CCNA Data Store Management Questions

Why this answer

How to eliminate wrong answers

Option A is wrong because Amazon Kinesis Data Analytics is designed for real-time stream processing using SQL or Apache Flink, not for querying static data already stored in S3; it requires a streaming data source and incurs ongoing processing costs. Option C is wrong because Amazon Redshift is a fully managed data warehouse that requires provisioning and managing clusters, which contradicts the 'no infrastructure management' requirement; it is also overkill for simple SQL queries on S3 data and incurs higher costs for idle compute. Option D is wrong because Amazon DynamoDB is a NoSQL key-value and document database, not designed for SQL queries on S3 data; it requires data to be loaded into tables and does not support direct querying of S3 objects.

Why this answer

How to eliminate wrong answers

Option B (Amazon DynamoDB) is wrong because it is a NoSQL key-value and document database optimized for low-latency, high-throughput read/write operations, not for cost-effective archival storage of rarely accessed logs; storing large volumes of infrequently accessed JSON logs in DynamoDB would incur significant costs for provisioned throughput and storage. Option C (Amazon RDS) is wrong because it is a relational database service designed for transactional workloads with structured data and frequent queries, not for storing semi-structured JSON logs at low cost; it would require schema management and incur higher per-GB storage costs compared to S3. Option D (Amazon Redshift) is wrong because it is a petabyte-scale data warehouse optimized for complex analytical queries on structured and semi-structured data, not for simple, cost-effective archival storage; using Redshift for rarely accessed logs would be over-provisioned and expensive due to its compute and storage costs.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because manually updating the schema in Athena is error-prone and does not scale with frequent schema changes; Hive-style partitions alone do not handle schema evolution. Option C is wrong because S3 Select operates on individual objects and returns data in CSV/JSON format, not Parquet, and it does not support schema evolution or table-level queries across multiple files. Option D is wrong because Redshift Spectrum requires manual schema updates for external tables and is not designed for automatic schema evolution like AWS Glue Data Catalog.

Why this answer

How to eliminate wrong answers

Option A is wrong because SSE-C encryption requires the client to provide the encryption key; if the key were missing, the error would be an encryption-related error (e.g., 'InvalidArgument' or 'AccessDenied' with a different message), not a generic 'S3AccessDeniedException'. Option B is wrong because the EMR service role is used for the cluster's service-level permissions (e.g., launching instances, reading logs), not for data access to S3; the instance profile (IAM role attached to EC2 instances) handles data read/write permissions, and the question states earlier stages succeed, indicating the instance profile has write permissions. Option D is wrong because the 'Bucket owner enforced' setting (S3 Object Ownership) controls ACLs and ownership of objects, not access permissions; it does not cause an 'S3AccessDeniedException' — it would affect who owns new objects, not whether the write is allowed.

Why this answer

How to eliminate wrong answers

Option A is wrong because increasing Kinesis shards to 8 would increase the number of concurrent Lambda consumers, potentially amplifying the write throttling issue by generating more parallel writes to DynamoDB. Option B is wrong because increasing Lambda concurrency to 20 would allow more simultaneous invocations, each writing up to 100 records, which would increase the aggregate write rate and worsen ProvisionedThroughputExceededException. Option C is wrong because increasing the batch size to 200 would cause each Lambda invocation to attempt writing more records at once, creating larger spikes in write demand that exceed the 1000 WCU limit.

Why this answer

How to eliminate wrong answers

Option B is wrong because switching to on-demand capacity mode would eliminate throttling but at a significantly higher cost for a read-heavy workload, and it does not leverage the existing provisioned capacity setup. Option C is wrong because increasing provisioned write capacity units (WCUs) does not address read throttling; the issue is read-heavy, so RCUs need adjustment, not WCUs. Option D is wrong because adding a GSI distributes reads across partitions but does not increase the table's total provisioned read capacity; it could even worsen throttling if the GSI's write capacity is not properly provisioned.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because modifying a read replica to be Multi-AZ does not trigger a failover; Multi-AZ is a separate feature for high availability within a single region, and read replicas are not part of the Multi-AZ failover mechanism. Option B is wrong because RDS does not automatically fail over to a read replica; automatic failover only occurs with Multi-AZ deployments, not with read replicas. Option D is wrong because deleting the primary DB instance does not cause the read replica to automatically become the primary; the read replica remains a read-only copy until manually promoted.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because using a random partition key with no clustering column would scatter data across partitions, requiring a full scan to find records for a specific user, which is highly inefficient. Option B is wrong because using 'timestamp' as the partition key would place each timestamp in a separate partition, making it impossible to query all records for a user without scanning multiple partitions, and the clustering column 'user_id' would not help retrieve the last 10 records per user efficiently. Option C is wrong because while 'user_id' as the partition key correctly groups data by user, having no clustering column means you cannot order records by timestamp, so retrieving the last 10 records would require fetching all records for that user and sorting them in application code, which is suboptimal.

Why this answer

How to eliminate wrong answers

Option B is wrong because the SerDe library is not incorrect for CSV files; Athena uses the LazySimpleSerDe by default for CSV, which is fully supported and does not cause zero rows. Option C is wrong because CSV is a widely supported table format in Athena, and Athena can query CSV files natively. Option D is wrong because Athena is designed to read tables from the Glue Data Catalog; in fact, Athena and Glue Data Catalog are tightly integrated, and this is a standard use case.

Why this answer

How to eliminate wrong answers

Option A is wrong because increasing read capacity units (RCUs) only raises the provisioned throughput limit, but does not inherently distribute reads more evenly across partitions; high latency during peak hours is often due to hot partitions or throttling, not insufficient capacity. Option B is wrong because adding a sort key to an existing table is not possible without recreating the table, and a sort key does not directly improve read distribution across partitions; it only enables more flexible query patterns within a partition. Option D is wrong because enabling DynamoDB global tables provides multi-region replication for disaster recovery and low-latency reads from multiple regions, but it does not improve read distribution across partitions within a single table or reduce latency for a single-region workload.

Why this answer

How to eliminate wrong answers

Option A is wrong because it denies PUT requests where `s3:x-amz-server-side-encryption` is `aws:kms`, which would block the very encryption method required, making it impossible to upload objects with SSE-KMS. Option C is wrong because it denies PUT requests where encryption is not `AES256`, which would enforce SSE-S3 (AES256) instead of SSE-KMS, failing the requirement for KMS-managed keys. Option D is wrong because it denies PUT requests where the encryption header is not set, which would block unencrypted uploads but does not specifically enforce SSE-KMS; it would also allow SSE-S3 or other encryption types if the header is present, missing the specific KMS requirement.

Why this answer

How to eliminate wrong answers

Option A is wrong because a cross-Region Read Replica requires manual promotion to become the primary, which is not automatic failover and introduces downtime during the promotion process. Option B is wrong because restoring from daily automated snapshots in another Region is a manual, point-in-time recovery process that can lose up to 24 hours of data and does not provide automatic failover. Option C is wrong because Multi-AZ only provides high availability within a single AWS Region, not across different Regions, and cannot protect against a regional outage.

Why this answer

How to eliminate wrong answers

Option B (DynamoDB Streams) is wrong because it captures a time-ordered sequence of item-level changes (inserts, updates, deletes) in a DynamoDB table, but it does not automatically expire or delete data; it is used for event-driven processing or replication, not for scheduled data removal. Option C (Global Tables) is wrong because it provides multi-region, fully replicated tables for low-latency access and disaster recovery, but it has no built-in mechanism to expire or delete items based on time. Option D (Point-in-Time Recovery) is wrong because it enables continuous backups of DynamoDB table data to restore to any point within the last 35 days, but it does not delete or manage the lifecycle of individual items.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because it only checks for the presence of any server-side encryption header (s3:x-amz-server-side-encryption), which could be AES256 (SSE-S3) or aws:kms (SSE-KMS), but does not enforce the use of a customer managed KMS key. Option B is wrong because using an Allow effect with a condition does not override a default implicit deny; to enforce a restriction, you must use an explicit Deny statement. Option D is wrong because it requires the encryption header to equal AES256, which enforces SSE-S3, not SSE-KMS with a customer managed key.

Why this answer

How to eliminate wrong answers

Option B (Amazon RDS for MySQL with InnoDB) is wrong because relational databases are optimized for complex queries and ACID transactions, not for high-throughput ingestion of many small, immutable writes; they incur overhead from indexing, locking, and transaction logs that limit write throughput. Option C (Amazon S3 with standard storage class) is wrong because S3 is an object store optimized for durability and high read throughput, but it has a minimum object size of 0 bytes and a write latency of tens to hundreds of milliseconds per PUT request, making it unsuitable for low-latency, high-frequency writes of many small files. Option D (Amazon Elastic Block Store volumes) is wrong because EBS provides block-level storage volumes attached to a single EC2 instance, which creates a bottleneck for distributed write workloads and does not natively support the high concurrency needed for thousands of simultaneous sensor writes.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because increasing the number of nodes changes the cluster configuration, which the question explicitly prohibits. Option C is wrong because ANALYZE updates table statistics for the query planner but does not reduce disk I/O caused by poor data layout or data movement. Option D is wrong because VACUUM reclaims disk space from deleted rows and sorts data, but it does not fundamentally redesign tables to reduce I/O; it only maintains existing design.

Why this answer

How to eliminate wrong answers

Option A is wrong because transitioning to S3 Standard-IA after 30 days would move data too early, incurring unnecessary costs for the first year when immediate access is needed, and the 2555-day expiration is correct but the storage class is not suitable for infrequent access after year one. Option B is wrong because transitioning to S3 Glacier Flexible Retrieval after 365 days is acceptable, but this option lacks an expiration action, so data would not be automatically deleted after 7 years, violating the requirement. Option C is wrong because transitioning to S3 One Zone-IA after 90 days is too early and does not provide the durability needed for financial data (single AZ risk), and the 365-day expiration is far too short for a 7-year retention requirement.

Why this answer

How to eliminate wrong answers

Option A is wrong because creating an IAM role for each partner and attaching a policy that grants access to specific objects does not inherently enforce time-limited access; the role would need additional mechanisms like STS to generate temporary credentials, and it does not provide the simplicity of a single URL. Option C is wrong because a bucket policy that allows access only from the partner's IP address range would grant access to all objects in the bucket (or a broader set) rather than restricting to specific objects, and it does not provide time-limited access. Option D is wrong because CloudFront signed URLs require CloudFront distribution and custom origin setup, which adds unnecessary complexity and cost; while they can restrict access to specific objects, they are not the simplest or most direct solution for S3 presigned URLs, and the question specifically asks for presigned URLs.

Why this answer

How to eliminate wrong answers

Option B is wrong because Amazon ElastiCache for Redis is an in-memory cache, not a durable data store; while it offers sub-millisecond latency, it is typically used for caching or session management and requires a separate persistent database to avoid data loss on node failure, making it unsuitable as the primary store for frequently updated JSON documents that must persist. Option C is wrong because Amazon S3 is an object storage service with eventual consistency for overwrite PUTS and higher latency (typically tens to hundreds of milliseconds) for read operations, and S3 Select is a server-side filtering feature that does not reduce latency for individual document reads or writes; it is not designed for frequent, low-latency updates. Option D is wrong because Amazon RDS for MySQL is a relational database that requires schema definition, does not natively store JSON as a first-class document model (though it supports JSON data type, it lacks the flexible schema and single-digit millisecond read/write performance of DynamoDB for key-value access patterns), and incurs higher operational overhead for scaling and connection management in a serverless architecture.

Why this answer

How to eliminate wrong answers

Option A is wrong because changing the sort key to descending order does not reduce read capacity consumption; it only affects the order of results, not the number of items read or the RCUs consumed. Option B is wrong because DynamoDB Streams are used for change data capture and triggering downstream processes, not for read performance optimization; read replicas are not a feature of DynamoDB. Option C is wrong because decreasing ReadCapacityUnits does not force caching; it throttles read requests, leading to ProvisionedThroughputExceededException errors and degraded performance, not optimization.

Why this answer

How to eliminate wrong answers

Option A is wrong because the SerDe 'org.apache.hadoop.hive.ql.io.parquet.serde.ParquetHiveSerDe' is specifically designed for Parquet files and is fully compatible; the error stems from the INPUTFORMAT, not the SerDe. Option C is wrong because if the S3 bucket location did not exist, Athena would return a 'Path not found' or 'Access denied' error, not a parsing error related to file format. Option D is wrong because table names in Athena can contain underscores without causing errors; underscores are valid characters in Hive/Athena table identifiers.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because adding a secondary sort key on 'customer_id' does not address the data distribution issue; sort keys only affect the order of data within each slice, not which slice holds the data, so queries still need to scan all slices. Option C is wrong because keeping DISTSTYLE EVEN with a different sort key does not co-locate rows with the same customer_id; EVEN distributes rows randomly across slices, so every query still scans all slices. Option D is wrong because DISTSTYLE ALL replicates the entire table to every node, which is inefficient for a large fact table due to excessive storage and maintenance overhead, and does not target the filter performance issue.

Why this answer

How to eliminate wrong answers

Option B is wrong because unloading the table to S3 and reloading is a heavy, manual process that does not reclaim space in place and can be avoided with a simple VACUUM; it also incurs additional S3 costs and time. Option C is wrong because increasing the cluster node count adds more storage and compute capacity but does not reclaim the existing wasted space from deleted rows, and it may not improve performance if the underlying data is fragmented. Option D is wrong because the ANALYZE command only updates table statistics for the query planner, it does not reclaim storage space or physically reorganize data affected by UPDATE/DELETE operations.

Why this answer

How to eliminate wrong answers

Option A is wrong because Amazon RDS for PostgreSQL is a relational database with a fixed schema, requiring predefined tables and indexes for JSON data, which cannot handle schema-less IoT logs at scale without manual sharding or performance tuning. Option B is wrong because Amazon Redshift is a columnar data warehouse optimized for analytical queries on structured data, not for low-latency point queries by device ID and timestamp, and its schema-on-write model conflicts with schema-less requirements. Option D is wrong because Amazon S3 is an object store that can store JSON logs but lacks native indexing and low-latency query capabilities; querying by device ID and timestamp would require scanning or external services like Athena, adding latency and complexity.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because AWS Database Migration Service (DMS) is designed for heterogeneous or homogeneous migrations with ongoing replication, but it introduces significant complexity and potential downtime during the full-load and change-data-capture phases; it is not the optimal approach for a simple major version upgrade of an existing RDS instance. Option C is wrong because modifying the DB instance and applying the upgrade immediately causes an in-place upgrade that typically results in several minutes of downtime (often 10–30 minutes or more) while the instance is stopped, upgraded, and restarted, which violates the goal of minimizing downtime. Option D is wrong because taking a snapshot and restoring it as a new instance with the upgraded version requires the source instance to be available during the snapshot (which can take time) and then the restore process creates a new instance that is not automatically synchronized with the original; this approach involves significant downtime for the snapshot creation and restore, and does not provide a seamless cutover.

Why this answer

How to eliminate wrong answers

Option A is wrong because Amazon ElastiCache for Redis is an in-memory cache designed for sub-millisecond read-heavy workloads and ephemeral data, not for durable storage of semi-structured JSON from IoT devices; it lacks native JSON document storage (though RedisJSON module exists, it adds cost and complexity) and is significantly more expensive per GB than DynamoDB for persistent data. Option C is wrong because Amazon RDS for MySQL is a relational database that requires schema definition, making it inefficient for semi-structured JSON data that varies in fields; it incurs higher costs due to provisioned IOPS and storage, and its write performance is limited by the underlying instance size and transaction overhead. Option D is wrong because Amazon Redshift is a columnar data warehouse optimized for complex analytical queries on large datasets, not for high-frequency writes from IoT devices; its minimum cost is high (starts at ~$0.25/hour for dc2.large), and it is overkill for occasional reads of semi-structured JSON, leading to wasted expenditure.

Why this answer

How to eliminate wrong answers

Option A is wrong because a single-AZ primary with automatic backups does not provide a standby in a different Availability Zone, nor does it create a readable replica in a secondary region; backups are for point-in-time recovery, not for immediate failover or read scaling. Option C is wrong because a single-AZ primary lacks the required standby in a different Availability Zone within the primary region; the cross-region read replica only addresses the secondary region requirement. Option D is wrong because enabling Multi-AZ in both regions does not create a cross-region read replica; Multi-AZ in the secondary region provides a standby within that region but does not establish a readable replica that can be promoted from the primary region.

Why this answer

How to eliminate wrong answers

Option A is wrong because client-side encryption using the Amazon S3 Encryption Client encrypts data before it is sent to S3, meaning the encryption keys are managed entirely by the client, not by AWS; this provides maximum control but is not a server-side encryption option and does not leverage S3's built-in encryption features. Option B is wrong because SSE-S3 uses Amazon S3-managed keys where AWS handles key management entirely, giving the data engineer no control over key rotation, access policies, or auditing. Option D is wrong because SSE-C requires the customer to provide their own encryption keys, but those keys are managed by the customer outside of AWS, and S3 does not store or manage them, meaning you lose the ability to use AWS-managed key rotation and auditing, and you must manage key distribution and lifecycle yourself.

Why this answer

How to eliminate wrong answers

Option A is wrong because Amazon FSx for HDFS is a managed HDFS-compatible file system that replicates the on-premises Hadoop architecture, which does not decouple compute from storage and incurs higher costs for both storage and compute, making it less cost-effective and scalable than S3. Option C is wrong because Amazon EBS is a block-level storage designed for single EC2 instance attachment, not for shared access across multiple services like EMR and Redshift Spectrum, and it lacks the scalability and cost efficiency of object storage. Option D is wrong because Amazon EFS is a POSIX-compliant file system that does not integrate natively with Redshift Spectrum (which requires S3 or external tables) and is not optimized for the high-throughput, parallel access patterns of Hadoop workloads.

Why this answer

How to eliminate wrong answers

Option A is wrong because a bucket policy that denies access to unencrypted requests does not encrypt data at rest; it only enforces encryption in transit or for API calls, leaving stored objects unencrypted. Option C is wrong because client-side encryption with AWS KMS requires the data engineer to manage encryption logic in the application, adding significant operational overhead and complexity. Option D is wrong because server-side encryption with AWS KMS (SSE-KMS) introduces additional overhead for managing KMS keys, key policies, and potential costs, making it less operationally efficient than SSE-S3 for this requirement.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because writing data to Amazon S3 and using S3 Select does not address DynamoDB write throttling; S3 is a different storage service and S3 Select is for querying data in S3, not for increasing DynamoDB write throughput. Option B is wrong because increasing provisioned read capacity units does not help with write throttling; the issue is write requests, not reads. Option C is wrong because switching to provisioned capacity with Auto Scaling could help, but the question specifies 'without changing the application' and the current setup uses on-demand capacity, which already scales automatically; the throttling during spikes suggests the spike exceeds the on-demand burst capacity, and Auto Scaling would not prevent throttling if the spike is too rapid or exceeds the maximum provisioned capacity.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a read replica cannot offload writes; it only handles read traffic, and writes must still go to the primary database, so it does not reduce write latency or storage bottlenecks. Option B is wrong because while io1 provides consistent IOPS, it is significantly more expensive than gp3 and does not offer the same baseline performance improvements for write-heavy workloads without also increasing storage; additionally, the question asks for the most effective action without changing the instance class, and gp3 is a more cost-effective and modern choice. Option C is wrong because Multi-AZ deployment provides high availability and automatic failover, but it does not improve write performance; in fact, synchronous replication to the standby can add slight latency to writes.

Why this answer

How to eliminate wrong answers

Option A is wrong because Amazon Redshift is a columnar data warehouse optimized for complex analytical queries on structured data, not for low-latency primary key lookups on JSON documents with frequent writes. Option B is wrong because Amazon S3 is an object storage service that does not support low-latency primary key lookups or native querying without additional services like Athena or S3 Select, and it is not designed for frequent, transactional read/write operations. Option D is wrong because Amazon RDS for MySQL is a relational database with a fixed schema, requiring schema changes for flexible JSON documents, and while it can handle JSON, it does not match DynamoDB's single-digit millisecond latency for primary key lookups at scale.

Why this answer

How to eliminate wrong answers

Option B (DynamoDB with TTL and S3 for archival) is wrong because DynamoDB is optimized for key-value and document workloads, not time-series analytics; TTL only deletes old data, but querying historical data from S3 requires additional services like Athena or Glue, increasing complexity and latency. Option C (Amazon Redshift) is wrong because Redshift is a columnar data warehouse designed for large-scale analytical queries on structured data, but it is over-provisioned and costly for 10 GB/day of time-series data, and its storage and compute are not optimized for time-series-specific operations like downsampling or retention policies. Option D (Amazon RDS with MySQL) is wrong because RDS is a relational database with fixed storage and compute, leading to higher costs for storing 3.65 TB of historical data (10 GB/day × 365 days) and poor query performance on time-series data without built-in time-series features like automatic retention or partitioning.

Why this answer

How to eliminate wrong answers

Option A is wrong because Amazon Redshift Spectrum is a feature of Amazon Redshift that allows querying data in S3 from within a Redshift data warehouse, but it requires an existing Redshift cluster and is not a standalone service for directly querying S3 data without a database. Option C is wrong because Amazon EMR is a big data platform that uses frameworks like Apache Spark, Hive, or Presto for querying S3 data, but it requires provisioning and managing clusters, which adds complexity and is not a serverless SQL-only solution. Option D is wrong because AWS Glue is a serverless data integration service primarily used for ETL (extract, transform, load) jobs and data cataloging, not for directly querying S3 data with SQL; while it can prepare data for Athena, it is not a query engine itself.

Why this answer

How to eliminate wrong answers

Option A is wrong because the COPY command loads data into Redshift-managed storage, which bypasses Spectrum's external query capability and incurs storage costs; Spectrum queries data directly from S3 without loading. Option C is wrong because Redshift Spectrum does not require a separate cluster; it runs on the existing Redshift cluster's compute nodes, leveraging the Spectrum layer to access S3. Option D is wrong because copying data from S3 to Redshift-managed storage defeats the purpose of Spectrum, which is to query data in place without moving it.

Why this answer

How to eliminate wrong answers

Option A is wrong because EC2 instance store provides ephemeral block storage that is physically attached to the host; it is not durable (data is lost on instance stop/termination) and cannot be shared concurrently across multiple EC2 instances. Option B is wrong because Amazon S3 is an object storage service, not a file system; it does not support standard file-level locking or NFS/SMB protocols required for concurrent file access from multiple EC2 instances without additional gateways or software. Option C is wrong because Amazon EBS provides block-level storage volumes that can only be attached to a single EC2 instance at a time (except for multi-attach EBS io1/io2 volumes, which are limited to specific instance types and have strict constraints, not a general solution for concurrent file access).

Why this answer

How to eliminate wrong answers

Option A is wrong because S3 Glacier Deep Archive is intended for data accessed at most once or twice per year with retrieval times of 12–48 hours, which is too slow for logs that may need occasional access within minutes after the first 30 days. Option B is wrong because S3 Standard is designed for frequently accessed data with no minimum storage duration, leading to higher costs for long-term retention of infrequently accessed logs. Option C is wrong because S3 One Zone-IA stores data in a single Availability Zone, which does not provide the durability and availability needed for critical log files that must survive an AZ failure, and it also has a 30-day minimum storage charge.

Why this answer

How to eliminate wrong answers

Option A is wrong because read replicas are used for read scaling and disaster recovery, not for backup retention; they do not provide point-in-time recovery or long-term retention. Option B is wrong because while manual snapshots can be retained indefinitely, taking daily manual snapshots is operationally inefficient and error-prone, and AWS Backup offers a more automated and managed solution with lifecycle policies. Option C is wrong because Amazon RDS automated backups have a maximum retention period of 35 days, which cannot be extended to 7 years.

Why this answer

How to eliminate wrong answers

Option B is wrong because sort keys control the physical order of data on disk for query performance, not the distribution of data across nodes; they cannot resolve disk space imbalances. Option C is wrong because compression reduces the storage footprint of data on disk but does not address the uneven distribution of data that causes some nodes to fill up while others remain underutilized. Option D is wrong because adding more nodes increases total cluster capacity but does not fix the underlying data skew; the new nodes would also experience uneven data loads if the distribution style remains unchanged.

Why this answer

How to eliminate wrong answers

Why this answer

How to eliminate wrong answers

Option A is wrong because enabling Multi-AZ deployment provides high availability through synchronous standby replication, but it does not increase write throughput or reduce write latency; in fact, it can slightly increase write latency due to the synchronous commit to the standby. Option B is wrong because increasing provisioned IOPS directly increases costs, as you pay for the provisioned IOPS regardless of usage, and the question explicitly asks to reduce write latency without increasing costs. Option C is wrong because adding a read replica offloads read traffic, which does nothing to address write latency caused by hitting the WriteIOPS limit; write operations still hit the same primary instance with the same IOPS ceiling.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because server access logging records requests made to the bucket for auditing purposes, but it does not enforce or configure encryption of data at rest. Option C is wrong because versioning preserves, retrieves, and restores every version of every object in the bucket, but it has no effect on encryption settings. Option D is wrong because a bucket policy can deny unencrypted uploads using a condition key like `s3:x-amz-server-side-encryption`, but it does not itself configure the encryption mechanism; it only enforces a policy requirement, whereas default encryption directly applies encryption to all objects.

Why this answer

How to eliminate wrong answers

Option A is wrong because the distribution key and sort key do not need to be the same; they serve different purposes—distribution key optimizes data locality for joins and aggregations, while sort key optimizes range-restricted scans. Option B is wrong because DISTSTYLE EVEN distributes rows randomly across slices, which would scatter a single customer's data across all nodes, increasing network traffic and reducing the benefit of the sort key for range scans. Option D is wrong because the sort key on order_date still helps even though the query filters on customer_id first; Redshift can apply predicate-based block pruning on the sort key after the distribution key filter narrows the relevant slices, and the sort key order (customer_id, order_date) means the date filter can still be used efficiently within each customer's data.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `s3:x-amz-server-side-encryption-aws-kms-key-id` is used to enforce the use of a specific AWS KMS key ID for SSE-KMS, not SSE-C. Option B is wrong because `s3:x-amz-server-side-encryption` is used to enforce the encryption mode (e.g., AES256 or aws:kms) for SSE-S3 or SSE-KMS, but it does not enforce the use of customer-provided keys required for SSE-C. Option D is wrong because `s3:x-amz-server-side-encryption-customer-algorithm` enforces the algorithm (e.g., AES256) used with SSE-C, but it does not enforce the presence of the customer-provided key itself, which is the core requirement for SSE-C.

Why this answer

How to eliminate wrong answers

Option A is wrong because converting to on-demand capacity mode before the sale would handle the spike without throttling, as on-demand scales instantly to any traffic, but the question's answer key incorrectly marks C as correct. Option B is wrong because setting a CloudWatch alarm to increase provisioned capacity when write throttling occurs is reactive and will cause throttling before the alarm triggers and capacity increases. Option D is wrong because enabling auto-scaling with a target utilization of 70% and a maximum capacity of 5000 WCU would work if configured in advance, but the table is not auto-scaled and the spike is sudden; auto-scaling has a cooldown period and cannot react instantly to a 10-minute spike.

Why this answer

How to eliminate wrong answers

Option A is wrong because ANALYZE updates table statistics for the query planner but does not change the physical layout of data; a Seq Scan can still occur if the table lacks proper sort keys. Option B is wrong because automatic compression is applied during data loading (COPY or INSERT) to reduce storage and I/O, but it does not affect the scan method or data ordering to avoid Seq Scans. Option D is wrong because VACUUM reclaims space from deleted rows and re-sorts data only if sort keys are already defined; without sort keys, VACUUM cannot eliminate Seq Scans.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the standby promotion itself is nearly instantaneous in RDS Multi-AZ; the delay is not due to promotion time but DNS propagation. Option B is wrong because RDS Multi-AZ automatically synchronizes the standby synchronously, and no manual promotion is required—the failover is fully automated. Option C is wrong because the application uses the same RDS endpoint (CNAME) before and after failover; no reconfiguration is needed.

Why this answer

How to eliminate wrong answers

Option A is wrong because bucket ACLs do not support condition keys like `aws:PrincipalOrgID` and cannot restrict write access to specific IAM roles across accounts; they also grant read access to 'all authenticated users' (a deprecated concept that includes any authenticated AWS user, not just the organization). Option B is wrong because S3 Object Ownership with 'bucket owner enforced' only ensures the bucket owner retains object ownership, but does not by itself restrict write access to authorized roles or grant read access to the organization; it must be combined with a bucket policy. Option D is wrong because an IAM policy attached to roles only controls permissions within the same account and cannot grant cross-account read access to the entire organization; an S3 Access Point can simplify access but does not inherently allow all organization accounts to read without additional bucket policies or resource-based policies.

Why this answer

How to eliminate wrong answers

Option A is wrong because S3 Intelligent-Tiering automatically moves data between access tiers based on usage patterns, but it incurs a monthly monitoring and automation fee per object, making it less cost-effective for purely infrequent access patterns with no variable usage. Option B is wrong because S3 One Zone-IA stores data in a single Availability Zone, which risks data loss if that AZ fails, and it does not meet the implied durability requirement for data that must be retrievable immediately. Option D is wrong because S3 Glacier Deep Archive is designed for archival data with retrieval times of 12 to 48 hours, not immediate retrieval, and thus fails the 'retrieved immediately' requirement.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because S3 Standard-IA has a minimum storage duration charge of 30 days and a per-GB retrieval cost, making it more expensive than S3 Standard for the first 30 days of frequent access, and it does not provide the ability to restore deleted files within 7 days. Option B is wrong because S3 One Zone-IA does not provide the same durability as S3 Standard (it stores data in a single Availability Zone) and lacks versioning or retention features to restore deleted files within 7 days; additionally, transitioning after 30 days incurs lifecycle transition costs. Option C is wrong because S3 Glacier Deep Archive has a minimum storage duration of 180 days and a retrieval time of 12 hours or more, which does not meet the requirement to restore deleted files within 7 days; S3 Object Lock only prevents object deletion or overwrites, but does not enable restoration of already deleted files.