage and compute capacity.
D.Enable concurrency scaling to handle more queries.
AnswerC

Adding nodes increases both storage and compute, improving performance.

Why this answer

When a Redshift cluster's disk space is 80% full, query performance degrades because Redshift relies on large sequential I/O operations, and high disk utilization forces more random I/O and increases the likelihood of spilling to disk. Adding nodes increases both storage capacity and compute resources, directly alleviating the I/O bottleneck and improving query throughput. This is the recommended scaling action when disk space exceeds 70-80% utilization.

Exam trap

The trap here is that candidates often confuse the symptom (slow queries) with a need for sort key optimization or vacuuming, when the root cause is insufficient storage capacity causing I/O bottlenecks, which only adding nodes can resolve.

How to eliminate wrong answers

Option A is wrong because redesigning sort keys optimizes data distribution and pruning for specific query patterns, but it does not address the fundamental issue of insufficient storage capacity causing I/O contention. Option B is wrong because the VACUUM command reclaims space from deleted rows and sorts data, but it does not increase total disk capacity; with 80% disk full, vacuuming may only recover a small amount of space and will not resolve the performance degradation caused by high disk utilization. Option D is wrong because concurrency scaling adds transient compute capacity to handle increased query concurrency, but it does not increase the primary cluster's storage or reduce disk space pressure; performance issues from disk fullness persist even with concurrency scaling enabled.

Full explanation →
580
MCQhard

A company runs a nightly AWS Glue ETL job that writes results to an Amazon Redshift table using the JDBC connector. Recently, the job has been failing with the error 'ERROR: connection to server at ... failed: server closed the connection unexpectedly'. The Redshift cluster is in a private subnet with a VPC endpoint for S3. The Glue job runs in the same VPC with enhanced VPC routing enabled. Which is the most likely cause?

A.The JDBC driver is missing the 'redshift' compatibility mode setting.
B.SSL is not enabled on the Redshift cluster.
C.The Glue job's security group does not allow outbound traffic to the Redshift cluster.
D.AWS Glue does not support Redshift as a data source.
AnswerB

Correct. If the Redshift cluster enforces SSL, the connection will be rejected without SSL, causing the 'server closed the connection unexpectedly' error.

Why this answer

The error 'server closed the connection unexpectedly' typically indicates that the Redshift cluster rejected the connection, often because SSL is required but not enabled in the Glue JDBC connection. Redshift clusters can be configured with the `require_ssl` parameter set to true, forcing all connections to use SSL. Option B is correct because without SSL, the server terminates the connection.

Option A is incorrect because the 'redshift' compatibility mode is not a standard requirement; the JDBC driver works without it. Option C is incorrect because security group issues would cause a timeout or 'connection refused', not a server-side close. Option D is incorrect because Glue supports Redshift as a data source.

Exam trap

Candidates may assume that SSL is optional, but many production Redshift clusters enforce SSL, causing non-SSL connections to be dropped.

Full explanation →
581
MCQeasy

A data engineer needs to store semi-structured JSON logs from AWS CloudTrail. The logs are append-only and rarely accessed after 90 days. Which storage solution is MOST cost-effective?

A.Amazon S3 Glacier Deep Archive
B.Amazon S3 Standard
C.Amazon EBS with cold HDD volumes
D.Amazon DynamoDB with on-demand capacity
AnswerA

Glacier Deep Archive offers the lowest cost for long-term archival data.

Why this answer

Amazon S3 Glacier Deep Archive is the most cost-effective storage solution for CloudTrail logs that are append-only and rarely accessed after 90 days. It offers the lowest storage cost among AWS options (approximately $0.00099 per GB/month) and is designed for data that is accessed at most once or twice per year, with retrieval times of 12–48 hours. Since the logs are rarely accessed after 90 days, the retrieval latency is acceptable, and the cost savings over S3 Standard (which costs ~$0.023 per GB/month) are substantial.

Exam trap

The trap here is that candidates may choose S3 Standard or DynamoDB because they assume CloudTrail logs need frequent querying, but the question explicitly states 'rarely accessed after 90 days,' making Glacier Deep Archive the correct cost-optimal choice despite its longer retrieval time.

How to eliminate wrong answers

Option B is wrong because Amazon S3 Standard is designed for frequently accessed data and costs significantly more than Glacier Deep Archive, making it cost-inefficient for data that is rarely accessed after 90 days. Option C is wrong because Amazon EBS with cold HDD volumes (sc1) is a block storage service intended for attached EC2 instances, not for storing append-only logs as a standalone object store; it also incurs per-GB costs and requires managing EC2 instances, leading to higher total cost and complexity. Option D is wrong because Amazon DynamoDB with on-demand capacity is a NoSQL database optimized for low-latency queries and high-frequency access, not for cost-effective archival of append-only logs; its storage cost ($0.25 per GB/month) is orders of magnitude higher than Glacier Deep Archive, and it is not designed for infrequent access patterns.

Full explanation →
582
Multi-Selecthard

A company is building a data lake on S3. They have a large volume of CSV files (hundreds of GB) in a source bucket. They need to convert them to Parquet, partition by date, and ensure the data is encrypted at rest with SSE-KMS. The pipeline must be triggered automatically when new files arrive. Which THREE steps should be part of the solution? (Choose THREE.)

Select 3 answers
A.Configure S3 Event Notification to send events to an SQS queue
B.Use Amazon Kinesis Data Firehose to ingest new files
C.Create an AWS Glue ETL job that converts to Parquet and partitions by date
D.Use Amazon Athena CTAS query to convert files in batch
E.Configure the Glue job to use a KMS key for server-side encryption in S3
AnswersA, C, E

SQS can buffer events and trigger a Lambda or Step Functions workflow.

Why this answer

S3 Event Notifications can be configured to send events to an SQS queue when new CSV files arrive. This decouples the ingestion pipeline, allowing the Glue job to poll the queue for new file notifications and trigger processing without tight coupling or polling the S3 bucket directly. SQS provides reliable, scalable message delivery that can trigger downstream ETL workflows.

Exam trap

The trap here is that candidates often confuse batch conversion tools like Athena CTAS with event-driven pipelines, or assume Kinesis Firehose can process existing S3 files, when in fact Firehose only ingests streaming data and cannot read from S3 buckets.

Full explanation →
583
MCQmedium

A data engineer is designing a data lake on Amazon S3. The data ingestion pipeline must handle both batch and streaming data. The engineer wants to use a single service to ingest both types of data. Which service should the engineer choose?

A.Amazon Athena
B.Amazon Kinesis Data Firehose
C.S3 Transfer Acceleration
D.AWS Glue
AnswerB

Firehose can ingest streaming data and deliver to S3 in near real-time; batch data can be sent via Firehose API.

Why this answer

Amazon Kinesis Data Firehose is the correct choice because it is a fully managed service that can ingest both batch and streaming data and deliver it directly to Amazon S3 without requiring custom code. It can receive streaming data from sources like Kinesis Data Streams or Amazon CloudWatch Logs, and also handle batch data via API calls, making it a single ingestion point for both patterns. While AWS Glue does support both batch and streaming ETL, it is primarily an ETL service that requires writing and managing jobs, and is not designed as a direct data ingestion service to S3 without additional configuration.

Therefore, Kinesis Data Firehose is the most appropriate service for this requirement.

Exam trap

The trap here is that candidates often confuse Amazon Kinesis Data Firehose with Amazon Kinesis Data Streams, but the question specifically asks for a single service that handles both batch and streaming data and delivers to S3, which Firehose does directly without requiring a separate consumer.

How to eliminate wrong answers

Option A is wrong because Amazon Athena is an interactive query service for analyzing data in S3 using SQL, not a data ingestion service. Option C is wrong because S3 Transfer Acceleration is a feature that speeds up uploads to S3 over long distances using edge locations, but it does not handle streaming data or provide a unified ingestion pipeline. Option D is wrong because AWS Glue is a serverless data integration service primarily used for ETL (extract, transform, load) jobs and cataloging, not for real-time streaming ingestion.

Full explanation →
584
MCQhard

A company uses Amazon Kinesis Data Streams to ingest real-time clickstream data. A Lambda function processes each record. Recently, the Lambda function has been failing with 'ProvisionedThroughputExceededException' when writing results to a DynamoDB table. The data engineer has already increased the DynamoDB write capacity. What else can the engineer do to resolve the issue?

A.Increase the Lambda function memory.
B.Increase the DynamoDB read capacity units.
C.Decrease the Lambda batch size to 1.
D.Increase the number of shards in the Kinesis stream.
AnswerD

More shards distribute the load across more Lambda invocations.

Why this answer

Increasing the number of shards in the Kinesis stream increases the number of concurrent Lambda invocations, distributing the write load across more Lambda functions and reducing the number of writes per second to DynamoDB from each invocation. This helps mitigate ProvisionedThroughputExceededException. Option A is incorrect: increasing Lambda memory does not directly affect DynamoDB write throttling.

Option B is incorrect: increasing DynamoDB read capacity does not help with write throttling. Option C is incorrect: decreasing the batch size to 1 reduces the number of records per invocation, but since each shard still invokes Lambda, it may increase the number of invocations and potentially increase the write frequency, worsening the throttling.

Full explanation →
585
MCQhard

A data engineer is monitoring an Amazon Redshift cluster and notices that the 'WLM query wait time' metric is consistently high during peak hours. The cluster uses automatic WLM. The engineer wants to reduce query wait times without changing the cluster size. Which action is MOST effective?

A.Enable concurrency scaling.
B.Change WLM to manual mode and increase the number of queues.
C.Increase the maximum number of queries per queue.
D.Enable short query acceleration (SQA).
AnswerA

Concurrency scaling adds capacity to handle concurrent queries.

Why this answer

Enabling concurrency scaling (Option A) is the most effective action because it automatically adds transient cluster capacity during peak loads, allowing more queries to run concurrently without increasing wait times. This is specifically designed to reduce WLM query wait time. Option B (manual WLM) requires tuning and does not add capacity.

Option C (increasing max queries per queue) could increase concurrency but may lead to resource contention and longer wait times if the cluster is already saturated. Option D (short query acceleration) prioritizes short queries, which does not address overall wait times for all queries. Therefore, A is correct.

Full explanation →
586
MCQhard

A data engineer is troubleshooting a DMS task that is replicating data from an on-premises Oracle database to an RDS for MySQL instance. The task is failing with 'ORA-1555: snapshot too old' error. What is the best course of action?

A.Disable full supplemental logging on the source tables.
B.Increase the size of the redo logs on the source database.
C.Enable batch optimized apply on the DMS task.
D.Increase the UNDO tablespace size and set UNDO_RETENTION to a higher value.
AnswerD

This gives the CDC process enough undo to read consistent snapshots.

Why this answer

The ORA-1555 'snapshot too old' error occurs when a long-running query (such as Change Data Capture (CDC) in AWS DMS) needs to read consistent data from undo segments, but the undo information has been overwritten or retained for too short a period. Increasing the UNDO tablespace size and setting UNDO_RETENTION to a higher value ensures that undo data is preserved longer, allowing CDC to read consistent snapshots without encountering this error. Option A (disabling supplemental logging) would prevent CDC from capturing changes, thus is incorrect.

Option B (increasing redo logs) does not address the undo retention issue. Option C (enabling batch optimized apply) may improve apply performance but does not resolve the source-side undo problem.

Full explanation →
587
MCQhard

A data engineering team is managing an Amazon Redshift cluster that is used for BI reporting. The cluster has a mix of large tables (some over 1 TB) and many smaller tables. The team notices that queries on a large fact table are slow. The fact table is distributed using KEY distribution on the customer_id column, which has high cardinality. The team wants to improve query performance. They have the option to change the distribution style and sort key. Which redesign should they implement?

A.Keep the distribution style as AUTO and set the sort key to customer_id.
B.Change the distribution style to ALL and set the sort key to customer_id.
C.Change the distribution style to KEY on a different column with high cardinality.
D.Change the distribution style to EVEN and set the sort key to a date column used in WHERE clauses.
AnswerD

EVEN distributes evenly; sort key on date improves query performance.

Why this answer

Using EVEN distribution ensures data is evenly distributed across all nodes, avoiding data skew that can occur with KEY distribution on a high-cardinality column like customer_id. Setting the sort key to a date column used in WHERE clauses enables range-restricted scans, significantly reducing the amount of data scanned for common BI queries that filter by date. This combination improves query performance by maximizing parallelism and minimizing I/O.

Exam trap

The trap here is that candidates often assume KEY distribution on a high-cardinality column is optimal for large tables, but they overlook that even high-cardinality keys can cause severe data skew if the distribution key values are not uniformly distributed across nodes, leading to poor query performance.

How to eliminate wrong answers

Option A is wrong because AUTO distribution may default to KEY on customer_id, which already causes data skew and slow performance, and setting the sort key to customer_id does not address the distribution imbalance. Option B is wrong because ALL distribution copies the entire table to every node, which is impractical for a 1 TB fact table due to excessive storage and maintenance overhead, and it does not improve scan efficiency for large tables. Option C is wrong because changing the KEY distribution to a different high-cardinality column does not guarantee even distribution and may still lead to skew; the core issue is that KEY distribution on a high-cardinality column does not inherently balance data across slices.

Full explanation →
588
MCQmedium

A data engineer needs to transfer 10 TB of data from an on-premises Hadoop cluster to Amazon S3. The network bandwidth is limited to 100 Mbps, and the transfer must be completed within 48 hours. Which solution meets the requirements?

A.Use AWS DataSync to transfer data online
B.Use AWS Snowball Edge device to transfer data offline
C.Use S3 Transfer Acceleration over the internet
D.Set up AWS Direct Connect to increase bandwidth
AnswerB

Snowball Edge can transfer 10 TB offline within days.

Why this answer

The on-premises Hadoop cluster has 10 TB of data to transfer, but the network bandwidth is only 100 Mbps. At 100 Mbps, the theoretical maximum transfer rate is about 12.5 MB/s, which would take approximately 10 TB / 12.5 MB/s ≈ 800,000 seconds ≈ 222 hours — far exceeding the 48-hour window. AWS Snowball Edge is an offline, physical device that bypasses network constraints entirely, allowing you to transfer the data by shipping the device, which completes within days regardless of bandwidth.

Exam trap

The trap here is that candidates may assume S3 Transfer Acceleration or Direct Connect can magically overcome a hard bandwidth cap, but neither increases the last-mile bandwidth; the only way to transfer 10 TB in under 48 hours with a 100 Mbps link is to use an offline physical device like Snowball Edge.

How to eliminate wrong answers

Option A is wrong because AWS DataSync is an online data transfer service that still relies on network bandwidth; at 100 Mbps, it cannot transfer 10 TB within 48 hours due to the same bandwidth limitation. Option C is wrong because S3 Transfer Acceleration only optimizes routing over the internet using AWS edge locations, but it does not increase the underlying 100 Mbps bandwidth; the transfer would still take far longer than 48 hours. Option D is wrong because AWS Direct Connect provides a dedicated network connection, but it does not inherently increase bandwidth beyond the 100 Mbps limit unless you provision a higher-capacity circuit, which is not specified and would still require time to set up; the question assumes the bandwidth is fixed at 100 Mbps.

Full explanation →
589
Multi-Selecthard

Which THREE of the following are benefits of using Amazon DynamoDB Accelerator (DAX)? (Choose three.)

Select 3 answers
A.Offloads read traffic from the DynamoDB table.
B.Improves write throughput by batching writes.
C.Reduces read latency from single-digit milliseconds to microseconds.
D.Supports write-through caching to improve write performance.
E.Provides in-memory caching for DynamoDB tables.
AnswersA, C, E

DAX handles read requests, reducing load on the table.

Why this answer

DAX acts as a read-through cache that offloads read traffic from the DynamoDB table, reducing the number of read requests that hit the underlying table and thus lowering the consumed read capacity units (RCUs). This allows the table to handle more concurrent reads without scaling up provisioned capacity.

Exam trap

The trap here is that candidates often assume DAX improves write performance or supports write-through caching, but DAX is strictly a read cache and does not accelerate or batch writes.

Full explanation →
590
MCQeasy

A data engineer needs to transform a large dataset stored in Amazon S3 using Apache Spark. The engineer wants to minimize startup time and use a serverless approach. Which AWS service should the engineer use?

A.Amazon Redshift
B.Amazon EMR
C.AWS Glue
D.Amazon Athena
AnswerC

Serverless Spark with fast startup.

Why this answer

AWS Glue provides a serverless Spark environment with fast startup. Option A is wrong because Amazon Redshift is a data warehouse, not a Spark environment. Option B is wrong because Amazon EMR requires cluster provisioning, which increases startup time.

Option D is wrong because Amazon Athena is for querying data, not for transforming with Spark.

Full explanation →
591
MCQeasy

A data engineering team needs to ingest streaming data from an application into Amazon S3 for analytics. The data volume is moderate and the team wants the lowest operational overhead. Which AWS service should they use?

A.Amazon SQS
B.AWS Glue
C.Amazon Kinesis Data Streams
D.Amazon Kinesis Data Firehose
AnswerD

Fully managed, automatically writes streaming data to S3.

Why this answer

Amazon Kinesis Data Firehose is a fully managed service for loading streaming data into S3 with no code required and minimal operational overhead. Option A is incorrect because Amazon SQS is a message queue service, not designed for streaming data ingestion into S3. Option B is incorrect because AWS Glue is primarily a batch ETL service, not suitable for real-time streaming.

Option C is incorrect because Amazon Kinesis Data Streams requires custom consumers and more management, increasing operational overhead.

Full explanation →
592
MCQeasy

A company wants to migrate its on-premises MySQL database to Amazon RDS for MySQL with minimal downtime. Which AWS service should be used for the migration?

A.AWS Database Migration Service (DMS)
B.AWS Schema Conversion Tool (SCT)
C.AWS DataSync
D.AWS Direct Connect
AnswerA

Supports minimal downtime via ongoing replication.

Why this answer

AWS Database Migration Service (DMS) is purpose-built for migrating databases to AWS with minimal downtime by using ongoing replication (change data capture, CDC) from the source MySQL database to the target Amazon RDS for MySQL instance. This allows the source to remain fully operational during the migration, meeting the minimal-downtime requirement.

Exam trap

The trap here is that candidates confuse AWS DMS with AWS DataSync or SCT, assuming any data transfer tool works for database migration, but DMS is the only service that supports ongoing replication for minimal downtime database migrations.

How to eliminate wrong answers

Option B (AWS Schema Conversion Tool) is wrong because SCT is used for converting database schemas from one engine to another (e.g., Oracle to Aurora), not for migrating data with minimal downtime; it does not handle ongoing replication. Option C (AWS DataSync) is wrong because DataSync is designed for moving large volumes of file data (e.g., NFS, SMB) to Amazon S3 or EFS, not for database migrations or CDC replication. Option D (AWS Direct Connect) is wrong because Direct Connect establishes a dedicated network connection between on-premises and AWS, but it is a connectivity service, not a migration tool; it does not perform data migration or replication.

Full explanation →
593
MCQhard

A data engineer is migrating an on-premises Apache HBase workload to Amazon DynamoDB. The HBase table has a row key with composite structure: customer_id (10 chars) + timestamp (10 digits). The access pattern is to query by customer_id and retrieve the latest entries. How should the DynamoDB table be designed to optimize performance?

A.Create a table with partition key = customer_id and sort key = timestamp.
B.Use Amazon S3 with customer_id as prefix and timestamp as object name.
C.Create a table with partition key = concatenated customer_id and timestamp.
D.Create a table with partition key = timestamp and sort key = customer_id.
AnswerA

Allows querying by customer_id and sorting by timestamp to get latest entries.

Why this answer

DynamoDB's partition key (customer_id) evenly distributes data across partitions, while the sort key (timestamp) enables efficient range queries using Query with ScanIndexForward=false to retrieve the latest entries. This design directly maps the HBase composite row key pattern to DynamoDB's primary key structure, optimizing for the described access pattern.

Exam trap

The trap here is that candidates may think concatenating the row key into a single partition key (Option C) preserves the query pattern, but DynamoDB requires the partition key to be known exactly for queries, making it impossible to query by customer_id alone without a full scan.

How to eliminate wrong answers

Option B is wrong because Amazon S3 is an object store, not a low-latency NoSQL database; it lacks native support for range queries and cannot efficiently retrieve the latest entries by timestamp without scanning all objects. Option C is wrong because using a concatenated partition key (customer_id + timestamp) prevents querying by customer_id alone, as DynamoDB requires the exact partition key value for queries, forcing a full scan. Option D is wrong because using timestamp as the partition key leads to hot partitions (e.g., all writes for the same second hit one partition) and does not allow efficient retrieval by customer_id without a scan.

Full explanation →
594
MCQhard

A data engineering team is ingesting data from multiple sources into Amazon S3 using AWS Glue ETL jobs. The jobs are failing intermittently with the error: 'Task ran out of memory'. The input data size varies widely from 100 MB to 10 GB per job. Which configuration change would best mitigate this issue?

A.Increase the number of workers in the Glue job
B.Enable job bookmarking to process only incremental data
C.Reduce the batch size in the S3 source node
D.Change the job type from Spark to Python shell
AnswerB

Bookmarking reduces the data processed each run, lowering memory requirements.

Why this answer

Enabling job bookmarking allows the Glue ETL job to process only incremental (new or changed) data, which directly addresses the intermittent out-of-memory errors caused by widely varying input sizes (100 MB to 10 GB). By skipping previously processed data, the job consistently handles smaller data volumes per run, reducing memory pressure on the Spark executors.

Exam trap

The trap here is that candidates often assume increasing parallelism (Option A) is the universal fix for memory errors, but the root cause is the variable data volume per run, which job bookmarking mitigates by ensuring each run processes only a manageable subset of data.

How to eliminate wrong answers

Option A is wrong because increasing the number of workers adds more parallelism but does not reduce the per-executor memory load when processing large datasets; the job may still run out of memory on individual tasks if the data is skewed or the shuffle operations are memory-intensive. Option C is wrong because reducing the batch size in the S3 source node only affects how many files are listed per batch, not the volume of data loaded into memory for transformation; it does not prevent memory exhaustion from large input files. Option D is wrong because changing the job type from Spark to Python shell would remove distributed processing entirely, making the job unable to handle even moderate data sizes (e.g., 10 GB) and likely causing more frequent failures due to single-node memory limits.

Full explanation →
595
Multi-Selecteasy

Which TWO actions are effective ways to monitor the health of an Amazon DynamoDB table? (Choose two.)

Select 2 answers
A.Use AWS S3 inventory to track table size.
B.Use EC2 instance status checks.
C.Enable DynamoDB Streams and process with Lambda to detect failures.
D.Set up Amazon CloudWatch alarms on ConsumedReadCapacityUnits.
E.Monitor the 'TableHealth' metric in CloudWatch.
AnswersC, D

Streams can be used for monitoring changes.

Why this answer

Options C and D are correct. DynamoDB Streams with Lambda can detect failures by processing change events, and CloudWatch alarms on ConsumedReadCapacityUnits help monitor throughput and potential throttling. Option A is wrong because S3 inventory tracks S3 objects, not DynamoDB.

Option B is wrong because EC2 instance status checks are for EC2 instances, not DynamoDB tables. Option E is wrong because there is no 'TableHealth' metric in CloudWatch; DynamoDB health is monitored via metrics like ConsumedReadCapacityUnits, ThrottledRequests, and SystemErrors.

Full explanation →
596
MCQhard

A company is migrating its on-premises data warehouse to Amazon Redshift. The daily batch load from the source database takes 6 hours using a single-node Redshift cluster. The engineer needs to reduce load time to under 2 hours without increasing cost significantly. Which strategy should the engineer adopt?

A.Use COPY with compression (gzip) to reduce data volume.
B.Use a VPC endpoint to improve network throughput to S3.
C.Change the table distribution style to EVEN to distribute data evenly.
D.Increase the number of nodes in the Redshift cluster and use parallel COPY from multiple files.
AnswerD

More nodes enable parallel data loading.

Why this answer

Increasing the number of nodes in the Redshift cluster provides more compute and I/O capacity, and using parallel COPY from multiple files allows Redshift to automatically split the load across the node slices, dramatically reducing load time. This approach scales performance linearly with the number of nodes, enabling the engineer to meet the sub-2-hour target without significantly increasing cost if the cluster is sized appropriately.

Exam trap

The trap here is that candidates assume compression or network optimizations are the primary bottleneck, when in reality the single-node Redshift cluster's lack of parallelism is the root cause of the slow load time.

How to eliminate wrong answers

Option A is wrong because COPY with compression (gzip) reduces the data volume transferred over the network and the storage footprint, but it does not significantly reduce the load time on a single-node cluster; the bottleneck is the single node's compute and I/O capacity, not the data size. Option B is wrong because a VPC endpoint improves network throughput between the VPC and S3 by avoiding internet gateways, but the load time is dominated by Redshift's processing speed, not network bandwidth, especially for a single-node cluster. Option C is wrong because changing the table distribution style to EVEN distributes data evenly across slices, but on a single-node cluster there is only one slice, so EVEN distribution provides no performance benefit; distribution styles only matter for multi-node clusters to enable parallel processing.

Full explanation →
597
MCQhard

Refer to the exhibit. A data engineer is troubleshooting an IAM policy attached to a user. The user reports that they cannot upload objects to the S3 bucket 'data-lake-bucket' unless they explicitly specify the 'x-amz-server-side-encryption' header with value 'AES256'. The engineer wants to modify the policy to allow uploads without requiring encryption headers, but still enforce encryption on the bucket itself. Which change should the engineer make?

A.Remove the entire Deny statement.
B.Remove the Condition block from the Allow statement.
C.Change the Condition in the Allow statement to use aws:kms instead of AES256.
D.Set the bucket's default encryption to AES256 and keep the policy unchanged.
AnswerA

Removing the Deny allows uploads without encryption header; bucket default encryption can be used.

Why this answer

Removing the Deny statement eliminates the explicit denial that blocks uploads without the 'x-amz-server-side-encryption' header set to 'AES256'. The Allow statement already grants s3:PutObject, and by removing the Deny, users can upload without specifying encryption headers. The bucket's default encryption setting (e.g., AES256) will then automatically encrypt objects at rest, enforcing encryption without requiring the header in the request.

Exam trap

The DEA-C01 exam often tests the misconception that bucket default encryption can override an IAM Deny statement, but in reality, an explicit Deny always takes precedence regardless of bucket settings.

How to eliminate wrong answers

Option B is wrong because removing the Condition block from the Allow statement would still leave the Deny statement in place, which explicitly denies uploads without the required encryption header; the Deny overrides any Allow. Option C is wrong because changing the Condition to 'aws:kms' would require the header to specify 'aws:kms' instead of 'AES256', still mandating an encryption header and not resolving the user's issue. Option D is wrong because setting the bucket's default encryption to AES256 does not override the explicit Deny statement; the Deny still blocks uploads that lack the required header, even if the bucket would apply encryption automatically.

Full explanation →
598
MCQeasy

A marketing analytics team needs to ingest customer transaction data from an on-premises PostgreSQL database into Amazon S3 for analysis. The data volume is about 10 GB daily, and the team wants to perform full refresh daily (truncate and load) into S3 as Parquet files. The company has a Direct Connect connection to AWS. The team needs a simple, managed solution that minimizes operational overhead. What should the team use?

A.Set up AWS Database Migration Service (DMS) to continuously replicate data to S3 in Parquet format.
B.Use Amazon EMR with a Spark job that reads from PostgreSQL and writes to S3.
C.Use an AWS Glue ETL job with a JDBC connection to the PostgreSQL database, extract data, and write to S3 in Parquet format.
D.Use AWS Data Pipeline with a SQLActivity to extract data and copy to S3.
AnswerC

Glue is serverless and can handle daily full refresh with minimal setup.

Why this answer

AWS Glue ETL job is the best choice for this scenario. It is a fully managed service that can connect to on-premises PostgreSQL via a JDBC connection (using an AWS Glue connection with the appropriate network configuration over Direct Connect). It can perform a full extract (truncate and load) each day and write the data directly to S3 in Parquet format, minimizing operational overhead.

Option A (AWS DMS) is designed for ongoing change data capture (CDC) and continuous replication, not for daily full refreshes without incremental changes. Option B (Amazon EMR with Spark) requires managing clusters and is more complex than necessary for a simple daily load. Option D (AWS Data Pipeline) requires custom scripting and more configuration compared to Glue's built-in ETL capabilities.

Therefore, option C is correct.

Full explanation →
599
MCQhard

A company is using Amazon Redshift for analytics. The cluster has 20 nodes and the data is evenly distributed. Query performance has degraded over time. The data engineer suspects that table maintenance is needed. Which set of operations should be performed to improve query performance?

A.Run VACUUM and ANALYZE commands on all tables
B.Run VACUUM FULL on all tables
C.Run REINDEX on all tables
D.Run ALTER TABLE APPEND to reorganize data
AnswerA

VACUUM reclaims space and sorts rows; ANALYZE updates statistics for the optimizer.

Why this answer

Over time, Amazon Redshift tables accumulate deleted rows and unsorted data due to UPDATE and DELETE operations, which degrades query performance. Running VACUUM reclaims space and re-sorts data according to the table's sort key, while ANALYZE updates table statistics used by the query optimizer. Together, these operations restore data layout and enable efficient query planning, directly addressing the performance degradation.

Exam trap

The trap here is that candidates familiar with PostgreSQL may mistakenly apply PostgreSQL-specific maintenance commands like VACUUM FULL or REINDEX, not realizing that Amazon Redshift is based on a different architecture (columnar storage, no indexes) and only supports VACUUM and ANALYZE for table maintenance.

How to eliminate wrong answers

Option B is wrong because VACUUM FULL is a PostgreSQL command that is not supported in Amazon Redshift; Redshift only offers VACUUM (standard) and VACUUM DELETE ONLY, and FULL is not a valid option. Option C is wrong because REINDEX is a PostgreSQL command for rebuilding indexes, but Amazon Redshift does not use traditional indexes; it uses sort keys and distribution keys, so REINDEX has no effect. Option D is wrong because ALTER TABLE APPEND is used to move data between tables efficiently by remapping blocks, not to reorganize or maintain existing tables; it does not reclaim space or update statistics.

Full explanation →
600
Multi-Selecthard

A data engineer is designing a disaster recovery plan for an Amazon RDS for PostgreSQL database. The database is 500 GB and has a multi-AZ deployment. The recovery point objective (RPO) is 5 minutes, and the recovery time objective (RTO) is 2 hours. Which THREE actions should the engineer take to meet these objectives?

Select 3 answers
A.Enable Multi-AZ deployment for automatic failover.
B.Enable automated backups with a retention period of 1 day.
C.Take daily manual snapshots and export them to Amazon S3.
D.Disable automatic backups to reduce storage costs.
E.Configure a cross-region read replica for faster recovery in another region.
AnswersA, B, E

Multi-AZ provides automatic failover to standby in case of failure.

Why this answer

Multi-AZ deployment provides automatic failover to a standby in another Availability Zone, meeting the RTO of 2 hours. Option B is correct because automated backups enable point-in-time recovery within the retention period, supporting the RPO of 5 minutes (default backup retention is 1 day, which is sufficient). Option E is correct because a cross-region read replica can be promoted to a standalone database in another region for faster disaster recovery if the primary region fails.

Option C is wrong because manual snapshots exported to S3 are for long-term archival and not fast enough for a 2-hour RTO. Option D is wrong because disabling automated backups would prevent point-in-time recovery and violate the RPO of 5 minutes.

Full explanation →
Page 7

Page 8 of 23

Page 9

All pages

1234567891011121314151617181920212223

Practice DEA-C01 by domain

Target a specific domain to shore up weak areas.

Data Ingestion and TransformationData Operations and SupportData Security and GovernanceData Store Management
See all domains with question counts →