AWS Certified Data Engineer - Associate (DEA-C01) Practice Exam

What the AWS Certified Data Engineer - Associate (DEA-C01) exam covers

• Data Ingestion and Transformation282 questions
• Data Store Management215 questions
• Data Operations and Support181 questions
• Data Security and Governance149 questions

Free DEA-C01 practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 827.

1. Question 1Data Ingestion and Transformation

   An analyst wants near-real-time indexing of application logs into a search cluster for operational dashboards, tolerating a delivery latency of about one minute. Which Firehose destination configuration is designed for this?

   • AOpenSearch Service as the destinationCorrect
   • BAmazon S3 with Parquet conversion enabled
   • CAmazon Redshift as the destination
   • DAn HTTP endpoint to a batch reporting tool
   ✓ Correct answer: A

   Firehose has a native OpenSearch Service destination that indexes incoming records into a specified domain and index, which is well suited to operational log analytics dashboards that need data available within roughly a minute rather than requiring true sub-second streaming.

   Why the other options are wrong

   • BS3 with Parquet conversion is intended for cost-efficient analytical storage and batch querying, not live search dashboards.
   • CRedshift is optimized for structured analytical queries via SQL, not for the search-style indexing needed by log dashboards.
   • DAn HTTP endpoint to a batch reporting tool implies periodic batch consumption rather than near-real-time search indexing.
2. Question 2Data Ingestion and Transformation

   A Glue ETL job must extract data from an Amazon RDS database running inside a private VPC subnet. What should the engineer configure so the Glue job can reach the database securely?

   • AA larger DPU allocation assigned to run the ETL job
   • BA public S3 bucket policy granting Glue read access
   • CA Glue connection referencing the RDS VPC and subnetCorrect
   • DA crawler classifier configured specifically for JDBC
   ✓ Correct answer: C

   Glue connections store networking details, including VPC, subnet, and security group information along with credentials, that Glue uses to launch elastic network interfaces inside the VPC so a job can privately reach resources such as an RDS instance. An S3 bucket policy is unrelated to reaching a private database, JDBC classifiers only affect crawler schema parsing, and DPU count affects compute capacity, not network reachability.

   Why the other options are wrong

   • AAdding more DPUs increases compute capacity for the job but does not grant network access into the VPC.
   • BAn S3 bucket policy controls access to S3 objects, it has no effect on reaching a private RDS instance.
   • DA JDBC classifier helps a crawler parse a JDBC source's schema, it does not establish network connectivity.
3. Question 3Data Ingestion and Transformation

   A company wants to reduce the amount of data scanned by Athena queries against S3 data delivered by Firehose, targeting both smaller file sizes on disk and columnar storage efficiency. Which pair of Firehose settings most directly contributes to this goal?

   • AIncreasing the IAM role's permissions and enabling VPC delivery
   • BEnabling server-side encryption and disabling dynamic partitioning
   • CRecord format conversion to Parquet combined with compressionCorrect
   • DSwitching the destination from S3 to an HTTP endpoint
   ✓ Correct answer: C

   Parquet is a columnar format that lets Athena read only the needed columns and benefits from efficient encoding, while compression further reduces the physical size of the stored data; using both together in Firehose's format conversion and compression settings directly reduces bytes scanned and improves query performance and cost.

   Why the other options are wrong

   • AIAM permissions and VPC delivery affect security and connectivity, not file format or storage efficiency for Athena.
   • BEncryption protects data at rest but does not reduce scan size, and disabling partitioning does not improve columnar efficiency.
   • DSwitching to an HTTP endpoint removes the S3-based analytical storage entirely and is unrelated to Athena scan efficiency.
4. Question 4Data Ingestion and TransformationSelect all that apply

   Which two conditions are necessary for AWS Glue job bookmarks to correctly track incremental progress across job runs? (Choose two.)

   • AThe data source must be of a bookmark supported typeCorrect
   • BThe job must reference only a single catalog database
   • CThe job bookmark option must be enabled for that jobCorrect
   • DThe job must be scheduled on a fixed hourly cadence
   • EThe job must run using the Flex execution class option
   ✓ Correct answer: A, C

   Bookmarks only work when the 'Job bookmark' parameter is turned on for the job and the underlying source is a type Glue can track, such as S3 with supported formats or certain JDBC connections; unsupported sources or a disabled bookmark setting mean no incremental state is stored. Execution class, the number of catalog databases referenced, and a fixed run schedule have no bearing on whether bookmarks function.

   Why the other options are wrong

   • BReferencing a single catalog database is not a requirement for bookmarks to function correctly.
   • DBookmarks work regardless of whether a job runs on a fixed schedule or is triggered on demand.
   • EFlex execution class affects cost and scheduling priority, not whether bookmark tracking is available.
5. Question 5Data Store ManagementSelect all that apply

   Which of the following statements about DynamoDB global secondary indexes are true? (Choose two.)

   • AA GSI must be defined when the table is first created
   • BA GSI always requires the same partition key as the base table
   • CA GSI supports only eventually consistent readsCorrect
   • DA GSI shares the base table's provisioned read and write capacity
   • EA GSI can define a different partition and sort keyCorrect
   ✓ Correct answer: C, E

   A GSI is a separate index structure that can define its own partition key and sort key independent of the base table, and because updates propagate to it asynchronously, queries against a GSI only support eventually consistent reads. In contrast, local secondary indexes must share the base table's partition key, must be created at table creation time, and share the base table's provisioned capacity.

   Why the other options are wrong

   • AThat requirement applies to local secondary indexes, not global secondary indexes, which can be created or removed at any time.
   • BA GSI is specifically allowed to use a different partition key than the base table, unlike a local secondary index.
   • DA GSI has its own provisioned throughput settings separate from the base table, it does not share the base table's capacity.
6. Question 6Data Store Management

   A team is migrating from Oracle to Amazon Aurora PostgreSQL and needs to convert schema objects like stored procedures between the differing SQL dialects before running the data migration. Which service handles this schema conversion?

   • AAWS Schema Conversion Tool, for schema translationCorrect
   • BAWS Database Migration Service, for schema translation
   • CAWS Glue Studio, used for visual schema translation
   • DAmazon Redshift COPY command, for schema translation
   ✓ Correct answer: A

   When source and target databases use different SQL dialects, such as Oracle and PostgreSQL, the Schema Conversion Tool analyzes and converts schema objects like stored procedures and functions before the actual data migration runs. AWS DMS then handles moving the data itself once the converted schema is in place.

   Why the other options are wrong

   • BAWS Database Migration Service focuses on migrating the data itself and relies on the Schema Conversion Tool for heterogeneous schema translation.
   • CAWS Glue Studio is a visual interface for building ETL jobs and is not designed for cross-engine schema object conversion.
   • DThe Redshift COPY command loads data into Redshift tables and has no role in converting schema objects between database engines.
7. Question 7Data Operations and Support

   As part of a deployment script, an engineer needs to copy only the Glue scripts that have changed from a local build directory up to the S3 location referenced by the job definitions, without re-uploading unchanged files. Which AWS CLI command is best suited for this?

   • Aaws s3api put-object, which uploads a single object per invocation
   • Baws s3 mv, which moves objects and removes them from the source
   • Caws s3 cp --recursive, which copies every file in the directory each time
   • Daws s3 sync, which copies only new or changed files by comparing themCorrect
   ✓ Correct answer: D

   sync compares the contents of a source and destination location and transfers only the objects that differ, skipping files that are already identical. This makes it efficient for repeatedly deploying updated Glue scripts without re-uploading everything each time.

   Why the other options are wrong

   • Aput-object uploads a single object per call and would need a separate invocation and change-detection logic for each file.
   • Bmv relocates objects and deletes them from the source, which is not appropriate for scripts that should remain in the build directory.
   • Ccp --recursive uploads every file in the directory on each run, whether or not it changed, wasting time and bandwidth.
8. Question 8Data Operations and Support

   A security team must audit every GetObject and PutObject call made against a specific S3 bucket that stores raw pipeline data, including calls made by the Glue jobs that read and write to it. Which CloudTrail configuration captures this level of detail?

   • AA trail with Insights events enabled for anomalies
   • BThe default trail created automatically for the account
   • CA trail with S3 data events enabled for that bucketCorrect
   • DA trail with only management events enabled for it
   ✓ Correct answer: C

   Management events alone only capture control-plane actions like bucket creation, so object-level reads and writes require explicitly turning on data events for that specific bucket. Once enabled, every qualifying call, including ones made by Glue jobs, is recorded with the calling principal and timestamp.

   Why the other options are wrong

   • AInsights events flag unusual API call volume patterns, they are not a complete object-level activity log.
   • BThe account's default trail records management events only unless data events are explicitly added to it.
   • DManagement events cover control-plane operations, they do not record individual GetObject or PutObject calls.
9. Question 9Data Operations and Support

   A pipeline loads order records into a table where "order_id" must be present in every row and must never repeat. Which single DQDL rule type enforces both conditions at once?

   • AUniqueness
   • BColumnDataType
   • CIsPrimaryKeyCorrect
   • DCompleteness
   ✓ Correct answer: C

   IsPrimaryKey verifies that a column's values are not null and are unique across the dataset, which is exactly the combination of completeness and uniqueness needed to enforce primary-key-like behavior for order_id in one rule rather than two separate rules.

   Why the other options are wrong

   • AUniqueness alone reports a distinct-value ratio and does not also guarantee every value is present.
   • BColumnDataType validates a column's data type, not presence or uniqueness.
   • DCompleteness alone confirms values are not null but does not check for duplicates.
10. Question 10Data Security and Governance

    Beyond who granted which permission, a compliance team also wants to know which specific principal actually read data from a governed table through Lake Formation's credential vending. Which type of event supports that?

    • AAmazon Athena query history visible only in the console's saved tab
    • BAmazon S3 server access logs enabled on the destination analytics bucket
    • CLake Formation's CloudTrail data access events, like GetDataAccessCorrect
    • DLake Formation grant events only, since reads are never recorded separately
    ✓ Correct answer: C

    In addition to administrative grant and revoke events, Lake Formation can log data access events through CloudTrail that capture when a principal's query triggered credential vending against a registered location, such as the GetDataAccess API activity. This gives auditors visibility into actual data reads, not just the permissions that were configured.

    Why the other options are wrong

    • AAthena's saved queries tab tracks a user's own saved queries in the console, not an audit trail of governed data access events.
    • BS3 server access logs record requests at the bucket level and do not carry the Lake Formation grant and principal context needed for this purpose.
    • DGrant events alone only show configured permissions; Lake Formation separately supports logging actual data access activity.

Who this AWS Certified Data Engineer - Associate (DEA-C01) practice exam is for

This practice set is for anyone preparing for the AWS Certified Data Engineer - Associate (DEA-C01) exam at the intermediate level - from first-time candidates building a foundation to experienced AWS practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this AWS Certified Data Engineer - Associate (DEA-C01) practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real AWS Certified Data Engineer - Associate (DEA-C01) exam.

Related AWS resources

• AWS Certified Data Engineer - Associate (DEA-C01) study guideKey concepts
• AWS practice examsAll AWS
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• AWS Certified Generative AI Developer - Professional (AIP-C01) practice examRelated
• AWS CLF-C02 practice examRelated
• AWS DOP-C02 practice examRelated

AWS Certified Data Engineer - Associate (DEA-C01) practice exam FAQ