An ingestion service uses a password-based application account for a supported RDS database. Its credential is stored in Secrets Manager.
The service opens connections continuously, and the team wants to reduce authentication disruption during credential rotation. A separate administrative secret is available, and the database can support a cloned application user.
Which approach best addresses this requirement?
Use alternating-users rotation and have the application refresh cached credentials during normal operation and authentication recovery.
Use single-user rotation and schedule password changes during the service's busiest period to exercise recovery frequently.
Rotate the password through a deployment script and restart all ingestion workers whenever the secret changes.
Rotate the application password manually and distribute the new credential through the next scheduled application release.
A
Alternating-users rotation maintains two application users and rotates their credentials in turn, reducing disruption while credentials change. The application must still refresh credentials and handle authentication recovery. Single-user rotation can work but offers a different availability trade-off; deployment-coupled and manual rotation add coordination work.
Data Security and Governance
25
Select One
A Glue role in account B must read S3 objects in account A. The objects use SSE-KMS with account A's customer-managed key.
The required S3 permissions already exist. The role has no KMS permissions, the key policy permits only account A, and no KMS grants are configured.
Using key-policy and IAM-policy authorization, which TWO changes enable the read path?
Permit the external Glue role to decrypt through account A's KMS key policy.
Grant the Glue role kms:GenerateDataKey on the key in account B's IAM policy.
Add the KMS key ARN to the S3 bucket policy's list of allowed object resources.
Grant the Glue role kms:Decrypt on the key in account B's IAM policy.
A
Under the specified cross-account authorization model, decryption must be permitted in both the key policy in account A and the external role's IAM policy in account B. Granting kms:GenerateDataKey does not substitute for decrypt authorization when reading, and an S3 bucket policy does not grant KMS key usage.
Data Security and Governance
24
Select Two
D
A company has hundreds of S3 buckets containing data from different business units. Security needs ongoing visibility into where sensitive data might reside, with findings that can guide deeper investigation.
Representative sampling is acceptable for the initial discovery process. The team wants to avoid maintaining its own classifiers and scanning infrastructure.
Which approach should it use?
Run Glue crawlers across the buckets and classify sensitivity from the inferred column names.
Export S3 Inventory reports and maintain rules that classify objects from their names and metadata.
Enable Macie automated sensitive data discovery and review its findings and bucket assessments.
Develop a distributed scanning application that downloads objects and applies custom pattern libraries.
C
Macie automated discovery uses sampling to identify sensitive data and produce bucket-level visibility. That matches the requested initial assessment. Crawlers and inventory metadata do not inspect content in the same way; custom scanners add classifier and infrastructure maintenance. Automated discovery is not an exhaustive scan of every object.
Data Security and Governance
23
Select One
A Lake Formation-managed S3 table contains records for several regions and includes an email column. Regional analysts query it through Athena engine version 3.
EU analysts must see only EU rows and must not see email values. They have no broader grants or direct S3 access. The team wants to avoid maintaining separate regional copies.
Which approach should it choose?
Produce an EU-specific dataset with Glue, remove email values, and grant access to its catalog table.
Grant SELECT through a Lake Formation data filter combining the EU condition and column restriction.
Export EU records without email values to a separate Redshift database and grant analysts access there.
Create a regional S3 prefix and run a scheduled process that refreshes a sanitized copy for Athena.
B
Lake Formation data filters enforce the row and column restrictions against the existing dataset. The other designs can produce restricted data but introduce extra copies and refresh processes. The absence of broader grants or direct S3 access is important to preventing bypass.
Data Security and Governance
22
Select One
A bookmark-enabled Glue job appends transformed S3 data to a curated prefix. A logic defect affected all historical output.
The team must rebuild the dataset while keeping existing reports available. Corrected and original records must not appear together in the published dataset.
Which recovery approach provides the clearest validation and cutover boundary?
Reset the bookmark and append corrected records to the published prefix using a new job-run identifier.
Reset the bookmark, write to a separate prefix, validate the result, and switch the published table location.
Disable bookmarks and merge corrected files into the published prefix as each task completes.
Reset the bookmark and overwrite published partitions individually while reports continue querying them.
B
A separate rebuild location gives the team a complete candidate to validate before changing the published reference. Resetting bookmarks does not remove existing target files. Appending mixes versions, while in-place partition replacement exposes a partially rebuilt dataset during recovery.
Data Operations and Support
21
Select One
A provisioned Redshift cluster has a dedicated WLM queue for exploratory SELECT queries. Some queries run for hours and affect other users.
The team wants to stop queries after 15 minutes of execution, excluding queue wait time. It wants to avoid operating a custom query-monitoring service.
Which solution should it use?
Set a 900-second statement_timeout for all users assigned to the exploratory queue.
Schedule a Lambda function that checks query history and cancels queries exceeding the runtime target.
Add a WLM query monitoring rule that logs queries whose execution time exceeds 900 seconds.
Add a WLM query monitoring rule that aborts queries whose execution time exceeds 900 seconds.
D
A WLM query monitoring rule with the query_execution_time metric and an abort action implements the native execution-time control. statement_timeout includes time beyond execution, including queueing. A custom cancellation process adds operations, and logging alone does not stop the query. QMR enforcement is periodically evaluated rather than an exact millisecond deadline.
Data Operations and Support
20
Select One
After a bulk update changes the distribution of values in a Redshift table, an important query becomes slower. The table remains well sorted, and data distribution across nodes is balanced.
The plan estimates that a filter will return hundreds of rows, but execution processes millions. The team wants the least disruptive first corrective action.
What should it do?
Increase cluster size to provide more CPU and memory for the existing execution plan.
Rebuild the table with a different sort key based on the filter column.
Refresh optimizer statistics with ANALYZE and reassess the execution plan.
Increase the query's WLM memory allocation and retain the current optimizer metadata.
C
The mismatch between estimated and actual filtered rows following a data change points to optimizer statistics as the first area to correct. ANALYZE is less disruptive than resizing or rebuilding. More compute or memory may mask symptoms without addressing the estimate driving the plan.
Data Operations and Support
19
Select One
An analytics team wants to control unusually expensive Athena queries. All analysts must use a designated workgroup. Queries should be canceled when their scanned-data volume exceeds a configured threshold.
Analysts currently have permission to start queries in other workgroups. The team wants native controls rather than a custom process that monitors and stops queries.
Which TWO changes should it make?
Configure a per-query data scan cutoff on the designated workgroup.
Configure a workgroup-wide daily usage threshold that publishes an SNS alert.
Enable enforcement of the workgroup's result-location settings for client submissions.
Restrict analysts' query-start permissions to the designated workgroup.
A
The per-query cutoff supplies automatic cancellation, while IAM restrictions prevent analysts from bypassing it through another workgroup. A workgroup-wide usage threshold provides notification rather than query-level enforcement, and enforcing result-location settings does not restrict access to other workgroups. Canceled queries can still incur scan charges.
Data Operations and Support
18
Select Two
D
A Glue pipeline produces a daily financial dataset. Consumers must receive either the complete valid batch or the previous published batch. Publishing a subset of valid rows is not acceptable.
Required checks include non-null account identifiers and transaction-ID uniqueness across the batch. Failed batches must remain available for investigation. The team wants to use its existing Glue processing rather than add a separate validation platform.
Which TWO changes should it implement?
Remove records that fail row-level checks and publish the remaining records under the current dataset location.
Evaluate the required rules against the complete candidate batch within the Glue pipeline.
Publish the candidate batch and use an asynchronous alarm to initiate recovery if its checks fail.
Write candidates to a staging location and update the published reference only after all required checks pass.
B
Full-batch evaluation is necessary for the stated completeness and uniqueness requirements. Staging separates candidate production from publication, preserving the previous batch when validation fails. Removing invalid rows violates whole-batch publication, and asynchronous rollback exposes invalid data.
Data Operations and Support
17
Select Two
D
A team has three Glue jobs. Jobs A and B run in parallel, and job C must start only after both succeed. All jobs are started through the pipeline's triggers.
The pipeline requires no external API calls, human approval, or non-Glue tasks. The team wants a visual dependency graph without deploying a separate orchestration environment.
Which approach is the simplest fit?
Create a Glue workflow with a start trigger and an all-conditions-satisfied trigger for job C.
Create an MWAA environment and implement the dependencies in an Airflow DAG.
Create an EventBridge rule for each completion and store dependency state in DynamoDB.
Create a Lambda coordinator that polls job A and job B before submitting job C.
A
Glue workflows and conditional triggers directly express these Glue-only dependencies. An all-conditions trigger waits for both successful outcomes. The other designs add an environment or custom coordination code. The question specifies trigger-started jobs because dependent Glue triggers require that execution relationship.
Data Operations and Support
16
Select One
An Athena-only dataset uses predictable daily S3 prefixes. Every date in the configured range contains data, and new dates appear continuously.
Partition registration is delaying data availability. The team wants to remove daily registration work while preserving partition pruning.
Which approach provides the lowest ongoing maintenance?
Configure date-based partition projection and a matching storage-location template.
Schedule a crawler to discover new partitions shortly after each delivery.
Invoke a Lambda function on object arrival to register previously unseen partitions.
Run MSCK REPAIR TABLE before the first reporting query each day.
A
Partition projection derives partition values and locations from rules, eliminating registration for this predictable Athena-only layout. Crawlers, event-driven registration, and repair queries can maintain partitions, but each retains a recurring registration process.
Data Store Management
15
Select One
A versioned S3 landing bucket receives replacement versions of existing objects. The company must retain current objects but can permanently remove previous versions once they have been noncurrent for 30 days.
There are no retention locks or legal holds. The team wants ongoing cleanup with the least operational effort.
Which approach should it use?
Expire current objects after 30 days and enable expired-delete-marker cleanup.
Configure NoncurrentVersionExpiration with NoncurrentDays set to 30.
Schedule a Lambda function to list versions, calculate their ages, and delete eligible versions.
Generate S3 Inventory reports and use scheduled processing to submit version-deletion jobs.
B
Native lifecycle expiration performs the ongoing deletion based on noncurrent age. Lambda and inventory-driven deletion can implement cleanup but require additional processing and maintenance. Current-object expiration would affect data the company must retain.
Data Store Management
14
Select One
A DynamoDB table uses order_id as its partition key. A new application must retrieve a customer's orders within a creation-time range and return order_id, created_at, and total.
Eventual consistency is acceptable. The application should obtain all required attributes from one index query, and the team wants to avoid projecting unrelated attributes.
Which TWO design choices meet these requirements?
Create a local secondary index using customer_id as its partition key and created_at as its sort key.
Create a global secondary index using customer_id as its partition key and created_at as its sort key.
Use a KEYS_ONLY projection and request total in the index query's projection expression.
Use an INCLUDE projection for total, with table and index key attributes projected automatically.
B
The GSI supplies the customer-and-time access pattern, and an INCLUDE projection adds only the one extra required attribute while the table and index keys are projected automatically. An LSI retains the base partition key, so it cannot partition by customer. A GSI query cannot retrieve an unprojected attribute merely by naming it in a projection expression.
Data Store Management
13
Select Two
D
Two departments use separate Redshift compute environments in the same Region. One owns frequently updated curated tables; the other needs to query their latest committed contents.
Both environments support Redshift data sharing. The departments want independent compute capacity and minimal data-copying operations.
Which solution should they use?
Schedule UNLOAD and COPY operations between the environments at short intervals.
Publish table changes to a stream and apply them to duplicate consumer tables.
Create a datashare and let the consumer query the shared objects using its own compute.
Move both departments to the producer environment and separate their queries with WLM queues.
C
Data sharing provides access to live data while the consumer uses separate compute. It avoids maintaining replicated consumer tables. Scheduled copies introduce refresh work and lag; streaming replication adds infrastructure. Consolidating onto the producer loses the requested compute independence.
Data Store Management
12
Select One
A company stores five years of historical records as partitioned Parquet in S3. Analysts occasionally join a few historical date partitions with current data held in Redshift.
The existing Redshift cluster supports Spectrum. Loading the full history would add substantial storage, and the historical queries do not require local-table performance.
Which approach minimizes recurring data movement and duplicate storage?
Register external tables and join them to the current Redshift tables using Spectrum.
COPY all historical records into compressed Redshift tables and retain the S3 copy for recovery.
Load requested partitions into temporary Redshift tables before each historical analysis.
Export current Redshift tables to S3 before each analysis and perform the joins through Athena.
A
Spectrum can query supported S3 files and join external data with Redshift tables without loading the history. The selective, occasional access pattern makes this a good fit. The other approaches can produce results but introduce duplicated data or recurring transfer workflows. This does not imply Spectrum is always cheaper for frequent, broad scans.
Data Store Management
11
Select One
An S3 data lake receives daily inserts, updates, and deletes. Consumers query it through Athena engine version 3.
The team wants atomic SQL-based changes without maintaining custom logic to rewrite and publish affected partition directories. It also wants to retain the data in S3.
Which design best meets these requirements?
Store ordinary Parquet partitions and use a Glue job to rewrite changed partitions before updating their locations.
Store versioned CSV objects and maintain a view that selects the most recently uploaded object versions.
Store an append-only change log and require every consumer query to reconstruct the latest record state.
Use an Apache Iceberg table and apply the daily changes with Athena MERGE INTO.
D
Athena engine version 3 supports transactional MERGE INTO for Iceberg tables. Partition rewrites can implement updates but require the publication machinery the team wants to avoid. Object versioning does not provide row-level table transactions, and reconstructing state in every consumer shifts complexity to queries.
Data Store Management
10
Select One
A Redshift staging table contains multiple versions of each order. The curated dataset must contain one complete source row per order_id: the row with the greatest updated_at, using the greatest ingest_sequence to break timestamp ties.
The two ordering fields together are unique within each order.
Which transformation meets the requirement?
Group by order_id and independently take the maximum value of every other column.
Select distinct rows across all columns and sort the result by the two ordering fields.
Rank rows within each order by updated_at and retain every row with rank 1.
Assign ROW_NUMBER() within each order using both fields descending and retain row number 1.
D
The complete ordering produces one deterministic winning source row. Independent maxima can combine values from different rows. DISTINCT removes exact duplicates but does not select the latest version. Ranking only by timestamp can retain several tied rows.
Data Ingestion and Transformation
9
Select One
A team runs existing Spark jobs on an EMR cluster that remains active overnight. Jobs arrive irregularly, and there are long idle periods.
The jobs use standard Spark APIs and S3 storage. They require no custom operating-system packages or persistent HDFS data. A short startup delay is acceptable.
Which approach best reduces infrastructure administration and idle capacity while preserving the Spark workloads?
Retain the EMR cluster and use managed scaling to reduce its task-node capacity between jobs.
Move the jobs to EMR Serverless with no pre-initialized capacity and automatic application stopping.
Launch a transient EMR cluster for each job and maintain bootstrap and termination automation.
Package Spark in containers and operate an autoscaled Kubernetes cluster for job execution.
B
EMR Serverless runs the existing Spark workload without cluster administration. Avoiding pre-initialized capacity and allowing automatic stopping suits irregular jobs that tolerate startup time. Transient EMR clusters also reduce idle capacity but retain cluster configuration and lifecycle work. Persistent EMR or Kubernetes environments retain more infrastructure responsibility.
Data Ingestion and Transformation
8
Select One
A Lambda function consumes batches from an SQS standard queue and writes transformed records to a destination. When one record fails, the function currently throws an exception and the entire batch is retried.
The team wants to reduce unnecessary reprocessing while preventing duplicate destination effects when messages are delivered again.
Which TWO changes should it make?
Reduce the batch size to one and treat every successful destination write as a unique new record.
Extend the visibility timeout and retain the existing exception-based whole-batch retry behavior.
Enable partial batch responses and return the identifiers of messages that failed processing.
Make destination writes idempotent using a stable identifier for each logical source record.
C
Partial batch responses let Lambda retry failed SQS messages without deliberately retrying every successful message in the batch. Idempotent writes address duplicate delivery that can still occur. Smaller batches increase invocation overhead and do not eliminate duplicates, and extending the visibility timeout does not stop whole-batch retries.
Data Ingestion and Transformation
7
Select Two
D
A Glue Spark job joins a 2 TB fact dataset with an 8 MB reference dataset. The reference dataset fits comfortably in each executor's available memory.
Automatic broadcast joins were disabled during earlier testing. The current plan uses a sort-merge join, and most execution time is spent shuffling the fact dataset. No skewed join keys have been identified.
Which change most directly reduces data movement for this join?
Broadcast the reference dataset so each executor can join it with local fact partitions.
Increase shuffle partitions so the existing sort-merge join processes smaller partitions.
Add workers so more executors can process the existing shuffle concurrently.
Cache both datasets before executing the existing sort-merge join.
A
Broadcasting the small reference dataset avoids shuffling the large fact dataset for this join. More partitions or workers may improve the existing shuffle's execution but do not remove its data movement. Caching does not itself change the join strategy. The question explicitly explains why automatic broadcasting is not occurring.
Data Ingestion and Transformation
6
Select One
A company operates 80 Apache Airflow DAGs on self-managed infrastructure. The DAGs orchestrate Glue jobs, EMR workloads, and calls to external APIs.
The company wants to stop managing Airflow servers while preserving its DAGs, dependencies, and backfill behavior. Its operators and Python dependencies are compatible with a supported Amazon MWAA environment.
Which approach requires the least migration effort?
Replace each DAG with a Step Functions workflow using service integrations and Lambda tasks.
Move the DAGs and dependencies to Amazon MWAA and configure their execution permissions.
Rebuild the workflows as Glue workflows and use Lambda for their external API interactions.
Deploy Airflow containers on ECS and automate scheduler, worker, and metadata-database maintenance.
B
MWAA preserves the Airflow workflow model while managing its underlying environment. The compatibility assumptions remove the main migration uncertainty. Step Functions and Glue workflows require orchestration rewrites; running Airflow on ECS still leaves the team responsible for operating substantial parts of Airflow.
Data Ingestion and Transformation
5
Select One
A company must populate a relational analytics target from a production database and keep it updated as transactions occur. Both endpoints are supported by AWS DMS, and the source is configured for change capture.
The source application cannot stop accepting writes during the initial transfer. The team wants to minimize custom synchronization logic.
Which approach should it use?
Export the database, load the target, and run a scheduled comparison process to reconcile changed rows.
Run parallel JDBC extracts and track source modification timestamps in a custom synchronization table.
Load a database snapshot and deploy a transaction-log consumer that applies subsequent changes.
Configure a DMS full-load-and-CDC task to perform the initial transfer and ongoing replication.
D
DMS full load plus CDC handles the initial population and subsequent source changes. The other approaches introduce custom reconciliation, watermarking, or transaction-log processing. The question establishes supported endpoints and source configuration, making DMS the option with the least custom synchronization work.
Data Ingestion and Transformation
4
Select One
A sales team needs an hourly S3 extract of new and updated Salesforce records. The Salesforce objects and required fields are supported by Amazon AppFlow. The extraction requires simple field mapping and filtering.
The team has no existing integration code and wants the lowest development and maintenance effort.
Which solution should the data engineer choose?
Schedule a Lambda function that calls Salesforce APIs, tracks modification timestamps, and writes records to S3.
Configure an AppFlow Salesforce-to-S3 flow with scheduled incremental transfers and field mappings.
Schedule a Glue job that retrieves Salesforce records through APIs and maintains a processing watermark.
Run an ECS task that exports Salesforce records hourly and stores its extraction state in DynamoDB.
B
AppFlow provides the supported Salesforce connector, scheduling, incremental transfers, and mappings. The other approaches can perform the extraction but require custom API handling, state management, and maintenance. The deciding constraint is implementation effort, not whether those alternatives can move data.
Data Ingestion and Transformation
3
Select One
A pipeline uses Lambda to separate JSON events by customer and a scheduled Glue job to convert them to Parquet. The resulting files are stored in S3 for Athena.
There are 20 active customers, the records have a stable schema, and several minutes of delivery latency are acceptable. The team wants to replace both processing stages with native Amazon Data Firehose capabilities.
Which TWO configurations should it use?
Enable dynamic partitioning with inline extraction of the customer identifier from each event.
Configure a Lambda transformation that returns customer-specific prefixes and serialized Parquet records.
Enable record format conversion using a matching schema from the Glue Data Catalog.
Create one delivery stream per customer and maintain producer-side routing to the individual streams.
A
Dynamic partitioning replaces the customer-routing logic, while record format conversion replaces the scheduled JSON-to-Parquet stage. The stable schema and modest number of customer partitions fit these capabilities. A Lambda transformation or separate delivery streams per customer retain custom code or additional resources.
Data Ingestion and Transformation
2
Select Two
C
A company publishes JSON events to Amazon MSK. Analysts need to query recent events alongside existing Redshift tables with low ingestion latency. The events require only filtering and SQL-compatible field extraction.
The Redshift deployment supports streaming ingestion, and network connectivity to MSK is available. The team wants to minimize additional processing infrastructure.
Which solution should it implement?
Run a managed Flink application that consumes Kafka events and writes microbatches into Redshift staging tables.
Run Kafka consumers on ECS that accumulate events and load them into Redshift through the Data API.
Create an external schema for MSK and an automatically refreshed streaming materialized view in Redshift.
Deliver Kafka events to S3 and orchestrate frequent Redshift COPY operations from newly delivered objects.
C
Redshift streaming ingestion can consume MSK topic data directly into a materialized view. It avoids separate consumer applications and S3-loading orchestration for the stated SQL-compatible processing. The other designs can ingest the data but add components to operate. Automatic refresh supports low latency; it is not a fixed-latency guarantee.
Data Ingestion and Transformation
1
Select One
.png)
.svg)
