Free DEA-C01 practice test: 30 questions with answers

Amazon Data Firehose can read from a Kinesis data stream and deliver to S3 with buffering and no servers to manage. Athena runs queries rather than ingesting streams, and a crawler only catalogs existing data.

AWS DataSync transfers files between on-premises NFS or SMB storage and S3, with scheduling, bandwidth limits and data validation. Kinesis Video Streams is for media streams, and Route 53 Resolver handles DNS queries.

Glue job bookmarks track processed data for incremental loads, and explicit schema checks plus CloudWatch logs give a traceable run history. Ignoring errors hides drift, and removing logging or changing the file format does not solve the problem.

Salting spreads a hot key across several partitions, and adaptive query execution can split skewed partitions at runtime in Spark SQL. Bigger drivers do not fix executor-side skew, and single-file or single-core layouts remove parallelism.

Glue Studio visual jobs let engineers define transforms and output formats without writing Spark code, and partition keys produce date-based S3 prefixes. The other services are query, compute or visualization tools rather than an ETL designer.

Amazon Managed Service for Apache Flink supports windowed aggregations over streaming data, such as five-minute tumbling windows per key. Athena works on stored data in batch, and AWS Backup and SNS do not aggregate streams.

Parquet stores data by column, so Athena reads only the columns a query needs, and partitioning lets it skip prefixes that do not match the filter. Snappy compression further reduces the bytes read. Small CSV files and one large CSV both increase scanned data, and Glacier retrieval is slow and costly for interactive queries.

A unique event identifier allows deduplication, and a merge keyed on that identifier makes repeated loads idempotent. Turning off acknowledgements risks data loss, and random object names or extra partitions do not prevent duplicates.

The Glue Data Catalog is a shared Hive-compatible metadata store used by Athena, Redshift Spectrum and EMR. RDS parameter groups, ElastiCache and Parameter Store do not hold table metadata for these engines.

DynamoDB with a partition key and sort key supports efficient range queries on time for one device with consistent low latency. Redshift is for analytic scans, and Glacier Deep Archive has retrieval delays unsuitable for live reads.

Distributing the small dimension to all nodes and the fact table by its join key keeps joins local to each node, which avoids broadcast or redistribution at query time. Other styles force data movement during the join.

Redshift Spectrum queries S3 data through external tables defined in an external schema, which can use the Glue Data Catalog. Snapshots and data sharing are for different purposes, and SFTP is not a Spectrum source.

AWS DMS can capture ongoing changes from the source and deliver them to S3 with low impact on the database. Nightly dumps are not near real time, and read replicas do not produce a data lake feed.

Partitioning on a commonly filtered column reduces scanned data, and compressed columnar formats such as Parquet with Snappy cut bytes read. Many small uncompressed files, disabling the catalog, and one bucket per row all increase cost or complexity.

On-demand capacity mode charges per request and scales to the traffic without capacity planning, which fits a short daily burst. Fixed provisioning pays for idle capacity, and reserved capacity is a billing commitment for steady use.

A global secondary index with the email as the partition key supports efficient queries on that alternate access pattern. More write capacity does not change the key design, and scans read the whole table.

Glue writes logs and metrics to CloudWatch, and an alarm on failure metrics can notify through SNS. Manual checks and disabling logs delay detection and remove the evidence needed for troubleshooting.

A redrive policy with a dead-letter queue moves messages that exceed the maximum receive count, so poison messages do not block processing. Longer visibility timeouts slow retries, and FIFO deduplication does not isolate failing messages.

AWS Glue Data Quality evaluates datasets against rule sets such as completeness and uniqueness checks, and can stop or flag pipelines. Macie finds sensitive data, Config checks resource settings, and Trusted Advisor gives account recommendations.

An S3 key sensor waits for the object and fails only after its timeout, which handles late arrivals cleanly. Long sleeps waste worker slots, and removing retries or the DAG does not fix the dependency.

Retry blocks define backoff for transient errors, and Catch routes failures to another state such as an SNS notification. Pass and Choice states do not handle errors, and a long Wait does not retry.

Glue publishes job state change events to EventBridge, and a rule can match FAILED states and send to an SNS topic for email. Polling and manual checks add work, and a trail records API calls without alerting.

Object-level read activity is recorded as S3 data events in CloudTrail, which are not logged by default. Management events cover control plane actions, VPC Flow Logs record network traffic, and AWS Config tracks configuration state.

Amazon Macie uses machine learning and pattern matching to discover sensitive data such as personal identifiers in S3. Inspector scans workloads for vulnerabilities, Shield protects against DDoS, and GuardDuty detects threats from activity logs.

Lake Formation grants can be scoped to specific columns of a catalog table, which limits what engines such as Athena can read. S3 ACLs work at object level, and IAM S3 policies cannot enforce column-level restrictions.

SSE-KMS with a customer managed key gives control over key policy and rotation, and KMS API calls are recorded in CloudTrail. SSE-S3 uses AWS-managed keys, and storing keys in public places or tags is unsafe.

Redshift dynamic data masking applies masking rules by role at query time, so the underlying value stays unchanged. Dropping the column or blocking all reads removes access entirely, and exporting copies the data into an uncontrolled place.

A read-only IAM role enforces least privilege for engineers, and Object Lock prevents overwriting or deleting protected objects during retention. Broad bucket permissions, shared root credentials and disabling audit trails all weaken governance.

aws:SourceVpce identifies the VPC endpoint a request came through, and a bucket policy that denies requests without that endpoint enforces the path. Time, MFA and principal tags do not limit the network path.

Secrets Manager stores the secret and can rotate database credentials on a schedule, and applications fetch the current value at runtime. Plain text variables, repositories and unencrypted tables do not rotate or protect secrets properly.