Select Two (Multi-Select) Questions

Set up an S3 event notification to trigger the Lambda function on object creation.

Why wrong: This triggers Lambda after data is written, not before.

Subscribe the Lambda function to the CloudWatch Logs log group for the Firehose stream.

Why wrong: This is for monitoring, not for data transformation.

Have the Lambda function write the transformed data directly to the S3 bucket.

Why wrong: This bypasses Firehose and is not the intended design.

AWS Lake Formation

Why wrong: Lake Formation is for data lake management, not transformation.

Amazon Athena CTAS queries

Why wrong: Athena is for querying, not transformation pipelines.

Amazon Kinesis Data Firehose

Why wrong: Firehose is for streaming, not batch transformation.

Increase the number of DPUs for the Glue job.

Why wrong: More DPUs improve performance but not data consistency.

Use a staging table in Redshift with a transaction to commit.

Why wrong: Adds complexity; not a direct diagnostic step.

Increase the number of shards in the Kinesis stream.

Why wrong: More shards increase parallelism but do not directly reduce Lambda throttling.

Decrease the batch window in the Lambda event source mapping.

Why wrong: Shorter windows increase invocations, worsening throttling.

Increase the Lambda reserved concurrency to 1000.

Why wrong: Reserved concurrency sets a limit but does not prevent throttling if the account limit is exceeded.

Disable logging for the DMS task to free memory.

Why wrong: Logging uses minimal memory; disabling it does not resolve OOM.

Enable Full LOB mode to handle LOBs more efficiently.

Why wrong: Full LOB mode loads entire LOBs into memory, worsening the issue.

The number of columns in the table.

Why wrong: Column count is not a primary factor for distribution.

The data type of the distribution key column.

Why wrong: Data type does not affect distribution performance.

S3 Transfer Acceleration

Why wrong: Transfer Acceleration speeds up uploads over long distances but does not provide immutability or streaming-specific benefits.

S3 Cross-Region Replication (CRR)

Why wrong: CRR copies objects to another region for redundancy, but is not a core requirement for immutability or streaming ingestion.

S3 Glacier Flexible Retrieval

Why wrong: Glacier Flexible Retrieval has retrieval times of minutes to hours.

S3 Glacier Deep Archive

Why wrong: Deep Archive has retrieval times of 12 hours or more.

Enable S3 Versioning on the bucket.

Why wrong: Versioning adds overhead and does not improve query performance.

Use server-side encryption with AWS KMS (SSE-KMS).

Why wrong: Encryption does not improve query performance.

Store data in CSV format with header rows.

Why wrong: CSV is not as efficient as columnar formats.

Use S3 server-side encryption with AWS KMS and an AWS managed key

Why wrong: AWS managed keys are not controlled by you and cannot be rotated on your schedule.

Use client-side encryption with keys stored in AWS Secrets Manager

Why wrong: Client-side encryption does not use S3 server-side encryption; keys are not managed by S3 and rotation is more complex.

Use S3 server-side encryption with S3 managed keys (SSE-S3)

Why wrong: SSE-S3 uses AWS-managed keys; you cannot control rotation.

Increase the number of DPUs and set 'coalesce(1)' in the script.

Why wrong: coalesce(1) reduces parallelism, increasing memory pressure on a single executor.

Decrease the number of DPUs and increase 'spark.shuffle.partitions'.

Why wrong: Decreasing DPUs reduces available memory, worsening the problem.

Set the 'RedshiftTempDir' parameter to a larger S3 bucket.

Why wrong: RedshiftTempDir is for staging data, not for resolving memory errors in Glue.

Check that the Glue job's VPC and security groups allow outbound traffic to the RDS instance

Why wrong: Network issues cause timeouts, not 'No suitable driver'.

Restart the Glue job with a higher timeout value

Why wrong: Restarting does not fix missing driver; the job will fail again.

Update the IAM role associated with the Glue job to allow 'rds:*' permissions

Why wrong: IAM permissions are for AWS API calls, not for driver loading.

Decrease the checkpoint interval to reduce state size.

Why wrong: More frequent checkpoints increase overhead.

Decrease the number of task managers to reduce CPU contention.

Why wrong: Fewer task managers reduce capacity.

Use ALL distribution for the 'sales' fact table to replicate data to every node and avoid data movement.

Why wrong: ALL distribution is for small dimension tables; replicating a large fact table wastes storage.

Use a compound sort key with the most frequently filtered column first.

Why wrong: Compound sort keys are less effective when queries filter on columns other than the first.

Choose AUTO distribution style for all tables and let Amazon Redshift automatically assign distribution.

Why wrong: AUTO may not always be optimal; manual selection can be better based on query patterns.

Enable S3 Transfer Acceleration on the bucket.

Why wrong: Transfer Acceleration speeds up transfers, does not encrypt.

Use client-side encryption before uploading objects to S3.

Why wrong: Client-side encryption encrypts before upload, but the question asks for data at rest which can be achieved server-side.

Attach a bucket policy that denies unencrypted PUT requests.

Why wrong: Bucket policies enforce whether objects must be encrypted at upload, but do not automatically encrypt data at rest.

Enable encryption at rest using the default DMS encryption settings.

Why wrong: DMS encryption at rest is for DMS internal storage, not S3; also does not meet customer-managed key requirement.

Configure the S3 bucket to use server-side encryption with S3 managed keys (SSE-S3).

Why wrong: SSE-S3 uses AWS-managed keys, not customer-managed.

Create an AWS KMS key and use it in the DMS endpoint to encrypt data in transit.

Why wrong: KMS keys are not used for transit encryption; SSL/TLS is used.

Create a column-level filter on the PII columns that limits access based on the user's training attribute.

Why wrong: Column-level filters do not support attributes; they filter by column name.

Create an IAM role for each user and attach a policy that allows 'lakeformation:GetDataAccess' only if the user has the training attribute.

Why wrong: IAM roles cannot be granted LF-tag permissions; Lake Formation manages grants.

Increase the Spark shuffle partitions to 500.

Why wrong: More partitions can increase overhead; optimal value depends on data.

Write the output as JSON instead of Parquet to avoid compression overhead.

Why wrong: JSON is larger and slower to read than Parquet.

Disable S3 Block Public Access on the bucket.

Why wrong: Block Public Access does not affect IAM role access.

Grant the GlueServiceRole permission to write to the AWS Glue Data Catalog.

Why wrong: Catalog permissions are for metadata, not S3 write.

Ensure the Glue job is in the same VPC as the S3 bucket.

Why wrong: S3 is global; VPC endpoints are for private connectivity, not permissions.

Increase the number of files by reducing file size to 1 MB

Why wrong: Many small files increase metadata overhead and slow down queries.

Use bucketing on high-cardinality columns

Why wrong: Bucketing helps with joins and sampling but not as universally as partitioning.