Courseiva

CCNA Data Store Management Questions

75 of 442 questions · Page 4/6 · Data Store Management · Answers revealed

226
MCQhard

A company runs a MySQL-compatible Amazon Aurora database for its e-commerce platform. The database experiences high write latency during peak hours. The application performs frequent INSERT and UPDATE operations on a table with 50 million rows. The DB instance is db.r5.large with 500 GB of Provisioned IOPS storage. A recent performance analysis shows that the average queue depth is consistently above 32 and write latency exceeds 50 ms. The company needs to reduce write latency without changing the application code. What should a data engineer do?

A.Enable Aurora Auto Scaling to automatically add reader instances.
B.Convert the cluster to Aurora Serverless v2 to automatically scale compute capacity.
C.Resize the DB instance to a larger instance type such as db.r5.xlarge.
D.Create a read replica and configure the application to offload read queries.
AnswerC

Increasing instance size provides more CPU and memory, reducing queue depth and write latency.

Why this answer

The high queue depth (consistently above 32) and write latency exceeding 50 ms indicate that the current db.r5.large instance is CPU or I/O constrained for the write workload. Resizing to a larger instance type such as db.r5.xlarge increases the available vCPUs, memory, and network bandwidth, which directly reduces queue depth and write latency by allowing more concurrent write operations to be processed. This solution does not require application code changes and addresses the root cause of insufficient compute capacity for the frequent INSERT and UPDATE operations on the 50-million-row table.

Exam trap

The trap here is that candidates confuse read scaling solutions (Auto Scaling, read replicas) with write performance improvements, or assume that Aurora Serverless v2 automatically solves all performance issues without considering that write latency is often tied to instance size and storage configuration.

How to eliminate wrong answers

Option A is wrong because Aurora Auto Scaling adds reader instances to handle read traffic, not write traffic; write operations are always handled by the writer instance, so adding readers does not reduce write latency. Option B is wrong because converting to Aurora Serverless v2 changes the scaling model but does not guarantee lower write latency; it may even introduce cold start delays or scaling cooldown periods that could worsen latency during peak hours, and it does not directly address the queue depth issue caused by insufficient instance resources. Option D is wrong because creating a read replica and offloading read queries does not affect write latency; write operations still go to the writer instance, which remains the bottleneck.

227
Multi-Selectmedium

A company is using Amazon S3 to store sensitive financial data. They need to ensure that all objects are encrypted at rest. Which TWO methods can achieve this? (Choose TWO.)

Select 2 answers
A.Enable S3 Transfer Acceleration on the bucket.
B.Apply a bucket policy that denies PutObject without encryption.
C.Use SSE-KMS to encrypt objects with AWS KMS.
D.Use client-side encryption before uploading objects.
E.Enable default encryption on the S3 bucket using SSE-S3.
AnswersC, E

SSE-KMS provides server-side encryption with customer-managed keys.

Why this answer

SSE-KMS (Server-Side Encryption with AWS Key Management Service) allows you to encrypt objects at rest in S3 using customer-managed or AWS-managed KMS keys. This provides envelope encryption, separate key management, and audit trails via AWS CloudTrail, meeting compliance requirements for sensitive financial data.

Exam trap

The trap here is that candidates might think client-side encryption (Option D) is not a valid method for encryption at rest, or they might confuse S3 Transfer Acceleration (Option A) with encryption, or believe that a bucket policy (Option B) alone encrypts objects rather than just enforcing encryption requirements.

228
MCQhard

A company is building a real-time analytics dashboard using Amazon Kinesis Data Streams and Amazon DynamoDB. The data engineer needs to ensure that the DynamoDB table can handle write spikes without throttling. Which approach is the most cost-effective?

A.Use DynamoDB Accelerator (DAX) to cache writes.
B.Use provisioned capacity with auto-scaling set to a maximum of 10,000 WCU.
C.Use an Amazon Lambda function to buffer writes and batch them to DynamoDB.
D.Use DynamoDB on-demand capacity mode.
AnswerD

On-demand scales instantly and is cost-effective for unpredictable workloads.

Why this answer

DynamoDB on-demand capacity mode automatically scales to handle write spikes without requiring capacity planning or management, making it the most cost-effective choice for unpredictable workloads like a real-time analytics dashboard. It charges per request, so you only pay for the writes you actually use, avoiding over-provisioning costs.

Exam trap

The trap here is that candidates often confuse DAX's read caching with write handling, or assume that auto-scaling provisioned capacity can handle sudden spikes instantly, when in reality it scales gradually and can still throttle during rapid bursts.

How to eliminate wrong answers

Option A is wrong because DAX is an in-memory cache for reads, not writes; it does not prevent write throttling. Option B is wrong because provisioned capacity with auto-scaling can still throttle during sudden spikes due to the lag in scaling up, and setting a maximum of 10,000 WCU may be insufficient or wasteful. Option C is wrong because using Lambda to buffer writes adds latency and complexity, and while it can batch writes, it does not eliminate the risk of throttling if the batch rate exceeds the table's capacity.

229
MCQeasy

A data engineer needs to store time-series sensor data from thousands of IoT devices. The data is written once, read frequently for the last 24 hours, and rarely accessed after 30 days. Which storage solution is MOST cost-effective?

A.Amazon Redshift with automatic compression and distribution keys.
B.Amazon DynamoDB with TTL to expire data after 30 days.
C.Amazon Timestream with a 30-day retention policy.
D.Amazon S3 with lifecycle policies to transition to S3 Glacier after 30 days.
AnswerC

Timestream is designed for time-series data, with cost-effective tiered storage and built-in analytics.

Why this answer

Amazon Timestream is purpose-built for time-series data, offering automatic storage tiering where recent data resides in memory for fast queries and historical data is moved to a cost-optimized magnetic store. A 30-day retention policy aligns perfectly with the requirement to keep data accessible for frequent reads over the last 24 hours while automatically expiring older data, minimizing storage costs without manual intervention.

Exam trap

The trap here is that candidates often choose Amazon S3 with lifecycle policies (Option D) because they associate S3 with cost-effective storage, but they overlook the requirement for frequent reads of recent data, which S3 cannot serve with low latency without additional caching layers, and they miss that Timestream is the only AWS service natively designed for time-series data with automatic tiering and retention.

How to eliminate wrong answers

Option A is wrong because Amazon Redshift is a columnar data warehouse optimized for complex analytical queries on structured data, not for high-frequency time-series ingestion from thousands of IoT devices; its cost and overhead are excessive for simple sensor data storage. Option B is wrong because Amazon DynamoDB with TTL is designed for key-value and document workloads, not for time-series queries like range scans over the last 24 hours; TTL only deletes expired items but does not provide efficient time-based querying or automatic tiering, leading to higher read costs and complexity. Option D is wrong because Amazon S3 with lifecycle policies to transition to S3 Glacier after 30 days is cost-effective for archival but does not support low-latency frequent reads for the last 24 hours without additional services like S3 Select or Athena, and S3 is not optimized for high-write, time-ordered data ingestion from IoT devices.

230
MCQeasy

The exhibit shows the output of describe-table for a DynamoDB table. The application is experiencing throttling errors when reading data. What is the MOST likely cause?

A.The sort key is not used correctly for queries.
B.The table has a hot partition due to the HASH key.
C.The table size is too large, causing slow reads.
D.The table's provisioned read capacity is too low.
AnswerD

5 RCUs is very low; if the application reads more than 5 RCUs, throttling occurs.

Why this answer

The describe-table output shows the table has provisioned read capacity set to 5, but the application is experiencing throttling errors. Throttling occurs when read requests exceed the provisioned read capacity units (RCUs). Increasing the read capacity or implementing retries with exponential backoff would resolve this.

The throttling is directly caused by insufficient provisioned read capacity for the workload.

Exam trap

The trap here is that candidates may confuse throttling with performance issues like hot partitions or inefficient queries, but the describe-table output directly shows low provisioned read capacity, making insufficient capacity the most likely cause.

How to eliminate wrong answers

Option A is wrong because the sort key not being used correctly would cause inefficient queries (e.g., full table scans) but not necessarily throttling; throttling is a capacity issue, not a query pattern issue. Option B is wrong because a hot partition due to the HASH key would cause throttling on specific partitions, but the question states the application is experiencing throttling errors when reading data generally, not just on a single partition; the describe-table output does not indicate a hot partition. Option C is wrong because table size does not directly cause throttling; DynamoDB can handle large tables efficiently with proper partitioning, and throttling is based on provisioned capacity, not storage size.

231
MCQmedium

A data engineer needs to migrate an on-premises PostgreSQL database to Amazon RDS for PostgreSQL. The database is 2 TB and has a continuous stream of write operations. The migration should minimize downtime. Which AWS service should be used?

A.AWS DataSync
B.AWS Database Migration Service (DMS)
C.AWS Snowball Edge
D.AWS Glue
AnswerB

DMS supports ongoing replication and minimal downtime for database migrations.

Why this answer

AWS Database Migration Service (DMS) is the correct choice because it supports ongoing replication (change data capture) from an on-premises PostgreSQL source to Amazon RDS for PostgreSQL, enabling a near-zero downtime migration. DMS can handle the 2 TB dataset and continuous write stream by performing a full load followed by continuous replication of changes until the cutover. Other services lack the ability to perform live, transactional replication with minimal interruption.

Exam trap

The trap here is that candidates often choose AWS DataSync (Option A) because they confuse it with a database migration tool, but DataSync cannot replicate live transactional changes and is meant for file or object storage, not relational databases with ongoing writes.

How to eliminate wrong answers

Option A is wrong because AWS DataSync is designed for one-time or periodic bulk data transfers between on-premises storage and AWS, not for continuous database replication or minimizing downtime during a live database migration. Option C is wrong because AWS Snowball Edge is a physical device for offline data transfer, which would require stopping writes to the database to export the data, causing significant downtime and not supporting ongoing replication. Option D is wrong because AWS Glue is a serverless data integration service for ETL (extract, transform, load) jobs, not a database migration tool; it cannot perform live replication or handle continuous write streams from a source database.

232
MCQmedium

A company is using Amazon S3 to store sensitive data. To meet compliance requirements, they need to automatically transition objects to S3 Glacier Deep Archive after 90 days and delete them after 7 years. What is the MOST cost-effective way to configure this?

A.Configure an S3 Lifecycle policy to transition objects to Glacier Deep Archive after 90 days and expire them after 7 years.
B.Manually move objects to Glacier Deep Archive and delete them using a script.
C.Use S3 Intelligent-Tiering to automatically move objects to Glacier Deep Archive and set expiration.
D.Enable S3 Object Lock with a retention period of 7 years and use a lifecycle policy to transition to Glacier Deep Archive.
AnswerA

Lifecycle policies provide automated transitions and expirations based on object age.

Why this answer

An S3 Lifecycle policy can automate both the transition of objects to S3 Glacier Deep Archive after 90 days and their expiration (permanent deletion) after 7 years. This is the most cost-effective approach as it eliminates manual effort and leverages S3's native, serverless lifecycle management, which incurs no additional cost beyond the storage and transition fees.

Exam trap

The trap here is that candidates may confuse S3 Intelligent-Tiering with lifecycle policies, not realizing that Intelligent-Tiering does not support Glacier Deep Archive transitions, or they may overcomplicate the solution by adding Object Lock when a simple lifecycle policy suffices.

How to eliminate wrong answers

Option B is wrong because manually moving objects and deleting them via a script is not cost-effective due to ongoing operational overhead, risk of human error, and lack of automation for compliance; it also does not scale. Option C is wrong because S3 Intelligent-Tiering does not support automatic movement to Glacier Deep Archive; it only moves data between Frequent Access, Infrequent Access, and Archive Instant Retrieval tiers, not to Glacier Deep Archive. Option D is wrong because S3 Object Lock is used for write-once-read-many (WORM) compliance and preventing object deletion or overwrites, not for automating transitions or expirations; combining it with a lifecycle policy adds unnecessary complexity and cost without providing any benefit for the stated requirements.

233
MCQmedium

Refer to the exhibit. A data engineer is troubleshooting write throttling on the Orders table. The table has a composite primary key (OrderID as partition key, CustomerID as sort key). The engineer notices that writes are throttled even though the write capacity is not fully utilized. What is the most likely cause?

A.The table is empty and has no items.
B.A global secondary index (GSI) is consuming write capacity.
C.The read capacity units are too low.
D.Writes are concentrated on a single partition key value.
AnswerD

Hot partition causes throttling even if total capacity is not exceeded.

Why this answer

D is correct because write throttling on an Amazon DynamoDB table occurs when requests exceed the provisioned throughput for a specific partition, even if the overall table write capacity is underutilized. With a composite primary key where OrderID is the partition key, writes concentrated on a single OrderID value (e.g., a hot key) will hit that partition's 3,000 WCU or 1,000 WCU (on-demand) limit, causing throttling while other partitions remain idle.

Exam trap

AWS often tests the misconception that overall table capacity utilization is the sole indicator of throttling, but the trap here is that throttling can occur at the partition level due to hot keys, even when the table's total write capacity is underutilized.

How to eliminate wrong answers

Option A is wrong because an empty table does not cause write throttling; throttling is based on capacity consumption, not table size. Option B is wrong because a global secondary index (GSI) consumes write capacity from its own provisioned throughput, not from the base table's write capacity, and the question states the write capacity is not fully utilized. Option C is wrong because read capacity units are independent of write operations; low RCU would throttle reads, not writes.

234
Multi-Selecthard

A company runs an Amazon RDS for PostgreSQL instance for an OLTP application. The database size is 500 GB. The company wants to minimize downtime during backups and ensure point-in-time recovery (PITR) for the last 7 days. Which TWO features should the company use? (Choose TWO.)

Select 2 answers
A.Enable Multi-AZ deployment for high availability.
B.Create a read replica in a different Availability Zone.
C.Enable automated backups with a retention period of 7 days.
D.Create daily manual snapshots and copy them to another region.
E.Enable Enhanced Monitoring to track backup progress.
AnswersA, C

Multi-AZ reduces downtime during automated backups by taking backups from the standby.

Why this answer

Multi-AZ deployment for Amazon RDS provides high availability by automatically provisioning and maintaining a synchronous standby replica in a different Availability Zone. This minimizes downtime during backups by allowing automated backups to be taken from the standby instance, eliminating I/O suspension on the primary. Option C is correct because enabling automated backups with a retention period of 7 days enables point-in-time recovery (PITR) within that window, restoring the database to any second within the retention period using transaction logs.

Exam trap

The trap here is that candidates often confuse read replicas or manual snapshots with backup and recovery features, failing to recognize that only automated backups with a retention period enable point-in-time recovery, and that Multi-AZ is required to minimize downtime during backups by offloading them to the standby instance.

235
MCQmedium

A company stores sensitive data in an Amazon S3 bucket. A compliance requirement mandates that all data must be encrypted at rest with a key that is automatically rotated every year. The company also needs to maintain an audit trail of who used the key. Which solution meets these requirements?

A.Use AWS KMS customer managed keys (SSE-KMS) with automatic key rotation enabled.
B.Use customer-provided encryption keys (SSE-C) and rotate keys manually.
C.Use S3 managed keys (SSE-S3) and enable S3 server access logs.
D.Configure a bucket policy to enforce encryption using the 'aws:SecureTransport' condition.
AnswerA

KMS customer managed keys support automatic annual rotation and CloudTrail auditing.

Why this answer

AWS KMS customer managed keys (SSE-KMS) with automatic key rotation enabled satisfies both requirements: it encrypts data at rest in S3 and automatically rotates the KMS key every year. Additionally, KMS integrates with AWS CloudTrail to log every API call (e.g., Decrypt, GenerateDataKey) that uses the key, providing an audit trail of who used the key and when.

Exam trap

The trap here is that candidates confuse SSE-S3's automatic rotation (which is invisible and lacks audit trails) with SSE-KMS's automatic rotation (which provides both rotation and CloudTrail logging), or they mistakenly think SSE-C or bucket policies can satisfy the audit trail requirement.

How to eliminate wrong answers

Option B is wrong because SSE-C requires the customer to provide and manage their own encryption keys, and AWS does not support automatic rotation for customer-provided keys — rotation must be done manually, which violates the compliance requirement for automatic yearly rotation. Option C is wrong because SSE-S3 uses S3-managed keys that are automatically rotated by AWS, but it does not provide a per-key audit trail of who used the key; S3 server access logs only record requests to the bucket, not granular key usage events. Option D is wrong because the 'aws:SecureTransport' condition enforces encryption in transit (HTTPS), not encryption at rest, and it does not involve key rotation or audit trails for key usage.

236
MCQmedium

A company is migrating its on-premises Oracle database to Amazon RDS for Oracle. The database is 2 TB in size and has a 24-hour maintenance window. The migration must have minimal downtime. Which AWS service should be used for the migration?

A.Amazon RDS native backup and restore
B.AWS Database Migration Service (DMS)
C.Amazon S3 Transfer Acceleration
D.AWS Snowball Edge
AnswerB

DMS supports minimal downtime migrations.

Why this answer

AWS Database Migration Service (DMS) is the correct choice because it supports heterogeneous migrations (Oracle to RDS for Oracle) with minimal downtime using ongoing replication via Oracle LogMiner or binary reader. DMS can perform a full load of the 2 TB database and then continuously replicate changes from the source to the target during the 24-hour maintenance window, allowing a final cutover with only seconds of downtime.

Exam trap

The trap here is that candidates often confuse AWS Snowball Edge for any large data migration, but Snowball is designed for offline transfers where downtime is acceptable, not for minimal-downtime online migrations that require continuous replication.

How to eliminate wrong answers

Option A is wrong because Amazon RDS native backup and restore requires creating a backup file from the on-premises Oracle database and restoring it into RDS, which involves significant downtime for the backup and restore process, and does not support ongoing replication for minimal downtime. Option C is wrong because Amazon S3 Transfer Acceleration is a service for speeding up uploads to S3 over the internet, but it does not provide database migration capabilities, schema conversion, or ongoing replication needed for a live database migration. Option D is wrong because AWS Snowball Edge is a physical data transfer device for moving large volumes of data (e.g., 2 TB) offline, which introduces days of latency for shipping and cannot achieve minimal downtime; it also lacks the ability to capture and apply ongoing transactional changes during transit.

237
Multi-Selecthard

A data engineer is troubleshooting slow query performance on an Amazon Redshift cluster. The cluster has 10 nodes and is using automatic distribution style. The engineer suspects that data distribution is causing excessive data movement. Which steps should the engineer take to diagnose and resolve the issue? (Choose THREE.)

Select 3 answers
A.Choose appropriate distribution keys for large tables
B.Use the EXPLAIN command to analyze query plans
C.Run the VACUUM command to reclaim space
D.Query the STL_DIST and STL_BCAST system tables
E.Increase the number of nodes in the cluster
AnswersA, B, D

Proper distribution keys minimize data movement.

Why this answer

Choosing appropriate distribution keys for large tables ensures that data is evenly distributed across the cluster slices, minimizing the need for data redistribution during joins and aggregations. Automatic distribution style may not always select the optimal key, leading to excessive data movement and slow query performance.

Exam trap

The trap here is that candidates often confuse VACUUM (which only reorganizes data within slices) with distribution optimization, or assume scaling out nodes automatically resolves distribution-related performance issues without addressing the underlying key choice.

238
MCQhard

An application uses the 'orders' DynamoDB table with the schema and provisioned throughput shown in the exhibit. The application frequently queries by customer_id (range key) without specifying the order_id (partition key). What is the most likely impact on performance?

A.Queries will require a full table scan, consuming significant read capacity.
B.Queries will be throttled because the table does not have a global secondary index.
C.Queries will be fast because the sort key is indexed.
D.Queries will cause hot partitions on the table.
AnswerA

Without partition key, DynamoDB scans the entire table.

Why this answer

The application queries by customer_id (the sort key) without specifying order_id (the partition key). In DynamoDB, a Query operation requires the partition key to be specified; without it, the only way to retrieve items is a full table Scan, which reads every item in the table. This consumes read capacity proportional to the entire table size, leading to high latency and cost.

Exam trap

The trap here is that candidates assume the sort key alone can be used for efficient queries, forgetting that DynamoDB's indexing requires the partition key to be specified for a Query operation.

How to eliminate wrong answers

Option B is wrong because throttling is not caused by the absence of a GSI; throttling occurs when consumed capacity exceeds provisioned throughput, and a Scan can cause throttling indirectly by consuming high capacity, but the lack of a GSI itself does not throttle queries. Option C is wrong because the sort key (customer_id) is only indexed within the context of a specific partition key (order_id); without the partition key, the sort key index cannot be used for efficient lookup. Option D is wrong because hot partitions are caused by uneven access patterns on a single partition key, not by queries that omit the partition key; a Scan reads all partitions evenly, so it does not create hot spots.

239
MCQmedium

A company is using Amazon RDS for MySQL with Multi-AZ deployment. The database size is 2 TB and the workload is read-heavy. To improve read performance, which option should be used?

A.Use Amazon ElastiCache to cache database queries
B.Increase the instance size to 16xlarge
C.Create Read Replicas in the same or different regions
D.Enable Multi-AZ on additional instances
AnswerC

Read Replicas allow offloading read traffic.

Why this answer

Amazon RDS for MySQL Read Replicas offload read traffic from the primary DB instance, directly improving read performance for a read-heavy workload. With a 2 TB database, Read Replicas can be created in the same or different regions, providing horizontal read scaling without impacting the primary instance's write capacity. Multi-AZ deployment already provides high availability but does not improve read performance, as the standby instance is not used for reads.

Exam trap

The trap here is that candidates often confuse Multi-AZ with read scaling, assuming the standby instance can serve reads, but Multi-AZ is strictly for high availability and disaster recovery, not for read traffic.

How to eliminate wrong answers

Option A is wrong because Amazon ElastiCache caches query results, reducing database load, but it does not directly improve read performance for all queries, especially those that cannot be cached (e.g., write-heavy or dynamic queries), and it introduces cache invalidation complexity. Option B is wrong because increasing the instance size to 16xlarge vertically scales the database, which can improve performance, but it is less cost-effective and does not provide the same read scalability as horizontal scaling with Read Replicas; it also does not leverage the Multi-AZ deployment's standby for reads. Option D is wrong because enabling Multi-AZ on additional instances is not a valid configuration; Multi-AZ is a feature of the primary instance that provisions a standby in a different Availability Zone for failover, not for read scaling, and additional instances cannot have Multi-AZ enabled independently.

240
MCQmedium

A data engineer is troubleshooting a slow-running query on Amazon Redshift. The query scans a large table but returns few rows. Which diagnostic step should be taken first?

A.Use EXPLAIN to review the query plan.
B.Run ANALYZE on the table.
C.Check the concurrency scaling status.
D.Run VACUUM on the table.
AnswerA

Reveals how the query is executed, helps identify bottlenecks.

Why this answer

When a query scans a large table but returns few rows, the most likely cause is an inefficient query plan—such as a full table scan instead of using indexes or zone maps. Using EXPLAIN first reveals the execution plan, allowing the engineer to identify whether the query is performing unnecessary sequential scans, missing filter pushdown, or using suboptimal join strategies. This diagnostic step should always precede tuning actions like ANALYZE or VACUUM, which address data distribution or storage bloat rather than query planning.

Exam trap

The trap here is that candidates often jump to performance-tuning commands like ANALYZE or VACUUM without first diagnosing the query plan, but the DEA-C01 exam emphasizes that EXPLAIN is the foundational step for identifying inefficient scan patterns before applying any corrective actions.

How to eliminate wrong answers

Option B is wrong because ANALYZE updates table statistics for the query optimizer, but if the query plan is already suboptimal (e.g., missing a WHERE clause filter), fresh statistics won't fix the root cause—EXPLAIN must be checked first. Option C is wrong because concurrency scaling handles increased query load by adding cluster capacity, but it does not improve the efficiency of a single slow query that scans many rows unnecessarily. Option D is wrong because VACUUM reclaims disk space and sorts rows for better compression, but it does not change the query execution path—a full table scan will remain a full table scan even after a vacuum.

241
Multi-Selecthard

A company is migrating a large Oracle database to Amazon Aurora PostgreSQL. The migration must have minimal downtime and preserve data consistency. Which THREE AWS services or features should be used?

Select 3 answers
A.Amazon RDS for Oracle as the target
B.AWS DataSync for initial load
C.AWS Schema Conversion Tool (SCT) for schema conversion
D.Amazon Aurora PostgreSQL as the target database
E.AWS Database Migration Service (DMS) for continuous replication
AnswersC, D, E

SCT converts Oracle schema to Aurora PostgreSQL compatible schema.

Why this answer

The AWS Schema Conversion Tool (SCT) is required to convert the source Oracle database schema (including stored procedures, functions, and data types) to a format compatible with Amazon Aurora PostgreSQL. Without SCT, the heterogeneous migration would fail due to incompatible SQL dialects and database objects.

Exam trap

The trap here is that candidates often confuse AWS DataSync (a file-transfer service) with database migration tools, or mistakenly think RDS for Oracle can serve as a migration target when the question explicitly specifies Aurora PostgreSQL.

242
MCQmedium

A company is using Amazon RDS for PostgreSQL with Multi-AZ deployment. The primary instance fails and a failover occurs. After the failover, the application cannot connect to the database. What is the MOST likely cause?

A.The database instance is in a 'stopped' state after failover.
B.The Multi-AZ failover requires manual intervention to complete.
C.The security group for the RDS instance was not updated during failover.
D.The application is using the old primary instance endpoint instead of the RDS CNAME.
AnswerD

The application should use the CNAME, which updates automatically after failover.

Why this answer

After a Multi-AZ failover in Amazon RDS for PostgreSQL, the DNS CNAME record automatically updates to point to the new primary instance in the standby Availability Zone. If the application hardcodes the old primary instance's endpoint (specific IP or DNS name) instead of using the RDS CNAME (which remains constant), it will attempt to connect to the failed instance, causing connectivity loss. The CNAME is the stable connection point that always resolves to the current primary instance.

Exam trap

The trap here is that candidates may assume security groups or instance state are the issue, but AWS explicitly tests the concept that the RDS CNAME is the correct connection target and that hardcoding endpoints leads to failover failures.

How to eliminate wrong answers

Option A is wrong because RDS Multi-AZ failover does not stop the database instance; the new primary is promoted and remains in an 'available' state. Option B is wrong because Multi-AZ failover is fully automated and requires no manual intervention to complete. Option C is wrong because security groups are associated with the RDS instance itself, not with a specific AZ or IP, and they remain unchanged during failover; the new primary inherits the same security group configuration.

243
MCQhard

The exhibit shows the output of describe-table for a DynamoDB table. The table is used for a reporting job that queries by 'pk' and filters on 'sk' using a range condition. The job is running slowly. What is the most likely cause?

A.The table lacks a global secondary index (GSI).
B.The provisioned read capacity is too low.
C.The table uses provisioned throughput instead of on-demand.
D.The table needs a local secondary index (LSI) on 'sk'.
AnswerB

5 RCU is very low for reporting queries.

Why this answer

The describe-table output shows the table has a primary key composed of 'pk' (partition key) and 'sk' (sort key), which is ideal for the query pattern described (query by 'pk' and filter on 'sk' with a range condition). The job is running slowly, and the most likely cause is insufficient provisioned read capacity, as the reporting job may be consuming more read capacity units than provisioned, leading to throttling and slower performance.

Exam trap

The trap here is that candidates often assume a missing index (GSI or LSI) is the cause of slow queries, but the table already has a sort key that supports the query pattern, so the real issue is likely throughput capacity.

How to eliminate wrong answers

Option A is wrong because a GSI is not needed; the table already has 'sk' as a sort key, which supports efficient range queries on 'sk' when querying by 'pk'. Option C is wrong because switching to on-demand capacity would not necessarily fix slowness caused by low provisioned read capacity; on-demand is for unpredictable traffic, not a direct solution to throttling from insufficient capacity. Option D is wrong because an LSI is unnecessary; the table already has a sort key ('sk') on the base table, which supports the same range query pattern that an LSI would provide.

244
MCQmedium

A company is storing sensitive user data in an Amazon S3 bucket. The security team requires that all data be encrypted at rest using a customer-managed key stored in AWS KMS. The bucket policy must deny any PUT request that does not include the appropriate encryption header. Which bucket policy condition key should be used?

A.s3:x-amz-server-side-encryption-aws-kms-key-id
B.s3:x-amz-server-side-encryption
C.s3:x-amz-acl
D.aws:SourceArn
AnswerA

This condition key allows requiring a specific KMS key ID for encryption.

Why this answer

The `s3:x-amz-server-side-encryption-aws-kms-key-id` condition key allows the bucket policy to enforce that PUT requests include a specific customer-managed KMS key ID in the `x-amz-server-side-encryption-aws-kms-key-id` header, ensuring encryption at rest with the required key. This directly meets the security team's requirement to deny PUT requests that lack the appropriate encryption header tied to a customer-managed KMS key.

Exam trap

The trap here is that candidates often confuse `s3:x-amz-server-side-encryption` (which only checks the encryption algorithm, not the key) with `s3:x-amz-server-side-encryption-aws-kms-key-id` (which checks the specific KMS key ID), leading them to pick option B when the requirement explicitly demands a customer-managed key.

How to eliminate wrong answers

Option B is wrong because `s3:x-amz-server-side-encryption` only checks whether the `x-amz-server-side-encryption` header is present (e.g., `AES256` or `aws:kms`), but it cannot enforce that a specific customer-managed KMS key ID is used; it would allow any KMS key, including AWS-managed keys. Option C is wrong because `s3:x-amz-acl` is used to control access control list (ACL) headers in requests, not encryption headers, so it is irrelevant to encryption enforcement. Option D is wrong because `aws:SourceArn` is a global condition key used to restrict requests based on the ARN of the source resource (e.g., an SNS topic or Lambda function), not to enforce encryption headers in S3 PUT requests.

245
Multi-Selectmedium

A company is designing a data lake on Amazon S3 for analytics. The data includes sensitive personally identifiable information (PII). Which TWO actions should the company take to protect the data? (Choose TWO.)

Select 2 answers
A.Enable S3 Block Public Access.
B.Enable Requester Pays.
C.Enable S3 Transfer Acceleration.
D.Enable cross-region replication.
E.Enable default encryption with SSE-KMS.
AnswersA, E

Why this answer

S3 Block Public Access (Option A) prevents any public access to S3 buckets and objects, which is critical for protecting PII from unintended exposure. Default encryption with SSE-KMS (Option E) ensures that all data written to S3 is encrypted at rest using AWS KMS-managed keys, providing both encryption and centralized key management for sensitive data.

Exam trap

The trap here is that candidates often confuse operational features like Requester Pays or Transfer Acceleration with security controls, or they think replication alone provides data protection, when in fact encryption and access blocking are the direct mechanisms for safeguarding PII.

246
MCQmedium

A data engineer runs the above CLI command to describe the DynamoDB table 'Orders'. The table has a partition key 'OrderID' and sort key 'CustomerID'. Which query operation is most efficient for retrieving all orders for a specific customer?

A.Query the table using CustomerID as the partition key
B.Scan the table and filter by CustomerID
C.Use GetItem with CustomerID as the key
D.Create a Global Secondary Index on CustomerID and query the index
AnswerD

A GSI allows efficient query by CustomerID alone.

Why this answer

A Global Secondary Index (GSI) on CustomerID allows you to query efficiently using CustomerID as the partition key, avoiding a full table scan. Since the base table's primary key is (OrderID, CustomerID), you cannot directly query by CustomerID alone; a GSI provides an alternative access pattern optimized for this query.

Exam trap

The trap here is that candidates assume the sort key can be used as a query filter without an index, but DynamoDB requires the partition key for Query operations, and a Scan is often mistakenly chosen as a simpler alternative despite its performance cost.

How to eliminate wrong answers

Option A is wrong because CustomerID is the sort key, not the partition key, so a Query operation requires the partition key (OrderID) to be specified; you cannot query using only the sort key. Option B is wrong because a Scan reads every item in the table, which is inefficient and costly for large datasets, especially when a targeted query is possible. Option C is wrong because GetItem requires both the partition key and sort key to retrieve a single item; it cannot return multiple orders for a customer.

247
MCQhard

Refer to the exhibit. A data engineer applies this bucket policy to an S3 bucket. A user within the 10.0.0.0/24 IP range attempts to upload an object to the bucket using an HTTP (non-HTTPS) request. What is the outcome?

A.The upload succeeds because the Allow statement grants permission.
B.The upload succeeds because the user's IP is allowed.
C.The upload fails because the user's IP is not in the allowed range for PutObject.
D.The upload fails because the request is not using HTTPS.
AnswerD

Explicit Deny for non-HTTPS requests.

Why this answer

The bucket policy includes a condition `aws:SecureTransport` set to `false`, which explicitly denies any request that does not use HTTPS. Since the user is making an HTTP (non-HTTPS) request, the Deny statement overrides any Allow statement, causing the upload to fail. The correct answer is D.

Exam trap

The DEA-C01 exam often tests the precedence of explicit Deny over Allow in IAM policies, and the trap here is that candidates focus on the IP range in the Allow statement and overlook the Deny condition that blocks non-HTTPS requests.

How to eliminate wrong answers

Option A is wrong because the Allow statement is overridden by the explicit Deny when the condition `aws:SecureTransport` equals `false`; the upload does not succeed. Option B is wrong because even though the user's IP is within the allowed range (10.0.0.0/24), the Deny statement for non-HTTPS requests takes precedence and blocks the upload. Option C is wrong because the user's IP is actually within the allowed range for PutObject; the failure is due to the lack of HTTPS, not the IP range.

248
MCQmedium

A data engineer is migrating an on-premises MongoDB database to Amazon DocumentDB. Which migration strategy minimizes downtime?

A.Take a snapshot of the MongoDB database and restore it to DocumentDB.
B.Use AWS Database Migration Service (AWS DMS) with full load only.
C.Export data using mongodump and import using mongorestore.
D.Use AWS DMS with full load and ongoing replication from MongoDB to DocumentDB.
AnswerD

Ongoing replication allows near-zero downtime cutover.

Why this answer

AWS DMS with full load and ongoing replication (change data capture) minimizes downtime by continuously synchronizing changes from the source MongoDB to the target DocumentDB after the initial full load, allowing a cutover with only a brief pause. This is the only option that supports near-zero downtime migration for live databases.

Exam trap

The trap here is that candidates assume any AWS DMS migration automatically minimizes downtime, but only the full load plus ongoing replication (CDC) option achieves near-zero downtime, while full load only still requires a write stop.

How to eliminate wrong answers

Option A is wrong because taking a snapshot and restoring it captures only a point-in-time copy, requiring the source database to be offline or read-only during the snapshot, causing downtime. Option B is wrong because AWS DMS full load only transfers the current data once, without capturing ongoing changes, so any writes during the migration are lost and downtime is needed to stop writes before cutover. Option C is wrong because mongodump and mongorestore are offline tools that require the source MongoDB to stop accepting writes during the export, resulting in significant downtime.

249
MCQhard

A financial services company stores transaction data in Amazon RDS for PostgreSQL. The company requires that all changes to the database be logged for audit purposes, including before and after images of updated rows. Which feature should the data engineer enable?

A.Enable automated backups and export logs to Amazon S3
B.Enable Enhanced Monitoring and publish logs to CloudWatch Logs
C.Set up logical replication using pglogical or native publication/subscription
D.Enable Multi-AZ deployment and read replicas
AnswerC

Logical replication provides row-level changes with before and after images.

Why this answer

Logical replication, using either pglogical or native PostgreSQL publication/subscription, captures row-level changes (INSERT, UPDATE, DELETE) and can include both the old and new values of updated rows. This meets the audit requirement for before-and-after images, as logical replication decodes the write-ahead log (WAL) to produce a change stream that includes full row snapshots.

Exam trap

The trap here is that candidates confuse database-level logging features (like Enhanced Monitoring or automated backups) with row-level change data capture, assuming any logging mechanism will capture before-and-after images, when only logical replication (or triggers with audit tables) provides that granularity.

How to eliminate wrong answers

Option A is wrong because automated backups capture point-in-time snapshots of the entire database, not a continuous, row-level change stream with before-and-after images; exporting logs to S3 provides error logs or slow query logs, not row-level audit trails. Option B is wrong because Enhanced Monitoring collects OS-level metrics (CPU, memory, disk I/O) and publishes them to CloudWatch Logs, not database row changes. Option D is wrong because Multi-AZ deployment provides high availability via synchronous standby replication, and read replicas serve read traffic; neither logs individual row modifications or provides before-and-after images.

250
MCQhard

A company uses Amazon EMR to process large datasets stored in Amazon S3. The cluster uses a transient configuration and stores intermediate data on HDFS. After a job fails due to a spot instance termination, the data engineer needs to rerun the job. What should the engineer do to minimize data loss and cost?

A.Use a long-running cluster with all on-demand instances to avoid interruptions.
B.Configure the cluster with a mix of spot and on-demand instances and set HDFS replication to 3.
C.Configure the cluster to use EMRFS and store intermediate data in S3.
D.Increase the HDFS replication factor to 5 and use only spot instances.
AnswerB

This balances cost and reliability; on-demand instances provide stability for HDFS NameNode and critical nodes.

Why this answer

Using a mix of spot and on-demand instances balances cost savings with fault tolerance, while setting HDFS replication to 3 ensures that intermediate data on HDFS survives the loss of a single node (e.g., a terminated spot instance). This allows the job to resume from the last checkpoint or reduce recomputation, minimizing both data loss and cost.

Exam trap

The trap here is that candidates assume storing intermediate data in S3 (EMRFS) is always better for durability, but they overlook that HDFS replication with spot/on-demand mix provides a cheaper, faster recovery for transient cluster workloads without incurring S3 write costs.

How to eliminate wrong answers

Option A is wrong because using all on-demand instances eliminates cost savings from spot instances and does not address the transient cluster design; a long-running cluster increases costs unnecessarily. Option C is wrong because storing intermediate data in S3 via EMRFS introduces higher latency and cost for transient data, and EMRFS does not natively support checkpointing for HDFS-dependent intermediate data. Option D is wrong because increasing HDFS replication to 5 consumes more storage and network bandwidth, and using only spot instances increases the risk of frequent failures without on-demand fallback, leading to higher recomputation costs.

251
MCQeasy

A data engineer needs to store archival data that is rarely accessed but must be retained for 7 years. The data should be retrievable within 12 hours. Which Amazon S3 storage class is MOST cost-effective?

A.S3 Intelligent-Tiering
B.S3 Glacier Flexible Retrieval
C.S3 Standard
D.S3 Glacier Deep Archive
AnswerD

Lowest cost with 12-hour retrieval.

Why this answer

S3 Glacier Deep Archive is the most cost-effective storage class for archival data that is rarely accessed and requires a 7-year retention period, with retrieval times up to 12 hours. It offers the lowest storage cost among S3 classes, making it ideal for long-term retention of data that does not need immediate access.

Exam trap

The trap here is that candidates often confuse S3 Glacier Flexible Retrieval (which offers faster retrieval but higher cost) with S3 Glacier Deep Archive, failing to recognize that the 12-hour retrieval requirement is easily met by Deep Archive's standard retrieval, making it the most cost-effective choice for long-term archival.

How to eliminate wrong answers

Option A is wrong because S3 Intelligent-Tiering is designed for data with unknown or changing access patterns, automatically moving data between tiers based on usage, which incurs monitoring and automation costs that are unnecessary for rarely accessed archival data. Option B is wrong because S3 Glacier Flexible Retrieval offers retrieval times from minutes to hours (typically 1-5 minutes for expedited, 3-5 hours for standard), but its storage cost is higher than Glacier Deep Archive, making it less cost-effective for data that only needs retrieval within 12 hours. Option C is wrong because S3 Standard is designed for frequently accessed data with millisecond retrieval times, and its storage cost is significantly higher than archival classes, making it prohibitively expensive for data that is rarely accessed and retained for 7 years.

252
MCQeasy

A data engineer needs to store semi-structured JSON files that are accessed infrequently but must be retrievable within minutes. The data should be stored cost-effectively. Which storage solution meets these requirements?

A.Amazon S3 Glacier Flexible Retrieval storage class.
B.Amazon S3 Glacier Deep Archive storage class.
C.Amazon S3 Standard-Infrequent Access (S3 Standard-IA) storage class.
D.Amazon S3 Standard storage class.
AnswerC

S3 Standard-IA is cost-effective for infrequent access with millisecond retrieval.

Why this answer

Amazon S3 Standard-Infrequent Access (S3 Standard-IA) is the correct choice because it is designed for data accessed infrequently but requires rapid retrieval (within milliseconds). It offers lower storage costs than S3 Standard while maintaining low-latency access, meeting the requirement of retrievability within minutes cost-effectively.

Exam trap

The trap here is that candidates often confuse retrieval time with retrieval cost, assuming that 'infrequent access' implies slower retrieval, but S3 Standard-IA provides the same low-latency access as S3 Standard, unlike Glacier classes which have significantly longer retrieval times.

How to eliminate wrong answers

Option A is wrong because Amazon S3 Glacier Flexible Retrieval is optimized for archival data where retrieval times range from minutes to hours, but it incurs higher retrieval costs and is not designed for frequent or rapid access within minutes. Option B is wrong because Amazon S3 Glacier Deep Archive is the lowest-cost storage class for long-term archival, but retrieval times are typically 12 hours or more, far exceeding the 'within minutes' requirement. Option D is wrong because Amazon S3 Standard is designed for frequently accessed data with high durability and low latency, but it is more expensive than S3 Standard-IA for infrequently accessed data, making it less cost-effective for this use case.

253
MCQeasy

A data engineer is designing a data lake on Amazon S3. The data is accessed frequently for the first 30 days, then rarely accessed after 90 days, and must be archived after 1 year. Which S3 lifecycle policy configuration meets these requirements with the lowest cost?

A.Transition to S3 One Zone-IA after 30 days, then to S3 Glacier Deep Archive after 365 days.
B.Transition to S3 Glacier Flexible Retrieval after 90 days.
C.Transition to S3 Glacier Instant Retrieval after 30 days, then expire after 365 days.
D.Transition to S3 Standard-IA after 30 days, then to S3 Glacier Deep Archive after 365 days.
AnswerD

Standard-IA is cost-effective for infrequent access, and Deep Archive is the cheapest archival tier.

Why this answer

It transitions data to S3 Standard-IA after 30 days (when frequent access drops), then to S3 Glacier Deep Archive after 365 days for archival, minimizing cost while meeting all access patterns. Standard-IA offers lower storage cost than Standard for infrequent access, and Glacier Deep Archive is the cheapest storage class for long-term archival.

Exam trap

The trap here is that candidates often choose S3 Glacier Instant Retrieval (Option C) thinking it balances retrieval speed and cost, but it is not designed for frequent access and does not archive data, only deletes it after 365 days.

How to eliminate wrong answers

Option A is wrong because S3 One Zone-IA is not durable enough for a data lake (single AZ, 99.5% availability) and does not provide the lowest cost for the first 30 days of frequent access; it also skips the 90-day rare access period. Option B is wrong because transitioning directly to S3 Glacier Flexible Retrieval after 90 days ignores the first 30 days of frequent access, incurring higher costs during that period, and does not archive after 1 year. Option C is wrong because S3 Glacier Instant Retrieval is designed for data accessed once a quarter, not for frequent access in the first 30 days, and expiring after 365 days deletes data instead of archiving it, failing the requirement to archive after 1 year.

254
MCQeasy

A retail company stores customer transaction data in an Amazon S3 bucket. The data is encrypted using server-side encryption with AWS KMS (SSE-KMS). The company uses an IAM role to allow an Amazon Athena query service to read the data. The data engineer creates a new Athena workgroup and attempts to run a query on the S3 bucket. The query fails with an access denied error. The IAM role has permissions to decrypt the KMS key and read from the bucket. The engineer checks the S3 bucket policy and finds that it does not explicitly allow access. What is the most likely cause of the failure?

A.The S3 bucket is in a different AWS account than the Athena workgroup.
B.The S3 bucket policy does not grant the required permissions to the Athena service principal.
C.The IAM role does not have permission to use the KMS key for encryption operations.
D.Athena does not support querying data encrypted with SSE-KMS.
AnswerB

The S3 bucket policy must explicitly allow the Athena service or the IAM role to access the bucket.

Why this answer

The most likely cause is that the S3 bucket policy does not explicitly grant the required permissions to the Athena service principal. Even though the IAM role has permissions to decrypt and read, Athena operates as a service and the bucket policy must allow the `athena.amazonaws.com` principal to perform `s3:GetObject` and `s3:ListBucket` actions. Option B is correct because without this explicit grant, the bucket policy implicitly denies access.

Option A is incorrect because the bucket being in a different account would cause an error, but the scenario does not indicate cross-account setup. Option C is incorrect because the IAM role already has decrypt permissions. Option D is incorrect because Athena supports SSE-KMS encrypted data with proper KMS permissions.

255
MCQmedium

A company stores sensitive data in Amazon S3. They need to ensure that all objects are encrypted at rest. Which approach meets this requirement with minimal effort?

A.Use client-side encryption before uploading
B.Enable default encryption on the S3 bucket with SSE-S3
C.Enable S3 Versioning and MFA Delete
D.Use a bucket policy to deny PutObject without encryption
AnswerB

Automatically encrypts all new objects with minimal effort.

Why this answer

Enabling default encryption on an S3 bucket with SSE-S3 (Server-Side Encryption with S3-Managed Keys) automatically encrypts all objects at rest using AES-256, with no additional effort from the user. This ensures that any object uploaded without explicit encryption headers is encrypted by default, meeting the requirement with minimal configuration overhead.

Exam trap

The trap here is that candidates often confuse enforcing encryption at upload (via bucket policy) with automatically encrypting data at rest, leading them to choose option D, which requires additional policy management and does not guarantee encryption of all objects without explicit headers.

How to eliminate wrong answers

Option A is wrong because client-side encryption requires the application to manage encryption keys and perform encryption before upload, adding significant operational effort and complexity, which contradicts the 'minimal effort' requirement. Option C is wrong because S3 Versioning and MFA Delete provide data protection against accidental deletion and overwrites, but they do not encrypt objects at rest. Option D is wrong because a bucket policy to deny PutObject without encryption only enforces encryption on upload but does not encrypt existing objects or objects uploaded without the required headers; it also requires additional policy management and does not automatically encrypt data at rest.

256
MCQmedium

Refer to the exhibit. An IAM policy is attached to a user. The user cannot upload objects to the S3 bucket 'example-bucket' using the AWS CLI. What is the most likely cause?

A.The user is not using HTTPS for API calls
B.The policy does not allow s3:PutObject
C.The user is not in the same AWS region
D.The resource ARN does not include the bucket itself
AnswerA

The condition aws:SecureTransport requires HTTPS.

Why this answer

The IAM policy explicitly denies all actions unless the request uses HTTPS (via the `aws:SecureTransport` condition key). Since the AWS CLI by default can use HTTP if not explicitly configured to use HTTPS, the user's upload attempt fails. The `s3:PutObject` action is allowed in the policy, but the condition block overrides that permission when the request is not made over HTTPS.

Exam trap

AWS often tests the `aws:SecureTransport` condition key as a hidden denial, leading candidates to incorrectly assume the action is missing or the ARN is malformed.

How to eliminate wrong answers

Option B is wrong because the policy does allow `s3:PutObject` on the bucket; the issue is the condition key, not the action. Option C is wrong because S3 is a global service and bucket operations are not restricted by the user's AWS region; the region is specified in the bucket ARN, not the user's location. Option D is wrong because the resource ARN `arn:aws:s3:::example-bucket/*` correctly includes all objects within the bucket, which is the standard way to grant object-level permissions; the bucket itself is not needed for object uploads.

257
MCQhard

A company runs an e-commerce platform on AWS. The product catalog is stored in Amazon DynamoDB with a table that has a partition key of 'product_id' and a sort key of 'category'. The application frequently queries products by category and by product_id. Recently, the operations team noticed that read latency has increased significantly for queries that filter by category. The DynamoDB table has auto scaling enabled. The data engineer examines the CloudWatch metrics and sees that the ReadThrottleEvents metric is non-zero for the table, but the consumed read capacity is well below the provisioned limit. The table has a global secondary index (GSI) on the 'category' attribute. Which action is most likely to resolve the latency issue?

A.Switch the table to DynamoDB on-demand capacity mode.
B.Enable DynamoDB Accelerator (DAX) to cache read queries.
C.Increase the provisioned read capacity on the main table.
D.Redesign the GSI partition key to include a random suffix to distribute load across multiple partitions.
AnswerD

This prevents a hot partition on the GSI.

Why this answer

The issue is that the GSI on 'category' is experiencing hot partitions because 'category' has low cardinality, causing uneven data distribution. The non-zero ReadThrottleEvents on the GSI (not the main table) indicate throttling on the GSI's provisioned capacity, even though the main table's consumed read capacity is below its limit. Adding a random suffix to the GSI partition key distributes reads across multiple physical partitions, reducing hot spots and latency.

Exam trap

The trap here is that candidates assume throttling always relates to the base table's provisioned capacity, overlooking that GSIs have independent capacity and can throttle even when the base table is underutilized, especially with low-cardinality sort keys like 'category'.

How to eliminate wrong answers

Option A is wrong because switching to on-demand mode would not resolve the hot partition issue; it only eliminates the need to manage provisioned capacity but does not fix the underlying data skew that causes throttling on the GSI. Option B is wrong because DynamoDB Accelerator (DAX) caches read results but does not address the root cause of throttling on the GSI due to uneven partition access; it would only mask the symptom for cached queries. Option C is wrong because increasing provisioned read capacity on the main table does not affect the GSI's separate capacity; the throttling is occurring on the GSI, not the base table, and the consumed read capacity on the main table is already well below its limit.

258
MCQhard

A company is migrating an on-premises PostgreSQL database to Amazon Aurora PostgreSQL. The database is 2 TB in size. The migration must have minimal downtime. Which approach should the data engineer use?

A.Use AWS Schema Conversion Tool (SCT) to convert the schema and then copy data using S3.
B.Create an Aurora read replica from the on-premises database using native replication.
C.Use AWS Database Migration Service (DMS) with ongoing replication to minimize downtime.
D.Use pg_dump to export the database and pg_restore to import into Aurora.
AnswerC

DMS supports full load + CDC for minimal downtime.

Why this answer

AWS DMS with ongoing replication (change data capture) is the correct approach because it allows a full load of the 2 TB database followed by continuous replication of changes from the on-premises PostgreSQL source to the Aurora PostgreSQL target, minimizing downtime to a short cutover window. This is the only option that supports near-zero downtime migration for large databases by capturing ongoing transactions.

Exam trap

The trap here is that candidates often confuse native PostgreSQL replication (e.g., streaming replication) with AWS-managed replication, assuming an Aurora read replica can be created from any PostgreSQL source, but Aurora read replicas are only supported within the Aurora cluster itself.

How to eliminate wrong answers

Option A is wrong because AWS SCT is used for schema conversion (e.g., from Oracle to PostgreSQL), but the source is already PostgreSQL, so no schema conversion is needed; copying data via S3 adds unnecessary complexity and does not provide ongoing replication for minimal downtime. Option B is wrong because Aurora read replicas can only be created from an existing Aurora DB instance, not from an on-premises PostgreSQL database; native PostgreSQL replication (e.g., streaming replication) is not supported across an on-premises-to-Aurora boundary without a custom intermediary. Option D is wrong because pg_dump/pg_restore is a logical backup and restore method that requires the source database to be offline or in a read-only state during the dump to ensure consistency, resulting in significant downtime for a 2 TB database.

259
MCQmedium

A data engineer is designing a data lake on Amazon S3. The data is accessed frequently for the first 30 days, then rarely after that. Compliance requires that data be retained for 7 years. What is the MOST cost-effective storage strategy?

A.Use S3 Intelligent-Tiering for the entire 7 years.
B.Store all data in S3 Standard for 7 years.
C.Use S3 Standard for 30 days, then S3 One Zone-IA for 7 years.
D.Use S3 Standard for 30 days, then transition to S3 Standard-IA, then to S3 Glacier Deep Archive after 90 days.
AnswerD

Standard-IA for infrequent access, then Glacier Deep Archive for long-term retention.

Why this answer

The most cost-effective because it matches the access pattern: S3 Standard for the first 30 days of frequent access, then S3 Standard-IA for the next 60 days (reduced storage cost with a retrieval fee), and finally S3 Glacier Deep Archive for the remaining ~6.9 years to meet the 7-year retention requirement at the lowest possible storage cost. This lifecycle policy minimizes total cost by transitioning data to progressively cheaper storage tiers as access frequency drops, while still meeting compliance.

Exam trap

AWS often tests the misconception that S3 Intelligent-Tiering is always the most cost-effective for unknown access patterns, but in this scenario with a known access pattern (frequent for 30 days, then rarely), a lifecycle policy with explicit transitions is cheaper because it avoids the per-object monitoring fee of Intelligent-Tiering.

How to eliminate wrong answers

Option A is wrong because S3 Intelligent-Tiering incurs a monthly monitoring and automation fee per object, which over 7 years would be more expensive than a lifecycle-based approach, especially for rarely accessed data. Option B is wrong because storing all data in S3 Standard for 7 years is the most expensive option, as it does not take advantage of lower-cost tiers for data that is rarely accessed after 30 days. Option C is wrong because S3 One Zone-IA does not provide the durability or availability needed for long-term compliance (data is stored in a single Availability Zone) and is more expensive than Glacier Deep Archive for data accessed rarely over 7 years.

260
MCQhard

A company uses Amazon DynamoDB with provisioned capacity. During a sales event, write traffic spikes and some requests receive ProvisionedThroughputExceeded exceptions. The reads are within limits. The data engineer needs to minimize latency for the spike without manual intervention. Which solution is MOST cost-effective?

A.Use Amazon SQS to buffer write requests and process them in batches.
B.Disable auto scaling and set write capacity to the peak observed value.
C.Enable DynamoDB auto scaling for write capacity with a target utilization of 70%.
D.Enable DynamoDB Accelerator (DAX) to cache write operations.
AnswerC

Auto scaling adjusts capacity dynamically based on traffic, handling spikes cost-effectively.

Why this answer

DynamoDB auto scaling for write capacity automatically adjusts the provisioned write capacity units (WCUs) based on the actual traffic pattern, using a target utilization of 70% to balance cost and performance. This eliminates manual intervention and handles spikes efficiently by scaling up before throttling occurs, while remaining cost-effective since capacity scales down when traffic subsides.

Exam trap

The trap here is that candidates may confuse DAX as a solution for write performance, but DAX only accelerates reads (via caching) and does not mitigate write throttling, leading to an incorrect choice of Option D.

How to eliminate wrong answers

Option A is wrong because using Amazon SQS to buffer write requests introduces additional latency for processing batches, which contradicts the requirement to minimize latency during the spike, and it adds complexity and cost for queue management. Option B is wrong because disabling auto scaling and setting write capacity to the peak observed value is wasteful and costly, as it permanently allocates high capacity that is only needed during spikes, and it requires manual intervention to adjust. Option D is wrong because DynamoDB Accelerator (DAX) is an in-memory cache for read operations, not writes; it does not reduce write throttling or ProvisionedThroughputExceeded exceptions, and it adds cost without addressing the write capacity issue.

261
MCQeasy

A company stores critical financial data in Amazon DynamoDB. To meet compliance requirements, the data must be encrypted at rest with a customer-managed key. Which solution should the data engineer implement?

A.Configure the DynamoDB table to use a customer managed key from AWS KMS.
B.Use AWS CloudHSM to generate a key and import it into DynamoDB.
C.Enable default encryption on the DynamoDB table using S3-managed keys.
D.Use AWS Certificate Manager to issue a certificate and configure TLS.
AnswerA

DynamoDB integrates with KMS for customer-managed keys.

Why this answer

AWS DynamoDB integrates with AWS KMS to support encryption at rest using customer-managed keys (CMKs). By selecting a customer-managed key from KMS during table creation or via an update, the company can meet compliance requirements for controlling the encryption key lifecycle, including rotation and access policies. This approach ensures that the data is encrypted using AES-256 encryption, with the key material managed by the customer rather than AWS.

Exam trap

The trap here is that candidates may confuse encryption at rest with encryption in transit (TLS) or assume that CloudHSM can be directly used with DynamoDB, when in fact DynamoDB only supports KMS for encryption at rest, and CloudHSM requires a custom integration layer.

How to eliminate wrong answers

Option B is wrong because AWS CloudHSM provides hardware-based key storage but does not directly integrate with DynamoDB for encryption at rest; DynamoDB only supports KMS keys, not CloudHSM-generated keys imported via the HSM. Option C is wrong because DynamoDB does not use S3-managed keys; default encryption in DynamoDB uses AWS-owned keys or AWS-managed keys, not S3-managed keys, and S3-managed keys are specific to Amazon S3. Option D is wrong because AWS Certificate Manager and TLS are used for encryption in transit, not encryption at rest, and do not address the requirement for encrypting stored data with a customer-managed key.

262
MCQhard

A company is using Amazon DynamoDB with on-demand capacity for a gaming application. During a new game launch, write traffic spikes to 50,000 writes per second, but the application experiences throttling. The DynamoDB table has a partition key of 'game_id' and a sort key of 'timestamp'. What is the MOST likely cause of throttling?

A.The table has not enabled auto-scaling for writes.
B.The table's on-demand capacity is insufficient for the write spike.
C.Hot partitions due to a skewed access pattern on the partition key 'game_id'.
D.The sort key is not optimal for write-heavy workloads.
AnswerC

If many writes go to the same partition key, that partition can be throttled even with on-demand capacity.

Why this answer

DynamoDB on-demand capacity automatically scales to handle traffic spikes, but it still has per-partition throughput limits. With 'game_id' as the partition key, a single popular game can create a hot partition where all writes target the same partition, exceeding the partition's maximum write capacity (1,000 write capacity units per partition) and causing throttling, even though the overall table capacity is sufficient.

Exam trap

The trap here is that candidates assume on-demand capacity eliminates all throttling, but they overlook DynamoDB's per-partition throughput limits, which can cause throttling on hot partitions even with on-demand mode.

How to eliminate wrong answers

Option A is wrong because on-demand capacity does not use auto-scaling; it automatically adjusts capacity without needing auto-scaling enabled. Option B is wrong because on-demand capacity is designed to handle sudden spikes without manual provisioning, so insufficient capacity is not the issue—the problem is partition-level limits. Option D is wrong because the sort key does not affect write throughput distribution; partition key selection determines write distribution, and a sort key is irrelevant to throttling caused by hot partitions.

263
MCQmedium

A data engineer needs to store semi-structured JSON logs from multiple microservices in a cost-effective manner for ad-hoc querying using SQL. Which AWS service should be used?

A.Amazon Athena with data in S3
B.Amazon DynamoDB
C.Amazon RDS for MySQL
D.Amazon Kinesis Data Analytics
AnswerA

Athena can query JSON in S3 directly using SQL, cost-effective for ad-hoc queries.

Why this answer

Amazon Athena is the correct choice because it allows you to query semi-structured JSON logs stored in S3 directly using standard SQL, without needing to load or transform the data. Athena's schema-on-read approach and pay-per-query pricing make it highly cost-effective for ad-hoc analysis of large volumes of log data, as you only pay for the data scanned during queries.

Exam trap

The trap here is that candidates often confuse Amazon Athena with Amazon Kinesis Data Analytics, mistakenly thinking that Kinesis is the go-to service for SQL-based log analysis, when in fact Kinesis is for real-time streaming and Athena is the correct serverless query service for stored data in S3.

How to eliminate wrong answers

Option B (Amazon DynamoDB) is wrong because it is a NoSQL key-value and document database optimized for low-latency, high-throughput transactional workloads, not for ad-hoc SQL querying of semi-structured logs; it lacks native SQL support and would require expensive scanning of large datasets. Option C (Amazon RDS for MySQL) is wrong because it requires you to predefine a schema, load the JSON logs into relational tables, and pay for provisioned compute and storage even when idle, making it less cost-effective for sporadic ad-hoc queries compared to Athena's serverless model. Option D (Amazon Kinesis Data Analytics) is wrong because it is designed for real-time stream processing and analytics on streaming data using SQL, not for querying stored JSON logs in S3; it would require continuous ingestion and incurs ongoing costs regardless of query frequency.

264
MCQhard

A company uses Amazon RDS for MySQL with Multi-AZ deployment. During a recent failover, the application experienced a brief outage because it cached the old database endpoint. Which solution would minimize application disruption during future failovers?

A.Use Amazon ElastiCache to cache database queries and absorb the failover delay.
B.Create a read replica in another Availability Zone and promote it during failover.
C.Configure the application to connect using the RDS instance's private IP address.
D.Use the RDS cluster endpoint in the application configuration.
AnswerD

The cluster endpoint automatically points to the current primary instance, enabling seamless failover.

Why this answer

The RDS cluster endpoint (also known as the writer endpoint) automatically points to the primary instance in a Multi-AZ deployment. During a failover, DNS is updated to resolve the cluster endpoint to the new primary instance, so the application does not need to cache or change the endpoint. This minimizes disruption by ensuring the application always connects to the current primary without manual intervention.

Exam trap

The trap here is that candidates confuse the cluster endpoint with the instance endpoint or private IP, assuming that static IPs or read replicas provide better failover behavior, when in fact the cluster endpoint is specifically designed for automatic failover in Multi-AZ deployments.

How to eliminate wrong answers

Option A is wrong because ElastiCache caches query results, not database endpoints; it does not address the DNS resolution or endpoint caching issue during a failover. Option B is wrong because promoting a read replica creates a new standalone instance with a different endpoint, requiring application reconfiguration and causing longer disruption than Multi-AZ automatic failover. Option C is wrong because private IP addresses can change after a failover (the new primary may have a different IP), and using IPs bypasses DNS-based failover mechanisms, leading to connectivity failures.

265
MCQeasy

A company is using Amazon S3 as a data lake. The data engineer needs to ensure that all objects uploaded to a specific bucket are automatically replicated to a bucket in another AWS Region for disaster recovery. Which configuration should the engineer implement?

A.Enable S3 Same-Region Replication (SRR) on the source bucket.
B.Enable S3 Cross-Region Replication (CRR) on the source bucket.
C.Use S3 Transfer Acceleration to copy objects to the destination.
D.Use S3 Batch Operations to copy existing objects.
AnswerB

CRR replicates objects across regions automatically.

Why this answer

S3 Cross-Region Replication (CRR) is the correct choice because it automatically replicates objects from a source bucket in one AWS Region to a destination bucket in a different AWS Region, meeting the disaster recovery requirement for geographic separation. CRR requires versioning to be enabled on both buckets and replicates new objects asynchronously after upload.

Exam trap

The trap here is that candidates confuse S3 Transfer Acceleration (which speeds up uploads) with replication, or assume S3 Batch Operations can be used for ongoing replication, when only CRR provides automatic, cross-region object replication for disaster recovery.

How to eliminate wrong answers

Option A is wrong because S3 Same-Region Replication (SRR) replicates objects within the same AWS Region, not across regions, so it does not provide disaster recovery across geographic boundaries. Option C is wrong because S3 Transfer Acceleration speeds up uploads over long distances using AWS edge locations but does not replicate objects to another bucket; it only improves transfer performance for clients. Option D is wrong because S3 Batch Operations is used for bulk actions like copying existing objects or tagging, but it is a one-time operation, not an automatic, ongoing replication configuration for new objects.

266
MCQhard

A company is using Amazon DynamoDB with auto scaling enabled. During a marketing campaign, write traffic spikes, and some write requests fail with ProvisionedThroughputExceededException. The auto scaling policy has a target utilization of 70% and a maximum capacity that is high enough. What is the most likely cause of the throttling?

A.The table has a global secondary index that is throttling.
B.Auto scaling cannot react quickly enough to sudden traffic spikes.
C.The table does not have enough maximum capacity.
D.The auto scaling policy is not configured correctly.
AnswerB

Auto scaling has a lag, so sudden spikes can cause throttling.

Why this answer

Auto scaling in DynamoDB adjusts capacity based on the average utilization over a period (typically 5-10 minutes). When a sudden traffic spike occurs, the write requests can exceed the current provisioned capacity before the auto scaling policy has time to react and increase the capacity. This delay causes ProvisionedThroughputExceededException errors, even though the maximum capacity is set high enough.

Exam trap

The trap here is that candidates assume a correctly configured auto scaling policy with sufficient maximum capacity will always prevent throttling, ignoring the inherent latency in auto scaling's reaction to sudden, short-lived traffic spikes.

How to eliminate wrong answers

Option A is wrong because a throttling global secondary index (GSI) would cause its own ProvisionedThroughputExceededException, but the question states the write requests fail directly on the table, and a GSI throttling would typically manifest as errors on writes that affect the index, not necessarily all table writes. Option C is wrong because the question explicitly states that the maximum capacity is high enough, so insufficient maximum capacity is not the cause. Option D is wrong because the auto scaling policy is configured with a target utilization of 70% and a high enough maximum capacity, which is a standard and correct configuration; the issue is the inherent lag in auto scaling's response to sudden spikes, not a misconfiguration.

267
MCQmedium

A data engineer is analyzing a DynamoDB table for a session management application. The table currently has 10,000 items and is 1 MB in size. The application expects 1,000 writes per second during peak hours. What should the data engineer do to accommodate the write workload?

A.Reduce the item size to improve write performance.
B.Use global tables to distribute writes across regions.
C.Increase the write capacity units (WCU) for the table.
D.Enable DynamoDB Accelerator (DAX) to offload writes.
AnswerC

The current WCU is 5, insufficient for 1,000 writes/second.

Why this answer

DynamoDB write capacity is provisioned in Write Capacity Units (WCUs), and the table's current WCU setting is insufficient for 1,000 writes per second. Increasing the WCU ensures the table can handle the peak write throughput without throttling, as each WCU supports one write per second for items up to 1 KB. The table size (1 MB) and item count (10,000) are irrelevant to throughput capacity.

Exam trap

The trap here is that candidates confuse read-heavy optimizations (like DAX or global tables) with write performance, or assume that reducing item size alone can solve throughput issues, when the fundamental solution is to adjust the provisioned write capacity.

How to eliminate wrong answers

Option A is wrong because reducing item size does not increase the number of writes per second; it only reduces WCU consumption per write, but the core issue is insufficient provisioned capacity, not item size. Option B is wrong because global tables replicate data across regions for disaster recovery and low-latency reads, but they do not increase write throughput for a single table; writes are still subject to the table's WCU limit in each region. Option D is wrong because DynamoDB Accelerator (DAX) is an in-memory cache for reads only; it does not offload or accelerate write operations, which still go directly to the DynamoDB table.

268
MCQhard

A company is designing a data lake on Amazon S3. The data includes personal identifiable information (PII). The data engineer must ensure that only authorized users can access the data, and that access is logged for auditing. Which combination of services should the data engineer use?

A.S3 bucket policies with IAM policies and AWS CloudTrail with data events
B.Amazon S3 access points and VPC endpoints
C.Amazon Macie to discover PII and S3 Object Lock to prevent deletion
D.AWS KMS to encrypt data and AWS CloudTrail to log access
AnswerA

Bucket and IAM policies control access; CloudTrail logs data events for auditing.

Why this answer

S3 bucket policies combined with IAM policies provide fine-grained access control to restrict who can access the data, while AWS CloudTrail with data events logs every S3 object-level operation (e.g., GetObject, PutObject) for auditing. This combination directly meets the requirements of authorized access and logging for PII data.

Exam trap

The trap here is that candidates often assume CloudTrail automatically logs all S3 operations, but it only logs management events by default; data events must be explicitly enabled, and many overlook this distinction when designing for auditing.

How to eliminate wrong answers

Option B is wrong because Amazon S3 access points and VPC endpoints control network-level access and simplify bucket management, but they do not provide the required logging of data access for auditing. Option C is wrong because Amazon Macie discovers and classifies PII, and S3 Object Lock prevents deletion or overwriting, but neither service enforces access control or logs data access events. Option D is wrong because AWS KMS encrypts data at rest, which protects confidentiality but does not control who can access the data, and while AWS CloudTrail logs API calls, it does not log data events by default; without enabling data event logging, object-level access (e.g., reading a file) is not recorded.

269
MCQhard

A data engineer is troubleshooting an access denied error when an AWS Lambda function tries to decrypt an object encrypted with the KMS key 'abc123'. The Lambda function's execution role has the above policy attached. What is the likely cause of the error?

A.The Deny statement blocks all decrypt requests
B.The Lambda function does not have permission to call kms:GenerateDataKey
C.The KMS key policy does not grant the Lambda role decrypt permission
D.The IAM policy does not include kms:Decrypt permission
AnswerC

Key policies must also grant access; IAM alone may not be sufficient.

Why this answer

The error occurs because KMS requires both the IAM policy and the key policy to grant the necessary permissions. While the IAM policy attached to the Lambda execution role includes kms:Decrypt, the KMS key policy for 'abc123' does not explicitly grant the Lambda role permission to call kms:Decrypt. Since KMS key policies act as a resource-based policy, they must allow the principal (the Lambda role) to perform the action; otherwise, the request is denied even if the IAM policy allows it.

Exam trap

The trap here is that candidates assume IAM permissions alone are sufficient for KMS operations, overlooking that KMS key policies must explicitly grant access to the IAM role, which is a common source of access denied errors in cross-account or cross-service scenarios.

How to eliminate wrong answers

Option A is wrong because the Deny statement in the policy only blocks decrypt requests that do not include the encryption context 'Project=Alpha', not all decrypt requests; the error is likely due to missing key policy permissions, not a blanket Deny. Option B is wrong because the error is about decrypting an object, not generating a data key; kms:GenerateDataKey is used for encryption operations, not decryption, and the Lambda function is trying to decrypt, not encrypt. Option D is wrong because the IAM policy shown in the question includes kms:Decrypt permission (the policy lists kms:Decrypt as an allowed action), so the issue is not a missing IAM permission but rather the KMS key policy not granting the Lambda role decrypt permission.

270
MCQeasy

A company uses Amazon DynamoDB as the primary data store for a gaming application. The application stores user profiles and game state. During peak hours, the application experiences throttling on writes to the UserProfiles table. The table's read capacity is underutilized. Which solution should resolve the write throttling?

A.Increase the provisioned write capacity units for the table.
B.Enable DynamoDB Accelerator (DAX) on the table.
C.Add a global secondary index (GSI) to the table.
D.Configure auto scaling for read capacity units.
AnswerA

Increasing write capacity resolves write throttling.

Why this answer

Write throttling occurs when the number of write requests exceeds the provisioned write capacity units (WCUs) for the DynamoDB table. Since the read capacity is underutilized, the correct solution is to increase the provisioned WCUs to accommodate the peak write traffic. This directly addresses the capacity deficit without affecting read operations.

Exam trap

The trap here is that candidates may confuse read and write capacity solutions, such as selecting DAX (which only helps reads) or auto scaling for reads, when the issue is specifically write throttling.

How to eliminate wrong answers

Option B is wrong because DynamoDB Accelerator (DAX) is an in-memory cache that improves read performance, not write throughput; it does not increase write capacity or reduce write throttling. Option C is wrong because adding a global secondary index (GSI) consumes additional write capacity from the base table and can actually increase write throttling, not resolve it. Option D is wrong because auto scaling for read capacity units does not affect write throttling; write throttling requires adjusting write capacity, not read capacity.

271
MCQmedium

A data engineer is designing a data lake on Amazon S3. The data consists of sensitive personally identifiable information (PII) that must be encrypted at rest. The company requires that encryption keys be rotated every 90 days and that access to the keys be logged. Which encryption solution meets these requirements?

A.Use server-side encryption with customer-provided keys (SSE-C).
B.Use client-side encryption with a master key stored in AWS Secrets Manager.
C.Use server-side encryption with S3 managed keys (SSE-S3).
D.Use server-side encryption with AWS KMS (SSE-KMS) and enable automatic key rotation.
AnswerD

SSE-KMS provides customer-managed keys with rotation and logging via CloudTrail.

Why this answer

SSE-KMS with automatic key rotation (Option D) meets the requirements because it encrypts data at rest in S3, allows key rotation every 90 days via AWS KMS automatic rotation, and logs all key usage in AWS CloudTrail for auditing. This provides the necessary encryption, rotation, and access logging without managing keys externally.

Exam trap

The trap here is that candidates often confuse SSE-S3's automatic annual rotation with the required 90-day rotation, or assume SSE-C or client-side encryption can meet logging and rotation requirements without realizing they lack native AWS rotation and auditing capabilities.

How to eliminate wrong answers

Option A is wrong because SSE-C requires the customer to provide and manage their own encryption keys, and AWS does not support automatic key rotation or logging of key access for customer-provided keys. Option B is wrong because client-side encryption encrypts data before it reaches S3, but storing the master key in AWS Secrets Manager does not provide automatic key rotation every 90 days (Secrets Manager rotation is configurable but not native to KMS key rotation) and does not log key usage in CloudTrail as KMS does. Option C is wrong because SSE-S3 uses S3-managed keys that are rotated annually (not every 90 days) and do not provide granular access logging for key usage.

272
MCQhard

A CloudFormation template includes this IAM policy for a cross-account S3 upload use case. What is the purpose of the condition?

A.To enforce server-side encryption with KMS.
B.To limit the size of objects that can be uploaded.
C.To restrict uploads to only a specific AWS account.
D.To ensure that uploaded objects grant full control to the bucket owner.
AnswerD

The ACL bucket-owner-full-control grants the bucket owner full permissions.

Why this answer

The condition in the IAM policy uses the `s3:x-amz-acl` key with a value of `bucket-owner-full-control`. This ensures that any object uploaded to the S3 bucket explicitly grants the bucket owner full control over the object, overriding the default behavior where the uploading account retains ownership. This is critical in cross-account uploads to prevent the uploading account from retaining exclusive access to the objects.

Exam trap

The trap here is that candidates confuse the `s3:x-amz-acl` condition key with account-level restrictions or encryption settings, when in fact it specifically controls the Access Control List (ACL) applied to the uploaded object.

How to eliminate wrong answers

Option A is wrong because server-side encryption with KMS is enforced using the `s3:x-amz-server-side-encryption-aws:kms` condition key, not the `s3:x-amz-acl` key. Option B is wrong because object size limits are enforced using the `s3:content-length-range` condition key, not the ACL-related condition shown. Option C is wrong because restricting uploads to a specific AWS account is done using the `aws:SourceAccount` or `aws:SourceArn` condition keys, not the `s3:x-amz-acl` key which controls object ACL permissions.

273
Multi-Selectmedium

Which THREE of the following are best practices for managing data storage costs in Amazon S3? (Choose 3.)

Select 3 answers
A.Store all data in S3 Standard for maximum durability.
B.Use S3 Lifecycle policies to transition objects to S3 Glacier Deep Archive after a specified period.
C.Use S3 Object Lock to prevent object deletion and then apply a lifecycle policy to expire objects after a retention period.
D.Create multiple bucket replicas in different regions to ensure availability.
E.Enable S3 Intelligent-Tiering for data with unknown or changing access patterns.
AnswersB, C, E

S3 Lifecycle policies automatically transition objects to cheaper storage classes like S3 Glacier Deep Archive, reducing costs for infrequently accessed data—a key cost management practice.

Why this answer

S3 Lifecycle policies allow you to automatically transition objects to lower-cost storage classes like S3 Glacier Deep Archive after a specified period, reducing storage costs for infrequently accessed data. Option C is correct because combining S3 Object Lock with a lifecycle policy to expire objects after the retention period ensures that objects are automatically deleted when they are no longer needed, preventing unnecessary storage costs. Option E is correct because S3 Intelligent-Tiering automatically moves data between access tiers based on changing patterns, optimizing costs without manual intervention.

Options A and D are not best practices for cost management: storing all data in S3 Standard is costly, and creating multiple replicas increases storage costs.

Exam trap

A common trap is overlooking S3 Object Lock with lifecycle expiration as a cost management best practice. Object Lock is often seen solely as a compliance feature, but when paired with lifecycle policies, it ensures data is retained only as long as needed and then expires, directly impacting storage costs. The actual best practices for cost management include lifecycle transitions (Option B), Object Lock with lifecycle policies (Option C), and Intelligent-Tiering (Option E).

274
MCQhard

Refer to the exhibit. A data engineer is analyzing a query performance issue on an Amazon Redshift table. The table 'sales' has 100 million rows. The query is performing a full table scan. Which optimization should the engineer apply to improve query performance?

A.Change DISTKEY to region.
B.Use an interleaved sort key on (sale_date, region).
C.Use a compound sort key on (sale_date, region).
D.Change DISTSTYLE to ALL.
AnswerC

Compound sort key on sale_date first enables efficient range restriction, then region for aggregation.

Why this answer

The query is performing a full table scan, which indicates that Redshift cannot efficiently prune blocks. A compound sort key on (sale_date, region) orders rows by sale_date first, then by region, allowing Redshift to skip large portions of data when filtering on the leading column (sale_date). This minimizes the number of blocks scanned and dramatically improves query performance for range-based or equality filters on the leading column.

Exam trap

The trap here is that candidates often confuse distribution keys (which control data placement across nodes) with sort keys (which control row order within a node), leading them to choose DISTKEY or DISTSTYLE changes when the real issue is block pruning from a full table scan.

How to eliminate wrong answers

Option A is wrong because changing DISTKEY to region affects data distribution across nodes, not the physical order of rows within a node; it does not help with block pruning for a full table scan. Option B is wrong because an interleaved sort key gives equal weight to all columns, which can cause overhead in maintenance and is less efficient for range-based queries on the leading column compared to a compound sort key. Option D is wrong because changing DISTSTYLE to ALL replicates the entire table to every node, which can improve join performance but does not reduce the number of blocks scanned during a full table scan and may waste storage and memory.

275
MCQmedium

A data engineering team is managing an Amazon DynamoDB table that stores user session data. The table has a primary key of user_id (partition key) and session_id (sort key). The application performs strongly consistent reads on individual items. The team notices that read latency increases during peak hours. They suspect that the table is experiencing hot partitions. The team needs to improve read performance without changing the application code. Which solution should they implement?

A.Enable DynamoDB global tables to distribute reads across regions.
B.Enable DynamoDB Accelerator (DAX) for the table.
C.Increase the read capacity units for the table.
D.Change the application to use eventually consistent reads.
AnswerB

DAX caches reads and reduces latency.

Why this answer

DynamoDB Accelerator (DAX) is a fully managed, in-memory cache that delivers up to 10x read performance improvement by caching hot partition data. Since the application uses strongly consistent reads and cannot be changed, DAX provides a drop-in caching layer that reduces read latency on hot partitions without requiring any code modifications.

Exam trap

AWS often tests the misconception that increasing provisioned capacity (RCUs) can solve hot partition issues, but candidates must remember that DynamoDB enforces a per-partition throughput limit that cannot be exceeded regardless of total table capacity.

How to eliminate wrong answers

Option A is wrong because global tables replicate data across regions for disaster recovery and low-latency global access, but they do not solve hot partition issues within a single table; they add complexity and cross-region latency. Option C is wrong because increasing read capacity units (RCUs) only increases the provisioned throughput, but if a single partition key (user_id) is hot, the partition-level throughput limit (3,000 RCUs or 1,000 WCUs) still caps performance; more RCUs cannot overcome a single partition's bottleneck. Option D is wrong because changing to eventually consistent reads would reduce latency by sacrificing consistency, but the requirement explicitly states the application performs strongly consistent reads and the code cannot be changed.

276
MCQmedium

A data engineer runs the above command and gets the output. What does the 'MFADelete' setting imply?

A.Any modification to an object requires MFA.
B.To permanently delete a version of an object, the user must provide MFA.
C.MFA is required for all read operations as well.
D.All operations on the bucket require MFA authentication.
AnswerB

MFADelete adds an extra layer of security for version deletions.

Why this answer

The 'MFADelete' setting on an S3 bucket versioning configuration requires multi-factor authentication to permanently delete an object version. This means that when a user issues a DELETE request with a version ID (a permanent delete), they must include a valid MFA token in the request headers. It does not apply to creating new versions, reading objects, or other operations.

Exam trap

The DEA-C01 exam often tests the distinction between 'MFA Delete' (which only applies to permanent version deletion) and general MFA enforcement on all bucket operations, leading candidates to overgeneralize the scope of the setting.

How to eliminate wrong answers

Option A is wrong because 'MFADelete' does not require MFA for any modification (e.g., PUT, POST, or COPY operations); it only applies to permanent deletes of specific versions. Option C is wrong because read operations (GET, HEAD) are never subject to MFA requirements under this setting. Option D is wrong because 'MFADelete' is a versioning-specific sub-setting and does not enforce MFA on all bucket operations, only on permanent version deletion.

277
MCQhard

A company uses Amazon DynamoDB for a gaming leaderboard. The table has a partition key of 'game_id' and a sort key of 'score'. The read capacity is provisioned at 1000 RCUs. During peak hours, users report high latency when querying the top 10 scores for a specific game. The DynamoDB metrics show ConsumedReadCapacityUnits averaging 800 but occasional throttling. What is the most likely cause and solution?

A.Create a global secondary index with the same key schema to distribute reads
B.Remove the sort key and use a global secondary index
C.Increase the provisioned RCUs to 2000
D.The hot game_id partition is exceeding its throughput; add DynamoDB Accelerator (DAX) to cache reads
AnswerD

DAX caches frequent reads, reducing load on the hot partition and lowering latency.

Why this answer

The hot game_id partition is exceeding its provisioned throughput because DynamoDB distributes RCUs evenly across partitions, and a single partition can only handle up to (1000 RCUs / number of partitions) per second. When a specific game_id becomes popular, all reads hit the same partition, causing throttling despite low overall consumed capacity. Adding DynamoDB Accelerator (DAX) caches the top 10 scores for that partition, reducing read pressure and eliminating throttling without increasing RCUs.

Exam trap

The trap here is that candidates see 'ConsumedReadCapacityUnits averaging 800' and assume overall capacity is sufficient, missing that DynamoDB throttles at the partition level, not the table level, so a hot partition can be throttled even when table-level consumption is below provisioned RCUs.

How to eliminate wrong answers

Option A is wrong because creating a global secondary index with the same key schema would not distribute reads across partitions—it would still have the same hot partition issue, as the GSI inherits the same partition key. Option B is wrong because removing the sort key and using a GSI would break the leaderboard's ability to query by score order, and the GSI would still suffer from the same hot partition if the partition key remains 'game_id'. Option C is wrong because increasing RCUs to 2000 would only double the per-partition limit, but the hot partition would still be throttled if the traffic spike exceeds the new per-partition limit; it does not address the root cause of uneven access patterns.

278
MCQhard

A company runs an Amazon RDS for PostgreSQL instance that stores financial data. The company requires point-in-time recovery (PITR) with a retention period of 35 days. Additionally, the company needs to create a new database from a specific snapshot every night for testing. Which combination of actions should the data engineer take to meet these requirements?

A.Enable automated backups with a 35-day retention period and create a manual snapshot each night for testing.
B.Create a read replica and promote it to a new instance for testing each night.
C.Enable Multi-AZ and use the standby instance for testing.
D.Disable automated backups to reduce storage costs and take manual snapshots with 35-day retention.
AnswerA

Automated backups provide PITR; manual snapshots are independent and can be restored for testing.

Why this answer

Automated backups in Amazon RDS for PostgreSQL support a maximum retention period of 35 days, which satisfies the PITR requirement. Additionally, creating a manual snapshot each night provides a stable, independent copy for testing without interfering with the automated backup schedule or the source database's performance.

Exam trap

The trap here is that candidates often confuse the purpose of Multi-AZ standby instances (which are not directly usable for testing) or assume that manual snapshots alone can provide PITR, but automated backups are strictly required for point-in-time recovery in RDS.

How to eliminate wrong answers

Option B is wrong because a read replica is designed for read scaling and high availability, not for creating a nightly test database; promoting a read replica each night would disrupt replication and require re-creating the replica, which is inefficient and does not meet the PITR retention requirement. Option C is wrong because Multi-AZ provides high availability and automatic failover, but the standby instance is not directly accessible for testing; it cannot be used to create a new database without promoting it, which would break the Multi-AZ configuration. Option D is wrong because disabling automated backups eliminates the ability to perform point-in-time recovery (PITR), and manual snapshots alone do not support PITR; automated backups are required for transaction log retention and restore to any point within the retention window.

279
MCQeasy

A data engineer needs to store log files from multiple applications in a centralized location. The logs are generated in JSON format and each log entry is about 1 KB. The engineer needs to query the logs occasionally using SQL-like queries. Which AWS service is most appropriate?

A.Amazon DynamoDB
B.Amazon Redshift
C.Amazon Athena with data stored in S3
D.Amazon RDS for MySQL
AnswerC

Athena queries S3 data directly with SQL, suitable for occasional queries.

Why this answer

Amazon Athena is the most appropriate service because it allows you to query log files stored in S3 directly using standard SQL, without needing to load or transform the data. Since the logs are in JSON format and each entry is about 1 KB, Athena's schema-on-read approach works perfectly for occasional SQL-like queries, and you only pay for the data scanned per query, making it cost-effective for infrequent access.

Exam trap

The trap here is that candidates often choose Amazon Redshift or RDS because they think 'SQL-like queries' require a traditional database, overlooking Athena's ability to query data directly in S3 without loading it, which is a key serverless pattern for log analytics.

How to eliminate wrong answers

Option A is wrong because Amazon DynamoDB is a NoSQL key-value and document database optimized for low-latency, high-throughput access patterns, not for ad-hoc SQL-like queries on large volumes of log data, and it would require schema design and provisioning. Option B is wrong because Amazon Redshift is a petabyte-scale data warehouse designed for complex analytical queries on structured, transformed data, which is overkill and costly for occasional log queries on JSON files stored in S3. Option D is wrong because Amazon RDS for MySQL is a relational database that requires schema definition, data loading, and ongoing management, making it unsuitable for storing raw JSON log files directly without ETL, and it lacks the serverless, pay-per-query model for infrequent access.

280
MCQeasy

A company is using Amazon EMR to process large datasets stored in Amazon S3. The data engineer wants to reduce the time it takes to read data from S3 by optimizing the data format. Which file format should the engineer recommend?

A.CSV
B.Parquet
C.ORC
D.JSON
AnswerB

Parquet is columnar, compressed, and ideal for analytics.

Why this answer

Parquet is the correct choice because it is a columnar storage format that significantly reduces the amount of data read from Amazon S3 during analytical queries. By storing data column-wise, Parquet enables predicate pushdown and compression, which minimizes I/O and speeds up data processing in Amazon EMR, especially for large datasets.

Exam trap

The trap here is that candidates often assume ORC is the default or preferred format for all big data engines. However, for Amazon EMR, Parquet is generally recommended because of its superior performance with Spark and its ability to handle complex nested data structures efficiently.

How to eliminate wrong answers

Option A is wrong because CSV is a row-oriented text format that requires full file scans and offers no compression or predicate pushdown, leading to slower reads. Option C is wrong because ORC is also a columnar format optimized for Hive workloads, but it is not natively as performant with Spark and EMR as Parquet, and the question asks for the best recommendation for EMR. Option D is wrong because JSON is a row-oriented, self-describing format that is verbose and lacks efficient compression or columnar access patterns, resulting in high I/O and slower processing.

281
Multi-Selecthard

Which TWO are benefits of using Amazon S3 Object Lock? (Choose TWO.)

Select 2 answers
A.Helps meet regulatory requirements for write-once-read-many (WORM) storage.
B.Encrypts objects at rest using AWS KMS.
C.Prevents objects from being deleted or overwritten for a fixed time.
D.Automatically transitions objects to lower-cost storage classes.
E.Enables automatic versioning of objects.
AnswersA, C

Object Lock supports compliance and governance modes.

Why this answer

Amazon S3 Object Lock helps meet regulatory requirements for write-once-read-many (WORM) storage by allowing you to set retention periods and legal holds on objects. This ensures that data cannot be deleted or overwritten for a specified duration, which is a common requirement for compliance frameworks such as SEC Rule 17a-4 or FINRA.

Exam trap

The trap here is that candidates confuse S3 Object Lock with S3 Versioning or S3 Lifecycle policies, mistakenly thinking Object Lock handles encryption or storage tier transitions, when in reality it is solely focused on preventing object deletion or overwrite for compliance-driven WORM scenarios.

282
MCQhard

A company uses Amazon Redshift for its data warehouse. The data engineer notices that the most frequently accessed table is sorted by date, but queries often filter by customer_id. The table has 500 million rows and uses AUTO distribution style. What change would MOST improve query performance?

A.Change distribution style to KEY on customer_id.
B.Change distribution style to EVEN.
C.Change the sort key to include customer_id as a compound sort key.
D.Change the sort key to an interleaved sort key on date and customer_id.
AnswerC

A compound sort key with customer_id first will optimize queries filtering by customer_id.

Why this answer

Since queries frequently filter by customer_id but the table is sorted only by date, Redshift must scan all rows that match the date range and then filter by customer_id. By adding customer_id as a compound sort key (date, customer_id), Redshift can use zone maps to skip blocks that don't contain the requested customer_id within the date range, dramatically reducing the number of rows scanned and improving query performance.

Exam trap

The trap here is that candidates often assume distribution style (KEY or EVEN) is the primary lever for query performance on filtered columns, when in fact sort keys—especially compound sort keys—are far more impactful for reducing scanned data in range-filtered queries.

How to eliminate wrong answers

Option A is wrong because changing distribution style to KEY on customer_id would colocate rows with the same customer_id on the same slice, but it does not help with filtering within a node; without a sort key on customer_id, each slice still must scan all its rows to find matching customer_ids. Option B is wrong because EVEN distribution spreads rows randomly across slices, which can improve load balancing but does nothing to reduce the amount of data scanned per query; filtering by customer_id still requires a full scan of all slices. Option D is wrong because an interleaved sort key on date and customer_id would give equal weight to both columns, but for a table with 500 million rows and frequent range-based date queries, interleaved sort keys can cause significant overhead during maintenance (e.g., VACUUM REINDEX) and may not outperform a compound sort key when the leading column (date) is used in range filters.

283
MCQhard

A data engineer needs to set up a new Amazon RDS for PostgreSQL database for a production workload. The database must be highly available and resilient to a single Availability Zone failure. Which configuration should the engineer choose?

A.Single-AZ with automated backups
B.Multi-AZ deployment with one standby in a different AZ
C.Multi-AZ with two readable standbys
D.Single-AZ with a read replica
AnswerB

Provides automatic failover and high availability.

Why this answer

A Multi-AZ deployment for Amazon RDS PostgreSQL automatically provisions and maintains a synchronous standby replica in a different Availability Zone. This configuration provides automatic failover in the event of an AZ failure, ensuring high availability and resilience without manual intervention. The synchronous replication ensures zero data loss during failover, which is critical for production workloads.

Exam trap

The trap here is that candidates often confuse Multi-AZ with read replicas, assuming that a read replica can serve as a failover target, but in RDS PostgreSQL, read replicas are asynchronous and require manual promotion, making them unsuitable for automatic high availability against AZ failures.

How to eliminate wrong answers

Option A is wrong because a Single-AZ deployment with automated backups only protects against data loss via point-in-time recovery, but does not provide automatic failover or resilience to an AZ failure; the database becomes unavailable if the AZ goes down. Option C is wrong because Amazon RDS for PostgreSQL does not support Multi-AZ with two readable standbys; that feature is specific to Amazon RDS for Oracle and SQL Server Enterprise Edition, and PostgreSQL Multi-AZ only provides a single standby that is not readable. Option D is wrong because a Single-AZ with a read replica provides read scaling and some disaster recovery capability, but the read replica is asynchronous and does not provide automatic failover; a manual promotion is required, and the primary remains vulnerable to AZ failure.

284
MCQhard

A data engineering team is building a real-time analytics pipeline using Amazon Kinesis Data Streams, AWS Lambda, and Amazon DynamoDB. The Lambda function consumes records from the stream and writes aggregated data to a DynamoDB table. The application requires that each record be processed exactly once to avoid duplicates. The Lambda function is idempotent, but occasionally duplicate records are written due to retries from Kinesis. The team needs to ensure exactly-once semantics for DynamoDB writes. Which solution should they implement?

A.Enable DynamoDB Streams and use a second Lambda to deduplicate.
B.Use DynamoDB TransactWriteItems with a condition check on a unique transaction ID.
C.Use the Kinesis Client Library (KCL) to checkpoint after processing and ignore duplicates.
D.Ensure the Lambda function is idempotent by using upsert operations.
AnswerB

Condition check ensures only one write succeeds per unique ID.

Why this answer

DynamoDB TransactWriteItems with a condition check on a unique transaction ID ensures that the write only succeeds if the transaction ID does not already exist in the table. This provides exactly-once semantics by preventing duplicate writes even when Kinesis retries deliver the same record multiple times. The condition check acts as a distributed lock at the item level, guaranteeing idempotency without relying on downstream deduplication.

Exam trap

The trap here is that candidates often assume idempotent Lambda functions alone guarantee exactly-once processing, but they overlook that Kinesis retries can still cause duplicate writes unless a conditional write with a unique identifier is used at the database level.

How to eliminate wrong answers

Option A is wrong because enabling DynamoDB Streams and using a second Lambda to deduplicate introduces eventual consistency and additional latency, and does not prevent duplicate writes at the point of ingestion; it only attempts to clean up duplicates after they have already been written. Option C is wrong because the Kinesis Client Library (KCL) checkpointing tracks processing progress but does not prevent duplicate records from being delivered to the Lambda function during retries, so duplicates can still be written to DynamoDB. Option D is wrong because simply ensuring the Lambda function is idempotent using upsert operations (e.g., UpdateItem) does not guarantee exactly-once semantics; upsert can still overwrite data or create duplicate items if the record lacks a unique identifier or condition check.

285
MCQmedium

A media company stores large video files in Amazon S3 and uses Amazon CloudFront for content delivery. Users in different regions report slow download speeds for popular content. The data engineer needs to improve performance while minimizing cost. Which solution should the engineer implement?

A.Change the S3 storage class to S3 Standard-IA
B.Enable S3 Transfer Acceleration on the bucket
C.Create multiple S3 buckets in different regions and configure CloudFront with multiple origins
D.Enable CloudFront Origin Shield
AnswerD

Origin Shield provides an additional cache layer that improves cache hit ratio and reduces load on the origin, thereby improving download performance for users.

Why this answer

CloudFront Origin Shield acts as a centralized caching layer in front of the S3 origin, reducing the number of requests that reach the origin and improving cache hit ratios. This minimizes latency for users in different regions by serving popular content from the edge or shield cache, while also reducing origin load and data transfer costs.

Exam trap

The trap here is that candidates may confuse S3 Transfer Acceleration (which optimizes uploads) with download acceleration, or assume that multiple regional origins are needed when CloudFront's global edge network already handles geographic distribution.

How to eliminate wrong answers

Option A is wrong because changing the storage class to S3 Standard-IA reduces storage costs for infrequently accessed data but does not improve download speeds or reduce latency for users. Option B is wrong because S3 Transfer Acceleration speeds up uploads to S3 over long distances using AWS edge locations, but it does not accelerate downloads or improve CloudFront delivery performance. Option C is wrong because creating multiple S3 buckets in different regions and configuring CloudFront with multiple origins increases complexity and cost without addressing the core issue of cache efficiency; CloudFront already uses a global edge network, and adding more origins does not inherently improve cache hit ratios or reduce origin load.

286
MCQhard

A company is using Amazon S3 to store sensitive data. The security team requires that all data be encrypted at rest using a customer-managed AWS KMS key. The data engineer must ensure that only a specific IAM role can decrypt the data. Which policy should the data engineer attach to the KMS key?

A.A KMS key policy that allows the IAM role to perform kms:Decrypt
B.An IAM user policy that allows kms:Decrypt for the specific key
C.An IAM policy attached to the role that allows kms:Decrypt
D.An S3 bucket policy that denies access unless encryption is used
AnswerA

KMS key policies grant permissions to use the key.

Why this answer

KMS key policies are the primary mechanism for controlling access to a customer-managed KMS key. By specifying the IAM role as a principal in the key policy and granting kms:Decrypt, you ensure that only that role can decrypt data encrypted with this key, regardless of any IAM policies that might otherwise allow broader access.

Exam trap

The DEA-C01 exam often tests the misconception that IAM policies alone can control KMS key access, but the correct approach is to use a KMS key policy that explicitly grants the required action to the specific principal.

How to eliminate wrong answers

Option B is wrong because an IAM user policy alone is insufficient; KMS key access requires either a key policy that explicitly grants permissions to the user/role or a grant, and IAM policies only take effect if the key policy allows IAM policy-based access (via a root principal). Option C is wrong because while an IAM policy attached to the role can allow kms:Decrypt, it will only work if the KMS key policy also permits IAM policy-based access (e.g., by allowing the root account), which is not guaranteed and does not restrict decryption to that specific role as tightly as a key policy. Option D is wrong because an S3 bucket policy that denies access unless encryption is used does not control who can decrypt data; it only enforces encryption in transit or at rest, and does not restrict decryption permissions to a specific IAM role.

287
Multi-Selecthard

Which THREE factors should a data engineer consider when choosing between Amazon Redshift and Amazon Athena for querying large datasets in Amazon S3? (Choose three.)

Select 3 answers
A.Both support standard SQL queries.
B.Redshift requires provisioning and managing clusters, while Athena is serverless.
C.Athena charges per query based on data scanned, while Redshift charges for cluster compute capacity.
D.Athena can only query data stored in Amazon S3, while Redshift can also query data in S3.
E.Redshift is optimized for highly structured, frequently queried data, while Athena is better for ad-hoc queries on raw data.
AnswersB, C, E

Redshift needs cluster management; Athena is serverless.

Why this answer

Amazon Redshift requires manual provisioning, configuration, and ongoing management of clusters, including node sizing, scaling, and maintenance windows. In contrast, Amazon Athena is a serverless service that automatically handles infrastructure, requiring no cluster management and allowing users to query data directly from Amazon S3 without any setup overhead.

Exam trap

The trap here is that candidates may assume Athena is limited to S3-only queries or that both services have identical SQL support, overlooking the fundamental architectural differences in provisioning, cost models, and workload optimization that are the real decision factors.

288
Multi-Selecteasy

Which TWO data stores are considered fully managed, serverless, and suitable for storing JSON documents?

Select 2 answers
A.Amazon Redshift
B.Amazon ElastiCache for Redis
C.Amazon DocumentDB (with MongoDB compatibility)
D.Amazon DynamoDB
E.Amazon RDS for MySQL
AnswersC, D

DocumentDB is a managed document database, supports JSON.

Why this answer

Amazon DocumentDB (with MongoDB compatibility) is a fully managed, serverless document database that natively stores JSON documents. It supports MongoDB workloads, allowing you to store, query, and index JSON data without managing infrastructure, making it ideal for content management and catalog applications.

Exam trap

AWS often tests the distinction between fully managed serverless services (DocumentDB, DynamoDB) and those requiring provisioning or cluster management (Redshift, ElastiCache, RDS), leading candidates to mistakenly select ElastiCache for Redis due to its JSON module support, ignoring its non-serverless nature and primary use as a cache.

289
MCQeasy

A data engineer has set up an Amazon S3 lifecycle policy to transition objects to Glacier Instant Retrieval after 30 days. After 60 days, objects should transition to Deep Archive. However, objects are not transitioning to Deep Archive. What is the most likely cause?

A.The bucket has versioning enabled.
B.Deep Archive is not supported in the bucket's region.
C.Objects are smaller than 128 KB.
D.The transition to Deep Archive requires a minimum of 30 days after the previous transition.
AnswerC

Objects must be at least 128 KB to transition to S3 Glacier Instant Retrieval. If objects are smaller, the first transition fails, preventing subsequent transitions.

Why this answer

Amazon S3 lifecycle policies have a minimum object size requirement for transitions to certain storage classes. Objects must be at least 128 KB to transition to S3 Glacier Instant Retrieval. Since the policy first transitions objects to Glacier Instant Retrieval after 30 days, objects smaller than 128 KB cannot undergo that transition, and subsequent transitions to Deep Archive will also fail.

The 30-day minimum interval requirement is met (30 days between transitions), so option D is not the cause. Versioning (A) does not prevent transitions, and Deep Archive (B) is supported in all commercial AWS regions. Therefore, the most likely cause is that objects are smaller than 128 KB.

Exam trap

Candidates often overlook the 128 KB minimum object size for transitions to S3 Glacier Instant Retrieval, mistakenly attributing the failure to the 30-day interval rule.

How to eliminate wrong answers

Option A is wrong because S3 versioning does not prevent lifecycle transitions; lifecycle policies can be applied to both current and noncurrent versions independently. Option B is wrong because Deep Archive is supported in all AWS regions where S3 is available, including the standard commercial regions. Option C is wrong because the 128 KB minimum object size restriction applies only to S3 Intelligent-Tiering and S3 Glacier Instant Retrieval for automatic tiering, not to lifecycle transitions to Deep Archive; lifecycle policies can transition objects of any size.

290
MCQmedium

Refer to the exhibit. A data engineer runs the above AWS CLI command to view the table metadata in the AWS Glue Data Catalog. The data is stored as CSV in S3 with partitions by year and month. When querying the table using Amazon Athena, no data is returned. What is the most likely cause?

A.The partitions have not been added to the Glue Data Catalog.
B.The SerDe is not compatible with CSV files.
C.The S3 location points to a file instead of a folder.
D.The column data types are incorrect for the CSV data.
AnswerA

Partitions must be explicitly registered for Athena to query them.

Why this answer

The AWS CLI command shown only retrieves table metadata, not partition metadata. In AWS Glue, partitions must be explicitly added to the Data Catalog via `MSCK REPAIR TABLE`, `ALTER TABLE ADD PARTITION`, or a Glue crawler. Without partition metadata, Athena cannot locate the data files under the partitioned S3 paths (e.g., `s3://bucket/year=2024/month=01/`), resulting in zero rows returned even though the table schema is defined.

Exam trap

The trap here is that candidates assume the `PARTITIONED BY` clause in the table definition automatically registers the partitions in the Glue Data Catalog, but it only defines the schema; partition metadata must be added separately.

How to eliminate wrong answers

Option B is wrong because the default SerDe for CSV in Athena (`LazySimpleSerDe`) is fully compatible with standard CSV files; no SerDe mismatch would cause zero rows. Option C is wrong because the `LOCATION` in the Glue table points to a folder (the base path), not a file; Athena expects a folder and would fail with an error if a file were specified, not silently return no data. Option D is wrong because incorrect column data types would cause query failures or data conversion errors, not an empty result set; Athena would still attempt to read the data and return rows with nulls or errors.

291
MCQmedium

Refer to the exhibit. A data engineer notices that the Redshift cluster 'mycluster' does not have automated backups beyond 7 days. However, the compliance team requires a minimum of 35 days of backup retention. What should the engineer do?

A.Change the node type to ra3.xlplus to enable automatic backups for 35 days.
B.Enable audit logging to capture changes for recovery.
C.Take manual snapshots every day and retain them for 35 days.
D.Modify the cluster's automated snapshot retention period to 35 days.
AnswerD

The retention period can be increased up to 35 days via modification.

Why this answer

Amazon Redshift allows you to modify the automated snapshot retention period for a cluster up to 35 days. The engineer can use the AWS Management Console, CLI, or API to change the `automated_snapshot_retention_period` parameter from the current 7 days to 35 days, meeting the compliance requirement without additional manual intervention.

Exam trap

The trap here is that candidates may confuse backup retention with node type capabilities or audit logging, assuming that hardware or logging features inherently extend backup duration, when in fact the retention period is a simple configuration parameter.

How to eliminate wrong answers

Option A is wrong because changing the node type to ra3.xlplus does not affect the automated backup retention period; retention is configured independently of node type. Option B is wrong because audit logging captures user activity and SQL queries for security and compliance, not for point-in-time recovery of data; it does not replace backup retention. Option C is wrong because while manual snapshots can be retained for 35 days, this approach requires daily manual effort and does not leverage the automated backup feature that is already available; modifying the automated retention period is simpler and more reliable.

292
MCQeasy

A data engineer needs to store streaming data from IoT devices for real-time analytics. The data has a fixed schema and requires low-latency queries. Which AWS service should be used?

A.Amazon DynamoDB
B.Amazon Redshift
C.Amazon S3
D.Amazon Timestream
AnswerD

Timestream is designed for time-series data with low-latency queries.

Why this answer

Amazon Timestream is a time-series database purpose-built for IoT and operational applications that generate large volumes of time-stamped data. It automatically manages data retention and storage tiers (memory and magnetic) to provide fast query performance for recent data and cost-effective storage for historical data, making it ideal for real-time analytics on streaming IoT data with a fixed schema.

Exam trap

AWS often tests the misconception that any database can handle time-series data equally well, but the trap here is that candidates choose DynamoDB for its low-latency reads, overlooking that Timestream is the only AWS service purpose-built for time-series workloads with native support for time-based partitioning, retention policies, and analytical functions.

How to eliminate wrong answers

Option A is wrong because Amazon DynamoDB is a NoSQL key-value and document database optimized for high-throughput, low-latency read/write operations on individual items, but it lacks native time-series optimizations such as automatic downsampling, interpolation, and time-based partitioning, making it less efficient for time-series queries like aggregations over time windows. Option B is wrong because Amazon Redshift is a petabyte-scale data warehouse designed for complex analytical queries on structured and semi-structured data using SQL, but it is not optimized for real-time streaming ingestion or low-latency queries on high-frequency time-series data; its batch-oriented architecture introduces higher latency for streaming use cases. Option C is wrong because Amazon S3 is an object storage service that provides durable, scalable storage for any type of data, but it does not support real-time querying directly; querying S3 requires services like Athena or S3 Select, which add latency and are not designed for sub-second, low-latency queries on streaming data.

293
MCQhard

A data engineer is designing a data lake on Amazon S3. The data is frequently accessed by multiple analytics services, and the company needs to enforce fine-grained access control based on data tags. Which combination of AWS services should be used?

A.S3 Block Public Access settings
B.AWS Lake Formation with tag-based access control
C.S3 Access Points with bucket policies
D.S3 Object Lambda with IAM policies
AnswerB

Lake Formation provides fine-grained access control using tags.

Why this answer

AWS Lake Formation with tag-based access control (TBAC) is the correct choice because it provides fine-grained, attribute-based access control (ABAC) at the column, row, and cell level across a data lake on S3. By assigning LF-tags to Data Catalog resources and defining permissions based on those tags, you can enforce granular access policies that scale without managing individual user-to-resource mappings. This directly meets the requirement for tag-driven, fine-grained access for multiple analytics services.

Exam trap

The trap here is that candidates often confuse S3 Access Points (which provide network-level or prefix-level restrictions) with the fine-grained, tag-driven access control that Lake Formation TBAC uniquely offers, leading them to pick Option C despite its inability to enforce column- or row-level security based on tags.

How to eliminate wrong answers

Option A is wrong because S3 Block Public Access settings only prevent public exposure of S3 objects and do not provide any fine-grained, tag-based access control for internal users or services. Option C is wrong because S3 Access Points with bucket policies can restrict access based on VPC or IP, but they do not natively support tag-based access control at the column or row level; they operate at the bucket or prefix level only. Option D is wrong because S3 Object Lambda transforms data on read but does not enforce access control based on data tags; IAM policies attached to it cannot dynamically filter data by tags without custom code, and it lacks the centralized governance Lake Formation provides.

294
MCQeasy

A data engineer needs to store JSON documents that are frequently accessed by a low-latency web application. The data does not require complex queries, and the access pattern is primarily by a key. Which AWS service is most appropriate?

A.Amazon ElastiCache for Redis
B.Amazon S3
C.Amazon RDS for MySQL
D.Amazon DynamoDB
AnswerD

DynamoDB provides low-latency key-value access for JSON documents.

Why this answer

Amazon DynamoDB is the most appropriate service because it is a fully managed NoSQL key-value and document database designed for single-digit millisecond latency at any scale. It natively supports JSON documents and provides fast, consistent access by primary key without requiring complex query capabilities, making it ideal for low-latency web applications.

Exam trap

The trap here is that candidates often confuse ElastiCache for Redis as a persistent data store for JSON documents, but it is primarily an in-memory cache with optional persistence, not a durable, low-latency database designed for primary key access patterns.

How to eliminate wrong answers

Option A is wrong because Amazon ElastiCache for Redis is an in-memory data store primarily used for caching, session management, and real-time analytics, not for persistent storage of JSON documents that need durability and key-based access with low latency. Option B is wrong because Amazon S3 is an object storage service with higher latency (typically tens to hundreds of milliseconds) and is not optimized for frequent, low-latency key-based lookups required by a web application. Option C is wrong because Amazon RDS for MySQL is a relational database that requires predefined schemas and supports complex queries via SQL, which is overkill and adds unnecessary overhead for simple key-based access to JSON documents.

295
Multi-Selecthard

A company uses Amazon DynamoDB to store session data for a web application. The application experiences throttling during peak hours. The data engineer needs to reduce throttling. Which THREE actions should the engineer take?

Select 3 answers
A.Use DynamoDB Accelerator (DAX) to cache read requests.
B.Increase the provisioned read capacity units.
C.Implement exponential backoff in the application.
D.Design the partition key to include a random suffix to distribute writes.
E.Enable auto scaling on the table.
AnswersA, C, D

Reduces read capacity consumption.

Why this answer

DynamoDB Accelerator (DAX) is an in-memory cache that reduces read latency and offloads read requests from the DynamoDB table, directly decreasing the number of read capacity units consumed. By caching frequently accessed session data, DAX mitigates throttling during peak hours without requiring changes to the table's provisioned capacity.

Exam trap

The trap here is that candidates confuse reactive scaling (auto scaling) or capacity increases with proactive throttling reduction techniques, while the correct answers focus on caching, request distribution, and retry logic that directly reduce the load on the table.

296
MCQhard

A company uses Amazon DynamoDB with on-demand capacity for a gaming application that experiences unpredictable traffic spikes. The application reads the same set of 'hot' items frequently. Users report high latency during peak hours. Which action would MOST effectively reduce read latency for the hot items?

A.Enable DynamoDB Accelerator (DAX) for the table.
B.Switch to provisioned capacity with auto-scaling.
C.Increase the read capacity units for the table.
D.Enable DynamoDB Global Tables for multi-region replication.
AnswerA

DAX caches hot items, reducing read latency.

Why this answer

DynamoDB Accelerator (DAX) is an in-memory cache that sits between the application and DynamoDB, providing microsecond read latency for frequently accessed items. Since the application reads the same set of 'hot' items repeatedly, DAX can serve these reads from its cache, bypassing the storage layer and reducing latency during traffic spikes without requiring any table schema changes.

Exam trap

The trap here is that candidates often confuse throughput capacity (RCUs/WCUs) with latency, assuming that increasing capacity will speed up individual reads, when in fact capacity only controls the rate of requests, not the response time per request.

How to eliminate wrong answers

Option B is wrong because switching to provisioned capacity with auto-scaling does not reduce read latency; it only manages throughput capacity based on load, but the underlying read latency from DynamoDB remains the same. Option C is wrong because increasing read capacity units (RCUs) is only applicable to provisioned capacity mode, not on-demand capacity, and even if it were, it would not reduce latency for hot items—it only increases the maximum throughput. Option D is wrong because DynamoDB Global Tables replicate data across regions for disaster recovery and low-latency reads from distant regions, but it does not reduce latency for reads within the same region; it adds complexity and cost without addressing the hot-item caching issue.

297
MCQmedium

The exhibit shows an S3 bucket policy. What is the effect of this policy?

A.Allows all S3 actions over HTTPS only.
B.Allows all S3 actions to the bucket over any protocol.
C.Denies all S3 actions to the bucket.
D.Allows only GetObject and PutObject over HTTPS.
AnswerD

Explicit allow for those actions over HTTPS; deny for HTTP.

Why this answer

The S3 bucket policy in the exhibit uses a condition key `aws:SecureTransport` set to `true`, which restricts access to HTTPS only. The `Effect` is `Allow` for `s3:GetObject` and `s3:PutObject` actions, meaning only these two actions are permitted over HTTPS. This matches option D.

Exam trap

The trap here is that candidates see the `Deny` statement and assume the entire policy denies all actions, overlooking the `Allow` statement that permits specific actions over HTTPS.

How to eliminate wrong answers

Option A is wrong because the policy does not allow all S3 actions; it explicitly allows only `s3:GetObject` and `s3:PutObject`. Option B is wrong because the policy denies all actions over non-HTTPS protocols via the `Deny` statement with `aws:SecureTransport=false`, and the `Allow` statement only permits HTTPS. Option C is wrong because the policy does not deny all S3 actions; it allows `GetObject` and `PutObject` over HTTPS, while only denying actions that do not use HTTPS.

298
MCQmedium

A data engineering team is designing a data lake on Amazon S3 with a folder structure that separates raw, transformed, and curated data. The team needs to implement lifecycle policies to minimize storage costs while ensuring that data in the 'raw' zone is retained for 90 days before being moved to Amazon S3 Glacier Deep Archive. Additionally, data in the 'curated' zone should be deleted after 365 days. What is the MOST cost-effective way to achieve these requirements?

A.Configure S3 Intelligent-Tiering on both prefixes with automatic archiving to Glacier Deep Archive after 90 days in raw and deletion after 365 days in curated.
B.Create separate lifecycle policies for each prefix: one to transition raw to S3 Glacier Deep Archive after 90 days, another to delete curated after 365 days.
C.Create a lifecycle policy that transitions raw zone data to S3 Standard-IA after 90 days and deletes curated zone data after 365 days.
D.Create a single lifecycle policy with two rules: one to transition raw zone objects to S3 Glacier Deep Archive after 90 days, and another to delete curated zone objects after 365 days.
AnswerD

This meets cost and retention requirements efficiently.

Why this answer

A single S3 lifecycle policy can contain multiple rules, each applying to different prefixes. This allows you to transition raw zone objects to S3 Glacier Deep Archive after 90 days and delete curated zone objects after 365 days, minimizing storage costs without needing separate policies. S3 lifecycle policies are evaluated per object based on creation date, and using one policy reduces management overhead.

Exam trap

The trap here is that candidates might think separate lifecycle policies are required for different prefixes, but AWS allows multiple rules within a single policy, making it more cost-effective and easier to manage than creating separate policies.

How to eliminate wrong answers

Option A is wrong because S3 Intelligent-Tiering does not support automatic archiving to Glacier Deep Archive after a fixed number of days; it moves objects between access tiers based on usage patterns, not a scheduled transition, and it cannot enforce deletion after a specific period. Option B is wrong because while separate lifecycle policies can achieve the requirements, they are not the most cost-effective or efficient approach; a single policy with multiple rules is simpler and avoids potential policy conflicts or duplication of management. Option C is wrong because transitioning raw zone data to S3 Standard-IA after 90 days does not meet the requirement to move it to Glacier Deep Archive, which is the lowest-cost storage class for long-term archival; Standard-IA is more expensive than Glacier Deep Archive for data that is rarely accessed.

299
MCQeasy

A data engineer is designing a data store for a real-time analytics application that requires sub-millisecond read and write latency. The data is key-value in nature and the workload is both read-heavy and write-heavy. Which AWS service is most suitable?

A.Amazon ElastiCache for Redis
B.Amazon DynamoDB
C.Amazon RDS for MySQL
D.Amazon S3
AnswerB

DynamoDB offers consistent single-digit millisecond latency at scale.

Why this answer

Amazon DynamoDB is the most suitable service because it is a fully managed NoSQL key-value and document database designed for single-digit millisecond latency at any scale, and with features like DynamoDB Accelerator (DAX) it can achieve sub-millisecond read latency. It supports both read-heavy and write-heavy workloads through its distributed architecture and auto-scaling capabilities, making it ideal for real-time analytics applications.

Exam trap

The trap here is that candidates often choose ElastiCache for Redis because of its sub-millisecond performance, overlooking that the question specifies a 'data store' for a write-heavy workload, which requires durability and persistence that Redis does not guarantee by default, whereas DynamoDB is a fully managed, durable database designed for such use cases.

How to eliminate wrong answers

Option A (Amazon ElastiCache for Redis) is wrong because while Redis provides sub-millisecond latency, it is an in-memory data store primarily designed for caching and not as a durable primary data store; data persistence is optional and can lead to data loss if not configured correctly, making it unsuitable for a write-heavy workload requiring durability. Option C (Amazon RDS for MySQL) is wrong because it is a relational database that incurs higher latency due to disk I/O and SQL query overhead, and it cannot consistently achieve sub-millisecond read and write latency for key-value workloads. Option D (Amazon S3) is wrong because it is an object storage service with eventual consistency for overwrite PUTS and DELETE operations, and its latency is typically in the tens to hundreds of milliseconds, far exceeding the sub-millisecond requirement.

300
Multi-Selecthard

A company is using Amazon Kinesis Data Streams to ingest real-time clickstream data. The data must be stored in Amazon S3 in near real-time with minimal overhead. Which THREE steps should the data engineer take to achieve this? (Choose THREE.)

Select 3 answers
A.Configure a Lambda function to transform data before delivery to S3.
B.Create a Kinesis Data Firehose delivery stream that delivers data to S3.
C.Use Kinesis Data Analytics to process and store data in S3.
D.Enable S3 cross-region replication for the destination bucket.
E.Enable S3 compression (e.g., GZIP) in Firehose.
AnswersA, B, E

Why this answer

A Lambda function can be used as a data transformation step within a Kinesis Data Firehose delivery stream. This allows the clickstream data to be transformed (e.g., parsed, enriched, or reformatted) before being delivered to Amazon S3, enabling near real-time storage with minimal operational overhead.

Exam trap

The trap here is that candidates may confuse Kinesis Data Analytics with a storage service or think that cross-region replication is needed for near real-time ingestion, when in fact Firehose with Lambda transformation and compression is the correct, minimal-overhead solution.

← PreviousPage 4 of 6 · 442 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Data Store Management questions.