Domain 1: Data Ingestion and Transformation
- Kinesis Data Firehose buffers records and can deliver them directly to S3, Redshift, or an OpenSearch Service domain for near-real-time (roughly one-minute) search and dashboarding rather than true sub-second streaming.
- Firehose data transformation invokes an AWS Lambda function synchronously on batches of records before buffering, enabling per-record masking of PII, enrichment, or filtering; transformed output continues through normal delivery.
- Amazon MSK exposes standard Kafka APIs, so existing Kafka Streams applications performing stateful joins and aggregations across topics run against it largely unchanged.
- A long-running (persistent) EMR cluster suits unpredictable, all-day ad hoc Hive and Presto queries because it avoids the launch latency of starting a transient cluster per query; transient auto-terminating clusters fit scheduled batch work.
- EMR core nodes run YARN tasks and host the HDFS DataNode process that stores data blocks; EMRFS is the Hadoop-compatible file system that lets EMR read and write S3 via s3:// URIs.
- MWAA is managed Apache Airflow (scheduler, workers, and metadata database) and is favored when a team already has Airflow DAGs or needs Airflow-specific scheduling, backfill, and DAG visualization; Step Functions fits lightweight serverless event-driven orchestration.
- AWS DMS full load plus CDC performs an initial bulk copy and then continuously streams ongoing source changes; DMS Serverless auto-provisions, scales, and manages replication capacity.
- Partitioning data by year, month, and day lets Athena prune partitions and scan only the directories matching a query's date filter, reducing data scanned and cost.
- The Glue Data Catalog keeps a version history of a table's schema, so previous definitions remain viewable after a change; re-running a Glue crawler detects newly added columns and updates the table definition.
- Kinesis enhanced fan-out allocates an isolated throughput allowance (up to 2 MB/s per shard) to each registered consumer, avoiding contention among consumers.
- S3 multipart upload lets parts upload in parallel and lets an interrupted upload resume, improving speed and resilience for large objects.
- Kinesis Agent is a standalone application that monitors files and forwards new data to a Kinesis stream; EventBridge rule patterns can filter on S3 event fields like bucket name and object key prefix or suffix before invoking a target.
Domain 2: Data Store Management
- Amazon S3 provides strong read-after-write consistency, so a GET immediately after a PUT always returns the latest version of the object.
- S3 request throughput scales with the number of distinct prefixes and parallel connections a workload uses; AWS recommends multipart upload for objects larger than about 100 MB.
- S3 storage classes: Glacier Instant Retrieval gives millisecond access for data read a few times a year, while Glacier Flexible Retrieval restores within minutes to hours; Object Lock in compliance mode enforces a retention period no user can bypass.
- Athena writes query results to an S3 location set in the workgroup settings, charges on-demand by data scanned per query, and publishes per-workgroup metrics like data scanned to CloudWatch.
- Athena CTAS can output Parquet, ORC, Avro, JSON, or text formats; INSERT INTO appends query rows to an existing table, and query result reuse can serve a cached prior result within a configured maximum result age.
- Redshift UNLOAD writes results to S3 in parallel across the cluster's slices, producing multiple output files by default; short query acceleration prioritizes short queries so they do not wait behind long ones.
- DynamoDB on-demand capacity mode removes the need to forecast throughput and suits new applications with no traffic history; a high-cardinality partition key spreads writes evenly across partitions.
- In dimensional modeling, a fact table stores numeric measures and foreign keys that reference dimension tables (a star schema).
- A Requester Pays bucket rejects anonymous requests because the requester must be an authenticated AWS identity that can be billed; the owner still pays only for storage.
- AWS Glue ETL jobs provide a managed serverless way to read a source, transform, and write partitioned Parquet files into an S3 data lake without managing servers.
- S3 Storage Lens advanced tier unlocks prefix-level and storage-class-level activity metrics, extended history, and recommendations beyond the free summary tier.
- S3 event notifications to SQS let the downstream consumer control its own polling rate, concurrency, and retry behavior; OpenSearch Service suits full-text log search and near-real-time dashboards rather than transactional workloads.
Domain 3: Data Operations and Support
- In CloudWatch Logs Insights, the stats command with count(*) by jobName aggregates matching events and groups counts by job name; a single query can span multiple log groups.
- Redshift HealthStatus reports a binary healthy/unhealthy signal for reachability, while PercentageDiskSpaceUsed tracks how much storage capacity has been consumed.
- Redshift cost controls include pausing an idle provisioned cluster, capping Serverless RPU usage, using WLM query monitoring rules to abort costly queries, and concurrency scaling free credits that accrue daily.
- aws s3 sync copies only new or changed files based on size and timestamp comparison, making it efficient for repeatedly deploying updated Glue scripts.
- sam local invoke runs a Lambda function locally in a container emulating the Lambda runtime using a sample event, for fast iterative testing without deploying.
- Glue natively emits Job State Change and Crawler State Change events to EventBridge; the numFailedTasks metric reports how many Spark tasks failed during a Glue job run.
- Idempotent write patterns, such as overwriting a partition or upserting by key, ensure a rerun produces the same result instead of duplicate rows.
- Asynchronous Lambda invocations are retried automatically a limited number of times before failed events route to a DLQ or destination; stream-based event source mappings route terminal failures to an on-failure destination, not the function-level DLQ.
- SQS redrive-to-DLQ, Step Functions Retry-and-Catch, and Lambda event source on-failure destinations each provide a distinct way to bound retries and capture failures; tuning maxReceiveCount and backoff gives transient outages time to resolve.
- In DMS Limited LOB mode, LOB values larger than the configured maximum are silently truncated; raise the maximum LOB size or switch to Full LOB mode to preserve them.
- X-Ray traces requests across instrumented services and builds a service map highlighting latency bottlenecks; a boto3 waiter blocks until a resource such as a Glue job run reaches a terminal state.
- Amazon DataZone captures and visualizes data lineage, showing how datasets relate to the jobs and sources that produced them; many very short S3-reading tasks usually signal a small-file problem, not a compute issue.
Domain 4: Data Security and Governance
- AWS Glue requires a security group with a self-referencing inbound rule allowing all traffic from itself so the multiple ENIs it provisions for a job run can communicate.
- Interface VPC endpoints are backed by elastic network interfaces and support attached security groups (for example, allow inbound HTTPS on port 443 only from approved subnets); gateway endpoints for S3 are not ENI-backed and do not use security groups.
- AWS KMS is reached privately from a VPC through an interface endpoint built on AWS PrivateLink, keeping key API calls off the public internet.
- Lake Formation requires registering the S3 location with a data lake role before it can manage and vend access; a row-level data filter on a SELECT grant restricts which rows a principal sees via a filter expression.
- Column-level permissions cannot inspect free-text content, so unpredictable PII in a text column is best removed upstream with a Glue Detect PII transform before data reaches the governed table.
- CloudTrail separates S3 activity into object-level data events (which record the calling identity, source IP, and object key) and bucket-level management events; data event logs land in S3 as JSON and can be queried with Athena.
- An organization trail applies to every account in the organization and automatically covers new accounts; an AWS Config aggregator centralizes configuration and compliance data across accounts and regions.
- S3 default bucket encryption applies only to objects uploaded after it is enabled, so previously uploaded unencrypted objects must be copied or rewritten to become encrypted; AWS Config has a managed rule that checks default SSE.
- Encrypting CloudTrail logs with a customer managed KMS key requires a key policy granting CloudTrail permission to encrypt new log files; Glue Data Catalog encryption settings protect table metadata and connection passwords with a KMS key.
- Tag-based access control scales by covering resources dynamically through tags rather than per-resource grants; least privilege scopes permissions narrowly (for example, by S3 prefix) and adds conditions restricting when actions are allowed.
- Redshift audit logging captures connection attempts, user logins, and executed queries and can be delivered to an S3 bucket for long-term retention.
- Firehose objects delivered to S3 inherit the destination bucket's encryption; consistent identifiers and lineage tracking across zones make it possible to locate every copy of a customer's data for deletion.
AWS Certified Data Engineer - Associate (DEA-C01) exam tips
- Read scenario questions for the decisive constraint: latency requirement, cost sensitivity, existing tooling, or governance need usually points to exactly one service (for example, near-real-time to Firehose or OpenSearch, all-day ad hoc queries to a persistent EMR cluster).
- Know the boundaries between overlapping services: Step Functions vs MWAA for orchestration, Glue vs EMR for transformation, Kinesis Data Streams vs Firehose vs MSK for ingestion, and Athena vs Redshift for query.
- Memorize cost-and-performance levers for the big services: Athena data scanned (partitioning, columnar formats, result reuse), Redshift WLM and concurrency scaling, S3 storage classes, and DynamoDB capacity modes.
- For security questions, distinguish the layers: IAM for identity, KMS for encryption, Lake Formation for fine-grained (row and column) data access, and VPC endpoints (interface vs gateway) for private connectivity.
- With 802 practice questions and a 130-minute exam, pace to roughly 90 seconds per question, flag long scenarios, and eliminate options that contradict a stated requirement before choosing.
Study guide FAQ
What score do I need to pass the DEA-C01 exam?
You need a scaled score of 720 out of 1000. The exam is scored as a whole, so you do not need to pass each domain individually.
How is the exam weighted across domains?
The largest domain is Data Ingestion and Transformation, followed by Data Store Management, then Data Operations and Support, with Data Security and Governance being the smallest. Expect the most questions on ingestion, transformation, and storage services.
Do I need to know how to write code for this exam?
You do not write full programs, but you should recognize SQL patterns (Athena CTAS, Redshift UNLOAD), CLI commands (aws s3 sync), CloudWatch Logs Insights queries, and the behavior of Python tooling like boto3 waiters and the AWS SAM CLI.
How long is the exam and how many questions does it have?
The DEA-C01 exam runs 130 minutes and contains a mix of multiple-choice and multiple-response questions. Manage your time so long scenario questions do not leave you rushed at the end.