Validates skills in building data pipelines, ETL operations, and data lake design on AWS.
AWS Glue, Lambda, Kinesis, Amazon EMR, Step Functions
Amazon S3, Redshift, DynamoDB, Lake Formation, Apache Iceberg
CloudWatch, CloudTrail, Athena, QuickSight, Automation Pipelines
IAM, KMS, Macie, Glue Data Catalog, RBAC
Try real exam-style questions from the free sample set. Each answer comes with a full explanation.
Due to audit requirements from financial regulators, a company must retain a 90-day history of all access and data manipulation operations (such as object deletion, bucket policy changes, and data downloads) on Amazon S3 buckets, and be able to submit this history during audits.
Which AWS service should be enabled to meet these requirements without any additional application code changes?
Answer: C. AWS CloudTrail
The key in this question is that the company must retain a 90-day history of all access and data manipulation operations on S3 buckets and be able to submit this during audits, and must meet these requirements without any additional application code changes. AWS CloudTrail automatically records all API calls within the AWS account and tracks all S3 operations including GetObject (download), DeleteObject (deletion), and PutBucketPolicy (bucket policy changes) without code changes. CloudTrail logs can be stored in an S3 bucket and retained for the desired period, meeting the 90-day requirement.
!image
AWS CloudTrail records both management events (control plane operations such as bucket creation and policy changes) and data events (object-level operations such as GetObject, PutObject, and DeleteObject). CloudTrail Lake enables retaining event data for up to 7 years and querying with SQL. Management events are automatically recorded by default, while data events must be explicitly enabled. All recording is performed automatically at the AWS account level, requiring no application code modifications.
For audit log questions, precisely distinguish service purposes. If the requirement is API call auditing and access history tracking, choose AWS CloudTrail. If tracking resource configuration change history, choose AWS Config. If PII identification and data classification are needed, Amazon Macie is the answer. S3 server access logs are HTTP request-level logs, separate from CloudTrail API auditing.
A financial data services company operates an internal data analytics API through Amazon API Gateway. This API must only be called from specific AWS accounts and approved domains, and all other access must be blocked.
What is the most appropriate API Gateway security configuration to restrict accessible accounts and domains at the API level without an additional authentication layer?
Answer: C. Resource policy
To select the correct answer, you first need to understand the access control mechanisms available in API Gateway. The key requirements in this scenario are allowing only specific AWS accounts and approved domains at the API level without an additional authentication layer. The API Gateway resource policy is a JSON-based IAM policy document that explicitly controls access based on AWS accounts, IP address ranges, VPCs, and VPC endpoints, perfectly matching these requirements.
!image
Resource policies work by blocking access before API Gateway processes the request. Condition keys such as aws:SourceAccount, aws:SourceVpc, and aws:SourceIp allow precise specification of permitted AWS accounts and IP ranges. No user-credential-based authentication logic (such as a Lambda function or Cognito user pool integration) is required, keeping the configuration simple.
The Cognito user pool authorizer (Option 1) and Lambda custom authorizer (Option 2) both introduce an additional authentication layer, which does not match the requirements. API keys and usage plans (Option 4) are throttling and usage monitoring tools, not account- or domain-based access control mechanisms.
An AWS Lambda function performing data transformation tasks is experiencing timeout issues when processing large JSON files.
What Lambda setting should be adjusted to improve the function execution speed without changing the code logic?
Answer: C. Increase Lambda memory allocation
This question tests whether you can identify the Lambda setting that improves processing speed without code changes. In Lambda, memory and vCPU are linked — increasing the memory allocation automatically and proportionally increases the vCPU assigned to the function. Adjusting only the configuration setting improves processing speed without any code changes, making it the most direct solution for timeout issues when processing large JSON files.
!image
Lambda memory can be configured from 128 MB to 10,240 MB (10 GB), with a full vCPU assigned at 1,792 MB. Above 1,792 MB, multiple vCPUs are allocated, providing additional performance benefits for code that supports parallel processing. Because increasing memory also raises execution costs, it is recommended to use the Lambda Power Tuning tool to find the optimal memory setting.
Extending timeout and increasing memory are commonly confused. The timeout is an upper limit on allowed execution time — extending it does not improve the actual processing speed, so repeated timeout errors may continue. When 'improving processing speed' is the goal, increase memory; when 'temporarily allowing more execution time' is the goal, extend the timeout.
A data analytics team at an e-commerce company wants to immediately analyze terabytes of order and customer behavior log data stored in Amazon S3 using standard SQL without loading it into a separate data warehouse.
Which AWS service is most suitable for running interactive queries directly on an S3 data lake without separate infrastructure provisioning?
Answer: B. Amazon Athena
To select the correct answer, you first need to understand the difference between Amazon Athena and Amazon Redshift Spectrum. Athena is a fully serverless interactive query service that allows you to run standard SQL immediately against terabytes of log data stored in Amazon S3 without provisioning any cluster or infrastructure. It charges based on the amount of data scanned, making it cost-effective for analyzing S3 data directly without loading it into a data warehouse.
!image
Athena uses a Presto/Trino engine internally to support standard ANSI SQL and integrates with AWS Glue Data Catalog to automatically manage S3 data metadata. It supports various file formats including CSV, JSON, Parquet, and ORC, and leveraging partitioning can significantly reduce scanned data and query costs.
Option 1 (Amazon Redshift Spectrum) can query S3 data but requires provisioning a Redshift cluster, making it unsuitable for immediate-start requirements. Option 3 (AWS Glue Studio) is an ETL transformation tool that does not support interactive SQL queries. Option 4 (Amazon EMR) requires cluster provisioning and management, failing the requirement to analyze data immediately without infrastructure.
According to data governance policy, sensitive customer data stored in S3 must be encrypted with customer managed KMS keys, and the keys must be automatically rotated annually. Additionally, when a specific key is no longer needed, it must be able to be securely decommissioned.
Which KMS key type satisfies all these requirements?
Answer: C. Customer Managed Keys
Customer Managed Keys (CMK) support both configurable annual automatic rotation and Scheduled Key Deletion, satisfying all governance requirements in this scenario. Users directly create and manage the keys, with automatic rotation cycles customizable between 90 and 2,560 days. After disabling a key, it can be safely deleted following a 7 to 30-day waiting period.
KMS key types are divided into three categories based on the level of control. Customer Managed Keys are created and managed directly by the user, enabling full lifecycle control. AWS Managed Keys are managed by AWS services on behalf of the user, auto-rotate only on a 3-year cycle, and cannot be directly deleted. AWS Owned Keys are shared by AWS across multiple accounts, and users cannot even view the keys themselves.
!image
To avoid confusing AWS Managed Keys and Customer Managed Keys, distinguish them by whether the rotation cycle is configurable and whether the key can be deleted. If annual rotation or custom interval and the ability to decommission are required, choose Customer Managed Keys; if the AWS service default is sufficient, choose AWS Managed Keys.
The AWS Certified Data Engineer - Associate (DEA-C01) exam consists of 65 questions with a 130-minute time limit.
The passing score for the DEA-C01 exam is 720 out of 1000.
The DEA-C01 sample set (20 questions with full explanations) is free. The full bank of 470+ questions is available with a CloudMasterIT subscription.
The DEA-C01 certification is valid for 3 years after passing. Recertification is required after that.