Read this the night before or on exam morning. It assumes you’ve studied the notes. It’s here to refresh, not to teach.
Exam day
- 65 questions in 130 minutes: 50 scored and 15 unscored that you can’t spot. Scaled score 100 to 1,000; you need 720. Multiple choice and multiple response (two or more correct from five or more options).
- About 2 minutes per question. No penalty for guessing and unanswered counts as wrong, so answer everything. Flag and move on.
- Compensatory scoring: you don’t have to pass each domain, only the exam overall.
- Domain weights: Data ingestion and transformation 34%, data store management 26%, data operations and support 22%, data security and governance 18%.
- Names: Kinesis Data Firehose is now Amazon Data Firehose; Kinesis Data Analytics is Managed Service for Apache Flink. The exam guide may use the old names.
How to read a DEA question
Read the last sentence first, then hunt for constraint words.
| The question says | Pick |
|---|---|
| Least operational overhead, serverless | Glue, Athena, Firehose, Step Functions, Redshift Serverless, EMR Serverless |
| Near real time, seconds | Kinesis Data Streams, Flink, MSK. Firehose is near real time (buffered) |
| Replay or multiple consumers | Data Streams (extended retention, enhanced fan-out) or Kafka, not Firehose |
| Reduce Athena cost | Parquet, partitions, compression, CTAS, fewer columns |
| Only some columns or rows | Lake Formation data filters, Redshift RLS/column grants |
| Another account | Resource policy + IAM on both sides; customer managed KMS key shared in key policy |
| Existing Airflow | MWAA |
| Existing Hadoop/Spark with custom libraries | EMR |
| No code | DataBrew |
| Audit who called an API | CloudTrail. What changed in a resource is Config |
Elimination: answers that use long-lived access keys, hardcoded passwords, polling EC2 cron jobs, or row-by-row inserts into Redshift are almost always wrong.
Streaming at a glance
| Fact | Value |
|---|---|
| Kinesis shard | 1 MB/s or 1,000 records/s in; 2 MB/s out (shared) |
| Enhanced fan-out | 2 MB/s per shard per consumer, ~70 ms, push |
| Retention | 24 h default, up to 365 days |
| Max record | 1 MB |
| Ordering | Per shard (partition key) |
| Hot shard fix | Better key, split shard, or on-demand mode |
| Lag signal | GetRecords.IteratorAgeMilliseconds |
| Firehose | Buffer by size or time; not replayable; Lambda transform; Parquet/ORC conversion; dynamic partitioning |
| DynamoDB Streams | 24 h, ordered per item |
| Lambda event source mapping | Batch size, batch window, parallelization factor up to 10, partial batch response, bisect, DLQ |
Glue and EMR
- Glue: DPU-hours billed per second; Flex for cost; auto scaling; DynamicFrame (choice types, ResolveChoice); bookmarks for incremental runs; pushdown predicate for partitions;
groupFilesfor many small files; crawlers populate the Data Catalog; Glue Data Quality uses DQDL. - EMR: core on On-Demand, task on Spot, data in S3, transient clusters; Serverless for no cluster; on EKS for shared Kubernetes.
- Formats: Parquet or ORC for analytics, Avro for streaming and evolution. Files of 128 MB to 1 GB.
Orchestration
| Tool | One-liner |
|---|---|
| Step Functions | Serverless, retry/catch, .sync, Map; Standard up to 1 year, Express up to 5 min |
| MWAA | Managed Airflow, DAGs in S3, VPC-based |
| Glue workflows | Glue-only graph |
| EventBridge | Events and schedules |
| SNS / SQS | Fan-out alerts / buffer work |
Redshift
- Distribution: KEY (join column), ALL (small dimensions), EVEN, AUTO. Sort key on range-filtered columns.
COPYfrom S3 with many equal-sized compressed files and a manifest.UNLOADto S3 (Parquet ok).- Spectrum: S3 via the catalog. Federated query: live RDS/Aurora. Materialized views: precomputed. Data sharing: live, no copy. Zero-ETL: Aurora/RDS/DynamoDB. Data API: HTTPS SQL.
- PK/FK are informational only. Concurrency scaling for bursts; WLM for priorities.
Storage and lifecycle
- Classes: Standard, Intelligent-Tiering, Standard-IA, One Zone-IA, Glacier Instant/Flexible/Deep Archive. Minimum durations 30/90/180 days.
- Lifecycle: transition, expire, noncurrent versions, incomplete multipart uploads. Versioning + delete markers. Object Lock for WORM.
- DynamoDB: TTL (free deletes, within ~48 h), PITR 35 days, GSI (anytime, eventual) vs LSI (creation only), on-demand vs provisioned, export to S3.
- New partitions: crawler,
MSCK REPAIR TABLE,ADD PARTITION, partition projection.
Security and governance
| Topic | Key point |
|---|---|
| Roles | Trust policy names the service; permissions policy lists actions; iam:PassRole to create jobs |
| Policy evaluation | Explicit deny wins; cross-account needs both sides |
| Secrets Manager vs Parameter Store | Rotation and RDS/Redshift integration vs cheaper config |
| Lake Formation | Register S3 location, grants on tables/columns, row/cell filters, LF-Tags, cross-account via RAM |
| S3 encryption | SSE-S3 default, SSE-KMS (+ Bucket Keys), SSE-C, client-side |
| KMS cross-account | Customer managed key, key policy + IAM; AWS managed keys can’t be shared |
| Glue/EMR | Security configurations encrypt outputs, logs, catalog, local disks and in-transit |
| In transit | aws:SecureTransport, require_ssl, TLS; Direct Connect alone isn’t encrypted |
| Masking | DataBrew, Redshift dynamic data masking, Lake Formation filters; hash with salt |
| Private access | Gateway endpoints (S3, DynamoDB), interface endpoints (PrivateLink), Access Points |
| Region restriction | SCP on aws:RequestedRegion, limit replication and backup copies |
| PII | Macie to find, Lake Formation to restrict |
Logging and monitoring
- CloudTrail: management events on (90 days history); data events off by default; trail to S3 for retention; integrity validation; CloudTrail Lake for SQL.
- CloudWatch Logs: retention defaults to never expire; Insights for queries; metric filters; subscription filters to Lambda/Kinesis/Firehose/OpenSearch.
- Analyse: Insights (recent), Athena (archived, cheap), OpenSearch (search/dashboards), EMR (huge volumes).
- Alerts: CloudWatch alarm to SNS; EventBridge on Glue/Step Functions/EMR state changes. Costs: Budgets and Cost Explorer.
- Quality dimensions: completeness, consistency, accuracy, integrity. Glue Data Quality (DQDL) and DataBrew rulesets; route bad rows to a quarantine prefix.
Common traps
- Firehose can’t replay; Data Streams can.
- Kinesis ordering is per shard, not global.
- Lambda isn’t for 20-minute jobs.
- Athena charges per data scanned, so file format and partitions matter more than query shape.
- Redshift needs
COPY, not row inserts. - Lake Formation grants may be ignored if IAM already allows access (or denied if the S3 location isn’t registered).
- Many tiny S3 files hurt Glue, Athena and EMR alike.