AWS DEA-C01 · Updated 2026
Free AWS Data Engineer Associate Practice Exam (DEA-C01)
Full-length DEA-C01 mock exams with the same number of questions and time as the real exam. Ingestion, transformation, data stores, operations and governance scenarios, answers explained, and your score by domain.
1. Choose a set
2. Choose a mode
65 questions · 2 hours 10 min · same as the real exam
You have an unfinished attempt on this set.
Questions 1–10Page 1 of 7
🏆
Question 1Ingestion & Transformation
A ride-sharing company streams GPS events into Amazon Kinesis Data Streams and uses the city name as the partition key. Most traffic comes from three large cities, and producers get ProvisionedThroughputExceededException errors even though total stream usage is well below capacity. Which change BEST resolves the errors?
Correct answer: C. Use a high-cardinality value such as the trip ID as the partition key.
The errors come from hot shards, because a low-cardinality key sends most records to a few shards. A high-cardinality key such as trip ID spreads writes evenly across all shards. Enhanced fan-out only adds read throughput for consumers and does not change per-shard write limits.
The errors come from hot shards, because a low-cardinality key sends most records to a few shards. A high-cardinality key such as trip ID spreads writes evenly across all shards. Enhanced fan-out only adds read throughput for consumers and does not change per-shard write limits.
Question 2Data Store Management
A media company stores raw application logs in S3 Standard. Logs are read often for 30 days, rarely for the rest of the first year, and must be kept for seven years for audits, where retrieval within 48 hours is acceptable. Which configuration is the MOST cost-effective?
Correct answer: B. Lifecycle rule to S3 Standard-IA at 30 days and S3 Glacier Deep Archive at 365 days
Standard-IA lowers cost for data that is rarely read after 30 days, and Glacier Deep Archive is the cheapest class for long-term retention with retrieval in hours. Expiring objects at 365 days breaks the seven-year audit rule. Moving to Glacier Instant Retrieval on day 1 adds retrieval fees during the busy first month.
Standard-IA lowers cost for data that is rarely read after 30 days, and Glacier Deep Archive is the cheapest class for long-term retention with retrieval in hours. Expiring objects at 365 days breaks the seven-year audit rule. Moving to Glacier Instant Retrieval on day 1 adds retrieval fees during the busy first month.
Question 3Data Operations
A logistics company orchestrates a nightly pipeline with AWS Step Functions. One state starts an AWS Glue job that sometimes fails with a transient throttling error from a source API, and a manual rerun always succeeds. The team wants the pipeline to recover from these failures automatically without writing custom code. Which solution BEST meets these requirements?
Correct answer: D. Add a Retry field to the Glue task state with exponential backoff.
A Retry field on the task state retries the Glue job automatically with exponential backoff and needs no custom code. A Catch with an SNS notice only alerts people, so recovery is still manual.
A Retry field on the task state retries the Glue job automatically with exponential backoff and needs no custom code. A Catch with an SNS notice only alerts people, so recovery is still manual.
Question 4Security & Governance
An AWS Glue job reads source files from an S3 bucket encrypted with SSE-KMS using a customer managed key and writes results to another bucket. The job fails with an AccessDenied error on read, even though its IAM role allows s3:GetObject on the source bucket. Which change BEST fixes the problem while following least privilege?
Correct answer: A. Allow kms:Decrypt on that key for the Glue role in the role policy and key policy.
Reading SSE-KMS objects also needs kms:Decrypt on the key, allowed by both the IAM policy and the key policy. Switching to SSE-S3 removes the company's control over the key, which weakens the encryption design instead of fixing permissions.
Reading SSE-KMS objects also needs kms:Decrypt on the key, allowed by both the IAM policy and the key policy. Switching to SSE-S3 removes the company's control over the key, which weakens the encryption design instead of fixing permissions.
Question 5Ingestion & Transformation
A media company has one Kinesis data stream with 10 shards. Five consumer applications read from it with shared throughput, and each now sees read throttling and latency above one second. Each consumer needs its own read throughput with the lowest latency. What should the data engineer do?
Correct answer: B. Register each consumer application for enhanced fan-out.
Enhanced fan-out gives each registered consumer a dedicated 2 MB per second per shard and pushes records over HTTP/2, usually in about 70 ms. Adding shards raises total capacity, but consumers still share each shard's read limits. Calling GetRecords more often makes throttling worse because each shard allows only five calls per second.
Enhanced fan-out gives each registered consumer a dedicated 2 MB per second per shard and pushes records over HTTP/2, usually in about 70 ms. Adding shards raises total capacity, but consumers still share each shard's read limits. Calling GetRecords more often makes throttling worse because each shard allows only five calls per second.
Question 6Data Store Management
A data lake team stores 800 TB of datasets in S3. Access patterns differ by dataset, change over time, and cannot be predicted. The team wants storage cost to drop automatically with no retrieval fees and no performance impact. Which storage class should it use?
Correct answer: A. S3 Intelligent-Tiering
Intelligent-Tiering moves objects between access tiers based on actual use and charges no retrieval fees, so it suits unknown or changing patterns. Standard-IA is cheaper to store, but it charges per GB retrieved, which can cost more when data is read often.
Intelligent-Tiering moves objects between access tiers based on actual use and charges no retrieval fees, so it suits unknown or changing patterns. Standard-IA is cheaper to store, but it charges per GB retrieved, which can cost more when data is read often.
Question 7Data Operations
A retailer receives vendor files in an Amazon S3 bucket at random times during the day. Each new file must start an AWS Step Functions workflow that validates and loads it. The team wants a serverless, event-driven design with the least custom code. Which solution BEST meets these requirements?
Correct answer: D. Enable EventBridge on the bucket and route Object Created events to the state machine.
With EventBridge enabled on the bucket, an Object Created rule can start the state machine directly for each file with no polling code. A scheduled Lambda that lists the bucket adds custom code and delay, and it can miss or double-process keys.
With EventBridge enabled on the bucket, an Object Created rule can start the state machine directly for each file with no polling code. A scheduled Lambda that lists the bucket adds custom code and delay, and it can miss or double-process keys.
Question 8Ingestion & Transformation
A retailer uses Amazon Data Firehose to deliver clickstream data to Amazon S3. Athena queries are slow because the bucket holds millions of objects smaller than 1 MB. Data may arrive in S3 up to 10 minutes after it is sent. Which change BEST fixes the problem with the least effort?
Correct answer: A. Raise the buffer size to 128 MiB and the buffer interval to 600 seconds.
Firehose writes an object when either the buffer size or the buffer interval is reached first. Larger buffer hints create fewer, larger objects within the allowed 10-minute delay, with no new code. A merge function would also cut the file count, but it adds custom code and more operational work.
Firehose writes an object when either the buffer size or the buffer interval is reached first. Larger buffer hints create fewer, larger objects within the allowed 10-minute delay, with no new code. A merge function would also cut the file count, but it adds custom code and more operational work.
Question 9Security & Governance
A data lake on AWS Lake Formation has hundreds of tables, and new tables are added weekly. Access depends on data sensitivity and business unit. Admins currently grant permissions table by table, which does not scale. Which solution BEST meets these requirements with the least ongoing effort?
Correct answer: C. Create LF-Tags for sensitivity and business unit and grant on tag expressions.
LF-Tag based access control grants permissions on tag expressions, so new tables get access as soon as they are tagged. Bucket policies by prefix do not give table or column control and must be updated as tables grow.
LF-Tag based access control grants permissions on tag expressions, so new tables get access as soon as they are tagged. Bucket policies by prefix do not give table or column control and must be updated as tables grow.
Question 10Data Store Management
An Amazon Redshift cluster joins a 2-billion-row sales fact table to a 300-million-row customers table on customer_id. Query plans show large redistribution steps for every join. Which change BEST reduces this data movement?
Correct answer: A. Set both tables to KEY distribution on customer_id.
KEY distribution on the join column places matching rows from both tables on the same slice, so the join needs no redistribution. ALL distribution copies a table to every node, which is not practical for 300 million rows and slows loads. EVEN distribution ignores the join key.
KEY distribution on the join column places matching rows from both tables on the same slice, so the join needs no redistribution. ALL distribution copies a table to every node, which is not practical for 300 million rows and slows loads. EVEN distribution ignores the join key.
Question 11Ingestion & Transformation
A logistics company sends JSON telemetry through Amazon Data Firehose to Amazon S3. The data team wants the files stored as Apache Parquet to lower Athena scan costs, without writing or running any conversion code. What should the team do?
Correct answer: D. Turn on Firehose record format conversion with a schema from an AWS Glue table.
Firehose can convert JSON input to Parquet or ORC natively, using a table in the AWS Glue Data Catalog as the schema, so no custom code is needed. A nightly Glue job works, but it adds a separate job to build and manage, and the data stays in JSON until the job runs.
Firehose can convert JSON input to Parquet or ORC natively, using a table in the AWS Glue Data Catalog as the schema, so no custom code is needed. A nightly Glue job works, but it adds a separate job to build and manage, and the data stays in JSON until the job runs.
Question 12Data Operations
A media company gives several analyst teams access to Amazon Athena. Last month one analyst ran ad hoc queries on raw logs that scanned many terabytes and caused a large bill. The company wants to cap the data each query can scan for the analyst teams while finance queries remain unrestricted. Which solution BEST meets these requirements?
Correct answer: B. Create a separate Athena workgroup for analysts with a per-query data usage control limit.
Athena workgroups support per-query data usage controls that cancel any query scanning more than the set limit, and finance can stay in a different workgroup. A budget alert only reports spend after it happens and does not stop a large query.
Athena workgroups support per-query data usage controls that cancel any query scanning more than the set limit, and finance can stay in a different workgroup. A budget alert only reports spend after it happens and does not stop a large query.
Question 13Ingestion & Transformation
A fintech company runs a self-managed Apache Kafka cluster on Amazon EC2. Dozens of producer and consumer applications use the Kafka client libraries and Kafka Connect. The company wants to reduce cluster management work without changing application code. Which service should it move to?
Correct answer: C. Amazon Managed Streaming for Apache Kafka (Amazon MSK)
Amazon MSK runs Apache Kafka as a managed service, so existing Kafka clients and Connect workloads keep working after an endpoint change. Kinesis Data Streams is also managed, but it uses a different API, so every application would need code changes.
Amazon MSK runs Apache Kafka as a managed service, so existing Kafka clients and Connect workloads keep working after an endpoint change. Kinesis Data Streams is also managed, but it uses a different API, so every application would need code changes.
Question 14Data Store Management
Most queries on a large Amazon Redshift events table filter on a narrow range of event_time, such as the last seven days. The queries scan far more blocks than they need. What should the data engineer change?
Correct answer: B. Make event_time the sort key of the table.
With event_time as the sort key, Redshift stores rows in time order and uses zone maps to skip blocks outside the filtered range. A timestamp distribution key does not help range filters and can spread data unevenly across slices.
With event_time as the sort key, Redshift stores rows in time order and uses zone maps to skip blocks outside the filtered range. A timestamp distribution key does not help range filters and can spread data unevenly across slices.
Question 15Security & Governance
A global company stores sales data in a Lake Formation governed table. European analysts must see only rows where region is EU, and they must not see the customer_email column. Other analysts can see all data. Which solution BEST meets these requirements?
Correct answer: D. Create a data cell filter with an EU row filter that excludes the email column.
A Lake Formation data cell filter combines a row filter expression with column exclusion and is granted like a table permission. A view with direct S3 access lets analysts read the raw files and bypass the filter.
A Lake Formation data cell filter combines a row filter expression with column exclusion and is granted like a table permission. A view with direct S3 access lets analysts read the raw files and bypass the filter.
Question 16Data Operations
A bank runs reporting dashboards on an Amazon Redshift provisioned cluster. At the start of each month, hundreds of users run read queries at the same time and queries wait in queues for minutes. The rest of the month the cluster is lightly used. The bank wants to handle the monthly burst without paying for a larger cluster all month. Which solution BEST meets these requirements?
Correct answer: B. Enable concurrency scaling on the WLM queue used by the dashboard queries.
Concurrency scaling adds transient cluster capacity for queued read queries during bursts and is billed only while in use. A permanent resize pays for peak capacity all month, which fails the cost goal.
Concurrency scaling adds transient cluster capacity for queued read queries during bursts and is billed only while in use. A permanent resize pays for peak capacity all month, which fails the cost goal.
Question 17Ingestion & Transformation
A gaming company streams player events into Kinesis Data Streams. It must compute rolling five-minute scores per player in real time, keep that state if a node fails, and emit results within seconds. The team has Java developers and wants a managed service. What should it use?
Correct answer: C. Managed Service for Apache Flink with a stateful windowed application
Managed Service for Apache Flink supports stateful stream processing with windows and checkpoints that restore state after a failure. Lambda can process stream records, but memory is not kept reliably between invocations and it has no built-in window state. A scheduled Glue batch job cannot emit results within seconds.
Managed Service for Apache Flink supports stateful stream processing with windows and checkpoints that restore state after a failure. Lambda can process stream records, but memory is not kept reliably between invocations and it has no built-in window state. A scheduled Glue batch job cannot emit results within seconds.
Question 18Data Store Management
A company keeps the last 12 months of sales in Amazon Redshift and five years of older sales as Parquet files in S3, cataloged in the AWS Glue Data Catalog. Analysts sometimes need to join the older sales with current dimension tables in Redshift, without loading the old data. What should the team use?
Correct answer: A. Amazon Redshift Spectrum with an external schema
Redshift Spectrum queries S3 data through an external schema that points to the Glue Data Catalog, and it can join those external tables with local tables in one query. COPY would load the old data into the cluster, which the team wants to avoid.
Redshift Spectrum queries S3 data through an external schema that points to the Glue Data Catalog, and it can join those external tables with local tables in one query. COPY would load the old data into the cluster, which the team wants to avoid.
Question 19Security & Governance
An AWS Glue job connects to an Amazon RDS for PostgreSQL database with a user name and password stored in the job script. A security review requires that credentials be removed from code and rotated every 30 days automatically. Which solution BEST meets these requirements?
Correct answer: D. Store the credentials in AWS Secrets Manager with automatic rotation enabled.
Secrets Manager keeps the credentials out of code and supports scheduled automatic rotation for RDS databases. Parameter Store can store them securely, but it has no built-in rotation, so rotation stays manual.
Secrets Manager keeps the credentials out of code and supports scheduled automatic rotation for RDS databases. Parameter Store can store them securely, but it has no built-in rotation, so rotation stays manual.
Question 20Ingestion & Transformation
A healthcare analytics firm receives small CSV files in an S3 bucket throughout the day, each under 5 MB. Each file needs a few columns renamed and a timestamp added, then must be written to another bucket within a minute of arrival. The team wants the least operational overhead. Which solution BEST fits?
Correct answer: A. Use an S3 event notification to invoke a Lambda function for each file.
An S3 event notification invokes Lambda as soon as each object is created, and a light transform of a small file fits easily within Lambda limits. A Glue job every minute adds startup time and cost for tiny files. An always-on EMR cluster adds the most management work, and DataSync copies files without transforming them.
An S3 event notification invokes Lambda as soon as each object is created, and a light transform of a small file fits easily within Lambda limits. A Glue job every minute adds startup time and cost for tiny files. An always-on EMR cluster adds the most management work, and DataSync copies files without transforming them.
Question 21Data Operations
A gaming company processes player events from Amazon Kinesis Data Streams with a consumer application on Amazon ECS. Players report that leaderboard updates are sometimes delayed by many minutes. The team needs an alert that shows when the consumer is falling behind the stream. Which solution BEST meets these requirements?
Correct answer: C. Create a CloudWatch alarm on the stream's GetRecords.IteratorAgeMilliseconds metric.
IteratorAgeMilliseconds measures how old the last record read is, so a rising value shows the consumer is falling behind. ECS CPU can be high or low while lag grows, so it does not measure the delay directly.
IteratorAgeMilliseconds measures how old the last record read is, so a rising value shows the consumer is falling behind. ECS CPU can be high or low while lag grows, so it does not measure the delay directly.
Question 22Data Store Management
A startup runs analytics queries a few hours each week at unpredictable times. It has no staff to size clusters or manage pause and resume schedules, and it wants to pay only when queries run. Which Amazon Redshift option BEST fits?
Correct answer: D. Amazon Redshift Serverless
Redshift Serverless scales capacity automatically and bills only for compute used while queries run, with no cluster sizing. Reserved nodes lower the hourly rate but charge for the cluster all the time. A pause schedule needs predictable usage times, which this startup does not have.
Redshift Serverless scales capacity automatically and bills only for compute used while queries run, with no cluster sizing. Reserved nodes lower the hourly rate but charge for the cluster all the time. A pause schedule needs predictable usage times, which this startup does not have.
Question 23Ingestion & Transformation
An insurance company wants to move a 2 TB on-premises Oracle database into an Amazon S3 data lake. After the first copy, inserts, updates and deletes must keep flowing to the lake while the source stays in use. Which approach BEST meets the requirement?
Correct answer: D. An AWS DMS task that uses full load plus ongoing replication (CDC)
A DMS full load plus CDC task copies existing data once and then reads the source transaction logs to replicate ongoing changes with low impact on the source. A nightly full load copies everything again, leaves the lake up to a day old, and does not record deletes as changes.
A DMS full load plus CDC task copies existing data once and then reads the source transaction logs to replicate ongoing changes with low impact on the source. A nightly full load copies everything again, leaves the lake up to a day old, and does not record deletes as changes.
Question 24Security & Governance
A data platform writes millions of small objects per day to an S3 bucket that uses SSE-KMS with a customer managed key. KMS request costs have become high and some requests are throttled. The company must keep using its customer managed key. Which solution BEST meets these requirements?
Correct answer: B. Enable S3 Bucket Keys on the bucket's default encryption.
S3 Bucket Keys create a bucket-level data key that cuts the number of KMS calls while still using the customer managed key. SSE-S3 would remove KMS calls but breaks the requirement to keep the customer managed key.
S3 Bucket Keys create a bucket-level data key that cuts the number of KMS calls while still using the customer managed key. SSE-S3 would remove KMS calls but breaks the requirement to keep the customer managed key.
Question 25Data Store Management
An orders table in Amazon DynamoDB uses order_id as the partition key and already holds production data. A new feature must list all orders for a customer_id sorted by order_date, and it can use eventually consistent reads. What should the data engineer add?
Correct answer: C. A global secondary index on customer_id with order_date as the sort key
A global secondary index can be added to an existing table with a different partition key, and it returns items sorted by its sort key with eventually consistent reads. A local secondary index must share the table's partition key and can only be created with the table. A Scan reads the whole table and is slow and costly.
A global secondary index can be added to an existing table with a different partition key, and it returns items sorted by its sort key with eventually consistent reads. A local secondary index must share the table's partition key and can only be created with the table. A Scan reads the whole table and is slow and costly.
Question 26Ingestion & Transformation
A research lab keeps 300 TB of instrument files on an on-premises NFS server connected to AWS by a 10 Gbps AWS Direct Connect link. It must copy the data to Amazon S3 and then copy new and changed files every night, with integrity checks and no custom scripts. Which service BEST fits?
Correct answer: D. AWS DataSync with an on-premises agent and a scheduled task
DataSync copies data from NFS and SMB shares to AWS, transfers only changed files on later runs, verifies integrity, and supports schedules. Transfer Family provides an SFTP endpoint for clients to push files, so the lab would still need scripts to find and send changed files.
DataSync copies data from NFS and SMB shares to AWS, transfers only changed files on later runs, verifies integrity, and supports schedules. Transfer Family provides an SFTP endpoint for clients to push files, so the lab would still need scripts to find and send changed files.
Question 27Data Operations
A travel company uses Amazon Data Firehose with an AWS Lambda transformation function to clean booking events before delivery to Amazon S3. Some records fail the transformation because of unexpected fields. The team needs to find and replay these failed records later. Which solution BEST meets these requirements?
Correct answer: C. Read the failed records from the Firehose error output prefix in Amazon S3.
Records that fail Lambda transformation are written by Firehose to the error output prefix in the S3 destination, where they can be inspected and replayed. Source record backup stores every original record, so it does not separate the failures from the good data.
Records that fail Lambda transformation are written by Firehose to the error output prefix in the S3 destination, where they can be inspected and replayed. Source record backup stores every original record, so it does not separate the failures from the good data.
Question 28Ingestion & Transformation
A marketing team needs a daily export of opportunity records from Salesforce into an Amazon S3 data lake. The data engineers want a managed, no-code integration that can filter fields and run on a schedule. What should they use?
Correct answer: B. Amazon AppFlow with a scheduled flow from Salesforce to Amazon S3
AppFlow is a managed integration service for SaaS applications such as Salesforce, with field mapping, filters, and scheduled or event-based flows. DMS migrates databases and does not support Salesforce as a source, and DataSync moves files from storage systems rather than SaaS records.
AppFlow is a managed integration service for SaaS applications such as Salesforce, with field mapping, filters, and scheduled or event-based flows. DMS migrates databases and does not support Salesforce as a source, and DataSync moves files from storage systems rather than SaaS records.
Question 29Data Store Management
A gaming company stores player session records in Amazon DynamoDB. Each record is useful for only 24 hours, and the table keeps growing. The company wants expired items removed automatically without using write capacity. What should it do?
Correct answer: C. Enable TTL on an attribute that holds the expiry time in epoch seconds.
DynamoDB TTL deletes items after the epoch time in the chosen attribute has passed, and these deletes use no write capacity. A nightly scan-and-delete function uses read and write capacity and adds code to maintain. DynamoDB tables do not have lifecycle rules like S3 buckets.
DynamoDB TTL deletes items after the epoch time in the chosen attribute has passed, and these deletes use no write capacity. A nightly scan-and-delete function uses read and write capacity and adds code to maintain. DynamoDB tables do not have lifecycle rules like S3 buckets.
Question 30Security & Governance
A healthcare startup streams device data through Amazon Kinesis Data Streams. A new policy requires all stream data at rest to be encrypted with a key the company controls. Producers and consumers must keep working with minimal change. Which solution BEST meets these requirements?
Correct answer: A. Enable server-side encryption on the stream with a customer managed KMS key.
Kinesis server-side encryption with a customer managed key encrypts data at rest and can be enabled on an existing stream; apps only need KMS permissions. TLS protects data in transit, not at rest in the stream.
Kinesis server-side encryption with a customer managed key encrypts data at rest and can be enabled on an existing stream; apps only need KMS permissions. TLS protects data in transit, not at rest in the stream.
Question 31Data Operations
An AWS Glue Spark job joins a large orders table with customer data. Most tasks finish in minutes, but a few tasks run for over an hour, and the job duration did not improve after adding more workers. Analysis shows that a few customer IDs account for most orders. Which solution BEST addresses the root cause?
Correct answer: B. Salt the skewed join key to spread the heavy customer IDs across more partitions.
The slow tasks come from data skew, where a few keys put most rows in a few partitions. Salting the key spreads those rows across more tasks. Auto scaling or bigger workers add capacity, but one huge partition still runs on one task.
The slow tasks come from data skew, where a few keys put most rows in a few partitions. Salting the key spreads those rows across more tasks. Auto scaling or bigger workers add capacity, but one huge partition still runs on one task.
Question 32Ingestion & Transformation
A bank's business partners send daily settlement files with SFTP clients that they cannot change. The bank wants the files to land directly in Amazon S3 without running its own SFTP servers. Which solution BEST meets these requirements?
Correct answer: A. Create an AWS Transfer Family SFTP server that stores files in S3.
Transfer Family provides a fully managed SFTP endpoint that writes files straight to S3, so partners keep their existing clients. An SFTP server on EC2 also supports the existing clients, but the bank would have to patch, scale and monitor that server itself.
Transfer Family provides a fully managed SFTP endpoint that writes files straight to S3, so partners keep their existing clients. An SFTP server on EC2 also supports the existing clients, but the bank would have to patch, scale and monitor that server itself.
Question 33Data Store Management
An online store runs orders on Amazon Aurora MySQL. Reporting queries during business hours slow down checkout traffic on the writer instance. The team wants to offload the reports with minimal replication lag and no application change beyond a new endpoint. What should it do?
Correct answer: C. Add Aurora Replicas and point reports at the reader endpoint.
Aurora Replicas share the cluster storage volume, so replica lag is usually well under a second, and the reader endpoint spreads report connections across them. A larger writer adds cost and still runs both workloads on one instance. Hourly snapshot exports add delay and a new query engine.
Aurora Replicas share the cluster storage volume, so replica lag is usually well under a second, and the reader endpoint spreads report connections across them. A larger writer adds cost and still runs both workloads on one instance. Hourly snapshot exports add delay and a new query engine.
Question 34Ingestion & Transformation
An AWS Glue ETL job reads JSON files from an S3 prefix every hour and writes Parquet output. Each run reprocesses every file from the past month, which raises cost and creates duplicate rows. What should the data engineer enable so each run processes only new files?
Correct answer: D. AWS Glue job bookmarks on the job
Job bookmarks store state about data that a job has already processed, so later runs read only new S3 objects. Auto scaling changes the number of workers to match the load, but the job would still reprocess every file and create the same duplicates.
Job bookmarks store state about data that a job has already processed, so later runs read only new S3 objects. Auto scaling changes the number of workers to match the load, but the job would still reprocess every file and create the same duplicates.
Question 35Data Operations
An insurance company loads claims data with an AWS Glue ETL job into a curated S3 zone. The company wants the job to check that claim_id is unique and premium is always positive. If the checks fail, the data must not reach the curated zone. The team wants a managed solution with minimal custom code. Which solution BEST meets these requirements?
Correct answer: D. Add Glue Data Quality DQDL rules to the job and stop it when the ruleset fails.
AWS Glue Data Quality lets the job evaluate DQDL rules such as IsUnique and ColumnValues before writing, and the job can stop when the ruleset fails. Checking with Athena after the load lets bad data reach the curated zone first and needs custom cleanup logic.
AWS Glue Data Quality lets the job evaluate DQDL rules such as IsUnique and ColumnValues before writing, and the job can stop when the ruleset fails. Checking with Athena after the load lets bad data reach the curated zone first and needs custom cleanup logic.
Question 36Security & Governance
A financial services company has hundreds of S3 buckets created by many teams over several years. Auditors ask the company to find which buckets contain personal data such as names, credit card numbers and passport numbers. The company wants an automated, managed solution. Which solution BEST meets these requirements?
Correct answer: A. Enable Amazon Macie automated sensitive data discovery for the account.
Macie uses managed data identifiers to find PII such as credit card and passport numbers across S3 buckets automatically. GuardDuty S3 protection detects suspicious access activity, not the sensitive content of objects.
Macie uses managed data identifiers to find PII such as credit card and passport numbers across S3 buckets automatically. GuardDuty S3 protection detects suspicious access activity, not the sensitive content of objects.
Question 37Data Store Management
A SaaS company collects application logs. Engineers need full-text searches, such as finding error messages that contain a phrase, with results in under a second, plus interactive dashboards on the same data. Which service BEST fits?
Correct answer: B. Amazon OpenSearch Service with OpenSearch Dashboards
OpenSearch uses inverted indexes built for fast full-text search and includes OpenSearch Dashboards for visual exploration. Redshift is a strong analytics warehouse, but it is not designed for sub-second phrase search across large text fields.
OpenSearch uses inverted indexes built for fast full-text search and includes OpenSearch Dashboards for visual exploration. Redshift is a strong analytics warehouse, but it is not designed for sub-second phrase search across large text fields.
Question 38Ingestion & Transformation
An AWS Glue job reads a source where the price field is a number in most records but a string in some older records. The DynamicFrame schema shows price as a choice type, and the target Parquet table needs a double. Which approach handles this with the least custom code?
Correct answer: D. Call resolveChoice on the DynamicFrame with a cast:double action for price.
A DynamicFrame keeps both possible types as a choice type, and resolveChoice with a cast action turns the field into one type in a single call. Dropping string records would throw away valid data, and a custom UDF adds code that the built-in transform already covers.
A DynamicFrame keeps both possible types as a choice type, and resolveChoice with a cast action turns the field into one type in a single call. Dropping string records would throw away valid data, and a custom UDF adds code that the built-in transform already covers.
Question 39Data Operations
A marketing team receives a new customer survey dataset in Amazon S3. Analysts with no coding skills want to see column statistics, missing value counts and value distributions before they design any transformations. Which solution BEST meets these requirements?
Correct answer: C. Create an AWS Glue DataBrew dataset and run a profile job on it.
A DataBrew profile job gives a visual report of column statistics, missing values and distributions without code. A Glue crawler only infers the schema and does not report data statistics.
A DataBrew profile job gives a visual report of column statistics, missing values and distributions without code. A Glue crawler only infers the schema and does not report data statistics.
Question 40Ingestion & Transformation
Business analysts at a retail chain need to clean product data in S3 by fixing letter case, removing duplicates and splitting columns. They do not write code, and they want to preview each change on sample data before running the steps on the full dataset on a schedule. Which service BEST fits?
Correct answer: B. AWS Glue DataBrew projects with recipes run as scheduled jobs
DataBrew is a visual data preparation tool with built-in transformations, previews on sample data, and reusable recipes that can run as scheduled jobs. Glue ETL jobs and EMR notebooks can do the same cleaning, but the analysts would have to write code.
DataBrew is a visual data preparation tool with built-in transformations, previews on sample data, and reusable recipes that can run as scheduled jobs. Glue ETL jobs and EMR notebooks can do the same cleaning, but the analysts would have to write code.
Question 41Data Store Management
Daily partitions, and sometimes new columns, are added to JSON data in S3. Analysts query the data with Amazon Athena and need the AWS Glue Data Catalog to reflect both kinds of change without manual DDL. What is the simplest solution?
Correct answer: C. Schedule an AWS Glue crawler on the S3 path to update the table.
A scheduled crawler detects both new partitions and schema changes such as new columns, and it updates the catalog table. MSCK REPAIR TABLE only adds Hive-style partitions and never changes the table schema.
A scheduled crawler detects both new partitions and schema changes such as new columns, and it updates the catalog table. MSCK REPAIR TABLE only adds Hive-style partitions and never changes the table schema.
Question 42Security & Governance
A company stores customer records with Social Security numbers in Amazon Redshift. Support analysts must see only the last four digits, while the compliance team must see full values, and both groups query the same table. The company wants to avoid creating extra copies or views. Which solution BEST meets these requirements?
Correct answer: A. Create a dynamic data masking policy and attach it to the support analyst role.
Redshift dynamic data masking applies masking policies by role at query time, so each group sees different output from the same table. Revoking column access hides the column completely, so support would not see the last four digits.
Redshift dynamic data masking applies masking policies by role at query time, so each group sees different output from the same table. Revoking column access hides the column completely, so support would not see the last four digits.
Question 43Ingestion & Transformation
A media company runs 40 Apache Spark jobs that need native libraries packaged in a custom container image. The jobs run for several hours each night. The team wants to avoid managing clusters or servers. Which option BEST meets these requirements?
Correct answer: B. Amazon EMR Serverless applications that use a custom image
EMR Serverless runs Spark with no clusters to manage and supports custom images, so the team can package its native libraries. Glue uses its own managed runtime and does not accept custom container images. Lambda stops after 15 minutes, and EMR on EC2 still means managing clusters.
EMR Serverless runs Spark with no clusters to manage and supports custom images, so the team can package its native libraries. Glue uses its own managed runtime and does not accept custom container images. Lambda stops after 15 minutes, and EMR on EC2 still means managing clusters.
Question 44Data Store Management
An IoT table in S3 is partitioned by device_id, year, month, day and hour, which creates millions of partitions. Amazon Athena queries spend much of their time on partition metadata lookups, and new partitions appear every hour. Which feature BEST improves this?
Correct answer: A. Partition projection defined in the table properties
Partition projection lets Athena compute partition locations from rules in the table properties instead of reading partition metadata from the Glue Data Catalog, and new partitions need no registration. An hourly crawler keeps the catalog current but does not speed up lookups across millions of partitions.
Partition projection lets Athena compute partition locations from rules in the table properties instead of reading partition metadata from the Glue Data Catalog, and new partitions need no registration. An hourly crawler keeps the catalog current but does not speed up lookups across millions of partitions.
Question 45Data Operations
A research lab runs a daily Apache Spark job on Amazon EMR that takes several hours. The job tolerates the loss of some compute capacity, but the cluster must not lose HDFS data during the run. The lab wants to lower compute cost. Which solution BEST meets these requirements?
Correct answer: C. Run the primary and core nodes On-Demand and add task nodes on Spot Instances.
Task nodes hold no HDFS data, so running them on Spot cuts cost while losing one only reduces compute. Putting core nodes on Spot risks losing HDFS blocks when instances are reclaimed.
Task nodes hold no HDFS data, so running them on Spot cuts cost while losing one only reduces compute. Putting core nodes on Spot risks losing HDFS blocks when instances are reclaimed.
Question 46Ingestion & Transformation
A data warehouse team loads a daily customer file from S3 into Amazon Redshift. Each file holds new customers and changes to existing customers, keyed by customer_id. The team wants a SQL-only process that inserts new rows and updates existing rows in one step. What should it do?
Correct answer: B. COPY the file into a staging table, then MERGE it into the target table.
Loading a staging table and running MERGE applies inserts and updates in one statement keyed on customer_id. COPY only appends rows and has no update option, so loading into the target directly would duplicate customers. VACUUM reclaims space and re-sorts rows but does not remove duplicate keys.
Loading a staging table and running MERGE applies inserts and updates in one statement keyed on customer_id. COPY only appends rows and has no update option, so loading into the target directly would duplicate customers. VACUUM reclaims space and re-sorts rows but does not remove duplicate keys.
Question 47Security & Governance
An S3 bucket holds sensitive payroll files. Auditors require a record of every IAM principal that reads or deletes any object in this bucket. The account already has a CloudTrail trail with only management events. Which solution BEST meets these requirements?
Correct answer: D. Add S3 data events for the bucket to the CloudTrail trail.
Object-level calls such as GetObject and DeleteObject are data events, which a trail records only when they are enabled. Versioning keeps old object versions but does not record who read or deleted them.
Object-level calls such as GetObject and DeleteObject are data events, which a trail records only when they are enabled. Versioning keeps old object versions but does not record who read or deleted them.
Question 48Data Store Management
A company's S3 data lake must support row-level updates and deletes for privacy requests, consistent reads while writes are running, and queries of a table as it looked last week. The team uses Amazon Athena and AWS Glue. Which table format BEST meets these needs?
Correct answer: A. Apache Iceberg tables in the Glue Data Catalog
Iceberg adds ACID transactions, row-level updates and deletes, and snapshot-based time travel to data in S3, and both Athena and Glue support it. Plain Hive-style Parquet tables need whole files or partitions rewritten for deletes and offer no consistent snapshots. S3 Versioning tracks objects, not table snapshots.
Iceberg adds ACID transactions, row-level updates and deletes, and snapshot-based time travel to data in S3, and both Athena and Glue support it. Plain Hive-style Parquet tables need whole files or partitions rewritten for deletes and offer no consistent snapshots. S3 Versioning tracks objects, not table snapshots.
Question 49Ingestion & Transformation
A pipeline uses a Lambda function to validate a file, an AWS Glue job to transform it, and a second Lambda function to send a summary. A failed Glue run must retry twice with backoff, and the team wants a visual view of each run. Which service BEST orchestrates this with the least code?
Correct answer: B. AWS Step Functions with a Glue .sync task and Retry rules
Step Functions can start a Glue job and wait for it with the .sync integration, and Retry fields add backoff without code. The console shows each execution as a graph. A controller Lambda function needs custom polling and retry logic and can hit the 15-minute timeout.
Step Functions can start a Glue job and wait for it with the .sync integration, and Retry fields add backoff without code. The console shows each execution as a graph. A controller Lambda function needs custom polling and retry logic and can hit the 15-minute timeout.
Question 50Data Operations
A telecom company stores call records in Amazon S3 as uncompressed CSV files in one prefix. Analysts run Amazon Athena queries that usually filter on a single day and select a few columns, and costs keep rising. Which solution will reduce Athena cost the MOST?
Correct answer: D. Convert the data to Apache Parquet partitioned by call date in the Data Catalog.
Partitioning by date lets Athena skip other days, and columnar Parquet lets it read only the needed columns, so both cut the bytes scanned. A view does not change how much data Athena reads from the CSV files.
Partitioning by date lets Athena skip other days, and columnar Parquet lets it read only the needed columns, so both cut the bytes scanned. A view does not change how much data Athena reads from the CSV files.
Question 51Security & Governance
A company must keep a log of every SQL statement run on its Amazon Redshift provisioned cluster for compliance reviews. Audit logging is already enabled and connection and user logs appear in Amazon S3, but no query text appears. Which change BEST meets the requirement?
Correct answer: D. Set enable_user_activity_logging to true in the parameter group.
The user activity log, which holds each query's text, is written only when the enable_user_activity_logging parameter is true. CloudTrail records Redshift API calls such as cluster changes, not the SQL run inside the database.
The user activity log, which holds each query's text, is written only when the enable_user_activity_logging parameter is true. CloudTrail records Redshift API calls such as cluster changes, not the SQL run inside the database.
Question 52Ingestion & Transformation
A company is moving to AWS and has more than 200 Apache Airflow DAGs written in Python with custom operators. It wants to keep the DAGs as they are and stop managing the Airflow scheduler and workers. What should it use?
Correct answer: A. Amazon Managed Workflows for Apache Airflow (MWAA)
MWAA runs Apache Airflow as a managed service, so existing DAGs and custom operators can be uploaded to S3 with little or no change. Step Functions is a strong orchestrator, but rebuilding 200 DAGs as state machines is a large migration effort.
MWAA runs Apache Airflow as a managed service, so existing DAGs and custom operators can be uploaded to S3 with little or no change. Step Functions is a strong orchestrator, but rebuilding 200 DAGs as state machines is a large migration effort.
Question 53Data Store Management
A company has an Amazon Redshift RA3 producer cluster for ETL and wants a separate Redshift Serverless workgroup for the finance team to query the same tables. Finance must see live data without copies or new pipelines. What should the data engineer use?
Correct answer: C. Redshift data sharing from the producer to the workgroup
Data sharing gives consumer clusters or workgroups live read access to producer data without copying it, and both RA3 and Serverless support it. Nightly UNLOADs or snapshot restores create copies that can be a day old and need ongoing jobs.
Data sharing gives consumer clusters or workgroups live read access to producer data without copying it, and both RA3 and Serverless support it. Nightly UNLOADs or snapshot restores create copies that can be a day old and need ongoing jobs.
Question 54Data Operations
A company runs an Amazon Redshift provisioned cluster for a development team that works only from 9 AM to 6 PM on weekdays. The cluster sits idle nights and weekends. The company wants to cut compute cost and keep all data and settings. Which solution BEST meets these requirements?
Correct answer: A. Create pause and resume schedules for the cluster in the Redshift console.
Paused provisioned clusters stop compute billing while keeping data and settings, and Redshift can pause and resume on a schedule. Deleting and restoring from snapshots also works but adds operational effort and restore time.
Paused provisioned clusters stop compute billing while keeping data and settings, and Redshift can pause and resume on a schedule. Deleting and restoring from snapshots also works but adds operational effort and restore time.
Question 55Ingestion & Transformation
A data engineer builds a pipeline entirely in AWS Glue. A crawler must run first, and an ETL job must start only after the crawler finishes successfully. The engineer wants to manage this inside Glue and see the run history in one place. What should the engineer use?
Correct answer: B. A Glue workflow with a conditional trigger on the crawler state
Glue workflows chain crawlers and jobs, and a conditional trigger can start the job only when the crawler reaches the SUCCEEDED state. The workflow view shows each run as a graph. A fixed time offset does not check whether the crawler actually finished or succeeded.
Glue workflows chain crawlers and jobs, and a conditional trigger can start the job only when the crawler reaches the SUCCEEDED state. The workflow view shows each run as a graph. A fixed time offset does not check whether the crawler actually finished or succeeded.
Question 56Data Store Management
A retailer is designing an Amazon Redshift warehouse for sales reporting. Analysts slice sales by date, store and product and want simple queries with few joins. Which data model BEST fits?
Correct answer: B. A star schema with a sales fact table and denormalized dimensions
A star schema keeps measures in a central fact table that joins directly to denormalized dimension tables, so report queries stay short and fast. A normalized 3NF model reduces redundancy but needs many joins for each report and suits transactional systems better.
A star schema keeps measures in a central fact table that joins directly to denormalized dimension tables, so report queries stay short and fast. A normalized 3NF model reduces redundancy but needs many joins for each report and suits transactional systems better.
Question 57Security & Governance
A bank loads data into an Amazon Redshift provisioned cluster with COPY from Amazon S3 and exports results with UNLOAD. A security rule requires this traffic to flow through the bank's VPC so that VPC flow logs, security groups and S3 endpoint policies apply to it. Which solution BEST meets these requirements?
Correct answer: C. Turn on enhanced VPC routing and add an S3 gateway endpoint to the VPC.
Enhanced VPC routing forces COPY and UNLOAD traffic between Redshift and S3 through the cluster's VPC, where flow logs, security groups and endpoint policies apply. The require_ssl parameter encrypts client connections but does not change the network path of COPY and UNLOAD traffic.
Enhanced VPC routing forces COPY and UNLOAD traffic between Redshift and S3 through the cluster's VPC, where flow logs, security groups and endpoint policies apply. The require_ssl parameter encrypts client connections but does not change the network path of COPY and UNLOAD traffic.
Question 58Ingestion & Transformation
An online retailer runs orders on Amazon Aurora MySQL and wants the same data in Amazon Redshift for near real-time analytics. The team does not want to build or operate DMS tasks, Glue jobs or other pipelines, and new rows should appear in Redshift within seconds. Which solution BEST meets these requirements?
Correct answer: B. Create an Aurora zero-ETL integration that targets the Redshift warehouse.
An Aurora zero-ETL integration replicates data into Redshift within seconds, and AWS manages the replication, so no pipeline is needed. A DMS task can also replicate changes, but the team would have to build and operate it.
An Aurora zero-ETL integration replicates data into Redshift within seconds, and AWS manages the replication, so no pipeline is needed. A DMS task can also replicate changes, but the team would have to build and operate it.
Question 59Data Operations
A company uses AWS DMS to replicate changes from an on-premises Oracle database to Amazon Redshift. Reports show data in Redshift is now hours behind. CloudWatch shows CDCLatencySource is low, but CDCLatencyTarget is high and keeps growing. What is the MOST likely cause?
Correct answer: D. Changes are applied slowly to the Redshift target.
Low source latency with high target latency means DMS reads changes quickly but applies them to Redshift slowly. A problem reading the redo logs would raise CDCLatencySource as well.
Low source latency with high target latency means DMS reads changes quickly but applies them to Redshift slowly. A problem reading the redo logs would raise CDCLatencySource as well.
Question 60Data Store Management
A customers dimension in a data warehouse must keep each customer's full address history, so that past sales reports show the address that was valid at the time of each sale. Which approach BEST meets this requirement?
Correct answer: A. Insert a new row for each change with effective dates and a current flag.
A Type 2 slowly changing dimension adds a new row for every change, with effective dates or a current flag, so facts can join to the version that was valid at the time. Overwriting the row is Type 1 and loses history. A previous-address column, as in Type 3, keeps only one earlier value.
A Type 2 slowly changing dimension adds a new row for every change, with effective dates or a current flag, so facts can join to the version that was valid at the time. Overwriting the row is Type 1 and loses history. A previous-address column, as in Type 3, keeps only one earlier value.
Question 61Ingestion & Transformation
A streaming pipeline writes thousands of Parquet files of about 50 KB each into every hourly partition of an S3 data lake. Athena and Spark jobs that read these partitions have become slow. What should the data engineer do to improve read performance?
Correct answer: C. Run a scheduled job that compacts each partition into files of about 128 MB.
Every file adds listing, open and metadata overhead, so compacting many small files into fewer large files speeds up reads. Minute-level partitions create even more small files and more partitions to list. Transfer Acceleration speeds up long-distance transfers and does not help query engines.
Every file adds listing, open and metadata overhead, so compacting many small files into fewer large files speeds up reads. Minute-level partitions create even more small files and more partitions to list. Transfer Acceleration speeds up long-distance transfers and does not help query engines.
Question 62Security & Governance
A European company uses AWS Organizations. A new regulation requires that customer data never be stored or processed outside two EU Regions. The company wants a preventive control that applies to every account, including new ones. Which solution BEST meets these requirements?
Correct answer: A. Attach an SCP that denies requests outside the two EU Regions.
An SCP with an aws:RequestedRegion condition blocks actions in other Regions for every account in the organization, which is a preventive control. AWS Config rules only detect resources after they are created.
An SCP with an aws:RequestedRegion condition blocks actions in other Regions for every account in the organization, which is a preventive control. AWS Config rules only detect resources after they are created.
Question 63Data Operations
A table in the AWS Glue Data Catalog was deleted yesterday, and several Athena reports failed. The security team needs to find which IAM principal deleted the table and when. The account has the default AWS CloudTrail settings and no trails. Which solution BEST meets these requirements?
Correct answer: D. Search CloudTrail event history for the Glue DeleteTable event.
DeleteTable is a management event, and CloudTrail event history keeps 90 days of management events with no trail setup. Athena query history only shows Athena queries, so a delete made through the console or API would not appear there.
DeleteTable is a management event, and CloudTrail event history keeps 90 days of management events with no trail setup. Athena query history only shows Athena queries, so a delete made through the console or API would not appear there.
Question 64Data Store Management
A payments company wants to detect fraud rings by finding accounts that share devices, cards and addresses several hops apart. Queries must traverse these relationships quickly as the data grows. Which database BEST fits?
Correct answer: A. Amazon Neptune
Neptune is a graph database built to store relationships and run multi-hop traversals with Gremlin, openCypher or SPARQL. Redshift could model the links in tables, but deep multi-hop queries need many self-joins that get slower as the hops increase.
Neptune is a graph database built to store relationships and run multi-hop traversals with Gremlin, openCypher or SPARQL. Redshift could model the links in tables, but deep multi-hop queries need many self-joins that get slower as the hops increase.
Question 65Ingestion & Transformation
A daily AWS Glue job writes sales results for one date into an S3 partition. When the job fails partway and is rerun, the partition ends up with duplicate rows. The team wants every rerun to give the same result. Which design BEST makes the job idempotent?
Correct answer: C. Overwrite the whole target partition for that date on every run.
Overwriting the date partition replaces any partial output, so running the job once or many times gives the same data. Appending with a weekly cleanup leaves duplicates visible to readers for days. Random file names do not prevent duplicates at all.
Overwriting the date partition replaces any partial output, so running the job once or many times gives the same data. Appending with a weekly cleanup leaves duplicates visible to readers for days. Random file names do not prevent duplicates at all.
The real AWS Data Engineer Associate exam at a glance
65questions
2h 10mtime limit
MCQmultiple choice
75%+aim for here
Score 75% or more on two different sets before you book the real exam. Need a plan for your weak topics? See how we help you pass, or get a full refund.
More free AWS practice tests
AWS Cloud Practitioner Practice Test65 questions · CLF-C02AWS AI Practitioner Practice Test65 questions · AIF-C01AWS Solutions Architect Associate Practice Test65 questions · SAA-C03AWS Solutions Architect Professional Practice Test75 questions · SAP-C03AWS Security Specialty Practice Test65 questions · SCS-C03AWS DevOps Engineer Professional Practice Test75 questions · DOP-C02
See all 36 free practice tests →
Original practice questions written by CertOcean in the style of the AWS Data Engineer Associate exam. They are not real exam questions. AWS Data Engineer Associate and Amazon Web Services are trademarks of their owners. Real exam format: 65 questions (50 scored, 15 unscored) · 130 minutes · passing score 720 on a 100-1000 scale.