Courseiva

AWS Certified Data Engineer Associate DEA-C01 (DEA-C01) — Questions 601–675

1711 questions total · 23pages · All types, answers revealed

Take a mock examExam hub
Page 8

Page 9 of 23

Page 10
601
MCQhard

A company runs an Amazon RDS for PostgreSQL database. To meet disaster recovery requirements, they set up a cross-Region read replica. The replica has been lagging by several minutes. Which action is MOST effective to reduce the replica lag?

A.Enable Multi-AZ on the primary database.
B.Increase the instance size (memory and CPU) of the replica.
C.Increase the instance size of the primary database.
D.Decrease the instance size of the replica to reduce cost.
AnswerB

A larger replica can apply changes faster.

Why this answer

Increasing the instance size (memory and CPU) of the cross-Region read replica is the most effective action because replica lag in Amazon RDS for PostgreSQL is often caused by the replica being unable to keep up with the volume of write-ahead log (WAL) data arriving from the primary. A larger replica instance provides more compute and memory resources to apply WAL changes faster, reducing the replay lag. This directly addresses the bottleneck at the replica side without impacting the primary database.

Exam trap

The trap here is that candidates often assume the primary database is the bottleneck and choose to scale it up, but the lag is caused by the replica's inability to apply changes quickly enough, making the replica's instance size the correct lever to adjust.

How to eliminate wrong answers

Option A is wrong because enabling Multi-AZ on the primary database provides high availability within a single Region but does not reduce cross-Region replica lag; it may even increase lag due to synchronous replication overhead on the primary. Option C is wrong because increasing the instance size of the primary database improves its write performance but does not help the replica apply WAL data faster; the bottleneck is on the replica side, not the primary. Option D is wrong because decreasing the instance size of the replica would reduce its CPU and memory resources, worsening the replica lag by making it even harder to keep up with WAL replay.

Full explanation →
602
MCQmedium

An organization wants to audit all API calls made to AWS services for compliance. Which AWS service should be used to capture and store these API calls?

A.AWS CloudTrail
B.AWS Config
C.Amazon VPC Flow Logs
D.Amazon CloudWatch Logs
AnswerA

CloudTrail records AWS API calls for auditing.

Why this answer

AWS CloudTrail records all API calls made to AWS services and stores them in Amazon S3 for auditing and compliance. AWS Config monitors resource configurations, not API calls. Amazon VPC Flow Logs capture IP traffic information.

Amazon CloudWatch Logs stores log data but does not natively capture API calls; it can receive logs from CloudTrail if integrated, but CloudTrail is the primary service for capturing API calls.

Full explanation →
603
MCQhard

A data engineer is reviewing an IAM policy that controls access to an S3 bucket. The policy is attached to a user group. The policy includes a condition that explicitly requires server-side encryption with SSE-S3 for all GetObject requests. The engineer notices that users are unable to download objects from the bucket. What is the likely cause?

A.The policy is attached to a user group instead of an IAM role.
B.The policy does not specify the correct bucket ARN.
C.The policy does not allow the s3:GetObject action.
D.The objects are encrypted using SSE-KMS, not SSE-S3.
AnswerD

The condition requires SSE-S3 (AES256), so SSE-KMS objects are denied.

Why this answer

The IAM policy includes a condition that allows downloads only if the object is encrypted with SSE-S3. However, the objects in the bucket are encrypted using SSE-KMS, which does not satisfy the condition. As a result, the s3:GetObject request is denied.

This is a common scenario where a specific encryption condition in the policy blocks access when the actual encryption method differs. The other options are less likely: attaching the policy to a user group is valid and does not cause download issues; an incorrect bucket ARN would affect all operations, not just downloads; and missing s3:GetObject would be a straightforward policy error that would be easily identified.

Exam trap

The trap here is that candidates often focus only on S3 actions (like `s3:GetObject`) and overlook the required KMS permissions when SSE-KMS is involved, assuming SSE-S3 or no encryption is the default.

How to eliminate wrong answers

Option A is wrong because attaching a policy to a user group is a valid and common practice for granting permissions to multiple users; the issue is not about the attachment target but the permissions themselves. Option B is wrong because an incorrect bucket ARN would typically cause all actions to fail, not just downloads, and the question implies other operations might work. Option C is wrong because if the policy did not allow `s3:GetObject`, users would likely receive an Access Denied error for any read operation, but the question specifically mentions download failures, which can occur even with `s3:GetObject` allowed if KMS decrypt is missing.

Full explanation →
604
Multi-Selectmedium

A company is designing a data lake on AWS using Amazon S3. The data includes sensitive customer information that must be encrypted at rest. The company requires that encryption keys be managed by AWS, but the keys must be rotated automatically every year. Which TWO options meet these requirements? (Choose TWO.)

Select 2 answers
A.Use Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3).
B.Use client-side encryption with an AWS KMS key.
C.Use Server-Side Encryption with Customer-Provided Keys (SSE-C).
D.Use Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS) with manual key rotation.
E.Use Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS) with automatic key rotation enabled.
AnswersA, E

SSE-S3 automatically rotates keys every year.

Why this answer

SSE-S3 is correct because it provides server-side encryption where AWS manages the encryption keys entirely, including automatic annual rotation. This meets the requirement of encryption at rest with AWS-managed keys and automatic yearly rotation without any additional configuration.

Exam trap

The trap here is that candidates may assume SSE-KMS with automatic key rotation is the only option for automatic rotation, but SSE-S3 also provides automatic annual rotation, and the question specifically requires AWS-managed keys, making both SSE-S3 and SSE-KMS with automatic rotation valid.

Full explanation →
605
MCQhard

A company has an Amazon Redshift cluster that stores petabytes of data. Queries are experiencing high disk usage due to large intermediate results. The data engineer needs to improve query performance without adding more nodes. Which action should the engineer take?

A.Set appropriate distribution keys to minimize data movement.
B.Configure workload management (WLM) queues to limit concurrency.
C.Apply column compression encoding to reduce data size.
D.Define sort keys on all columns used in WHERE clauses.
AnswerA

Distribution keys reduce data shuffling but not intermediate results.

Why this answer

Setting appropriate distribution keys can minimize data movement during joins and aggregations, which directly reduces the size of intermediate results spilled to disk. This improves query performance without adding nodes. Option C (compression) reduces storage size and I/O but does not directly address disk usage from large intermediate results.

Option B (WLM) limits concurrency, not disk usage. Option D (sort keys) improves scan efficiency, not intermediate result size.

Full explanation →
606
MCQmedium

A data engineer is ingesting data from an on-premises database to Amazon S3 using AWS DataSync. The data transfer is scheduled to run daily at midnight. The engineer notices that the transfer takes longer than expected and sometimes does not complete before the next scheduled task. What should the engineer do to ensure the transfer completes within the window?

A.Increase the bandwidth limit in the DataSync task settings.
B.Decrease the bandwidth limit to reduce network congestion.
C.Increase the schedule frequency to every 12 hours.
D.Use S3 Transfer Acceleration instead of DataSync.
AnswerA

Higher bandwidth limit allows faster data transfer.

Why this answer

Increase the bandwidth limit in the DataSync task settings. Increasing the bandwidth limit allows DataSync to use more available network capacity, thereby speeding up the data transfer and ensuring it completes within the scheduled window. Option B is incorrect because decreasing the bandwidth limit would slow the transfer further.

Option C is incorrect because increasing the schedule frequency does not address the underlying bandwidth issue; it would merely start more transfers that would still be slow. Option D is incorrect because S3 Transfer Acceleration is designed for long-distance transfers over public internet and may not help if the bottleneck is on-premises bandwidth; additionally, DataSync is the recommended service for this scenario.

Full explanation →
607
Multi-Selectmedium

A data engineer is designing a data ingestion pipeline for IoT sensor data. The data is generated at a high velocity and must be processed in near real-time. The pipeline must also handle bursty traffic. Which TWO AWS services should be combined to achieve this? (Choose TWO.)

Select 2 answers
A.Amazon S3
B.Amazon Kinesis Data Analytics
C.Amazon Simple Queue Service (SQS)
D.AWS Glue
E.Amazon Kinesis Data Streams
AnswersB, E

Can process streaming data in near real-time.

Why this answer

Amazon Kinesis Data Streams is designed for real-time, high-velocity data ingestion, providing durable, ordered data streams that can handle bursty traffic by scaling shard capacity. Amazon Kinesis Data Analytics can process these streams in near real-time using SQL or Apache Flink, enabling immediate transformations and analytics without needing to store data first.

Exam trap

The DEA-C01 exam often tests the distinction between streaming services (Kinesis Data Streams) and batch/queue services (SQS, S3), so the trap here is assuming SQS can handle real-time streaming or that S3 can serve as a primary ingestion point for high-velocity data.

Full explanation →
608
MCQhard

A company runs a real-time analytics platform using Amazon Kinesis Data Streams with a shard count of 10. The data is consumed by an AWS Lambda function that writes to an Amazon DynamoDB table. The DynamoDB table has a partition key of 'user_id' and a sort key of 'timestamp'. The table is provisioned with 5000 RCUs and 5000 WCUs. Recently, the application experienced increased write latency and throttling errors (ProvisionedThroughputExceededException) on the DynamoDB table. The CloudWatch metrics show that ConsumedWriteCapacityUnits averages 4500 with occasional spikes to 6000. The Lambda function’s concurrency is set to 1000. The data engineer suspects the issue is due to hot partitions. Upon investigation, the engineer finds that a small number of users generate a disproportionately large amount of data. Which course of action would best resolve the throttling while minimizing cost?

A.Enable DynamoDB adaptive capacity and implement write sharding by adding a suffix to the partition key for high-volume users
B.Increase the provisioned WCUs to 10000 to handle spikes
C.Switch the DynamoDB table to on-demand capacity mode
D.Reduce the Lambda function concurrency to 100 to limit write requests
AnswerA

Adaptive capacity automatically manages partition throughput, and write sharding distributes writes across multiple partitions, reducing hot spots.

Why this answer

The root cause is hot partitions caused by a small number of high-volume users. Enabling DynamoDB adaptive capacity allows the table to automatically adjust throughput to accommodate uneven access patterns, but the key fix is write sharding — adding a random or calculated suffix to the partition key for those high-volume users. This distributes writes across multiple physical partitions, eliminating the hot spot without requiring a global increase in provisioned capacity, thus resolving throttling while minimizing cost.

Exam trap

AWS often tests the misconception that throttling is always solved by increasing total provisioned capacity or switching to on-demand, when the real issue is partition-level hot spots that require key design changes like write sharding.

How to eliminate wrong answers

Option B is wrong because simply increasing provisioned WCUs to 10000 does not address the hot partition issue; the throttling is due to uneven distribution of writes across partitions, not a lack of total capacity, so this would waste money without fixing the root cause. Option C is wrong because switching to on-demand capacity mode would handle spikes but at a significantly higher cost for sustained high write volumes, and it still does not solve the hot partition problem — on-demand tables can still throttle individual partitions if a single partition exceeds 1,000 WCUs (the per-partition throughput limit). Option D is wrong because reducing Lambda concurrency to 100 would limit the total write throughput, potentially causing data backlogs in Kinesis, and it does not address the uneven distribution of writes across DynamoDB partitions; the hot partition would still be throttled even with fewer concurrent writers.

Full explanation →
609
MCQeasy

A company is migrating its on-premises Oracle data warehouse to Amazon Redshift. The data engineering team needs to load data from Oracle to Redshift using AWS DMS (Database Migration Service). The source database is 2 TB in size. The team wants to minimize downtime and ensure data consistency during full load. Which approach should they take?

A.Use UNLOAD command to export data from Oracle to S3, then COPY into Redshift.
B.Use AWS DMS to perform a full load, then enable ongoing replication to capture changes.
C.Stop the source database, export data to flat files, upload to S3, and use COPY to load into Redshift.
D.Use COPY command directly from Oracle to Redshift over JDBC.
AnswerB

Minimizes downtime and ensures consistency.

Why this answer

AWS DMS can perform a full load of the 2 TB Oracle database while simultaneously capturing ongoing changes via CDC (Change Data Capture). After the full load completes, DMS applies the cached changes to Redshift, ensuring data consistency with minimal downtime. This approach avoids stopping the source database and leverages DMS's native replication capabilities.

Exam trap

The trap here is that candidates may confuse the UNLOAD command (Redshift export) with an Oracle export tool, or assume that a full database stop is required for consistency, when DMS's CDC capability eliminates that need.

How to eliminate wrong answers

Option A is wrong because the UNLOAD command is an Amazon Redshift command for exporting data from Redshift to S3, not for exporting from Oracle; it cannot be used on the source Oracle database. Option C is wrong because stopping the source database to export flat files introduces unnecessary downtime, which contradicts the goal of minimizing downtime; DMS can achieve consistency without halting operations. Option D is wrong because the COPY command in Redshift cannot read directly from Oracle over JDBC; it only loads data from S3, DynamoDB, or other supported sources, not from a live JDBC connection.

Full explanation →
610
Multi-Selectmedium

A company is running a critical data pipeline using AWS Glue. The pipeline must be highly available and fault-tolerant. Which TWO strategies should the data engineer implement? (Choose TWO.)

Select 2 answers
A.Configure the Glue job to run in multiple Availability Zones.
B.Use a single instance type for all Glue workers.
C.Increase the number of concurrent runs for the Glue job.
D.Enable job retries with exponential backoff.
E.Disable job bookmarks to avoid reprocessing.
AnswersA, D

Multi-AZ provides redundancy.

Why this answer

Configuring the Glue job to run in multiple Availability Zones ensures that if one AZ experiences a failure, the job can continue processing in another AZ, providing high availability and fault tolerance. This is a fundamental strategy for resilient data pipeline design in AWS.

Exam trap

The trap here is that candidates often confuse increasing concurrency (Option C) with fault tolerance, but concurrency only scales processing horizontally without providing redundancy against infrastructure failures.

Full explanation →
611
MCQmedium

A company is using AWS Database Migration Service (DMS) to migrate a 2 TB Oracle database to Amazon Aurora PostgreSQL. The migration must have minimal downtime. The source database is highly active with continuous writes. Which DMS migration type and additional configuration should the engineer use?

A.Use a CDC-only migration task to capture changes from the source.
B.Use a full load migration task and stop the source database before starting.
C.Use a full load migration task with task restart enabled.
D.Use a full load migration task followed by ongoing replication (CDC).
AnswerD

Full load migrates existing data, then CDC replicates new changes, minimizing downtime.

Why this answer

A full load migration followed by ongoing replication (CDC) allows the initial data copy to complete while continuously capturing and applying incremental changes from the highly active source. This minimizes downtime by keeping the target database nearly synchronized, requiring only a brief cutover window to stop writes and finalize replication.

Exam trap

The trap here is that candidates often assume a CDC-only task can handle both initial load and ongoing changes, but DMS requires a full load phase to populate the target before CDC can start, and they overlook that a full load alone cannot capture writes occurring during the migration.

How to eliminate wrong answers

Option A is wrong because a CDC-only task cannot migrate the existing 2 TB of data; it only captures ongoing changes, so the target would lack the initial dataset. Option B is wrong because stopping the source database before starting the migration would cause significant downtime, which contradicts the requirement for minimal downtime. Option C is wrong because a full load migration task with task restart enabled only retries the full load on failure; it does not capture ongoing writes after the initial load, so changes made during the migration would be lost, leading to data inconsistency.

Full explanation →
612
MCQeasy

A company is migrating an on-premises MySQL database to Amazon RDS for MySQL. The database is 500 GB in size. The migration must have minimal downtime and must be completed within a week. Which AWS service should the data engineer use to perform the migration?

A.Amazon S3 Transfer Acceleration.
B.AWS Snowball Edge.
C.AWS DataSync.
D.AWS Database Migration Service (DMS).
AnswerD

DMS supports ongoing replication for minimal downtime.

Why this answer

AWS Database Migration Service (DMS) is the correct choice because it is specifically designed for migrating databases to AWS with minimal downtime. DMS can perform a full load of the 500 GB MySQL database and then continuously replicate ongoing changes from the on-premises source to the Amazon RDS target using change data capture (CDC), allowing the migration to complete within a week with near-zero downtime.

Exam trap

The trap here is that candidates may confuse AWS DataSync (a file-transfer service) with database migration, or assume Snowball Edge is required for any migration over a few hundred gigabytes, when in fact DMS with CDC is the appropriate service for minimizing downtime in database migrations even with moderate data sizes.

How to eliminate wrong answers

Option A is wrong because Amazon S3 Transfer Acceleration is a feature for speeding up uploads to S3 buckets over long distances using optimized network paths and edge locations; it is not a database migration service and cannot handle schema conversion or ongoing replication. Option B is wrong because AWS Snowball Edge is a physical data transport device intended for large-scale data transfers (typically tens of TB or more) when network bandwidth is limited; for a 500 GB database with a one-week timeline and minimal downtime requirement, the network transfer is feasible and Snowball Edge would introduce unnecessary latency and downtime for shipping. Option C is wrong because AWS DataSync is designed for moving large amounts of file data (e.g., NFS, SMB shares) to or from Amazon S3, Amazon EFS, or Amazon FSx; it does not support database engines like MySQL and cannot perform schema conversion or ongoing replication of transactional changes.

Full explanation →
613
Multi-Selectmedium

A data engineer is designing a data ingestion pipeline for streaming data from IoT devices. The devices send JSON messages every second. The engineer needs to ingest the data with low latency and store it in Amazon S3 in Parquet format. Which TWO services should the engineer use together?

Select 2 answers
A.AWS Lambda
B.Amazon Athena
C.Amazon Kinesis Data Streams
D.AWS Glue
E.Amazon Kinesis Data Firehose
AnswersC, E

Provides low-latency ingestion.

Why this answer

The correct answers are C and E. Amazon Kinesis Data Streams (KDS) provides low-latency, real-time ingestion of streaming data from IoT devices, handling JSON messages sent every second. Amazon Kinesis Data Firehose (KDF) can then consume data from KDS, automatically convert it to Parquet format, and deliver it to Amazon S3.

This combination meets the low-latency and Parquet conversion requirements without custom code. Option A (Lambda) could transform data but requires additional management and is not necessary for Parquet conversion as Firehose handles it natively. Option B (Athena) is a query service, not for ingestion.

Option D (Glue) is batch-oriented and not suited for low-latency streaming.

Full explanation →
614
MCQmedium

Refer to the exhibit. A DynamoDB table 'Orders' has a GSI 'CustomerDateIndex'. A developer tries to query the GSI for all orders of a customer between two dates. The query fails. What is the most likely reason?

A.The GSI does not include 'order_id' in the key schema
B.The 'customer_id' attribute is not a partition key in the GSI
C.The query uses a date format that is not lexicographically sortable as a string
D.The 'order_date' attribute is not a sort key in the GSI
AnswerC

String sort on dates requires ISO 8601 format.

Why this answer

DynamoDB's Query operation requires the sort key to be lexicographically sortable when using comparison operators like BETWEEN. If the 'order_date' attribute is stored as a non-lexicographically sortable string format (e.g., 'MM-DD-YYYY' instead of 'YYYY-MM-DD'), the BETWEEN condition will fail to return correct results or may throw an error. The GSI's sort key must be in a format that supports string comparison for range queries to work properly.

Exam trap

AWS often tests the misconception that any string date format works for range queries, but the trap here is that DynamoDB requires lexicographically sortable strings for BETWEEN conditions, and non-ISO formats will silently fail or return incorrect results.

How to eliminate wrong answers

Option A is wrong because 'order_id' is not required in the GSI key schema for querying by customer and date range; the GSI only needs the partition key (customer_id) and sort key (order_date) for this query. Option B is wrong because 'customer_id' must be the partition key of the GSI for the query to work, and the question states the GSI is 'CustomerDateIndex', implying customer_id is the partition key. Option D is wrong because 'order_date' must be the sort key of the GSI for the BETWEEN query to work, and the index name 'CustomerDateIndex' suggests it is the sort key; the failure is due to date format, not missing sort key.

Full explanation →
615
MCQmedium

A data engineer is managing an Amazon RDS for PostgreSQL instance that serves as a source for change data capture (CDC) using AWS DMS. The DMS task is a full load followed by ongoing replication. The full load completed successfully, but the ongoing replication is failing with the error 'Value too long for character type'. The engineer has verified that the target database schema matches the source. The source table has a VARCHAR(256) column, and the target has VARCHAR(256) as well. However, some source rows contain values longer than 256 characters. What should the engineer do to resolve the issue?

A.Modify the DMS task to truncate data that exceeds the column length.
B.Rename the target column to match a different source column.
C.Change the target column to a CLOB data type.
D.Alter the target table column to a larger data type, such as VARCHAR(512).
AnswerD

Resolves the length mismatch.

Why this answer

The error indicates that source data exceeds the column length. The source column definition may not enforce the length, or the data was inserted bypassing constraints. The engineer should alter the target column to a larger size, such as VARCHAR(512), to accommodate the actual data.

Option A is wrong because truncating data may cause data loss. Option B is wrong because renaming would cause mapping issues. Option C is wrong because the error is not about character set; using CLOB may not be compatible with the CDC process and would change the data type.

Full explanation →
616
MCQmedium

A company runs a critical application on Amazon RDS for MySQL. To ensure high availability and automatic failover, the database is deployed as a Multi-AZ DB instance. The application uses read-heavy workloads. Which additional configuration should be used to offload read traffic without impacting write performance?

A.Use the Multi-AZ standby instance for read queries.
B.Create one or more Read Replicas in different AZs.
C.Use Amazon ElastiCache to cache read queries.
D.Change to a Single-AZ deployment with a larger instance size.
AnswerB

Read Replicas can handle read traffic, and Multi-AZ ensures high availability for writes.

Why this answer

Amazon RDS Read Replicas are designed to offload read traffic from the primary DB instance without affecting write performance. Unlike the Multi-AZ standby instance, which is not accessible for reads, Read Replicas can be placed in different Availability Zones and serve read queries independently, improving read scalability while the primary handles writes.

Exam trap

The trap here is that candidates often assume the Multi-AZ standby instance can be used for read queries, but AWS explicitly prevents this to ensure failover consistency, making Read Replicas the correct choice for offloading reads.

How to eliminate wrong answers

Option A is wrong because the Multi-AZ standby instance is a passive replica that cannot serve read traffic; it only provides automatic failover and is not accessible for read queries. Option C is wrong because while Amazon ElastiCache can cache read queries, it does not offload read traffic from the database itself—it only reduces the number of queries hitting the database by caching results, but the question specifically asks for offloading read traffic without impacting write performance, and Read Replicas directly address this by providing additional database endpoints for reads. Option D is wrong because switching to a Single-AZ deployment with a larger instance size eliminates high availability and does not offload read traffic; it only increases capacity for both reads and writes, which can still impact write performance under heavy read load.

Full explanation →
617
Multi-Selectmedium

A company is using AWS Glue ETL to transform and load data from Amazon S3 to Amazon Redshift. The data engineer notices that the job is taking longer than expected. Which TWO actions can improve the job performance?

Select 2 answers
A.Use Amazon Redshift Spectrum to query data directly.
B.Partition the source data in S3.
C.Increase the number of DPUs for the Glue job.
D.Enable S3 Transfer Acceleration.
E.Use a larger Redshift node type.
AnswersB, C

Partitioning reduces data scanned.

Why this answer

Options B and C are correct because partitioning the source data in S3 reduces the amount of data scanned by Glue, improving I/O efficiency, and increasing the number of DPUs adds more parallelism for transformations. Option A is incorrect because Redshift Spectrum is for querying data in S3 directly from Redshift, not for Glue ETL jobs. Option D is incorrect because S3 Transfer Acceleration speeds up uploads to S3 but does not affect Glue job performance during ETL processing.

Option E is incorrect because larger Redshift node types do not impact Glue job execution; they only affect Redshift query performance.

Full explanation →
618
Multi-Selectmedium

A company runs a data processing pipeline on Amazon EMR. The pipeline reads data from S3, processes it with Spark, and writes results back to S3. The engineer notices that the cluster is underutilized and wants to reduce costs. Which TWO actions should the engineer take? (Choose TWO.)

Select 2 answers
A.Use Spot instances for task nodes.
B.Configure the cluster to terminate after the job completes.
C.Change the master node to a larger instance type.
D.Enable EMRFS consistent view.
E.Increase the number of core nodes to improve parallelism.
AnswersA, B

Spot instances are cheaper than On-Demand.

Why this answer

Using Spot instances for task nodes in Amazon EMR can significantly reduce costs, as Spot instances are spare EC2 capacity offered at up to 90% discount compared to On-Demand instances. Since task nodes are stateless and can be added or removed without affecting cluster stability, they are ideal candidates for Spot instances, allowing the engineer to lower expenses while maintaining processing capacity.

Exam trap

The trap here is that candidates may confuse cost optimization features like Spot instances and auto-termination with performance improvements or data consistency settings, leading them to select options that increase resources or enable features unrelated to cost reduction.

Full explanation →
619
MCQmedium

A data engineering team is using Amazon DynamoDB to store time-series data for a monitoring application. The table has a primary key of device_id (partition key) and timestamp (sort key). The application queries data for a specific device over a time range. The team notices that read latency is high for devices that generate large amounts of data. They need to improve query performance. Which solution should they implement?

A.Enable DynamoDB Accelerator (DAX) for the table.
B.Change the application to use eventually consistent reads.
C.Create a global secondary index with device_id as partition key and a truncated timestamp as sort key to distribute writes.
D.Increase the read capacity units for the table.
AnswerC

Helps spread write load and improve read performance for time-range queries.

Why this answer

Creating a global secondary index (GSI) with device_id as the partition key and a truncated timestamp as the sort key helps distribute write traffic more evenly across partitions. This reduces hot partitions caused by devices that generate large amounts of data, thereby improving read latency by preventing throttling and reducing contention on a single partition.

Exam trap

The trap here is that candidates often mistake high read latency as a pure read-throughput issue and choose to increase RCUs or add DAX, overlooking the fact that the real bottleneck is write-side hot partitions causing throttling and increased latency for reads on that partition.

How to eliminate wrong answers

Option A is wrong because DynamoDB Accelerator (DAX) is an in-memory cache that reduces read latency for frequently accessed items, but it does not address the root cause of high read latency—hot partitions due to uneven write distribution. Option B is wrong because eventually consistent reads only reduce latency by returning data that may be slightly stale, but they do not solve the underlying partition-level performance issue caused by skewed write patterns. Option D is wrong because increasing read capacity units (RCUs) can help with throughput but does not mitigate the hot partition problem; if a single partition is overwhelmed, additional RCUs cannot be fully utilized due to DynamoDB's partition-level throughput limits.

Full explanation →
620
MCQmedium

Refer to the exhibit. A data engineer attaches this bucket policy to an S3 bucket. A developer tries to upload an object to the bucket using the AWS CLI with the command: `aws s3 cp file.txt s3://my-bucket/`. The upload fails. What is the most likely reason?

A.The CLI command does not specify the encryption header, so the request is denied by the policy
B.The developer used the wrong AWS region
C.The CLI command does not include the required KMS key ID
D.The IAM user does not have s3:PutObject permission
AnswerA

The policy denies requests without encryption header.

Why this answer

The correct answer. The bucket policy condition `aws:SecureTransport` or similar encryption requirement (e.g., `s3:x-amz-server-side-encryption`) denies requests that do not include the required encryption header. The `aws s3 cp` CLI command does not automatically include the `x-amz-server-side-encryption` header; it uses SSE-S3 by default without setting the header explicitly.

Therefore, the request is denied because the header is missing. Option B is incorrect because the policy does not depend on region. Option C is incorrect because the policy does not require a specific KMS key ID; it only requires the encryption header.

Option D is incorrect because the IAM user likely has `s3:PutObject` permission, but the bucket policy explicitly denies the request due to missing encryption header.

Full explanation →
621
MCQeasy

A data engineer uses AWS CloudTrail to investigate a security incident. The engineer runs the command shown in the exhibit. What does the output indicate?

A.A file was downloaded from the S3 bucket.
B.A file was deleted from the S3 bucket.
C.A batch of files was listed from the S3 bucket.
D.A file was uploaded to the S3 bucket.
AnswerD

PutObject indicates an upload.

Why this answer

The CloudTrail event shows EventName as PutObject, which indicates an object was uploaded to S3. The resource name includes the bucket and the object key 'sales_2024-07-01.csv', confirming a single file upload. Option A is incorrect because the event is PutObject, not GetObject.

Option B is incorrect because PutObject is an upload, not a deletion. Option C is incorrect because PutObject represents uploading a single object, not listing a batch of files.

Full explanation →
622
Multi-Selecthard

A company uses AWS Glue to process large datasets. The Glue job occasionally fails with 'DiskFull' errors. Which TWO actions should the engineer take to resolve this issue? (Choose two.)

Select 2 answers
A.Increase the number of workers for the Glue job.
B.Store intermediate results in Amazon S3 instead of local disk.
C.Enable job bookmark to skip already processed data.
D.Use a Python shell job instead of Spark.
E.Use G.2X worker type which provides more disk space per worker.
AnswersA, E

More workers provide more aggregate disk space.

Full explanation →
623
Multi-Selectmedium

Which TWO of the following are valid approaches to implement fine-grained access control for Amazon DynamoDB items based on user attributes? (Choose 2.)

Select 2 answers
A.Enable row-level security in DynamoDB using AWS Lake Formation.
B.Configure a VPC endpoint with a bucket policy to restrict access to specific items.
C.Use Amazon Cognito identity pools with IAM roles that include conditions based on user attributes.
D.Store user-specific items in separate S3 buckets and use IAM policies to restrict bucket access.
E.Use IAM policies with condition keys like 'dynamodb:LeadingKeys' to restrict access to items with a specific partition key value.
AnswersC, E

Cognito can map user attributes to IAM roles with fine-grained policies.

Why this answer

Amazon Cognito identity pools can be configured to assume IAM roles with fine-grained policies that use condition keys such as `dynamodb:LeadingKeys` or custom attribute-based conditions. This allows access to DynamoDB items to be restricted based on user-specific attributes (e.g., user ID) without hardcoding permissions per user.

Exam trap

The trap here is that candidates often confuse DynamoDB's fine-grained access control with S3 bucket policies or Lake Formation row-level security, mistakenly applying S3 or data lake concepts to DynamoDB item-level permissions.

Full explanation →
624
MCQeasy

A company needs to encrypt data in transit between an EC2 instance and an S3 bucket. Which method should be used?

A.Use HTTPS endpoints
B.Use plain HTTP
C.Use an IPsec VPN
D.Server-side encryption (SSE)
AnswerA

HTTPS encrypts data in transit using TLS.

Why this answer

HTTPS endpoints encrypt data in transit between EC2 and S3 using TLS/SSL, ensuring confidentiality and integrity over the public internet. S3 supports HTTPS natively on its REST endpoints, and the AWS SDKs default to HTTPS, making this the simplest and most secure method for encrypting data in motion.

Exam trap

The trap here is confusing encryption in transit (HTTPS) with encryption at rest (SSE), leading candidates to select server-side encryption even though it does not protect data during network transfer.

How to eliminate wrong answers

Option B is wrong because plain HTTP transmits data in cleartext, exposing it to interception and tampering, which violates encryption-in-transit requirements. Option C is wrong because an IPsec VPN encrypts traffic between networks but is unnecessary and overly complex for direct EC2-to-S3 communication, which can be secured via HTTPS without additional infrastructure. Option D is wrong because server-side encryption (SSE) protects data at rest within S3, not data in transit between EC2 and S3.

Full explanation →
625
MCQeasy

A data engineer needs to grant an IAM user read-only access to a specific KMS key for decrypting S3 objects. Which policy element should be used?

A.Attach an IAM policy to the user allowing kms:Decrypt
B.Add a statement to the KMS key policy allowing the IAM user to call kms:Decrypt
C.Add a bucket policy that grants kms:Decrypt
D.Use an SCP in AWS Organizations to allow kms:Decrypt
AnswerB

Correct. KMS key policies are resource-based policies that directly grant permissions to IAM users or roles to perform actions on the key. Adding a statement to the key policy allowing the IAM user to call kms:Decrypt is the recommended method.

Why this answer

KMS key policies are resource-based policies that directly grant permissions to IAM users or roles to perform actions on the key. To grant an IAM user read-only access (kms:Decrypt) to a specific KMS key, the recommended approach is to add a statement in the key policy that allows that user to call kms:Decrypt. Option A is incorrect because an IAM policy alone cannot grant KMS permissions unless the key policy explicitly allows it (by default, key policies must allow IAM policies).

Option C is incorrect because bucket policies cannot grant kms:Decrypt permissions; they can only specify conditions for using KMS keys. Option D is incorrect because SCPs are used in AWS Organizations to set permission boundaries, not to grant permissions.

Full explanation →
626
MCQmedium

A data engineer is migrating an on-premises Apache Cassandra cluster to Amazon Keyspaces (for Apache Cassandra). The cluster has 10 TB of data. The migration must minimize application downtime. Which strategy should the engineer use?

A.Set up a dual-write pattern where the application writes to both the on-premises cluster and Keyspaces, then switch reads to Keyspaces once data is synchronized.
B.Export the data using the Cassandra COPY command and import it into Keyspaces using the COPY command.
C.Take a snapshot of the on-premises cluster and restore it to Keyspaces using the Keyspaces console.
D.Use AWS Database Migration Service (DMS) to continuously replicate data from the on-premises cluster to Keyspaces.
AnswerA

This minimizes downtime by keeping both systems in sync and allows for a gradual cutover.

Why this answer

The dual-write pattern allows the application to write to both the on-premises Cassandra cluster and Amazon Keyspaces simultaneously, ensuring data consistency with minimal downtime. Once the existing data is backfilled and the systems are synchronized, reads can be switched to Keyspaces with near-zero application interruption. This approach avoids the downtime required for bulk export/import or snapshot restore.

Exam trap

The trap here is that candidates often assume AWS DMS can handle any database migration, but DMS does not support Cassandra as a source, making Option D a distractor for those who overestimate DMS's capabilities.

How to eliminate wrong answers

Option B is wrong because the Cassandra COPY command is a bulk export/import tool that requires the application to stop writes during the migration to ensure consistency, causing significant downtime for 10 TB of data. Option C is wrong because taking a snapshot of the on-premises cluster and restoring it to Keyspaces via the console is not supported; Keyspaces does not provide a native snapshot restore feature from on-premises snapshots. Option D is wrong because AWS DMS does not support Apache Cassandra as a source for continuous replication; DMS supports relational databases and some NoSQL databases but not Cassandra.

Full explanation →
627
MCQeasy

A company needs to ingest data from multiple SaaS applications into Amazon S3. The data sources provide REST APIs. Which AWS service can be used to build a fully managed data ingestion pipeline without writing custom code?

A.Amazon AppFlow
B.Amazon Kinesis Data Streams
C.AWS Lambda with custom code
D.AWS Glue with Python shell
AnswerA

AppFlow is a fully managed integration service for SaaS applications.

Why this answer

Amazon AppFlow is a fully managed service designed to transfer data from SaaS applications to AWS services like Amazon S3 without writing custom code. Option B is wrong because Amazon Kinesis Data Streams is primarily for real-time streaming data, not for directly ingesting from SaaS APIs. Option C is wrong because AWS Lambda requires custom code to integrate with SaaS APIs.

Option D is wrong because AWS Glue with Python shell is for ETL transformations and also requires custom scripting.

Full explanation →
628
MCQmedium

A company is using AWS Glue to run ETL jobs that process data from Amazon S3 and load it into Amazon Redshift. The jobs are failing with the error 'Unable to connect to Redshift cluster'. The Redshift cluster is in the same VPC as the Glue job. What is the MOST likely cause?

A.The Redshift cluster's security group does not allow inbound traffic from the Glue job's security group.
B.The IAM role associated with the Glue job does not have permission to access Redshift.
C.The Glue job is not configured to use the same VPC as the Redshift cluster.
D.The Redshift cluster is not publicly accessible and Glue is trying to connect from outside the VPC.
AnswerC

Glue jobs need VPC configuration to access resources in a private VPC.

Why this answer

The most likely cause is that the Glue job is not configured to use the same VPC as the Redshift cluster. By default, AWS Glue jobs run in a separate VPC managed by Glue. To connect to resources in a customer VPC (like a Redshift cluster), the Glue job must be explicitly associated with that VPC via a Glue connection or job configuration.

Option C is correct. Option A is incorrect because even if the security group allows inbound traffic, the Glue job's network may not be routed to the Redshift cluster if it is in a different VPC. Option B is incorrect because the IAM role handles authentication, not network connectivity.

Option D is incorrect because the Redshift cluster is in the same VPC, so public accessibility is not required; the error indicates a network connectivity issue, not a public access issue.

Full explanation →
629
Multi-Selecthard

A company uses Amazon Redshift for data warehousing. The security team requires that data be encrypted at rest using a customer-managed key (CMK) in AWS KMS, and that the key be rotated automatically every year. Additionally, the team wants to restrict access to the key to only the Redshift cluster and a security admin IAM role. Which steps should the company take? (Choose THREE.)

Select 3 answers
A.Add the security admin IAM role as a key user in the KMS key policy.
B.Alter the existing Redshift cluster to enable encryption with the CMK.
C.Enable automatic key rotation in the KMS key policy.
D.Disable automatic key rotation to comply with security policy.
E.Create a new Redshift cluster and specify the CMK for encryption.
AnswersA, C, E

Allows the admin to manage the key.

Why this answer

Options A, C, and E are correct. Option A adds the security admin IAM role as a key user in the KMS key policy. Option C enables automatic yearly rotation of the CMK.

Option E creates a new Redshift cluster and specifies the CMK for encryption. Option B is wrong because you cannot enable encryption on an existing unencrypted cluster by altering it; you must create a new cluster or restore from an encrypted snapshot. Option D is wrong because it disables rotation, which conflicts with the security requirement.

Full explanation →
630
MCQhard

A company uses Amazon S3 to store log files from multiple applications. The logs are encrypted with AWS KMS (SSE-KMS). A data engineer needs to grant a new IAM user read-only access to the logs. The engineer attaches an S3 bucket policy that allows s3:GetObject and a KMS key policy that allows kms:Decrypt. However, the user still receives an 'Access Denied' error when trying to download an object. What is the MOST likely missing permission?

A.The user does not have s3:ListBucket permission on the bucket.
B.The user does not have s3:GetObjectVersion permission.
C.The user's IAM policy does not include kms:Decrypt permission.
D.The user does not have kms:GenerateDataKey permission.
AnswerC

Both the key policy and the IAM user policy must allow kms:Decrypt; the IAM policy is missing this action.

Why this answer

To use SSE-KMS, the user needs kms:Decrypt, but also the IAM policy must allow kms:Decrypt, not just the key policy. The key policy alone is not sufficient if the IAM user's policy denies or does not allow the action. Option A is incorrect because s3:ListBucket is for listing, not downloading.

Option B is incorrect because s3:GetObjectVersion is for versioned buckets. Option D is incorrect because kms:GenerateDataKey is for encryption, not decryption.

Full explanation →
631
MCQmedium

A media company stores video files in Amazon S3 buckets organized by content type. The company has a requirement to automatically archive files that are older than 90 days to Amazon S3 Glacier Deep Archive to reduce costs. However, the company wants to retain the ability to restore files within 12 hours if needed. The data engineer creates an S3 Lifecycle policy to transition objects to Glacier Deep Archive after 90 days. After deploying the policy, the engineer notices that the storage costs have not decreased significantly. On reviewing the bucket metrics, the engineer sees that many objects are being deleted directly by users before the lifecycle policy takes effect. The company needs to enforce the lifecycle policy and prevent premature deletions. What should the data engineer do to enforce the lifecycle policy?

A.Apply an S3 Object Lock retention policy with a default retention mode of GOVERNANCE and a retention period of 90 days.
B.Enable S3 Versioning on the bucket and add a lifecycle rule to transition noncurrent versions to Glacier Deep Archive after 90 days.
C.Enable S3 Multi-Factor Authentication (MFA) Delete on the bucket to require MFA for all delete operations.
D.Use S3 Glacier Select to query the objects and restore them if needed.
AnswerB

Versioning preserves deleted objects as noncurrent versions, which can then be transitioned by lifecycle rules.

Why this answer

Enabling S3 Versioning ensures that when users delete objects, a delete marker is created instead of permanently deleting the object. The lifecycle rule can then transition the noncurrent versions (the original objects) to Glacier Deep Archive after 90 days, preserving the data while reducing costs. Option A is incorrect because Object Lock with GOVERNANCE mode prevents any deletion or overwrite for the retention period, which may interfere with normal operations and does not address the lifecycle policy enforcement.

Option C is incorrect because MFA Delete provides additional security for delete operations but does not prevent the deletion itself; it only requires MFA authentication. Option D is incorrect because S3 Glacier Select is used to query archived data, not for lifecycle management.

Full explanation →
632
MCQhard

Refer to the exhibit. A data engineer ran the CLI command to check the configuration of an RDS instance named 'mydb'. Which statement accurately describes the current configuration?

A.The database is in the 'stopped' state
B.The database is a Single-AZ deployment and is not a read replica
C.The database is a read replica of another instance
D.The database is a Multi-AZ deployment
AnswerB

MultiAZ False and no ReadReplicaSourceDBInstanceIdentifier.

Why this answer

The CLI command output shows 'DBInstanceStatus: available' and 'MultiAZ: False', indicating the database is running as a Single-AZ deployment. Additionally, the absence of a 'SourceDBInstanceIdentifier' field confirms it is not a read replica. The 'ReadReplicaSourceDBInstanceIdentifier' is not present, which would be required if it were a read replica.

Exam trap

AWS often tests the misconception that a database with 'available' status must be a read replica or Multi-AZ, but the absence of the 'ReadReplicaSourceDBInstanceIdentifier' and 'MultiAZ: False' clearly identify it as a standalone Single-AZ instance.

How to eliminate wrong answers

Option A is wrong because the CLI output shows 'DBInstanceStatus: available', not 'stopped', so the database is running, not stopped. Option C is wrong because the output lacks a 'ReadReplicaSourceDBInstanceIdentifier' field, which is mandatory for a read replica; without it, the instance is a primary database, not a replica. Option D is wrong because the output explicitly shows 'MultiAZ: False', which means it is a Single-AZ deployment, not Multi-AZ.

Full explanation →
633
MCQmedium

A company runs a production Amazon RDS for MySQL database with Multi-AZ deployment. The database experiences high read latency during peak hours. The company wants to improve read performance with minimal application changes. Which solution should a data engineer recommend?

A.Create one or more read replicas in a different Availability Zone.
B.Use Amazon DynamoDB Accelerator (DAX) as a caching layer.
C.Increase the DB instance size to a larger instance class.
D.Enable Multi-AZ on the existing instance.
AnswerA

Read replicas offload read traffic from the primary instance.

Why this answer

Creating read replicas in a different Availability Zone offloads read traffic from the primary DB instance, reducing read latency during peak hours. Read replicas in Amazon RDS for MySQL are asynchronous replicas that can serve SELECT queries, requiring minimal application changes (only a new connection endpoint). This directly addresses high read latency without altering the existing Multi-AZ setup.

Exam trap

The trap here is that candidates confuse Multi-AZ with read scaling, assuming the standby instance can serve reads, but in Amazon RDS for MySQL, the Multi-AZ standby is passive and cannot accept connections until failover occurs.

How to eliminate wrong answers

Option B is wrong because Amazon DynamoDB Accelerator (DAX) is an in-memory cache for DynamoDB, not for Amazon RDS for MySQL; it cannot be used as a caching layer for a relational database. Option C is wrong because increasing the DB instance size (vertical scaling) may improve overall throughput but does not specifically offload read traffic and can be more expensive than adding read replicas; it also does not address the root cause of high read concurrency. Option D is wrong because enabling Multi-AZ on the existing instance provides high availability and automatic failover, not read scaling; the Multi-AZ standby cannot serve read traffic, so it does not reduce read latency.

Full explanation →
634
MCQhard

A data pipeline uses AWS Glue to read CSV files from an S3 bucket, transform them, and write Parquet back to S3. The pipeline runs daily and processes about 500 GB per run. The team wants to reduce costs without increasing runtime. Which approach is most effective?

A.Pre-convert the CSV files to Parquet in S3 using a separate process.
B.Enable job bookmarks to skip already processed data.
C.Increase the number of DPUs for the Glue job to improve parallelism.
D.Optimize the Glue script to select only required columns and filter rows early.
AnswerD

Selecting only required columns and filtering rows early reduces data scanned, lowering Glue job costs without increasing runtime.

Why this answer

Optimizing the Glue script to use column pruning and predicate pushdown reduces the amount of data scanned, lowering costs without increasing runtime. Option A (pre-converting CSV to Parquet) adds an extra processing step and cost, making it less effective. Option B (enabling job bookmarks) tracks already processed data but does not reduce the cost per run.

Option C (increasing DPUs) may actually increase costs and can cause unpredictable runtime.

Full explanation →
635
MCQhard

Refer to the exhibit. A data engineer runs the AWS CLI command to describe a Glue job. The job is expected to process new data incrementally using job bookmarks. However, the job reprocesses all data every time it runs. What is the MOST likely reason?

A.The job bookmark option is set to 'job-bookmark-enable' but should be 'job-bookmark-disable'.
B.The job's MaxRetries is set to 0, which disables bookmarks.
C.The ETL script does not use the 'transformation_ctx' parameter in its DynamicFrame transformations.
D.The Glue job's command name is 'glueetl', which does not support job bookmarks.
AnswerC

Without transformation_ctx, Glue cannot track bookmarks.

Why this answer

AWS Glue job bookmarks rely on the `transformation_ctx` parameter to track state. Without it, Glue cannot identify which data has already been processed, causing the job to reprocess all data on every run. The `transformation_ctx` must be passed to each DynamicFrame transformation (e.g., `apply_mapping`, `filter`, `join`) to enable bookmark-based incremental processing.

Exam trap

The trap here is that candidates often assume bookmarks are controlled only by the job configuration setting (`job-bookmark-enable`) and overlook the critical role of `transformation_ctx` in the ETL script, which is a common oversight in AWS Glue exam questions.

How to eliminate wrong answers

Option A is wrong because `job-bookmark-enable` is the correct setting to enable bookmarks; setting it to `job-bookmark-disable` would disable them, not fix the reprocessing issue. Option B is wrong because `MaxRetries` controls the number of retry attempts on failure and has no effect on job bookmark behavior. Option D is wrong because `glueetl` is the standard command name for ETL jobs and fully supports job bookmarks; the command name does not disable bookmarks.

Full explanation →
636
MCQhard

Refer to the exhibit. An IAM policy is attached to an IAM role used by an application. The application needs to read objects from 'my-bucket' that have the tag 'classification=public'. The application account is 123456789012. However, the application is getting 'Access Denied' errors. What is the most likely reason?

A.The Deny statement uses StringNotEquals, which incorrectly denies the application account.
B.The policy does not grant s3:ListBucket permission, so the application cannot list objects.
C.The object being accessed does not have the tag 'classification=public'.
D.The Deny statement blocks all access from accounts other than 123456789012, but the application is in that account.
AnswerC

Without the tag, the Allow condition fails, leading to implicit deny.

Why this answer

The Allow statement grants s3:GetObject only when the request has a condition that the object tag 'classification' equals 'public' (using StringEquals). If the object being accessed does not have this tag, the Allow condition is not satisfied, and the request is implicitly denied. The Deny statement does not apply because it only denies when the source account is NOT 123456789012, and the request does come from that account.

Thus, the most likely cause is that the object's tag does not match 'classification=public'.

Full explanation →
637
MCQmedium

A company uses AWS Glue to process streaming data from Amazon Kinesis Data Streams. The job reads JSON records and writes Parquet to Amazon S3. Recently, the job started failing with 'Out of Memory' errors. Which change is MOST likely to resolve the issue?

A.Enable compression on the Kinesis stream.
B.Change the output format from Parquet to ORC.
C.Increase the number of DPUs allocated to the Glue job.
D.Reduce the streaming batch size in the Glue job configuration.
AnswerC

More DPUs provide more memory and CPU.

Why this answer

The 'Out of Memory' error in AWS Glue indicates that the job's allocated resources are insufficient for the data volume or processing complexity. Increasing the number of DPUs (Data Processing Units) directly increases the available memory and compute capacity, which is the most straightforward fix for OOM errors in Glue streaming jobs. Option C is correct because it addresses the root cause—resource exhaustion—by scaling the job horizontally.

Exam trap

The trap here is that candidates often confuse 'Out of Memory' with a data format or compression issue, leading them to choose options like A or B, when the real solution is to scale compute resources via DPUs.

How to eliminate wrong answers

Option A is wrong because enabling compression on the Kinesis stream reduces data transfer size but does not affect the memory footprint of the Glue job processing the data; the job still decompresses records into memory. Option B is wrong because changing the output format from Parquet to ORC does not reduce memory usage—both are columnar formats with similar memory profiles, and the error is not related to serialization efficiency. Option D is wrong because reducing the streaming batch size can help with latency but does not guarantee resolution of OOM errors; the job may still fail if individual records or transformations are memory-intensive, and the core issue is insufficient total memory allocation.

Full explanation →
638
MCQeasy

A company needs to ingest data from an on-premises Oracle database into Amazon S3 on a daily basis. The data volume is about 100 GB per day. Which AWS service is BEST suited for this task?

A.Use AWS DataSync to copy the database files to S3.
B.Use Amazon Kinesis Data Firehose with a database connector.
C.Use AWS Database Migration Service (DMS) to replicate data to S3.
D.Use AWS Glue to extract data from Oracle and write to S3.
AnswerC

DMS supports continuous replication from Oracle to S3.

Why this answer

AWS Database Migration Service (DMS) can continuously replicate data from Oracle to S3, and it supports full load and change data capture (CDC). Option A (AWS DataSync) is for file-based transfers, not database replication. Option B (Amazon Kinesis Data Firehose) is for streaming data, not database pull.

Option D (AWS Glue) is for ETL but does not natively support continuous CDC from Oracle.

Full explanation →
639
MCQmedium

Refer to the exhibit. An IAM policy is attached to an EC2 instance role that runs a data ingestion application. The application reads files from an S3 bucket 'data-lake-primary' and sends records to a Kinesis stream named 'clickstream'. The application is failing with an 'AccessDenied' error when trying to read from S3. What is the MOST likely cause?

A.The actions are specified incorrectly; they should be s3:GetObject and s3:PutObject only.
B.The policy is not attached to the EC2 instance role.
C.The Kinesis stream name is incorrect.
D.The policy does not include the s3:ListBucket permission.
AnswerD

Reading objects often requires ListBucket permission for the bucket.

Why this answer

The application reads files from an S3 bucket, which requires both s3:GetObject (to read the object) and s3:ListBucket (to list objects in the bucket, typically needed for operations like listing or navigating the bucket). Without s3:ListBucket, the SDK may fail with an AccessDenied error when it tries to enumerate objects or validate the bucket path, even if s3:GetObject is present. Option D correctly identifies this missing permission as the most likely cause.

Exam trap

The DEA-C01 exam often tests the misconception that only s3:GetObject is needed for reading from S3, ignoring that many SDK operations require s3:ListBucket for discovery or navigation, leading candidates to overlook this permission.

How to eliminate wrong answers

Option A is wrong because the actions are not specified incorrectly; s3:GetObject is correct for reading objects, and s3:PutObject is not needed for reading. Option B is wrong because the question states the policy is attached to the EC2 instance role, so the issue is not about attachment but about missing permissions. Option C is wrong because the error is 'AccessDenied' when trying to read from S3, not from Kinesis, so an incorrect Kinesis stream name would cause a different error (e.g., ResourceNotFoundException) or a different access denied error on the Kinesis side.

Full explanation →
640
MCQeasy

A company uses AWS Glue to process CSV files from an S3 bucket. The job fails intermittently with a 'SchemaDetectionError' for files that have inconsistent column counts. What is the most efficient way to handle this?

A.Use the 'mergeSchema' option when reading the DynamicFrame.
B.Convert all CSV files to Parquet format using a separate preprocessing job.
C.Define a fixed schema in the Glue job using 'apply_mapping' to map columns.
D.Set the job to 'ignore' schema mismatches in the job parameters.
AnswerC

Correct. Defining a fixed schema and using `apply_mapping` to map columns effectively handles inconsistent column counts by ensuring a consistent schema is applied to all files.

Why this answer

Defining a fixed schema using the `schema` parameter in the DynamicFrame reader forces Glue to apply that schema to all CSV files. With `apply_mapping`, you can map the actual columns present to the fixed schema, handling inconsistent column counts by ignoring extra columns and filling missing columns with nulls. This avoids schema detection errors without extra preprocessing.

Exam trap

The trap is assuming `mergeSchema` works for CSV files. In AWS Glue, `mergeSchema` is only supported for Parquet/ORC formats. For CSV, you must define a fixed schema and use `apply_mapping` to handle inconsistencies.

How to eliminate wrong answers

Option B is wrong because converting to Parquet does not inherently solve schema inconsistency; Parquet also requires a consistent schema across files unless mergeSchema is explicitly enabled, and adding a preprocessing job is less efficient than handling it inline. Option C is wrong because 'apply_mapping' only remaps existing columns after the schema is resolved; it does not handle files with missing or extra columns that cause the initial schema detection to fail. Option D is wrong because AWS Glue does not have a job parameter to 'ignore' schema mismatches; the error occurs during schema detection, and ignoring it would lead to data corruption or job failure.

Full explanation →
641
Multi-Selectmedium

A data engineering team is designing a data lake on Amazon S3 for storing sensor data from IoT devices. The data is written in near real-time and needs to be queried using Amazon Athena. Which TWO configurations should the team implement to optimize query performance and minimize costs?

Select 2 answers
A.Compress the data using GZIP.
B.Use S3 Standard-IA storage class.
C.Store the data in Apache Parquet format.
D.Partition the data by date and sensor ID.
E.Enable Requester Pays on the S3 bucket.
AnswersC, D

Parquet is columnar and reduces scan size.

Why this answer

Apache Parquet is a columnar storage format that allows Athena to read only the columns needed for a query, drastically reducing I/O and scan costs. Combined with compression (like Snappy or GZIP), Parquet minimizes the amount of data scanned per query, which directly lowers Athena's cost (charged per TB scanned) and improves query performance through predicate pushdown and efficient encoding.

Exam trap

AWS often tests the misconception that any compression (like GZIP alone) is sufficient for Athena optimization, but the trap is that without a columnar format like Parquet or ORC, compression alone does not enable column pruning or predicate pushdown, leading to higher scan costs and slower queries.

Full explanation →
642
MCQhard

A company uses Kinesis Data Streams to ingest clickstream data. They notice that the data processing latency increases as the number of shards grows. What is the most likely cause and solution?

A.Reduce the number of shards or increase the number of consumers.
B.Increase the Kinesis Producer Library (KPL) batch size.
C.Use enhanced fan-out to allow multiple consumers per shard.
D.Increase the number of shards to handle more data.
AnswerA

Balancing shards and consumers ensures each shard is processed, reducing latency.

Why this answer

As the number of shards increases, the total throughput of the stream increases, but each shard has a fixed limit of 5 read transactions per second. If the number of consumers remains constant, each consumer must poll more shards sequentially, increasing the per-record processing latency. Reducing the number of shards or adding more consumers distributes the polling load, reducing the time each consumer spends waiting for shard-level throttling.

Exam trap

The trap here is that candidates often assume more shards always improve performance, but the DEA-C01 exam tests the understanding that read-side latency scales inversely with the number of consumers relative to shards, not with shard count alone.

How to eliminate wrong answers

Option B is wrong because increasing the KPL batch size only affects the write side (producer throughput), not the read-side latency caused by too many shards per consumer. Option C is wrong because enhanced fan-out provides dedicated 2 MB/second read throughput per consumer per shard, but it does not reduce the latency introduced by a single consumer having to poll many shards sequentially; it only helps when multiple consumers need to read the same shard concurrently. Option D is wrong because increasing the number of shards would worsen the problem by forcing each consumer to poll even more shards, further increasing latency.

Full explanation →
643
Drag & Dropmedium

Order the steps to migrate an on-premises database to Amazon RDS using AWS DMS.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First, create the replication instance. Then configure endpoints, create the migration task, start it, and finally validate the migrated data.

Full explanation →
644
MCQmedium

A company stores sensitive customer data in an S3 bucket. The security team requires that all data be encrypted at rest using a customer-managed AWS KMS key. However, when a data engineer attempts to upload an object using the AWS CLI, the upload fails with an access denied error. The engineer has s3:PutObject permission on the bucket. Which additional permission is most likely missing?

A.kms:CreateKey
B.kms:Decrypt
C.s3:PutObjectAcl
D.kms:GenerateDataKey
AnswerD

Required to generate a data key for server-side encryption.

Why this answer

To upload an object with SSE-KMS, the IAM user or role must have kms:GenerateDataKey permission to generate a data key for encryption. Option D is correct because without it, the upload fails. Option A (kms:CreateKey) is for creating keys, not using them.

Option B (kms:Decrypt) is for decryption, not upload. Option C (s3:PutObjectAcl) is for ACLs, not encryption.

Full explanation →
645
Multi-Selectmedium

A company uses Amazon Kinesis Data Firehose to deliver streaming data to Amazon S3. The delivery stream is failing with 'Insufficient capacity' errors. Which THREE actions should the data engineer take to resolve this issue? (Choose THREE.)

Select 3 answers
A.Enable S3 bucket versioning to handle concurrent writes.
B.Increase the buffer size and buffer interval in the Firehose delivery stream configuration.
C.Configure a CloudWatch alarm to monitor the error rate.
D.Request a service quota increase for Kinesis Data Firehose.
E.Increase the number of shards in the source Kinesis data stream.
AnswersB, D, E

Larger buffers reduce the frequency of writes, lowering capacity needs.

Why this answer

Options B, D, and E are correct. B: Increasing buffer size and interval allows Firehose to batch more records before delivery, reducing the rate of PUT requests and alleviating temporary capacity issues. D: Requesting a service quota increase for Kinesis Data Firehose raises the default limits on data delivery throughput, directly addressing insufficient capacity errors caused by throttling.

E: Increasing the number of shards in the source Kinesis data stream provides higher write throughput to Firehose, reducing backpressure and 'Insufficient capacity' errors. Option A is incorrect because S3 bucket versioning handles object versioning, not write capacity or Firehose throughput. Option C is incorrect because CloudWatch alarms only monitor and alert, they do not resolve capacity issues.

Full explanation →
646
MCQeasy

An e-commerce application uses Amazon ElastiCache for Redis to cache product catalog data. The cache currently uses lazy loading. The team wants to ensure that frequently accessed product data is always fresh. Which caching strategy should they implement?

A.Write-through caching
B.Set a TTL of 5 minutes for all cached items
C.Use database read replicas to serve data
D.Lazy loading with TTL
AnswerA

Write-through updates cache directly on writes, ensuring data is always fresh.

Why this answer

Write-through caching ensures that data is written to the cache simultaneously with the database, guaranteeing that frequently accessed product data is always fresh. This strategy eliminates stale reads by synchronously updating the cache on every write, which directly addresses the requirement for freshness without relying on expiration or lazy population.

Exam trap

The trap here is that candidates often assume lazy loading with a short TTL is sufficient for freshness, but the exam tests the understanding that only write-through (or write-behind) strategies guarantee synchronous cache updates without relying on expiration windows.

How to eliminate wrong answers

Option B is wrong because setting a TTL of 5 minutes does not guarantee freshness; data can still become stale within the TTL window, and frequently accessed items may be served from the cache even after they have been updated in the database. Option C is wrong because database read replicas serve stale data asynchronously and do not cache product data in ElastiCache, failing to meet the caching freshness requirement. Option D is wrong because lazy loading with TTL still allows stale data to be served until the TTL expires or a cache miss triggers a refresh, which does not ensure that frequently accessed data is always fresh.

Full explanation →
647
MCQhard

A company uses AWS Glue to process JSON logs from S3. The logs have a nested structure and the schema evolves over time. The data engineer needs to ensure the Glue job can handle schema changes without failing. Which configuration should be used?

A.Manually update the table schema in the Glue Data Catalog before each run
B.Use Spark SQL with a static schema definition in the script
C.Set the job parameter '--enable-glue-datacatalog' and '--mergeDynamicColumns' to true
D.Enable AWS Glue Schema Registry and define a schema version
AnswerC

This allows Glue DynamicFrame to merge schema variations automatically.

Why this answer

Setting '--enable-glue-datacatalog' allows the Glue job to use the Data Catalog as the metastore, and '--mergeDynamicColumns' (or the equivalent '--enable-schema-evolution' in newer Glue versions) instructs the job to dynamically merge new columns from the evolving JSON schema into the existing table schema during runtime, preventing job failures due to schema mismatches. This is specifically designed for nested, schema-evolving data like JSON logs, as it automatically reconciles differences between the source data and the catalog definition.

Exam trap

The trap here is that candidates often confuse the AWS Glue Schema Registry (which enforces schema compatibility and versioning) with the schema evolution capabilities of the Glue DynamicFrame, leading them to choose Option D even though it would reject schema changes rather than adapt to them.

How to eliminate wrong answers

Option A is wrong because manually updating the table schema before each run is not scalable, error-prone, and defeats the purpose of automated schema evolution; it also introduces operational overhead and potential downtime. Option B is wrong because using Spark SQL with a static schema definition in the script will cause the job to fail when new fields appear in the JSON logs, as Spark's static schema cannot adapt to dynamic changes without manual code modifications. Option D is wrong because the AWS Glue Schema Registry is designed for schema validation and serialization/deserialization (e.g., Avro, Protobuf) to enforce compatibility rules, not for dynamically merging evolving schemas during ETL processing; it would reject records that don't conform to the registered schema version, causing job failures instead of handling changes gracefully.

Full explanation →
648
MCQmedium

A data engineer needs to ingest data from an on-premises Oracle database into Amazon S3 on a daily basis. The data volume is approximately 500 GB per day. The source database is behind a firewall that does not allow direct internet access. Which service should the engineer use to transfer the data securely?

A.AWS DataSync with a network path through AWS Direct Connect or VPN.
B.AWS Database Migration Service (AWS DMS) with ongoing replication from Oracle to S3.
C.Amazon S3 Transfer Acceleration with a public endpoint.
D.AWS Snowball Edge device for daily transfers.
AnswerA

DataSync is designed for scheduled transfers to S3.

Why this answer

AWS DataSync can transfer data from on-premises storage to AWS over a network path established through AWS Direct Connect or a VPN, which is necessary because the source database is behind a firewall that blocks direct internet access. DataSync automates the movement of large datasets (up to 500 GB daily) and integrates with Oracle databases via a supported agent, handling incremental transfers efficiently. This makes it the correct choice for secure, scheduled, and high-volume data ingestion into Amazon S3.

Exam trap

The trap here is that candidates may assume AWS DMS is the only tool for database-to-S3 transfers, overlooking that DataSync is purpose-built for scheduled, large-volume file transfers from on-premises systems behind firewalls, while DMS is optimized for ongoing replication and schema conversion, not daily bulk dumps.

How to eliminate wrong answers

Option B is wrong because AWS DMS with ongoing replication is designed for continuous change data capture (CDC) and database migration, not for daily bulk file transfers to S3; it would require a network path through Direct Connect or VPN anyway, and its S3 target is for full-load snapshots, not optimized for repeated 500 GB daily dumps. Option C is wrong because Amazon S3 Transfer Acceleration uses public internet endpoints and requires direct internet access, which the firewall blocks; it also does not handle the extraction from Oracle, only accelerates uploads to S3. Option D is wrong because AWS Snowball Edge is a physical device intended for offline, one-time or periodic large-scale data transfers (e.g., terabytes to petabytes), not for daily 500 GB transfers, as the logistics of shipping and processing a device each day would be impractical and violate the daily frequency requirement.

Full explanation →
649
MCQmedium

A company runs a SQL Server transactional database on Amazon RDS. They need to capture change data (inserts, updates, deletes) in near real-time and replicate them to an Amazon S3 data lake. Which AWS service is most suitable?

A.AWS Database Migration Service (DMS) with change data capture
B.AWS Glue DataBrew
C.Amazon Kinesis Data Streams with Kinesis Client Library
D.Amazon Redshift Spectrum
AnswerA

DMS supports ongoing replication with CDC and can write to S3.

Why this answer

AWS DMS with change data capture (CDC) is the most suitable service because it can continuously capture and replicate incremental changes (inserts, updates, deletes) from a SQL Server transactional database on Amazon RDS to an S3 data lake in near real-time. DMS uses native SQL Server transaction logs (e.g., MS-CDC or log-based replication) to read changes without impacting source performance, and it supports target S3 in formats like Parquet or CSV. This directly meets the requirement for near-real-time CDC replication to a data lake.

Exam trap

The trap here is that candidates may confuse Kinesis Data Streams as a general-purpose streaming solution for any real-time data, but it lacks native CDC capabilities for relational databases without additional custom code or connectors, making DMS the correct choice for database-to-S3 replication.

How to eliminate wrong answers

Option B is wrong because AWS Glue DataBrew is a visual data preparation tool for cleaning and normalizing data, not a service for capturing and replicating change data from a live database. Option C is wrong because Amazon Kinesis Data Streams is a real-time streaming service that requires custom producers and consumers (e.g., KCL) to ingest and process data, but it cannot natively capture CDC from a SQL Server database without additional middleware like Debezium or a custom application. Option D is wrong because Amazon Redshift Spectrum is a query engine that allows running SQL queries directly against data in S3, not a service for ingesting or replicating change data from a source database.

Full explanation →
650
MCQhard

A data engineer at a media company is managing an Amazon RDS for MySQL database that stores user profiles and preferences. The database has been running on a db.r5.large instance with 500 GB of General Purpose SSD (gp2) storage. Recently, the application team has noticed increased query latency during peak hours. Amazon CloudWatch metrics show that the ReadIOPS metric is consistently peaking at 5,000 IOPS, which is near the baseline performance of the gp2 volume (1,500 IOPS baseline for 500 GB, but with bursts up to 3,000 IOPS for short periods). The database is not CPU-bound, and memory utilization is moderate. The data engineer needs to resolve the I/O bottleneck with minimal cost increase. The company is open to changing the storage type or instance class, but wants to avoid over-provisioning. What should the data engineer do?

A.Change the storage type to General Purpose SSD (gp3) and set the provisioned IOPS to 5,000.
B.Enable Multi-AZ deployment to offload reads to the standby instance.
C.Change the storage type to Provisioned IOPS SSD (io1) and provision 5,000 IOPS.
D.Upgrade the instance to a db.r5.xlarge to get more memory and reduce I/O.
AnswerA

gp3 provides a baseline of 3,000 IOPS and can be scaled up to 5,000 at lower cost than io1.

Why this answer

Gp3 provides a baseline of 3,000 IOPS at no additional cost and allows provisioning additional IOPS independently. Setting provisioned IOPS to 5,000 gives the required performance without the burst limitations of gp2 and at a lower cost than io1. Option B is incorrect because Multi-AZ does not improve read IOPS; the standby is not used for reads.

Option C is incorrect because io1 would be more expensive than gp3 for the same IOPS. Option D is incorrect because upgrading the instance class adds memory and compute, which does not directly improve IOPS, and would increase cost unnecessarily.

Full explanation →
651
Multi-Selectmedium

Which TWO practices improve the performance of AWS Glue ETL jobs? (Choose two.)

Select 2 answers
A.Use pushdown predicates to filter data at the source
B.Increase the number of DPUs to the maximum allowed
C.Use the smallest possible file size for input data
D.Enable AWS Glue job metrics and debug logging
E.Use column pruning to select only required columns
AnswersA, E

Filters data early, reducing data scanned.

Why this answer

Pushdown predicates (Option A) improve AWS Glue ETL performance by filtering data at the source before it is read into the job. This reduces the volume of data transferred and processed, which is especially effective when using formats like Parquet or ORC that support predicate pushdown natively. By applying filters early, Glue avoids scanning unnecessary partitions or rows, leading to faster execution and lower costs.

Exam trap

The trap here is that candidates often confuse monitoring features (like enabling metrics and logging) with performance optimizations, or mistakenly believe that maximizing resources (DPUs) always improves speed, ignoring the overhead of small files and the benefits of early filtering and column selection.

Full explanation →
652
MCQhard

A company is using Amazon S3 to store sensitive customer data. The security team requires that all data be encrypted in transit and at rest. Additionally, they want to prevent any accidental public access. Which combination of actions should the data engineer take?

A.Enable default encryption with SSE-S3, enforce HTTPS only via bucket policy, and enable S3 Block Public Access.
B.Enable default encryption with SSE-KMS, allow both HTTP and HTTPS, and set bucket ACLs to private.
C.Use client-side encryption, enforce HTTPS via bucket policy, and enable S3 Block Public Access.
D.Enable default encryption with SSE-S3, allow HTTP and HTTPS, and use bucket ACLs to block public access.
AnswerA

SSE-S3 encrypts at rest, bucket policy enforces HTTPS, Block Public Access prevents public access.

Why this answer

Enabling default encryption with SSE-S3 ensures data is encrypted at rest automatically, enforcing HTTPS only via bucket policy ensures encryption in transit by rejecting HTTP requests, and enabling S3 Block Public Access prevents any accidental public exposure regardless of bucket policies or ACLs. This combination satisfies all security requirements: encryption in transit, encryption at rest, and prevention of public access.

Exam trap

The trap here is that candidates may think bucket ACLs or client-side encryption alone satisfy the requirements, but the exam tests that S3 Block Public Access is needed to fully prevent accidental public access and that HTTPS enforcement is mandatory for encryption in transit.

How to eliminate wrong answers

Option B is wrong because allowing both HTTP and HTTPS violates the encryption-in-transit requirement; HTTPS-only must be enforced. Option C is wrong because client-side encryption does not guarantee encryption at rest on the server side (the data may be decrypted before upload), and the security team requires encryption at rest managed by AWS. Option D is wrong because allowing HTTP and HTTPS fails encryption-in-transit, and bucket ACLs alone are insufficient to block all public access (e.g., bucket policies can still grant public access).

Full explanation →
653
MCQmedium

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The database experiences high write latency during peak hours. The application uses InnoDB tables. Which action would reduce write latency without changing the application code?

A.Enable storage autoscaling on the DB instance
B.Add a read replica to offload writes
C.Enable Multi-AZ on the DB instance
D.Increase the DB instance class size
AnswerD

A larger instance class provides more resources, improving write throughput.

Why this answer

Increasing the DB instance class size (Option D) provides more CPU and memory resources, which directly improves the database's ability to handle high write loads by reducing contention and speeding up InnoDB transaction processing. This action requires no application code changes and is the most direct way to address write latency caused by resource constraints.

Exam trap

The trap here is that candidates often confuse read replicas with write scaling, assuming they can offload writes, when in fact they only handle SELECT queries and do not reduce write latency on the primary.

How to eliminate wrong answers

Option A is wrong because storage autoscaling only increases storage capacity when space is low, which does not address write latency caused by CPU or memory bottlenecks. Option B is wrong because read replicas are designed to offload read traffic, not write operations; writes still go to the primary instance, so write latency remains unchanged. Option C is wrong because Multi-AZ deployment provides high availability and automatic failover, but it does not improve write performance; in fact, synchronous replication to the standby can slightly increase write latency.

Full explanation →
654
MCQeasy

A company uses AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that the KMS key can only be used from within the company's VPC. Which policy element should be added to the KMS key policy?

A.Set the Principal element to restrict access to the VPC.
B.Add a condition using aws:SourceIp to allow only IP addresses from the VPC.
C.Add a condition using aws:SourceVpc to allow only requests from the VPC.
D.Add a condition using kms:ViaService to allow only via VPC endpoints.
AnswerC

This condition restricts key usage to the specified VPC.

Why this answer

Using a condition with aws:SourceVpc restricts key usage to requests originating from a specific VPC. Option A is wrong because the Principal element specifies who can use the key, not where. Option B is wrong because aws:SourceIp is for IP addresses, not VPC.

Option D is wrong because kms:ViaService restricts usage to specific AWS services, not network location.

Full explanation →
655
Multi-Selecteasy

A data engineer is designing a data lake on Amazon S3 that must comply with GDPR. The engineer needs to ensure that individuals can request deletion of their personal data. Which THREE AWS services can be used together to automate the deletion of specific records?

Select 3 answers
A.AWS Lambda
B.AWS Glue
C.Amazon S3 Batch Operations
D.Amazon S3 Select
E.Amazon DynamoDB
AnswersA, C, D

Can process deletion logic.

Why this answer

AWS Lambda can be used to process deletion requests and trigger actions. Amazon S3 Batch Operations can perform bulk actions on S3 objects, such as deleting them. Amazon S3 Select can query specific records within S3 objects to identify which ones need deletion, enabling targeted removal.

Together, these services automate the deletion of specific records to comply with GDPR. AWS Glue is an ETL service, not designed for selective deletion, and Amazon DynamoDB is a NoSQL database, not directly applicable to S3 data.

Full explanation →
656
MCQhard

A company uses Amazon Kinesis Data Analytics for Apache Flink to process streaming data. The application reads from a Kinesis data stream, performs a 1-minute tumbling window aggregation, and writes results to an S3 bucket. Recently, the application started experiencing checkpoint failures and increasing processing delay. Which action should the engineer take FIRST to diagnose the issue?

A.Increase the parallelism of the Flink application.
B.Monitor CPU and memory utilization of the Flink application using Amazon CloudWatch metrics.
C.Switch to the Kinesis Client Library (KCL) for checkpointing.
D.Increase the checkpoint interval to reduce checkpoint frequency.
AnswerB

Checkpoint failures are often due to insufficient resources (CPU/memory). Monitoring CPU and memory utilization via CloudWatch metrics directly helps identify resource bottlenecks.

Why this answer

Checkpoint failures are often due to insufficient resources (CPU/memory) for the Flink job. Monitoring CPU and memory utilization via CloudWatch metrics directly helps identify resource bottlenecks. Option A (increasing parallelism) is a tuning step that might help but is not diagnostic.

Option C (switching to KCL) is not relevant for Flink checkpointing. Option D (increasing checkpoint interval) might reduce checkpoint frequency but does not address the root cause of checkpoint failures. The first step is to check resource utilization.

Full explanation →
657
MCQhard

A company has a multi-account strategy using AWS Organizations. The data engineering team needs to share a central S3 bucket across multiple accounts while maintaining fine-grained access control. Which solution should be used?

A.Use IAM roles in each account with cross-account access
B.Use Amazon CloudFront to serve the data
C.Use S3 access points with a policy per account
D.Create a bucket policy with principal ARNs for each account
AnswerC

Access points allow separate policies for each account.

Why this answer

S3 access points allow you to create separate access points for each account with their own policies, enabling fine-grained access control while sharing the same bucket. This integrates with AWS Organizations to simplify policy management. Option A is incorrect because cross-account IAM roles grant full access to the role's permissions and lack object-level granularity.

Option B is incorrect because CloudFront is a content delivery network, not an access control mechanism. Option D is incorrect because a bucket policy with principal ARNs for each account becomes difficult to manage as accounts scale, and it doesn't provide per-account fine-grained control like access points do.

Full explanation →
658
MCQmedium

A company uses Amazon EMR to process large datasets stored in Amazon S3. The data engineer notices that EMR tasks are failing with 'DiskOutOfSpace' errors. The cluster uses m5.xlarge instances with 1 EBS volume of 64 GB. What is the MOST cost-effective solution to resolve this issue?

A.Use a mix of on-demand and spot instances for core nodes.
B.Increase the EBS storage volume size for each instance and use spot instances for task nodes.
C.Switch to D2 instances which have more instance store volume.
D.Increase the number of task instances to distribute the workload.
AnswerB

More disk space solves the issue; spot instances reduce cost.

Why this answer

Increasing the EBS volume size provides additional disk space per instance, directly resolving the disk out-of-space error. Using spot instances for task nodes reduces cost. Option A is incorrect because mixing on-demand and spot instances does not increase per-instance disk space.

Option C is incorrect because switching to D2 instances is more expensive and may not be necessary. Option D is incorrect because adding more task instances distributes the workload but does not increase the disk space available to each instance, so individual tasks may still fail due to disk space.

Full explanation →
659
Multi-Selecthard

A company uses Amazon EMR to process sensitive data. The data engineer needs to ensure that data in transit between EMR and S3 is encrypted. Which THREE configurations achieve this? (Choose THREE.)

Select 3 answers
A.Enable S3 Block Public Access on the bucket
B.Configure EMRFS to use server-side encryption with S3 (SSE-S3) and require HTTPS
C.Enable SSE-KMS on the S3 bucket
D.Use SSE-C with HTTPS for S3 communication
E.Configure EMR to use VPC endpoints for S3 with a policy that enforces HTTPS
AnswersB, D, E

EMRFS can enforce HTTPS for data transfer.

Why this answer

To ensure encryption in transit between Amazon EMR and S3, you can use server-side encryption with customer-provided keys (SSE-C) with HTTPS (Option D), configure EMRFS to use server-side encryption with S3 (SSE-S3) and require HTTPS (Option B), or use VPC endpoints for S3 with a policy that enforces HTTPS (Option E). Option A (S3 Block Public Access) controls public access, not transit encryption. Option C (SSE-KMS) encrypts data at rest, not in transit.

Thus, correct answers are B, D, E.

Full explanation →
660
Multi-Selecthard

A company is ingesting real-time financial transactions into Amazon Kinesis Data Streams. The data is then consumed by a Kinesis Data Analytics for Apache Flink application that calculates running totals. The application is experiencing high latency and checkpoint failures. Which TWO steps should the engineer take to improve performance and reliability? (Select TWO.)

Select 2 answers
A.Enable enhanced fan-out for the Flink application.
B.Reduce the batch size of records processed per checkpoint.
C.Increase the number of shards in the Kinesis data stream.
D.Increase the number of KPUs (Kinesis Processing Units) for the Flink application.
E.Decrease the checkpoint interval to reduce state size.
AnswersC, D

More shards increase parallelism, reducing latency and improving throughput.

Why this answer

Options C and D are correct. Increasing the number of shards (C) increases the throughput and parallelism of the stream, reducing latency. Increasing KPUs (D) provides more compute resources for the Flink application, helping to prevent checkpoint failures.

Option A (enhanced fan-out) is designed for multiple consumers, not for a single Flink job. Option B (reducing batch size) may not improve overall throughput. Option E (decreasing checkpoint interval) could lead to more frequent checkpointing, increasing overhead and potentially causing more failures.

Full explanation →
661
Drag & Dropmedium

Arrange the steps to set up cross-region replication for an S3 bucket.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First, enable versioning on source and destination. Then create the destination bucket, add a replication rule, and assign an IAM role for replication.

Full explanation →
662
MCQmedium

A company uses Amazon S3 to store historical financial records. A compliance policy requires that all objects be encrypted with a customer-managed key stored in AWS KMS. The bucket is already configured with SSE-S3. What is the LEAST disruptive way to change the encryption to SSE-KMS?

A.Add a bucket policy to enforce SSE-KMS.
B.Update the bucket's default encryption settings to SSE-KMS.
C.Copy all objects to a new bucket that has default encryption set to SSE-KMS.
D.Use S3 Batch Operations to apply SSE-KMS to all existing objects.
AnswerC

Copying objects to a new bucket with SSE-KMS default encryption will re-encrypt them with the new key and is straightforward.

Why this answer

Changing the default encryption settings of an existing bucket (SSE-S3 to SSE-KMS) does not retroactively encrypt objects that were already stored with SSE-S3. Copying all objects to a new bucket that has default encryption set to SSE-KMS ensures every object is encrypted with a customer-managed key, as the copy operation re-encrypts each object using the new bucket's default settings. This approach is the least disruptive because it avoids modifying the original bucket's configuration or policies, which could break existing applications or access patterns.

Exam trap

The trap here is that candidates assume updating default encryption settings (Option B) will retroactively encrypt existing objects, but S3 default encryption only applies to new uploads, not to objects already stored with a different encryption method.

How to eliminate wrong answers

Option A is wrong because adding a bucket policy to enforce SSE-KMS only affects future uploads and does not change the encryption of existing objects, leaving them non-compliant. Option B is wrong because updating the bucket's default encryption settings to SSE-KMS only applies to new objects; existing objects remain encrypted with SSE-S3 and are not retroactively re-encrypted. Option D is wrong because S3 Batch Operations can apply SSE-KMS to existing objects, but this process is more disruptive than copying to a new bucket, as it requires careful management of permissions, potential downtime, and does not guarantee a clean separation of old and new encryption configurations.

Full explanation →
663
MCQhard

A media company uses Amazon Kinesis Data Firehose to ingest log data from web servers into Amazon S3. The data is then processed by AWS Glue jobs. The company wants to ensure that data is delivered to S3 within 5 minutes of ingestion. Currently, the Firehose delivery stream is configured with a buffer interval of 300 seconds and a buffer size of 5 MB. The log data arrives at a rate of 2 MB per second. The data engineer notices that some log files are delayed by up to 10 minutes. The company cannot change the buffer size due to downstream requirements. What should the data engineer do to meet the 5-minute delivery requirement?

A.Increase the buffer interval to 600 seconds to reduce the number of delivery attempts.
B.Increase the buffer size to 10 MB to ensure data is delivered in larger chunks.
C.Enable GZIP compression on the Firehose stream to reduce data size.
D.Decrease the buffer interval to 120 seconds.
AnswerD

Lower interval triggers delivery more often, reducing latency.

Why this answer

Decreasing the buffer interval to 120 seconds ensures that data is delivered to S3 within 2 minutes, meeting the 5-minute requirement. The current buffer interval of 300 seconds (5 minutes) is the primary cause of delays up to 10 minutes. Option A is incorrect because increasing the buffer interval would increase delay.

Option B is incorrect because increasing buffer size would also increase delay, as it takes longer to fill. Option C is incorrect because compression does not affect the buffer interval; data still waits up to 300 seconds.

Full explanation →
664
MCQmedium

A company wants to ingest streaming data from thousands of IoT devices into Amazon S3 with minimal latency and then transform the data using Spark SQL. Which AWS service should be used for data ingestion?

A.Amazon EMR
B.AWS Glue
C.Amazon Athena
D.Amazon Kinesis Data Firehose
AnswerD

Kinesis Data Firehose can ingest streaming data and deliver it to S3 with near-real-time latency.

Why this answer

Amazon Kinesis Data Firehose is the correct choice because it is a fully managed service designed for ingesting streaming data into Amazon S3 with near-real-time latency (typically 60 seconds or less). It can directly write data to S3 without requiring custom code or additional infrastructure, and it supports optional transformations via AWS Lambda, making it ideal for the described use case of streaming IoT data ingestion.

Exam trap

The trap here is confusing data ingestion services (Kinesis Data Firehose) with data processing or query services (EMR, Glue, Athena), leading candidates to pick EMR for its Spark SQL capability instead of recognizing that Firehose handles the ingestion step before transformation.

How to eliminate wrong answers

Option A is wrong because Amazon EMR is a big data processing service for running frameworks like Spark and Hadoop, not a streaming ingestion service; it would require additional setup (e.g., Kinesis or Kafka) to ingest data into S3. Option B is wrong because AWS Glue is a serverless ETL service primarily for batch data transformation and cataloging, not designed for real-time streaming ingestion into S3. Option C is wrong because Amazon Athena is an interactive query service for analyzing data in S3 using SQL, not an ingestion tool; it cannot ingest streaming data.

Full explanation →
665
MCQhard

A large e-commerce company uses Amazon DynamoDB to store shopping cart data. The table has a partition key of 'user_id' and a sort key of 'item_id'. The application performs frequent updates to the 'quantity' attribute for items in a user's cart. Recently, the operations team noticed that write requests are being throttled during peak shopping hours. The table is provisioned with 10,000 write capacity units (WCUs) and uses DynamoDB Accelerator (DAX) for read caching. The data engineer suspects that the throttling is due to hot partitions. The application uses a single AWS SDK client configured with retries. After reviewing the Amazon CloudWatch metrics, the engineer sees that the WriteThrottleEvents metric spikes for a few partition keys. The table has a high number of partitions. What should the data engineer do to resolve the throttling issue with minimal application changes?

A.Increase the provisioned write capacity to 20,000 WCUs permanently.
B.Enable DynamoDB Global Tables to distribute writes across regions.
C.Add more nodes to the DAX cluster to offload write traffic.
D.Configure DynamoDB Auto Scaling with a maximum WCU setting of 20,000 and a target utilization of 70%.
AnswerD

Auto Scaling dynamically adjusts capacity based on traffic, reducing throttling without permanent overprovisioning.

Why this answer

DynamoDB Auto Scaling can dynamically adjust write capacity in response to traffic patterns, reducing throttling on hot partitions without requiring application changes. Option A is incorrect because permanently increasing WCUs does not adapt to variable demand and may lead to over-provisioning. Option B (Global Tables) replicates data across regions but does not increase write capacity for a single table, so it does not resolve hot partition throttling.

Option C (DAX) is a read cache and does not offload write traffic; it only improves read performance.

Full explanation →
666
MCQhard

A company stores sensitive data in Amazon S3. The security team requires that all data be encrypted at rest and that the encryption keys be stored in AWS CloudHSM. Which S3 encryption option should be used?

A.SSE-S3
B.SSE-KMS with an AWS managed key
C.SSE-KMS with a customer managed key
D.SSE-C
AnswerD

SSE-C allows the customer to provide their own encryption keys, which can be stored and managed in CloudHSM.

Why this answer

SSE-C allows customers to provide their own encryption keys, which can be stored in CloudHSM. SSE-S3 and SSE-KMS use AWS-managed keys or KMS keys, not CloudHSM. Option D is correct.

Full explanation →
667
MCQeasy

Refer to the exhibit. An IAM policy includes this statement. What access does it grant?

A.It denies GetObject access to the bucket from IP addresses in 10.0.0.0/8
B.It allows GetObject access to the bucket only from a specific VPC
C.It allows PutObject access to the bucket from any IP address
D.It allows GetObject access to the bucket only from IP addresses in 10.0.0.0/8
AnswerD

The policy allows access from the specified IP range.

Why this answer

The policy statement allows the s3:GetObject action on the specified bucket, with a condition that the request must originate from an IP address within the 10.0.0.0/8 range. Therefore, it grants GetObject access only from IP addresses in that range. Option A is incorrect because the policy allows, not denies.

Option B is incorrect because the condition is based on IP address, not VPC. Option C is incorrect because the action is GetObject, not PutObject. Option D correctly describes the access granted.

Full explanation →
668
Multi-Selectmedium

Which THREE are best practices for managing data in Amazon S3 for a data lake? (Choose three.)

Select 3 answers
A.Enable S3 Versioning to protect against accidental deletions.
B.Configure lifecycle policies to transition data to colder storage tiers.
C.Enable S3 Snapshot for point-in-time recovery.
D.Disable S3 server access logging to reduce costs.
E.Use bucket policies to restrict access based on IAM roles.
AnswersA, B, E

Versioning provides data protection.

Why this answer

Enabling S3 Versioning is a best practice for data lakes because it protects against accidental deletions or overwrites by preserving all versions of an object, including deletions (which are recorded as delete markers). This allows you to recover previous object states and is essential for data governance and auditability in a data lake environment.

Exam trap

The trap here is that candidates may confuse S3 Versioning with a non-existent 'S3 Snapshot' feature, or mistakenly think disabling server access logging is a cost-saving best practice, when in fact it undermines security auditing.

Full explanation →
669
MCQhard

Refer to the exhibit. An S3 bucket policy allows the DataEngineerRole to get objects only if the request uses HTTPS. However, requests from this role are being denied even when using HTTPS. What is the MOST likely reason?

A.The IAM role does not have permission to use SSE-S3.
B.The condition key aws:SecureTransport is misspelled.
C.The bucket policy does not include a Deny statement for HTTP requests.
D.The IAM role's attached policy does not allow s3:GetObject on the bucket.
AnswerD

The bucket policy allows the role, but the role itself must also have an IAM policy that allows s3:GetObject.

Why this answer

Even though the bucket policy condition requires HTTPS, the IAM role must also have an IAM policy that explicitly allows s3:GetObject on the bucket. Without this, the request is denied regardless of the bucket policy. Option A is incorrect because SSE-S3 does not require explicit IAM permissions; it is a server-side encryption option that works by default.

Option B is incorrect because aws:SecureTransport is spelled correctly; misspelling would cause the condition to not apply, potentially allowing HTTP, but the issue is requests being denied. Option C is incorrect because the bucket policy uses a condition to require HTTPS, which effectively denies HTTP requests even without a separate Deny statement.

Full explanation →
670
Drag & Dropmedium

Arrange the steps to set up a streaming ETL pipeline using Amazon Kinesis Data Firehose to Amazon S3.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First, create the Firehose stream, configure source, set S3 destination, enable optional Lambda transformation, and test.

Full explanation →
671
MCQmedium

A company is using Amazon RDS for MySQL with Multi-AZ deployment. They notice that during a recent failover test, the application experienced a brief write outage. The application uses a connection string that points to the RDS instance endpoint. What is the MOST likely cause of the write outage?

A.The application is using a read replica endpoint, which does not support write operations.
B.The application is using the RDS instance endpoint instead of the cluster endpoint, so it does not automatically route to the standby after failover.
C.The application is connecting through a Network Load Balancer, which is not configured for cross-zone failover.
D.The application connection pool is exhausted because the failover caused all existing connections to drop simultaneously.
AnswerB

The instance endpoint is static and remains pointed to the original primary; after failover, the application must reconnect to the new primary using the CNAME which takes time to update.

Why this answer

In a Multi-AZ RDS deployment, the instance endpoint always points to the current primary instance. During a failover, the DNS record for the instance endpoint is updated to point to the new primary, but existing connections to the old primary are dropped, and the DNS change can take time to propagate. The application's connection string using the instance endpoint means it does not automatically route to the standby during the failover transition, causing a brief write outage until the DNS update completes and the application reconnects.

In contrast, using a cluster endpoint (available for Aurora, not standard RDS) or implementing retry logic in the application would mitigate this.

Exam trap

The trap here is that candidates often confuse the RDS instance endpoint with the cluster endpoint used in Amazon Aurora, assuming that Multi-AZ automatically provides a seamless, zero-downtime failover for writes, when in fact the instance endpoint requires DNS propagation and connection re-establishment.

How to eliminate wrong answers

Option A is wrong because a read replica endpoint is used for read-only traffic; while it does not support writes, the scenario describes a write outage during failover, not a persistent inability to write, and the application is using the instance endpoint, not a read replica endpoint. Option C is wrong because a Network Load Balancer is not a standard component in an RDS Multi-AZ architecture; RDS handles failover internally via DNS, and NLB is not involved in routing to RDS instances. Option D is wrong because while failover does cause existing connections to drop, connection pool exhaustion is a symptom of poor application retry logic, not the root cause of the write outage; the primary issue is the DNS propagation delay and the application's use of the instance endpoint.

Full explanation →
672
MCQhard

A data streaming application uses Kinesis Data Streams with 10 shards. The data producer is throttled frequently. Which action should be taken to resolve this issue?

A.Decrease the data retention period
B.Use enhanced fan-out for consumers
C.Enable server-side encryption
D.Increase the number of shards
AnswerD

Each shard provides 1 MB/s write capacity, so more shards increase capacity.

Why this answer

Throttling in Kinesis Data Streams occurs when the write throughput exceeds the shard limits. Each shard supports up to 1 MB/s or 1,000 records/s for writes. With 10 shards, the total write capacity is 10 MB/s or 10,000 records/s.

Increasing the number of shards (Option D) directly increases the write capacity, resolving the throttling issue by distributing the load across more shards.

Exam trap

The trap here is that candidates confuse consumer-side features (like enhanced fan-out or retention period) with producer-side capacity issues, leading them to pick options that do not address the root cause of write throttling.

How to eliminate wrong answers

Option A is wrong because decreasing the data retention period (default 24 hours, up to 365 days) does not affect write throughput or throttling; it only controls how long records are stored. Option B is wrong because enhanced fan-out is a consumer-side feature that provides dedicated read throughput (2 MB/s per consumer per shard) and does not address producer-side write throttling. Option C is wrong because enabling server-side encryption (SSE-S3 or SSE-KMS) secures data at rest but has no impact on write throughput or throttling.

Full explanation →
673
MCQhard

Refer to the exhibit. A data engineer has attached this bucket policy to an S3 bucket. What is the effect of this policy?

A.It enforces server-side encryption for all objects written to the bucket.
B.It allows the DataLakeRole to read and write objects, but only over HTTPS.
C.It allows anonymous access to the bucket for HTTPS requests.
D.It denies all access to the bucket except for requests from the DataLakeRole.
AnswerB

The allow statement grants GetObject and PutObject to the role; the deny statement blocks non-HTTPS requests for everyone.

Why this answer

The bucket policy uses a condition key `aws:SecureTransport` set to `true`, which restricts access to HTTPS (TLS) connections only. The `Principal` is `DataLakeRole`, and the `Action` includes `s3:GetObject` and `s3:PutObject`, so the policy allows that role to read and write objects exclusively over HTTPS, enforcing encrypted data in transit.

Exam trap

AWS often tests the distinction between encryption in transit (HTTPS/TLS) and encryption at rest (SSE), leading candidates to confuse the `aws:SecureTransport` condition with server-side encryption requirements.

How to eliminate wrong answers

Option A is wrong because the policy does not reference `s3:x-amz-server-side-encryption` or any condition enforcing server-side encryption (SSE) at rest; it only enforces encryption in transit via `aws:SecureTransport`. Option C is wrong because the `Principal` is explicitly set to `DataLakeRole` (an IAM role ARN), not `"*"` or `{"AWS": "*"}`, so anonymous access is not granted. Option D is wrong because the policy includes an `Allow` effect for `DataLakeRole` under the HTTPS condition, but it does not contain a `Deny` statement for other principals or conditions; without an explicit `Deny`, other access may still be allowed by other policies (e.g., bucket ACLs or IAM policies), so it does not deny all other access.

Full explanation →
674
Multi-Selecthard

A company wants to implement least privilege access for its data lake on S3. Which THREE practices should be followed? (Choose THREE.)

Select 3 answers
A.Grant s3:* to all users for simplicity
B.Use S3 bucket policies for cross-account access
C.Use S3 access points to enforce network policies
D.Disable S3 Block Public Access to allow flexibility
E.Use IAM policies to grant specific permissions to users and roles
AnswersB, C, E

Bucket policies are appropriate for cross-account.

Why this answer

The correct answers are B, C, and E. To implement least privilege for an S3 data lake, use S3 bucket policies for cross-account access (B), use S3 access points to enforce network policies (C), and use IAM policies to grant specific permissions (E). Option A is incorrect because granting s3:* to all users violates least privilege.

Option D is incorrect because disabling S3 Block Public Access increases risk; it should be enabled.

Full explanation →
675
MCQeasy

A company uses Amazon S3 to store sensitive data. The security team requires that all data be encrypted at rest using a customer-managed key that is rotated annually. Which encryption option should be used?

A.SSE-KMS (Server-Side Encryption with AWS KMS).
B.SSE-S3 (Server-Side Encryption with S3-managed keys).
C.Client-side encryption.
D.SSE-C (Server-Side Encryption with Customer-Provided keys).
AnswerA

Allows customer-managed KMS key with annual rotation.

Why this answer

SSE-KMS is the correct choice because it allows you to use a customer-managed key (CMK) in AWS KMS, which you can configure to rotate automatically on an annual schedule. This satisfies the security team's requirement for encryption at rest with a key you control and rotate yearly, while still leveraging server-side encryption that integrates with S3's existing infrastructure.

Exam trap

The trap here is that candidates often confuse SSE-C with customer-managed keys, but SSE-C requires you to supply the key on every operation and does not support AWS-managed rotation, making it unsuitable for the 'rotated annually' requirement.

How to eliminate wrong answers

Option B (SSE-S3) is wrong because it uses S3-managed keys that are automatically rotated by AWS, not customer-managed keys, so you cannot control the rotation schedule or manage the key yourself. Option C (Client-side encryption) is wrong because it encrypts data before it reaches S3, which does not meet the requirement for server-side encryption at rest managed by AWS; it also places the key management burden entirely on the client, not the customer-managed key service. Option D (SSE-C) is wrong because it requires you to provide your own encryption key with each request, and AWS does not manage or rotate the key—you must handle key storage and rotation entirely outside of AWS, which contradicts the requirement for a customer-managed key that is rotated annually within AWS.

Full explanation →
Page 8

Page 9 of 23

Page 10

All pages

1234567891011121314151617181920212223

Practice DEA-C01 by domain

Target a specific domain to shore up weak areas.

Data Ingestion and TransformationData Operations and SupportData Security and GovernanceData Store Management
See all domains with question counts →