AWS Data Engineer Associate — AWS practice for the AWS Data Engineer Associate credential

Which service is BEST for a sub-15-minute S3-triggered JSON-to-Parquet transform on small files?

1. Amazon EMR on EC2 with a persistent Spark cluster
2. AWS Glue Studio job set to G.1X workers on a 5-minute schedule
3. AWS Lambda triggered by the S3 ObjectCreated event
4. Amazon Redshift COPY command from S3 loaded on a nightly job

Answer: C — AWS Lambda triggered by the S3 ObjectCreated event

A) EMR is over-provisioned for tiny event-driven work. B) Glue jobs have longer cold-start than Lambda for tiny files. C) Lambda is the simplest, fastest, cheapest option for sub-15-minute event-driven transforms. D) COPY loads into Redshift; it does not produce Parquet on S3.

Which is the BEST way to ingest hundreds of small IoT MQTT messages per second?

1. AWS IoT Core routing to Kinesis Data Streams or Firehose
2. Amazon API Gateway HTTP endpoint invoked from every device on the fleet
3. Amazon SQS Standard directly published from each device using AWS credentials
4. Amazon EventBridge with a device-specific rule per fleet member deployed

Answer: A — AWS IoT Core routing to Kinesis Data Streams or Firehose

A) IoT Core natively handles MQTT at scale and routes to Kinesis, Firehose, or Lambda. B) Direct API Gateway per device does not scale device-side. C) Handing devices AWS credentials is a security anti-pattern. D) Per-device rules do not scale.

Which is TRUE about a Kinesis Data Streams shard?

1. It provides 2 MB/s ingest and 1 MB/s egress per consumer
2. It provides 5 MB/s ingest and 10 MB/s egress with a 5000 records/s write cap
3. It provides 1 MB/s ingest and 2 MB/s egress with a 1000 records/s write cap
4. It provides unlimited throughput scaled automatically by the service

Answer: C — It provides 1 MB/s ingest and 2 MB/s egress with a 1000 records/s write cap

A) The numbers are reversed — this is the direction-reversal trap. C) Correct: 1 MB/s in, 2 MB/s out, 1000 records/s write cap. Enhanced fan-out lifts per-consumer read limits. B) Those are inflated fabricated numbers. D) Streams scale by adding shards; they are not auto-unlimited.

Which is TRUE about Iceberg schema evolution on S3?

1. Adding, dropping, or renaming columns is safe without rewriting Parquet data files
2. Every column addition requires a full rewrite of every Parquet file for the table
3. Only columns of type STRING are allowed to evolve after the initial CREATE TABLE
4. Schema evolution requires switching the table from Iceberg to Delta Lake first

Answer: A — Adding, dropping, or renaming columns is safe without rewriting Parquet data files

A) Iceberg's schema evolution is metadata-only for adds, drops, renames, and type promotion — no data rewrite. B) Metadata-only is the whole point. C) All types evolve. D) No format switch is needed.

Which is TRUE of Redshift concurrency scaling?

1. It caches every query result in S3 for future dashboard hits
2. It replaces the primary cluster during a heavy write burst
3. It is only available with dc2 provisioned node types today
4. It adds transient read clusters billed per second when active

Answer: D — It adds transient read clusters billed per second when active

D) Concurrency Scaling adds transient read clusters billed per second (with a free-hour credit). B) The primary cluster is never replaced during scaling. C) Available on ra3 and Serverless too. A) Result caching is separate.

Which is the BEST layout for an Athena table storing 10 years of daily events?

1. Parquet files partitioned by year, month, and day with Snappy compression
2. One large CSV file per year stored in a flat prefix without partitioning
3. JSON documents grouped by user id in a single flat S3 prefix without partitions
4. Avro files with all events for the decade written into a single un-partitioned prefix

Answer: A — Parquet files partitioned by year, month, and day with Snappy compression

A) Columnar + time-partitioned is the canonical Athena layout for pruning. B) CSV is row-based and huge files are hard to prune. C) Un-partitioned JSON forces full scans. D) Avro is row-based and un-partitioned is worst-case.

Which BEST captures DEA-C01 exam topic coverage?

1. Only Athena SQL and the Glue Data Catalog with light governance content
2. Only Redshift internals with a small IAM section for cluster access control
3. Only Kinesis and MSK streaming plus their integrations with Lambda
4. Ingestion, storage, processing, querying, governance, security, monitoring, and cost

Answer: D — Ingestion, storage, processing, querying, governance, security, monitoring, and cost

D) Standard exam scope: ingestion, storage, processing, query, governance, security, monitoring, cost — spanning the four DEA domains. B) Too narrow. C) Too narrow. A) Too narrow.

Which is the BEST way to unblock a stuck DMS task with a no-primary-key error?

1. Add a primary key to the source table or enable supplemental logging for CDC
2. Restart the DMS replication instance with a larger instance class immediately
3. Delete the target endpoint and let DMS re-provision it automatically
4. Turn off encryption at rest on the target S3 bucket to speed replication

Answer: A — Add a primary key to the source table or enable supplemental logging for CDC

A) DMS CDC needs a primary key or equivalent unique identifier; add one or enable supplemental logging on the source. B) Instance size does not fix a schema issue. C) Endpoint deletion does not help. D) Encryption is unrelated.

Which is the BEST way to catch runaway Athena queries early?

1. CloudFront rate-based rules blocking Athena API calls from users
2. An SSM Session Manager audit trail on the query terminal session
3. Workgroup query-scanned-data limits with alarms on breach
4. Trusted Advisor best-practice checks on Athena configuration daily

Answer: C — Workgroup query-scanned-data limits with alarms on breach

C) Workgroups can cap per-query scanned data and alert on breach — the standard cost guardrail. B) SSM is not Athena governance. A) CloudFront is web CDN. D) Trusted Advisor is account-wide, not per-query.

Which is the BEST way to detect unauthorized access to sensitive S3 objects?

1. Enable S3 server access logging or CloudTrail S3 data events and alert on anomalies
2. Enable Requester Pays on the bucket so callers pay for their own access
3. Configure Transfer Acceleration so unauthorized users are charged extra bandwidth
4. Disable KMS integration so decrypt calls are unnecessary for the objects

Answer: A — Enable S3 server access logging or CloudTrail S3 data events and alert on anomalies

A) Server access logging and CloudTrail data events provide the audit trail needed for detection and alerting. B) Requester Pays affects billing, not detection. C) TA is about upload speed. D) Disabling KMS reduces security, not access visibility.

Which encryption approach fits a Redshift cluster storing regulated PII?

1. AES-256 with an AWS-owned KMS key managed transparently by Redshift
2. Client-side encryption performed inside each ELT script before COPY runs
3. AES-256 with a customer-managed KMS key and CloudTrail data events
4. Column-level encryption disabled to accelerate queries on large tables

Answer: C — AES-256 with a customer-managed KMS key and CloudTrail data events

A) An AWS-owned key gives no audit or rotation control. C) A customer-managed KMS key plus CloudTrail data-event logging supports rotation and audit — the compliance pattern. B) Client-side encryption breaks Redshift's query engine — it cannot filter encrypted values. D) Disabling encryption is the opposite of the requirement.

Which is TRUE about VPC endpoints for S3?

1. Gateway endpoints keep S3 traffic on the AWS backbone and support bucket-policy conditions
2. Interface endpoints for S3 are the only supported mode and use public IPs by default
3. Gateway endpoints require an internet gateway attached to the subnet route table
4. VPC endpoints for S3 replace IAM permissions on the buckets they route to

Answer: A — Gateway endpoints keep S3 traffic on the AWS backbone and support bucket-policy conditions

A) S3 gateway endpoints keep traffic on the AWS backbone and enable aws:sourceVpce policy conditions. B) Both gateway and interface endpoints exist; gateway is the classic mode. C) Gateway endpoints avoid needing an IGW. D) Endpoints do not replace IAM.

Passing score?

720/1000.

Managed Workflows for Apache Airflow (MWAA)?

Managed Apache Airflow service. For complex orchestration with DAGs in Python.

What is the medallion architecture?

Lakehouse organized into bronze (raw), silver (cleansed/joined), and gold (curated/aggregated) layers — clarifying responsibilities and supporting incremental refinement.

S3 encryption options?

SSE-S3 (S3-managed keys), SSE-KMS (KMS keys, audit, fine-grained), SSE-C (customer-provided), DSSE-KMS (dual-layer).

Glue DataBrew?

Visual data prep tool. 250+ transformations. No coding. Targets analysts.

Redshift encryption?

At rest with KMS or HSM keys. In-transit with SSL. Column-level encryption via KMS or app-level.