Free AWS Certified Data Engineer - Associate (DEA-C01) Sample Questions

Correct answer: A — Emit a custom CloudWatch metric for records processed per run and alarm when the metric drops below an expected threshold

• A. A custom metric tracking records processed, with an alarm on it dropping below expectation, catches a job that succeeds while producing unexpectedly few records.
• B. Increasing memory can help memory-bound performance, but it does nothing to detect a job that completes successfully while silently under-producing records.
• C. Catching and logging exceptions surfaces real errors, but a job that runs successfully without throwing raises no exception for this pattern to catch.
• D. Limiting concurrency to one controls how many instances run simultaneously, with no bearing on detecting whether a completed run produced expected volume.

Correct answers: A, B — Storing templates in version control lets every deployed change be traced back to a specific commit, author, and timestamp; Declaring resources in a template lets the same definition be deployed repeatably across multiple accounts without manual steps

• A. Version-controlled templates tie every change to a commit, author, and timestamp, giving the team traceability across accounts and over time for incidents.
• B. A declarative template can be applied the same way in each account, producing consistent resources without engineers repeating manual console steps.
• C. Infrastructure as code is defined in templates and applied through automation instead of the console; it does not require console-first resource creation.
• D. Some resource updates require replacement or cause brief interruption depending on the change type, so zero downtime is not guaranteed by templating alone.
• E. Passing syntax validation only confirms the template parses correctly; it does not verify the deployed resources behave correctly, so testing still matters.

Correct answer: A — Upload the JDBC driver JAR to an Amazon S3 location and reference that S3 path when creating the Glue connection, so the job loads the custom driver at runtime.

• A. AWS Glue lets you upload a custom JDBC driver JAR to Amazon S3 and reference its path when defining the connection, so the job loads that driver at runtime for engines Glue does not support natively.
• B. Glue is fully managed, but customers add custom JDBC drivers themselves through the S3-referenced connection mechanism rather than through a support case that modifies the underlying service infrastructure.
• C. Glue jobs run in a Spark environment, not the AWS Lambda runtime, so Lambda layers are not a mechanism for supplying dependencies to a Glue ETL job.
• D. Amazon Data Firehose delivers streaming data to a fixed set of destinations and does not connect to arbitrary relational databases over JDBC, so it cannot substitute for a custom driver.

Correct answers: A, B — Invoke a foundation model through Bedrock from a Lambda function triggered after a Glue crawler run, using the model to generate a description of each updated table's schema.; Call a Bedrock foundation model from within the existing Lambda transformation step to classify each incoming support ticket's free text into a topic category before writing the record downstream.

• A. Invoking a Bedrock foundation model from a Lambda function triggered after a crawler run lets the model read the updated schema and generate a descriptive summary, which is a documented pattern for enriching the Glue Data Catalog with generative AI metadata.
• B. Calling a Bedrock foundation model from inside an existing Lambda transformation step to classify free-text ticket content fits naturally into a pipeline that already processes each record with Lambda, adding topic classification without a separate service.
• C. Bedrock foundation models generate text and other content; they do not directly write to or replace the Glue Data Catalog's crawler-based schema discovery mechanism.
• D. Bedrock is a managed API for invoking foundation models over HTTPS; it is not a Glue Spark worker type and cannot run as a DPU-based executor inside a Glue job.
• E. Simple numeric aggregation such as counting rows by date is a standard SQL or Spark operation; a foundation model is not required and is not the only AWS mechanism capable of that calculation.

Correct answers: A, B — For pipeline A, configure the crawler with a time-based schedule, such as an hourly cron expression, so it runs once every hour regardless of file activity.; For pipeline B, configure an S3 Event Notification (or an EventBridge rule matching S3 object-created events) that invokes the job as soon as a new file arrives.

• A. A fixed hourly schedule directly matches pipeline A's requirement to catalog partitions once every hour regardless of whether or when files actually arrive.
• B. An S3 Event Notification or an EventBridge rule on object-created events fires immediately when a new file lands, which matches pipeline B's need to start processing within seconds of unpredictable arrivals.
• C. An event-driven trigger would run the crawler only when an object happens to be created, which would not guarantee the fixed once-per-hour cadence pipeline A requires, especially during periods with no new files.
• D. A fixed hourly check would introduce up to an hour of delay before new files are noticed, which fails pipeline B's requirement to react within seconds of an unpredictable file arrival.
• E. Manual on-demand triggers require a person to start every run, which meets neither pipeline A's unattended hourly cadence nor pipeline B's need for immediate, automatic reaction to new files.

Correct answer: A — Lambda polls each shard as a standard iterator consumer, sharing that shard's read throughput with any other consumer applications reading the same shard.

• A. Without configuring enhanced fan-out, the default Lambda-Kinesis event source mapping uses the standard iterator, polling each shard for records and sharing that shard's read throughput with any other consumer applications on the stream.
• B. Enhanced fan-out with a dedicated per-shard connection must be explicitly registered as a stream consumer and referenced in the event source mapping; it is not the default behavior.
• C. By default Lambda reads records in batches from each shard and invokes the function per batch rather than per individual record, which is more efficient than one invocation per record.
• D. Lambda's Kinesis event source mapping works with any standard Kinesis data stream; there is no special Lambda-only stream type or requirement to recreate the stream.

Correct answer: B — Step Functions Standard Workflows are fully managed with no servers to provision, support year-long executions, and integrate natively with Glue, Lambda, and approval tokens

• A. Glue triggers can start jobs and crawlers on a schedule, on demand, or on an event, but they provide no Choice-state branching logic and no mechanism to pause and wait for human approval.
• B. Step Functions Standard Workflows require no infrastructure provisioning from the team, support executions lasting up to a year, and have native integrations for Glue, Lambda, and human approval through waitForTaskToken.
• C. EMR on EC2 provisions actual EC2 instances the team is responsible for patching and sizing, and installing Airflow on the master node still means managing that node's software lifecycle, which is not serverless.
• D. An Auto Scaling group still consists of managed EC2 instances the team must patch and configure when scaled up; a zero minimum reduces idle cost but does not make the underlying compute serverless.

Correct answer: B — Asset Watchers, which let a producer DAG publish asset events that trigger dependent workflows in downstream MWAA environments, including across separate accounts

• A. Matching cron schedules across units only guarantees DAGs start at the same time, not that upstream data is actually ready, and creates no real dependency between the units' workflows.
• B. Asset Watchers let a producer DAG publish events about data asset readiness that trigger dependent workflows in downstream MWAA environments, including in other accounts, giving decoupled, event-driven cross-account triggering.
• C. The MWAA environment class controls compute capacity for DAGs within a single environment; it has no bearing on whether one account's environment can trigger a DAG in a separate account's environment.
• D. The catchup setting controls whether missed past DAG runs are backfilled when a DAG is unpaused; it has no role in coordinating asset-driven triggering between DAGs in different accounts.

Correct answer: B — Configuring a TimeoutSeconds or HeartbeatSeconds value on the task, so the machine fails the task with a States.Timeout error if no response arrives in the window

• A. IAM credential or role expiration is unrelated to how Step Functions bounds a waitForTaskToken wait; the timeout behavior is governed by the task's own Timeout and Heartbeat configuration.
• B. Task states support a TimeoutSeconds field bounding total wait time and a HeartbeatSeconds field requiring periodic heartbeats; if neither arrives in the configured window, Step Functions fails the task with States.Timeout.
• C. There is no automatic, unconfigurable sixty-second cutoff on waitForTaskToken tasks; the wait duration is governed by the explicitly configured TimeoutSeconds and HeartbeatSeconds fields.
• D. Step Functions does provide native TimeoutSeconds and HeartbeatSeconds fields specifically to bound these waits, so building a separate external polling mechanism is unnecessary.

Correct answer: A — Configure an AS2 endpoint, which is built for compliance-oriented B2B exchanges with signing, encryption, and message-disposition receipts.

• Configure an AS2 endpoint, which is built for compliance-oriented B2B exchanges with signing, encryption, and message-disposition receipts.. AS2 is specifically designed for regulated B2B data exchange, natively supporting digital signatures, encryption, and message-disposition acknowledgments that confirm receipt and integrity.
• Configure a plain FTP endpoint, since FTP is the simplest legacy protocol available for exchanging unencrypted files with external partners.. Plain FTP transmits data unencrypted and has no built-in signing or receipt mechanism, so it cannot satisfy the compliance and integrity requirements described.
• Configure an SFTP endpoint and rely solely on the partner's SSH key pair to satisfy the compliance requirement without AS2.. SFTP secures the transport channel with SSH but does not provide message-level signing or delivery receipts the way AS2 does for B2B compliance workflows.
• Configure browser-based transfers so business users can manually upload claims files through a web console each business day.. Browser-based transfers are meant for ad hoc human uploads to S3 and do not provide the automated signing, encryption, and receipt features required for this B2B exchange.

Correct answer: A — Create a materialized view over the aggregate query and enable automatic refresh so it stays current as base tables change.

• Create a materialized view over the aggregate query and enable automatic refresh so it stays current as base tables change.. A materialized view stores the precomputed join and aggregate result, and automatic refresh keeps it in sync with the infrequent base-table updates, making dashboard loads fast.
• Create a regular view over the aggregate query so Redshift always recomputes the join and aggregation on each dashboard load.. A regular view is just stored SQL; it still runs the full expensive join and aggregation every time the dashboard queries it, so load time does not improve.
• Increase the cluster's concurrency scaling limit so more dashboard queries can run in parallel against the base tables.. Concurrency scaling adds capacity for handling more simultaneous queries but does not reduce the cost of each individual expensive aggregate query.
• Add a sort key to each fact table so the same multi-join aggregate scans fewer blocks on every dashboard load.. A sort key can reduce scanned blocks somewhat, but the query still recomputes the full multi-table join and aggregation on every load rather than reusing a precomputed result.

Correct answer: A — Set the job's catalog update options, such as enableUpdateCatalog and the target database and table, on the sink so the job registers new partitions as it writes.

• A. Enabling catalog updates on the sink, along with specifying the target database and table, makes the Glue job itself create or update partition metadata in the Data Catalog as it writes output, removing the need for a separate crawler pass.
• B. Worker count controls parallelism for the transform and write stages of the job, not whether or when the Data Catalog is notified about new partitions, so scaling workers does not solve the metadata registration gap.
• C. from_options reads data without consulting the catalog at all and has no bearing on write-side catalog registration; it is unrelated to whether new output partitions get registered after a write.
• D. S3 event notifications can trigger Lambda functions or other targets, but they cannot directly embed an Athena DDL statement, and this is not a supported mechanism for catalog partition synchronization.

Correct answer: A — The crawler is pointed directly at the DynamoDB table name rather than an S3 path or JDBC connection, since DynamoDB is added as its own native crawler data source type.

• A. DynamoDB is one of the native data source types a Glue crawler can target directly by table name, without needing a JDBC connection string or an S3 path, which is what distinguishes it from file-based or relational sources.
• B. Glue infers a schema from a sample of DynamoDB items using its built-in handling for that data source type; it does not require a hand-written custom classifier just to read a DynamoDB table's structure.
• C. Exporting to S3 first would be a workaround, not a requirement; Glue crawlers support DynamoDB as a first-class data source and can read from the table directly.
• D. DynamoDB is accessed through the AWS API rather than a JDBC endpoint, so configuring a JDBC connection with a host and port, as would be done for RDS, does not apply to DynamoDB crawling.

Correct answers: A, B — S3 re-evaluates the object's current tags when each lifecycle action executes, so a tag removed before the action runs means it no longer matches; To reliably confirm an expiration or transition already ran before removing a tag, the team should wait for an S3 Lifecycle Event Notification first

• A. S3 evaluates tag-based filters against an object's current tags daily and again at the moment a queued action executes, so if the triggering tag was removed before the transition or expiration actually runs, the object no longer matches and the action does not proceed.
• B. AWS documentation recommends waiting for a Lifecycle Event Notification to reliably confirm that an expiration or transition already executed before removing the triggering tag, since tag changes and the daily evaluation cycle make timing assumptions unreliable otherwise.
• C. S3 does not cache tag values at creation time; the tag filter is a live condition re-checked before each action executes, so a tag change made any time before that point is honored.
• D. Once a lifecycle action has been queued for asynchronous processing and begins executing, removing a tag does not interrupt an action that is already underway; the re-evaluation happens before an action is applied, not mid-execution.
• E. Lifecycle rules apply continuously to both existing and newly created objects that match the filter at evaluation time, not just once when the rule was authored, so the rule keeps applying to new uploads going forward.

Correct answer: A — This configuration is invalid because S3 requires a minimum gap between certain storage class transitions, and 15 days between Standard-IA and Glacier does not satisfy it

• A. S3 Lifecycle enforces minimum transition timing between certain storage class pairs, and Amazon's documented guidance requires at least 30 days between a Standard-IA (or One Zone-IA) transition and a subsequent Glacier Flexible Retrieval transition, so a 15-day gap violates that constraint and the configuration would be rejected or corrected.
• B. S3 does not allow arbitrary transition timing between every storage class pair; documented minimum-gap constraints exist specifically for transitions into and out of the IA classes, so 'no minimum gap requirement' misstates the documented behavior.
• C. A single S3 Lifecycle rule can define multiple ordered transition actions that chain an object through several storage classes over its lifetime; splitting each transition into a separate rule is not a requirement.
• D. S3 does not silently skip a configured transition action; an invalid chained-transition configuration is rejected or must be corrected rather than partially applied by ignoring one of the two transitions.

Correct answer: A — DISTSTYLE ALL, which stores a full copy of the small table on every compute node so no join ever needs to redistribute rows

• A. A full copy on every node means whichever fact table's distribution key is used, the matching lookup row is always present locally, so no redistribution is needed for either join.
• B. Matching the key of one fact table only solves collocation for that table; the join against the other fact table, which distributes on a different column, would still require redistribution.
• C. Even distribution spreads rows without regard to any join column, so both fact table joins would still need to redistribute the lookup rows across the network.
• D. There is no VACUUM REEVALUATE command in Redshift, and manual reshuffling under AUTO distribution does not guarantee collocation with two differently distributed fact tables.

Correct answer: A — Amazon SageMaker ML Lineage Tracking, which records associations between datasets, processing jobs, training jobs, and models

• A. ML Lineage Tracking is purpose-built to capture the graph of artifacts and their associations across an ML workflow, letting a reviewer query from a deployed model back through training jobs to the exact dataset and transformations used.
• B. CloudWatch Logs Insights can search log text emitted during a job, but it does not model the structured relationships between datasets, jobs, and models that a lineage query needs to trace directly.
• C. CloudTrail records who called which API and when, which is useful for auditing actions, but it does not track the artifact-level relationships between a dataset, a training job, and a resulting model.
• D. S3 Versioning preserves prior file contents in a bucket, but on its own it does not connect a specific dataset version to the training job and model that consumed it.

Correct answer: A — Create per-customer schedules using Amazon EventBridge Scheduler, which manages individually recurring schedules with timezone awareness and per-schedule target payloads.

• A. EventBridge Scheduler is designed to manage large numbers of individual, timezone-aware schedules with per-schedule target payloads, which fits hundreds of customer-specific nightly invocations that change over time.
• B. A single UTC-only rule pushes all the timezone and per-customer payload logic into the Glue job itself, which is exactly the per-schedule management work EventBridge Scheduler already handles natively.
• C. Hardcoding hundreds of customer schedules inside one Lambda's loop, invoked once daily by an Airflow DAG, creates a single point of maintenance and does not honor individually varying customer times.
• D. A long-running Standard workflow parked in Wait states for up to a year per customer is an inefficient, hard-to-manage substitute for a purpose-built scheduling service.

Correct answers: A, B — Create an EventBridge rule with an event pattern matching Glue Job State Change events where the state is `FAILED`, and set the Lambda function as its target.; Configure the rule's target with an on-failure destination or dead-letter queue so the alert is retained if the Lambda invocation itself later fails.

• A. Glue emits job state change events to EventBridge, so a rule with an event pattern matching `FAILED` states and the Lambda function as its target reacts immediately without any polling.
• B. Adding an on-failure destination or DLQ to the rule's target protects against losing the failure alert if the Lambda invocation itself errors, keeping the page reliable end to end.
• C. Polling `get_job_runs` for every job once a minute is exactly the polling approach the team wants to avoid, and it adds latency and unnecessary API calls compared to an event-driven rule.
• D. CloudTrail records API activity and does not itself filter and deliver targeted service state-change events to a Lambda function the way an EventBridge rule with an event pattern does.
• E. S3 object permissions have no bearing on whether EventBridge delivers Glue job state change events; that delivery is governed by the rule's event pattern and target permissions, not S3 access.

Correct answer: A — Amazon Athena, running a serverless SQL query directly against the Parquet files through the Glue Data Catalog.

• Amazon Athena, running a serverless SQL query directly against the Parquet files through the Glue Data Catalog.. Athena is a serverless interactive query service that runs standard SQL directly against S3 data registered in the Glue Data Catalog, with no clusters to provision, matching a one-off report needed within the hour.
• Amazon EMR, launching a transient cluster sized for the query and terminating it once the report is generated.. Even a transient EMR cluster requires choosing an instance type and cluster size and waiting for it to bootstrap, adding provisioning overhead that is unnecessary for a single ad hoc aggregate query.
• Amazon Redshift provisioned clusters, resizing the cluster to a larger node type to handle the ad hoc workload.. A provisioned Redshift cluster requires the data to already be loaded or spectrum-configured and involves managing fixed compute nodes, which is heavier infrastructure than a single ad hoc query justifies.
• AWS Glue ETL jobs, writing a Spark script that aggregates the Parquet files and writes the result back to S3.. Writing and deploying a Glue Spark job adds development and job-run overhead that is disproportionate to a simple distinct-count query needed quickly for a report.

Correct answer: A — Athena Spark bills only for the compute consumed during active sessions, avoiding the cost of an idle cluster during the many hours with no exploratory workload.

• Athena Spark bills only for the compute consumed during active sessions, avoiding the cost of an idle cluster during the many hours with no exploratory workload.. Athena Spark is serverless and charges for the compute used during active notebook sessions, so a bursty workload that is idle most of the week avoids paying for cluster capacity that sits unused, unlike a long-running EMR cluster.
• Athena Spark supports installing arbitrary custom bootstrap actions and low-level YARN tuning that a managed EMR cluster does not expose to users.. It is EMR, not Athena Spark, that exposes bootstrap actions and low-level YARN configuration; Athena Spark trades that fine-grained control for a simpler, serverless session model.
• Athena Spark stores notebook files directly on cluster-attached HDFS volumes, giving faster local disk access than EMR's S3-backed storage.. Athena Spark is serverless and does not maintain a persistent HDFS cluster for notebook storage, so this describes neither how Athena Spark nor typical EMR-on-S3 storage patterns work.
• Athena Spark allows full root SSH access to the underlying worker nodes, which a managed EMR cluster restricts for administrators by default.. Athena Spark does not expose SSH access to underlying compute at all, since AWS manages the infrastructure entirely; EMR is the service that can allow SSH access to cluster nodes.

Correct answer: A — Stream the logs into an Amazon OpenSearch Service domain sized for the retention and query load, and build OpenSearch Dashboards for full-text search and drill-down visualization.

• A. OpenSearch Service is purpose-built for full-text search at scale and pairs with Dashboards for interactive drill-down visualization, and its storage tiers can retain years of data more cost-effectively than keeping everything hot in CloudWatch Logs.
• B. CloudWatch Logs Insights is well suited to ad hoc queries, but retention is governed by the log group's configured setting rather than unlimited, and it lacks the rich dashboarding this scenario requires.
• C. DynamoDB is a key-value and document store without native full-text search, so free-form log message search would require substantial custom indexing logic built entirely outside DynamoDB itself.
• D. Redshift SQL can filter structured text with pattern matching, but it is not designed for full-text search relevance ranking or the interactive drill-down visualization experience analysts need here.

Correct answers: A, B, F — A `filter` command early in the pipeline that restricts processing to log entries where the `level` field equals `ERROR`, before any aggregation runs.; A `stats count(*) by service, bin(5m)` command that groups the filtered entries into 5-minute buckets per service and counts the errors in each bucket.; A `sort count desc` and `limit 20` command at the end of the pipeline to order the aggregated results and cap the output to the top 20 buckets.

• A. Filtering to ERROR-level entries as early as possible in the pipeline reduces the data volume before the more expensive aggregation step runs, and it directly implements the requirement to count only errors.
• B. A stats command with a by clause that includes bin(5m) is exactly how Logs Insights groups counts into fixed time buckets per service, matching the 5-minute bucket and per-service breakdown requested.
• C. Logs Insights automatically discovers fields in JSON-formatted log events without a parse command, so an explicit regular expression extraction is unnecessary for this JSON-based log group.
• D. Dedup removes duplicate log records matching specified fields; it is not a prerequisite for aggregation and would incorrectly collapse repeated service names that should each contribute to the count.
• E. Sort and limit are pipeline commands that operate directly on the query's tabular results; visualization is a separate rendering option and is not required for sort or limit to function.
• F. Sort and limit are the standard commands for ordering aggregated results by count and capping the returned rows to the requested top 20 buckets.

Correct answer: A — Set the data quality check scope to apply the check to a selected group of columns rather than to an individual column.

• A. The check scope setting lets a single check be applied to a group of selected columns at once, which is exactly the mechanism for enforcing the same "at most 100" condition across all five numeric columns without repeating the rule.
• B. Duplicating the whole ruleset five times still creates five separate rule definitions to maintain, which is the repetitive approach the analyst is trying to avoid.
• C. Concatenating column names into a single SQL string does not express a per-column numeric comparison and would not correctly validate each column's values.
• D. Running five separate profile jobs multiplies operational overhead and still evaluates each column independently rather than through one shared rule.

Correct answers: A, B — Adaptive Query Execution (AQE) uses runtime statistics gathered during execution to dynamically resize shuffle partitions and split skewed ones.; AQE ships enabled by default starting with AWS Glue version 3.0 and continuing in 4.0, with no separate feature flag needed to turn it on.

• A. AQE reoptimizes the query plan at runtime using actual data statistics gathered during execution, including detecting and splitting skewed shuffle partitions, which is the automatic runtime correction the team wants.
• B. AQE ships enabled by default from Glue 3.0 onward and continues in 4.0, so teams get this runtime correction without having to opt in through a separate flag.
• C. AQE's defining feature is that it adapts the plan during execution using runtime statistics, not just static statistics collected before the job starts.
• D. AQE does not require manual salting configuration; it detects and corrects skew automatically based on runtime task statistics without a developer defining a salt key.
• E. AQE optimizes query execution plans and does not replace or infer the Data Catalog's schema metadata role.
• F. AQE is a general Spark SQL execution optimization that applies to standard ETL transform jobs; it is not limited to data quality evaluation runs.

Correct answers: A, B — The access point policy works alongside the underlying bucket policy, and a request must be permitted by both for the operation to succeed.; Restricting the access point to a VPC means requests routed through the public internet to that access point's alias are automatically rejected.

• A. An access point attached to a bucket enforces its own policy in conjunction with the bucket policy, so both must allow the request; the access point narrows access, it does not replace the bucket-level policy.
• B. A VPC-only access point is configured to accept requests only through the VPC endpoint tied to that VPC, so connection attempts arriving over the public internet to that access point are rejected regardless of the caller's identity.
• C. The calling principal still needs an IAM identity policy that allows the S3 action on the access point; network origin restriction is an additional layer, not a substitute for identity-based authorization.
• D. Creating an access point does not delete or disable the bucket policy; the bucket policy continues to apply to direct bucket requests and to requests made through any access point.
• E. Access points only support object-level operations such as `GetObject` and `PutObject`; bucket-level actions like deleting the bucket or changing its replication configuration are outside what an access point can be used for.

Correct answer: A — Self-managed database on EC2

• A. A database engine installed directly on an EC2 instance is unmanaged: the customer owns operating system patching, engine upgrades, and backup configuration, since AWS only manages the underlying virtualization layer.
• B. Amazon RDS is a managed relational database service where AWS handles engine patching, automated backups, and failover, which is the opposite of the unmanaged responsibility split described in the stem.
• C. Redshift Serverless is a fully managed, serverless data warehouse where AWS provisions and scales compute automatically, so the customer has no operating system or engine patching responsibility.
• D. AWS Glue is a fully managed ETL service where AWS provisions and manages the underlying Spark or Python execution environment, leaving the customer with no infrastructure or engine patching to perform.

Correct answers: A, C — Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in RDS rotation function so the password is updated on a schedule.; Update the ETL job's code to call the Secrets Manager get-secret-value API at runtime instead of reading static credentials from the configuration file.

• A. Secrets Manager natively integrates with RDS to rotate database passwords on a schedule using a managed Lambda rotation function, which directly satisfies the rotation requirement.
• B. This removes the hard-coded value from the config file, but Parameter Store alone does not rotate the password, so the static password is simply relocated rather than rotated.
• C. Retrieving the secret dynamically at runtime means the job always picks up the latest rotated password, removing the hard-coded value without needing an application redeploy.
• D. User-data scripts are visible to anyone with EC2 describe permissions on the instance and provide no rotation capability, leaving a static, exposed credential in place.
• E. IAM policies do not carry database passwords as a permission grant, and this still leaves a static credential outside a managed secret store with no rotation configured for it.

Correct answers: A, B — Tag each engineer's IAM role with a project principal tag matching their current assignment, updating only that tag value when the engineer switches projects.; Write an IAM policy condition comparing the principal's project tag against the resource's project tag so access is allowed only when the two values match.

• A. A principal tag on the role is the attribute that ABAC conditions compare against a resource tag, and changing the value on a project switch never touches the IAM policy.
• B. This condition is the mechanism that makes ABAC work: a single policy grants access dynamically whenever the principal's tag matches the resource's tag, with no per-project policy edit.
• C. Naming explicit ARNs per project is the role-based, named-resource pattern ABAC is meant to replace, and it still requires a policy change on every reassignment.
• D. Service control policies set permission boundaries across accounts but do not themselves perform tag-matching authorization, and per-engineer resource policies still need manual updates as assignments change.
• E. PowerUserAccess grants broad permissions across nearly all services regardless of project, and config rules only report violations after access has already occurred, not at request time.

Correct answer: A — Set the cluster's parameter group `require_ssl` parameter to true, which causes Redshift to reject any client connection that does not negotiate SSL/TLS before it can run queries.

• A. Setting `require_ssl` to true in the cluster's parameter group makes Redshift enforce SSL/TLS on every connection and refuse any client that attempts to connect without it, matching the requirement to reject unencrypted attempts.
• B. A driver-side preference for SSL negotiates encryption opportunistically but still permits a plaintext connection when the server does not enforce TLS, which does not satisfy a hard requirement to reject unencrypted attempts.
• C. VPC network traffic is not automatically encrypted at the packet level by default, and a VPN secures the tunnel between networks, not the application-layer connection between the ETL client and the cluster's SSL listener.
• D. Encryption at rest protects data stored on disk and is a separate control from transport encryption; it has no effect on whether a network connection between the client and cluster is encrypted.

Correct answers: A, B — Use the KMS `CreateGrant` operation to issue a grant for the specific principal and operations needed, since a grant can be programmatically created and later retired or revoked once the job finishes.; A grant can be scoped with constraints, such as an encryption context constraint, so the permission it confers applies only to requests matching that specific context, not to every use of the key.

• A. `CreateGrant` lets a permitted principal programmatically delegate specific key operations to another principal for a bounded purpose, and the grant can be retired or revoked afterward, making it well suited to temporary access during a single job run.
• B. Grants support constraints such as an encryption context constraint, which narrows the grant so it only authorizes requests carrying that specific context, giving fine-grained scoping beyond a blanket key permission.
• C. A grant is a separate access control object from the key policy document; creating or retiring a grant does not edit or republish the key policy, which is exactly why grants are convenient for temporary, programmatic access.
• D. Key policies and IAM policies can and routinely do grant permission to use a KMS key on their own; grants are an additional, more dynamic mechanism layered on top, not the only way to authorize key usage.
• E. Grants are designed specifically for programmatic delegation and can be created by any principal that itself has grant-creation permission on the key, not solely the root user through the console, which is what makes them practical for automated pipelines.

Correct answer: A — Define an Amazon Athena table over the existing S3 prefix using partition projection so queries can filter on the account, Region, and date partitions.

• A. Athena can query CloudTrail JSON log files in place using `CREATE EXTERNAL TABLE` with partition projection over the account, Region, and date structure already in the S3 path, requiring no data movement or new managed service.
• B. Standing up an OpenSearch domain and a custom reindexing pipeline is significant new infrastructure for a one-off quarterly query need, and it duplicates data that Athena could already query directly from S3.
• C. A persistent EMR cluster with nightly Hive reprocessing is far more operational overhead than a one-off SQL query requires, and it leaves a cluster running that must be managed and paid for continuously.
• D. CloudTrail Lake event data stores ingest events directly from CloudTrail or via copy-trail operations, not by manually copying arbitrary S3 objects, and building this pipeline is unnecessary new infrastructure for a single query.

Correct answers: A, B, C — It lets you run SQL queries across multiple event data stores spanning several accounts and Regions in the CloudTrail console, without configuring Athena tables.; It converts ingested events into columnar Apache ORC storage, so ad hoc SQL queries typically scan less data than an equivalent query over row-based JSON files.; It supports configurable retention of up to seven years on an event data store, meeting long compliance retention windows without a separate S3 lifecycle policy.

• A. Event data stores can span multiple accounts and Regions, and the CloudTrail console itself provides the SQL query editor, so no separate Athena table or Glue Data Catalog setup is required.
• B. CloudTrail Lake converts events to columnar ORC storage internally, which is why SQL queries against it are typically more efficient than scanning equivalent row-based JSON files directly.
• C. Event data stores support pricing options with retention up to roughly seven years, letting compliance teams meet long retention requirements without managing a separate S3 lifecycle configuration.
• D. CloudTrail Lake manages its own internal storage for event data stores rather than writing events into a customer-owned S3 bucket, so this description of the storage model is incorrect.
• E. CloudTrail Lake bills separately for data ingested into an event data store and for the amount of data scanned when running queries, so query execution is not free.
• F. CloudTrail Lake has no built-in integration that automatically routes flagged events to Amazon Macie; Macie is a separate service focused on discovering sensitive data in Amazon S3.

Correct answer: A — AWS Config, using its configuration history and item timeline for the bucket to show setting values and related resources over time.

• A. AWS Config records configuration items and configuration history for a resource over time, letting the engineer view the exact value of a setting before and after a change and see the relationships to other resources at that point in time.
• B. CloudTrail records who called which API and when, which is useful for identifying the actor, but it does not by itself present the before-and-after configuration state or the resource's relationship timeline the way Config's configuration history does.
• C. S3 server access logs capture data-plane requests like object reads and writes; they do not track changes to bucket-level settings such as encryption configuration.
• D. Trusted Advisor evaluates the current state of a resource against best-practice checks; it does not retain a historical timeline of past configuration values for a specific bucket.

Correct answer: A — Add the analyst as a project member for the initiative, and have them request the specific catalog asset so its owner can approve access scoped to that project.

• A. SageMaker Catalog projects scope membership and asset subscriptions to a specific initiative, so adding the analyst to the project and having them request the specific asset lets the dataset owner grant access limited to that project rather than the whole catalog.
• B. A broad sagemaker:* IAM policy would expose every dataset in the catalog to the analyst, which is the opposite of the least-privilege, project-scoped access the team wants to provide.
• C. Exporting metadata to a spreadsheet abandons the catalog's governed access and subscription model entirely and provides no enforcement of what the analyst is actually permitted to query.
• D. Building a Redshift datashare over the whole catalog and granting direct SELECT access bypasses the project-based subscription and approval workflow and exposes far more data than the single initiative requires.