Exam Simulation B: Second Set, Traps and Exam Day

Fifteen lessons gave you the content and Set A gave you a first sitting. A second sitting measures something different: not whether you know AWS Glue, but whether you can hold Glue job bookmarks apart from streaming watermarks, or Redshift distribution apart from sorting, while the clock runs. Almost nobody fails DEA-C01 because they have never heard of Amazon Macie; they fail because the stem asked for who called DeleteTable and they answered with a finding, or because the stem said LEAST operational overhead and they paid for a managed Airflow environment to run four Lambda steps. On a compensatory 100 to 1,000 scale with 720 to pass, discrimination is what separates a comfortable pass from a 705.

By the end of this lesson you will be able to:

• state the one-line correct framing for each of the twenty trap pairs most likely to cost you marks;
• spot a half-true option, the distractor that swaps exactly one attribute of a pair, and kill it in one clause;
• handle multiple-response stems with an all-or-nothing procedure that never assumes partial credit;
• run the arithmetic the exam actually asks for: DPU-hour cost, storage-class cost, bytes-scanned billing and weights-to-items;
• recite the official exam-day logistics: IDs, arrival, check-in, in-exam controls, score timing;
• grade Set B by domain block against explicit ready-versus-not-ready thresholds, and defend the comparative verdict on booking now versus seven more days;
• run a dip-driven 7-day study plan that revises by domain weakness rather than by chapter order.

---

1. Strategy: trap pairs and how the exam weaponises them

1.1 What a pair is, and what a distractor really looks like

AWS describes its own distractors as "generally plausible responses that match the content area" (DEA-C01 exam guide). The practical consequence is that most options you face are drawn from the same decision as the key, which means most losses on this exam are not knowledge failures, they are pair failures: you knew one member of the pair but could not state the line between them under time pressure. The guide's headline skill is "compare AWS services to understand the cost, performance, and functional differences", comparison is the exam.

A pair becomes an item through exactly three moves:

1. Swap one attribute per option: record-level vs buffered, exactly-once vs at-least-once, grant vs cap, discovery vs enforcement, dist vs sort.
2. Swap the ask: the stem wants bytes scanned, the option offers cluster hours; the stem wants who acted, the option offers what the content contained.
3. Swap the lifecycle position: the right service, the wrong pipeline stage: a crawler answer to an orchestration question, a catalog answer to a remediation question.

Worked example 1: a half-true option, dissected before you read the stem. Take the Amazon Macie vs AWS Config pair and build all four options the way the exam does:

Only D survives, and it survives because you evaluated both halves rather than recognising a familiar word. Options A and B each contain a phrase you have read in the documentation; that is the design. A distractor does not have to be false; it has to be false in the place the stem is asking about.

1.2 The three questions for any pair item

Slow candidates read options; fast candidates interrogate the pair first. Ask these three, in this order, before you look at a single option:

1. What does each member of the pair actually do? One clause each, from memory. If you cannot say what a materialized view does in one clause, the options will answer it for you: badly.
2. Which stem qualifier selects between them? replay, LEAST overhead, bytes scanned, content, DISTKEY, stale, full-load-and-cdc. The noun in the stem is usually the decoy; the qualifier is the key.
3. Does the surviving option satisfy both halves? For a (Select TWO) stem this is literal, and AWS's own DEA readiness deck states the rule as "No Negative points or Partial credit", so one false clause zeroes the option.

• 📚 Did you know? AWS's own Official Practice Question Set: AWS Certified Data Engineer: Associate contains exactly 20 questions: the same count as Set A and Set B here: is free, and sits at step 1 of AWS's four-step prep plan (exam guide → practice question set → Skill Builder courses → official practice exam), all as of Oct 2026. It is the closest official yardstick for the pacing you are training in this lesson.

---

2. Strategy: the item shapes, the blueprint and the clock

DEA-C01 publishes exactly two question types: multiple choice (one correct response plus three or more distractors) and multiple response (two or more correct responses out of five or more options). There is no ordering, no matching and no case-study item on this exam as of Oct 2026, so do not budget for them. What Set B adds on top of Set A is practice in the three shapes that cost the most marks: multiple response, calculation, and selection by pattern.

2.1 Multiple response without partial credit

The procedure that survives contact with five or six options:

1. Mark every option definitely yes / definitely no / maybe: in one pass, without choosing.
2. Resolve every maybe by re-reading the qualifier, not the option.
3. Submit only when no maybe remains. Two obvious answers plus an overlooked fifth correct one is the classic zero.

2.2 The calculation and selection shapes

Three families appear repeatedly, and each has one mechanical procedure.

Worked example 2: Glue DPU-hour cost (us-east-1, as of Oct 2026). A job runs 4 × G.2X workers = 8 DPU for 30 minutes, twice a day, in a 31-day month, at $0.44 per DPU-hour:

$$\text{per run} = 8 \times 0.5 \times 0.44 = \$1.76 \qquad \text{runs} = 2 \times 31 = 62 \qquad 62 \times 1.76 = \mathbf{\$109.12}$$

The distractors are the arithmetic slips: one run a day ($54.56), four runs a day ($218.24), hourly scheduling (a four-figure answer). Convert workers → DPU → hours → rate, in that order (Set B item 4).

Worked example 3, storage-class cost (us-east-1, as of Oct 2026). 100 TB = 102,400 GB of archive data. At Standard $0.023/GB-mo the same bytes cost $2,355.20 a month; at Standard-IA $0.0125 they cost $1,280.00; at Glacier Instant $0.004 they cost $409.60; at Glacier Deep Archive $0.00099 they cost about $101.38. The cheapest number is not the answer unless it also meets the retrieval deadline, Deep Archive retrieval is measured in hours, not minutes (item 8).

Worked example 4, Athena bills bytes scanned, not time. A 3 TB uncompressed CSV table with three equal columns, where dashboards SELECT one column: every query scans 3 TB, so 3 \times \5 = \mathbf{$15}$. Convert to Snappy Parquet (3:1) and read one of three columns → 0.33 TB →$\mathbf{$1.65}$. Same SQL, same result, a fraction of the bill, because the cost meter is bytes scanned ($5.00 per TB, 10 MB minimum per query), not cluster hours.

Worked example 5: selection by pattern. Translate the stem's nouns into a data model before reading service names:

Two of those rows become Set B items 8 and 11. The pattern never changes: noun → data model → service, and only then the options.

2.3 The Set B blueprint, its clock and its weights

Only domain percentages are published; the item counts below are arithmetic on 50 scored items: a planning aid, never an AWS figure.

Worked example 6, weights to items, twice over. On the live exam: $50 \times 0.34 = 17$, $50 \times 0.26 = 13$, $50 \times 0.22 = 11$, $50 \times 0.18 = 9$, and $17 + 13 + 11 + 9 = 50$. On Set B: $20 \times 0.34 = 6.8$, $20 \times 0.26 = 5.2$, $20 \times 0.22 = 4.4$, $20 \times 0.18 = 3.6$, which round to 7 / 5 / 4 / 4, and $7 + 5 + 4 + 4 = 20$. Domains 1 and 2 together are 60 % of scored content, that is why they hold 12 of these 20 items.

Worked example 7: Set B's own clock. The live exam gives exactly $130 \div 65 = \mathbf{2.00}$ minutes per item; with the ESL +30 accommodation that becomes $160 \div 65 = 2.46$ minutes. Set B uses a 90-second first-pass budget: $20 \times 90 = 1{,}800\ \text{s} = \mathbf{30}$ minutes. Sit Set B on 30 minutes flat; if you finish with time left, spend it on flagged items, not on re-reading confident ones.

• 📚 Did you know? AWS's own published rhythm for an Associate certification is 3 to 5 weeks of preparation in 45 to 90 minute sessions at your peak time, and AWS says explicitly that you need "a passing score, not a perfect score". The 7-day plan in section 8 is therefore a compressed plan: it assumes lessons 01 to 14 and Set A are already behind you, and it spends the week on discrimination and logistics rather than on new content.

---

3. Real-World Case Drills

Two AWS-published customer stories, converted into the only two moves this exam ever makes with a story: map it to a domain, then predict the stem. Every figure below is a customer result that AWS chose to publish: never an AWS promise and never a number without its date (case-study pages carry no publish date, so the only timestamp available is the access date; all figures below accessed Oct 2026).

Case drill 1, Integral Ad Science: hundreds of permission rules became two

The scenario. An ad-tech company runs a self-service data lake across producer and consumer accounts under GDPR and CCPA, where access must follow classification and job role. AWS's published account: the team used AWS Lake Formation with tag-based access control on top of the AWS Glue Data Catalog, with Amazon Athena and Amazon EMR as engines; S3 data is reachable only through a Lake Formation data access role; database-level tags are inherited by tables and columns; and Athena workgroups per business unit double as billing tags and query limits. AWS reports the permission surface collapsed from hundreds of permission rules to exactly 2.

Which domain? D4 Data Security and Governance (18 %): the story is an argument about role-, tag- and attribute-based authorization (skill 4.2.5) enforced through Lake Formation (skill 4.2.4). The hooks into D3 (Athena workgroups, query limits) are secondary: never answer a governance stem with a cost control.

What the exam would ask?

Trap to pre-load: "AWS guarantees a 99 % reduction in permission rules" is wrong twice; it converts a customer's result into a promise, and AWS never publishes such a guarantee. Rewrite every case percentage as "AWS reports that Integral Ad Science achieved …".

Case drill 2, Hearst: 30 TB a day through a stream and a delivery pipeline

The scenario. A media group with 250+ sites, 300+ magazines and 31 TV stations needs clickstream at scale. AWS's published account: Amazon Kinesis Data Streams plus Kinesis Data Firehose (renamed Amazon Data Firehose on 2024-02-09) feeding Spark streaming, ingesting 30 TB per day.

Which domain? D1 Data Ingestion and Transformation (34 %): the story is a streaming-versus-delivery distinction, which is trap pair 1 in section 5.

What the exam would ask?

Trap to pre-load: never "correct" an option that says Amazon Kinesis Data Firehose. The product became Amazon Data Firehose on 2024-02-09, but AWS states that no service endpoint, API, CLI command, IAM policy or CloudWatch metric changed: IAM actions are still firehose:*, and the DEA-C01 in-scope list still lists "Amazon Kinesis Data Firehose".

• 📚 Did you know? AWS's What is a data lake? page names Netflix, Zillow, Nasdaq, Yelp, iRobot and FINRA as reference customers for the exam-grade definition of a data lake: ingest as-is, securely store and catalog it, and run analytics without moving the data to a separate system. Case-study figures on this exam are almost always decomposable or dateable: when an option restates a customer result as an AWS guarantee, it is wrong even if every individual number looks familiar.

---

Real-World Case Drills

Two more AWS-published customer stories, run through the same two moves as section 3, map it to a domain, then predict the stem, but at 90-second speed, because Day 5 of the 7-day plan asks you to do exactly this from memory. Same rule as before: every figure below is a customer result AWS chose to publish (case-study pages carry no publish date, so the timestamp available is the access date; all figures accessed Oct 2026), never an AWS promise.

Case drill 3, Nasdaq: 70 billion records a day, and an archive that cannot be rewritten

The scenario. An exchange has to land orders, quotes and trades overnight, before the market opens, while keeping regulatory records unalterable for years. AWS's published account: since 2014 Nasdaq has run an Amazon S3 data lake as the storage layer, Amazon Redshift (with Redshift Spectrum) as the query layer, Amazon S3 Glacier for archive and S3 Object Lock for the write-once requirement. AWS reports the lake absorbed a jump from 30 billion to 70 billion records a day (peak 113 billion, Feb 2020), that 90 % of the load completed five hours sooner, that queries ran 32 % faster, and that a 15 TB slice is queried in place without being copied first.

Which domain? D2 Data Store Management (26 %): the story is an argument for decoupled storage and compute (write path in S3, read path in Redshift), which is the lake-house shape the guide tests under store selection. The hooks are D1 (the overnight window is an ingestion deadline) and D4 (Object Lock is the immutability control that Set B item 20 already drilled).

What the exam would ask?

Trap to pre-load: every case percentage is workload- and baseline-specific (digest 16 F1). "Queries run 32 % faster on Redshift" is Nasdaq's measurement on Nasdaq's workload: an option that offers it as an AWS performance guarantee is wrong even though the number is printed on an AWS page.

Case drill 4, Oportun: Macie finds the PII, you respond

The scenario. A fintech lender must locate and prioritise personal data held in S3 for FTC Safeguards and privacy obligations, with a small compliance team and a low tolerance for false positives. AWS's published account: Amazon Macie automated sensitive-data discovery across the account's buckets using managed and custom data identifiers, a bucket inventory and an account sensitivity score; AWS reports +95 % discovery accuracy and −80 % time to discover sensitive data (the Macie case card and re:Invent 2022 session SEC215).

Which domain? D4 Data Security and Governance (18 %), discovery and classification of sensitive content (skills 4.5.1 / 4.5.2). The response half of the same story is D3: findings → EventBridge → Lambda, which is precisely Set B item 15, discovery and remediation are separate skills in this blueprint.

What the exam would ask?

Trap to pre-load: the +95 % is S3 discovery accuracy achieved by one customer, not general data-loss-prevention coverage: digest 16 F8 explicitly warns against reading it as a cross-service DLP number, and Macie does not natively scan Amazon RDS or Amazon Redshift.

• 📚 Did you know? AWS reports that PayU consolidated roughly 40 production databases into S3 plus Redshift, cut query latency from 10 to 15 minutes to under a minute, saved $20,000 a month, and dropped query volume from 150,000 to 35,000 per month (−77 %), and those are two different levers: the platform consolidation delivered the savings, the query rationalisation delivered the volume cut. On this exam a stem that asks for cost and a stem that asks for demand are never answered with the same number, even when both come from the same customer story.

---

4. Practice Questions, Set B: 20 items in published weight order

Set B mirrors the live exam's dominant format: one correct response, three distractors; while drilling six multiple-response-style stems. Items run in domain-weight order: D1 seven, D2 five, D3 four, D4 four, which is the published 34 / 26 / 22 / 18 split rounded onto twenty items. All twenty are adapted from question-bank items Q21: Q40.

4.0 How to sit Set B

4.1 Domain 1: Data Ingestion and Transformation (34 %) · items 1 to 7

Teardown: Q1 · concurrency is the cause, not the workers. Why it is right: AWS documents that Glue bookmarks do not support concurrent job runs and that commits fail, so the only change that removes the cause is one run at a time. Why the traps lose: A raises throughput, which does nothing for a state guarantee and makes overlap more likely; C masks the symptom and resets incremental state, so the next run reprocesses everything: the opposite of the desired behaviour; D (FLEX) is a cost optimisation for non-urgent jobs and has no effect on bookmark state. Trap: the error says bookmark, so candidates reach for a bookmark command; the stem says concurrently, so the answer is a concurrency setting. Source: bank Q25 · Glue glue-troubleshooting-errors.html (digest 15 C9) · skill 1.2.7.

Teardown, Q2 · two metrics, both about the source. Why it is right: if the bookmark gates the source, nothing is read, so recordsRead and bytesRead both fall to zero, and those are the two Glue aggregate metrics that would show it. Why the traps lose: B describes an out-of-memory alarm (glue.ALL.jvm.heap.usage above 0.9) plus task errors, but a skip raises no error, which is exactly why the job "succeeds"; C pairs a true metric with an executor-allocation metric, which measures DPU backlog (work waiting), not source skipping; D is memory plus executor demand, both unrelated to a skipped source. Trap: in an MR stem every statement is a separate question, one false clause zeroes the option, and there is no partial credit to collect. Live-exam form: two checkboxes, all-or-nothing. Source: bank Q26 · Glue job-monitoring.html and monitor-continuations.html · skill 1.2.7.

Teardown, Q3 · three requirements, three services, one pipeline. Why it is right: the stem demands no code, row-level outcomes and a five-minute alert, DataBrew rulesets supply the first two, and EventBridge → SNS supplies the third, which maps to skills 1.1.6 (event triggers), 1.2.5 (transformation service by requirement) and 1.3.4 (notification services); the rule definitions themselves are skill 3.4.2. Why the traps lose: B discovers schema drift, it does not evaluate data-quality rules, right service family, wrong job; C is DDL on a table that a raw CSV prefix does not even have; D refreshes optimizer statistics and validates nothing. Trap: crawler answers catalog and discovery questions, never data-quality ones, this is the classic wrong-lifecycle-position distractor. Source: bank Q27 · DataBrew rule-based profiling docs · exam-guide skills 1.1.6 / 1.2.5 / 1.3.4 / 3.4.2.

Teardown, Q4 · workers → DPU → hours → rate. Why it is right: 8 \times 0.5\ \text{h} \times \0.44 = $1.76$per run,$2 \times 31 = 62$runs,$62 \times 1.76 = \mathbf{$109.12}$(worked example 2). **Why the traps lose:** **B** halves the schedule to one run a day ($31 \times 1.76 = 54.56$); **C** doubles it to four runs a day; **D** models the job running every hour of the month. **Trap:** the item is 90$0.44/DPU-hour, us-east-1, as of Oct 2026; digest 15 C8) · skill 1.2.4.

Teardown, Q5 · reset is not rewind. Why it is right: the CLI reference defines reset-job-bookmark as clearing bookmark state, so the next run re-reads the source from the start. Why the traps lose: A describes the console's rewind feature, a separate operation that takes a point in time; C would be delete-job; D describes the bookmark-PAUSE job parameter, a mode rather than this API call. Trap: all four options are verbs you have seen in the Glue console, the discriminator is what state exists afterwards: cleared (everything reprocessed), rewound to a chosen window, or paused. Source: bank Q29 · CLI glue reset-job-bookmark.html, Glue monitor-continuations.html · skill 1.2.7.

Teardown: Q6 · two requirements, one type. Why it is right: populated with existing rows plus kept continuously in sync needs both phases, and full-load-and-cdc is the only DMS type that does both in one task. Why the traps lose: A loads a point-in-time snapshot and stops: the target diverges immediately while the source keeps accepting writes; C assumes the target is already backfilled (cdc-only is correct only when the tables have been loaded); D moves files over a network protocol, not database changes, and Aurora is not a file target. Trap: the six-hour cutover window is a deadline, not a task type: do not let a duration pick your option. Two more rules travel with this item: DMS CDC does not provide real-time replication, and only one task in a bidirectional pair may be full-load-and-cdc. Source: bank Q32 · DMS CHAP_Task.CDC.html, CHAP_Tasks.html (digest 15 C18) · skill 1.1.1.

Teardown: Q7 · read the snippet for the invariant, not the keyword. Why it is right: the ON clause is order_id and the failure is duplicate-matching: meaning the source side of the join is not unique, so the fix must make it unique. Why the traps lose: A invents a transaction requirement (a single MERGE is already atomic); C is false: MERGE is a supported Redshift command; D is a performance recommendation for large merges, not a correctness precondition, and would not stop two identical staging rows. Trap: two familiar words pull candidates away from the actual defect: DISTKEY (performance) and BEGIN (transactions); while the error message already names the problem. Source: bank Q33 · Redshift r_MERGE.html, merge-specify-a-column-list.html · skills 1.2.5 / 2.4.1.

4.2 Domain 2: Data Store Management (26 %) · items 8 to 12

Teardown, Q8 · two qualifiers, then the arithmetic. Why it is right: the stem stacks archive-shaped data with retrieval within minutes, Glacier Instant Retrieval is built for long-lived archive data with millisecond retrieval, and the cost check confirms it: 102{,}400 \times 0.004 = \mathbf{\409.60}$. **Why the traps lose:** **B** has the lowest number ($102{,}400 \times 0.00099 \approx $101$) but Deep Archive retrieval is measured in **hours**, missing the deadline outright, the classic "biggest saving loses" move; **C** meets the retrieval time but costs about **3×** more ($102{,}400 \times 0.0125 = $1{,}280$), so it fails *minimises storage cost*; **D** pairs the right class with the **Standard** rate ($102{,}400 \times 0.023 = $2{,}355.20$). Trap: read the deadline before the price list, and never accept a per-GB rate without checking which column of the pricing table it came from (worked example 3). Source: bank Q21 · aws.amazon.com/s3/storage-classes/, glacier-storage-classes.html (digest 15 C13, as of Oct 2026) · skill 2.3.2.

Teardown: Q9 · native, free, epoch seconds. Why it is right: TTL is the mechanism the guide pairs with S3 versioning (skill 2.3.4), it is free, and the attribute is a Number holding epoch seconds: not milliseconds. Why the traps lose: B applies to S3 objects, not table items, and an export is a copy that would then need its own lifecycle; C is a migration/replication mechanism, not a retention mechanism; D works but burns read/write capacity for something the table does natively. Trap: delete automatically after 24 hours tempts any job-shaped answer; ask "does the store have a native clock?" before you accept a worker. Two TTL facts travel with it: deletion is best-effort, typically within two days, and an expired-but-not-yet-deleted item still reads and bills, so filter on ttl > now when correctness depends on it. Source: bank Q22 · DynamoDB TTL.html, APIReference/API_UpdateTimeToLive.html (digest 15 C28) · skill 2.3.4.

Teardown, Q10 · the quote decides it. Why it is right: AWS's loading guidance says "We strongly recommend using the COPY command to load large amounts of data" and that individual INSERT statements "might be prohibitively slow", so one COPY per table per load wins. Why the traps lose: A is the guidance printed backwards, the single most reliable wrong-answer detector in this area; C is false, Parquet is a supported COPY source format and columnar loading is the recommended shape; D omits s3:ListBucket (needed to enumerate the prefix) and, for SSE-KMS objects, kms:Decrypt. Trap: a partial IAM list looks complete because one action is obviously right, authorization options are graded on the whole permission set, not on the most memorable action. Source: bank Q23 · Redshift r_COPY.html, t_Loading_data.html (digest 15 C27), copy-parameters-authorization.html · skill 2.3.1.

Teardown: Q11 · schema-on-write in the catalog, not schema-on-read. Why it is right: the table is already registered, and Athena reads registered schemas from the Glue Data Catalog, so only a crawler run or ALTER TABLE ADD COLUMN changes what Athena returns. Why the traps lose: B is destructive and irrelevant to metadata; C regresses the cost model (loses columnar pruning) and still does not update a registered table; D is the core misconception the item tests: footers are what engines without a catalog use, not a cataloged Athena table. Trap: the files already contain the column feels like enough; the qualifier is registered table, which moves authority from the data to the catalog (skills 2.2.3 crawlers populate catalogs, 2.4.2 changes to the characteristics of data). Source: bank Q24 · Glue aws-glue-crawler.html, Athena tables.html · skills 2.2.3 / 2.4.2.

Teardown: Q12 · distribution fixes joins, sorting fixes scans. Why it is right: AWS's own guidance is that distributing a pair of tables on their joining keys makes the leader node collocate rows on the slices by join value, and matching keys on both sides avoids redistribution entirely. Why the traps lose: A leaves dim_customer to be broadcast or redistributed on every join; C puts a 50-million-row table on every node: storage multiplies by node count, and DISTSTYLE ALL is only sensible for genuinely small dimensions (the 100-row dim_product is the ALL candidate here); D addresses scan and filter order, not join collocation. Trap: the query is slow pulls candidates to VACUUM, ANALYZE or SORTKEY, but the stem asks about the join, and the join is a distribution problem (trap pair 11). Source: bank Q31 · Redshift c_choosing_dist_sort.html, t_designating_distribution_styles.html (digest 15 C15) · skill 2.4.5.

4.3 Domain 3: Data Operations and Support (22 %) · items 13 to 16

Teardown: Q13 · one signal per stage, and it must measure that stage. Why it is right: stream lag (GetRecords.IteratorAgeMilliseconds, where zero means caught up), replication lag (CDCLatencyTarget) and concurrency starvation (Throttles) are the published health signals for their stages. Why the traps lose: B mixes a once-a-day storage metric with a metric name that does not exist for Glue and a CPU reading that says nothing about queueing; C substitutes GetRecords.Latency, which measures API call duration, not read-position lag: the most common metric mix-up in this domain; D repeats the storage/CPU pair and adds a Glue error counter, which counts task failures rather than pipeline health. Trap: monitoring in the stem pulls candidates to any metric they remember: the qualifier is stage: stream, replication, function. Redshift alarms need queue signals (for example WLMQueueLength), not CPU alone. Source: bank Q30 · CloudWatch metrics pages for Kinesis Data Streams, DMS, Lambda, S3, Glue, Redshift · skills 3.3.3 / 3.3.7.

Teardown, Q14 · who called, plus what the catalog now says. Why it is right: the auditor asks two questions, which principal and when, and CloudTrail's management events carry userIdentity and time, while Glue's own version history and Table State Change events carry the catalog-side "what changed" (skills 3.3.5 and 3.3.1). Why the traps lose: B offers S3 request metrics, which are operational telemetry about object requests rather than API identities, plus Macie, which discovers sensitive content; C pairs a true source with VPC Flow Logs, which record network flows, not API identities; D is half-right then claims version history alone answers which principal, it does not carry the caller's identity, and generic application logs are not catalog audit. Trap: the catalog half of the answer is the part candidates forget, because audit pulls everyone to CloudTrail; a two-part question needs two sources. Live-exam form: two checkboxes, all-or-nothing. Source: bank Q40 · Glue cloudwatch-cloudtrail-integration.html, CloudTrail User Guide · skills 3.3.1 / 3.3.5.

Teardown, Q15 · Macie reports, you respond. Why it is right: all three actions respect the division of labour, EventBridge routes the finding (skill 3.3.9), Lambda automates the response (skill 3.1.8), Lake Formation enforces the classification (skills 4.2.4 / 4.5.2), and suppression plus archival is a documented Macie finding-lifecycle step. Why the traps lose: B assigns encryption and deletion to Macie, a discovery service changes nothing by itself; C assigns key administration to Macie and suppresses without validating, which destroys the audit trail; D is three authorization and networking non-sequiturs that widen access while the exposure is unresolved. Trap: severity-3 is a distractor lure, Macie severities run 1 = Low, 2 = Medium, 3 = High with no Critical level, and findings are retained 90 days; the number tells you priority, not who may act. Source: bank Q36 · Macie findings-suppress.html, how-it-works.html · Lake Formation data-filtering docs (digest 15 C21, C23) · skills 3.1.8 / 3.3.9 / 4.5.2.

Teardown: Q16 · two doors, both must open. Why it is right: AWS documents that "a requestor's request must pass through two doors": IAM permissions and Lake Formation permissions, and Athena specifically requires lakeformation:GetDataAccess in the caller's IAM policy, while the grant must sit on the resource the query reads (and be issued by a data lake administrator). Why the traps lose: B is an account-level S3 listing permission plus a networking control: neither is an authorization door; C destroys least privilege (an IAM admin is not automatically a data lake administrator) while hybrid access mode is a legacy-migration aid, not a missing grant; D pairs the one true IAM action with AdministratorAccess, which would let the analyst grant themselves access: the opposite of the intended control. Trap: the stem lists IAM permissions that look generous (athena:*, glue:*), which tempts you to conclude IAM is fine; the missing action is a Lake Formation action living inside the IAM policy. Domain note: this item sits in Domain 3 as operate Athena queries against a governed lake (skill 3.1.7), while its mechanics are task 4.2.4. Source: bank Q34 · athena/latest/ug/lf-athena-user-permissions.html (digest 15 C22), Lake Formation lf-permissions-overview.html (C19) · skills 3.1.7 / 4.2.4.

4.4 Domain 4: Data Security and Governance (18 %) · items 17 to 20

Teardown, Q17 · the door is propped open by a default. Why it is right: with IAMAllowedPrincipals holding Super, Lake Formation explicitly defers to IAM alone, so no grant you make can restrict anything until that default group is revoked (or the "Use only IAM access control" setting is disabled), which is AWS's recommended transition to the fine-grained model. Why the traps lose: B changes who may grant, not who may read; C is the incremental migration state, not the end state, and does not close the catalog; D hands out administration, notably, that policy does not even let the holder add further admins, and closes nothing. Trap: I granted permissions and nothing changed is the most-reported Lake Formation symptom; the cause is a default, not a missing grant. An IAM AdministratorAccess user is not automatically a data lake administrator either. Source: bank Q35 · Lake Formation access-control-fine-grained.html, lf-permissions-reference.html (digest 15 C20) · skill 4.2.4.

Teardown: Q18 · the ceiling is the function, not the stream. Why it is right: AWS states Lambda scales to 1,000 concurrent executions per region, and the event source mapping runs at most one concurrent execution per shard, so the 10 MB/s cap is a function ceiling, and the fix is either more streams (more independent mappings) or a design change. Why the traps lose: A names the correct ceiling but jumps to an unrelated service, ignoring a fix that stays on the in-scope path; C mistakes a per-shard rate for the binding constraint and, worse, a 1M-shard stream would already far exceed 10 MB/s; D invents a total-throughput cap that does not exist (sustained >1000 MB/s per KDS stream requires ODA) and swaps in a queue with different semantics. Trap: every option quotes a real-sounding number: the discriminator is which number AWS attaches to which resource. Provisioned concurrency raises the ceiling for a specific alias but does not uncap account-level scaling. Source: bank Q37 · Lambda with-kinesis.html, account-limits.html, Kinesis provisioned-throughput.md (digest 15 C10) · skills 1.1.6 / 4.3.1.

Teardown: Q19 · granular report beats summary view. Why it is right: CUR is "the most comprehensive source of AWS cost and usage data": itemised per resource, per account, per service, per tag, with discounts: delivered to S3 where Athena can slice it by business unit (skills 1.1.4 ingestion of billing data, 1.2.5 transform for analytics, 3.3.7 reporting, 4.2.1 tags for governance). Why the traps lose: A gives a summary view: Cost Explorer's granularity is aggregated, not per line item, so it cannot reproduce the breakdown; B measures bytes, not dollars, and CloudWatch has no cost dimensions; C tells you whether you overshot a budget, not who overshot it. Trap: without installing agents steers candidates away from the only agent-free granular option: CUR is delivered, not collected. Source: bank Q38 · Cost and Usage Report User Guide, Billing docs · skills 1.1.4 / 1.2.5 / 3.3.7 / 4.2.1.

Teardown: Q20 · enforce, then record. Why it is right: compliance-mode Object Lock is the only mode whose retention cannot be shortened by anyone, including the account root: the regulatory-grade answer, and CloudTrail data events (not management events) are what record s3:DeleteObject attempts with identity and time. Why the traps lose: A's lifecycle rule expires the objects rather than protecting them; versioning plus replication duplicates data but a privileged principal can still delete both versions without a retention lock; C replicates, which is durability, not immutability: the replica inherits deletability unless it too is locked; D is a policy wish that the same principal's admin can edit away, and CloudWatch Logs does not capture S3 API attempts by default. Trap: cannot be deleted is the stem's only real verb: everything else is window dressing. Object Lock requires a versioning-enabled bucket, and retention applied before 2023-01-05 kept its transition-age gate; since that date S3 removed the minimum-age restriction on transitions (minimum storage duration per class still applies). Source: bank Q39 · S3 object-lock.html, object-lock-best-practices.html, CloudTrail data-event docs · skills 4.2.1 / 4.2.3 / 4.5.1.

4.5 Two extra discrimination items · not counted in the /20 grade

These two are stretch items built from the 2025 to 2026 changes in the 2026 Updates box. They are not part of the 7 / 5 / 4 / 4 blueprint above, so they do not change your score, your thresholds or your routing table: grade them separately, and if either is wrong, re-read the corresponding update row before you sit.

Teardown: Q21 · the floor is the discriminator. Why it is right: AWS states On-demand Advantage is an account-level mode that removes the per-stream hourly charge and bills a 25 MB/s ingest + 25 MB/s retrieval minimum once enabled; which is why it wins above roughly 10 MB/s aggregate or hundreds of streams, and why it can lose below that (digest 17 B.12 / C, S20). Why the traps lose: B is the pre-2025 fact: the mode list is now three (Provisioned, On-demand Standard, On-demand Advantage), the single most reliable "stale bank" tell in this area; C inverts the scope: the floor is account-wide, so 40 streams share one floor, not 40 of them; D invents a retention change: extended retention is a separate per-GB-month charge ($0.023/GB-month as of Oct 2026, previously $0.10) and is untouched by the mode. Trap: every option quotes a real number from the Kinesis pricing page; the discriminator is which resource AWS attaches the number to: account or stream. Source: digest 17 S20 / S21 (2025-11-04), Kinesis Data Streams pricing and sizing docs · skills 1.1.6 / 1.2.4.

Teardown, Q22 · easier sharing, same two doors. Why it is right: AWS's 2026-02-11 announcement describes cross-account sharing v5: one AWS RAM share can now carry unlimited tables (AWS's wording: hundreds of thousands), new grants use wildcard patterns rather than per-resource associations, the upgrade is opt-in, and existing shares and APIs keep working (digest 17 B.17 / S39). Why the traps lose: B is exactly backwards, per-table resource associations were the old constraint, and nothing was migrated forcibly; C asserts a deprecation AWS has never published, governed tables remain documented as the older primitive, and claiming otherwise is a digest (G) item; D invents a quota and a uniform Regional rule, when the published change was the removal of per-type limits rather than a new numeric cap. Trap: February 2026 is a real date on a real announcement, so candidates accept whichever story they half-remember; the discriminator is direction of change, sharing got easier, permissions got tighter (Iceberg DELETE on LF-governed tables now needs DELETE permission, and Iceberg DML also needs ALTER). Source: digest 17 S39 (2026-02-11), Lake Formation cross-account sharing docs, Redshift behaviour changes (Patch 202) · skills 4.2.4 / 4.5.7.

• 📚 Did you know? The 2025-12-12 guide refresh (v1.1) added eight skills, roughly 6 % of the map, and removed three, so a bank written against v1.0 can be slightly stale about what is in scope; the in-scope list still prints "Amazon Kinesis Data Firehose" even though AWS renamed the product to Amazon Data Firehose on 2024-02-09, because the rename changed no endpoint, API, CLI command, IAM action or CloudWatch metric. When an option's product name looks outdated, it is usually still valid on this exam.

---

5. TRAP DRILL: the top twenty pair lines

Twenty pair lines, one clause each. Print the middle column, cover the last two, and re-derive the stem word from the framing. Every trap below fired on the Set A or Set B items you just sat; this table is the whole exam's decision logic in twenty rows.

• 📚 Did you know? Every pair line above is a qualifier pair, not a service list. The exam almost never asks "what does Firehose do"; it asks "which statement decides between Streams and Firehose", and the deciding words are the ones in the last column. Cover the last column, read the framing, and say the stem word aloud; if you can produce the word from the framing, you can produce the answer from the stem.

---

6. EXAM DAY: logistics, check-in and the clock

Everything in this section is either printed in the AWS exam guide or stated by AWS Training and Certification as of Oct 2026. Nothing here is a guess about your specific test centre.

6.1 Before the day

6.2 At the test centre

1. Arrive 15 to 30 minutes early. Late arrivals may be turned away.
2. Store bags, phones, watches, notes and any paper in a locker. Scratch paper is not permitted.
3. Sign in with your two IDs. The proctor photographs you (test centre) or screens you (online).
4. You are assigned a seat or a proctored session; the exam software loads your form.
5. No break once started. The 130-minute clock runs continuously.

6.3 During the exam

• 📚 Did you know? The 15 unscored items exist so AWS can pre-test questions for future forms, they are not labelled, they are not easier, and they count toward the same 130 minutes, so your pacing budget must assume all 65 are scored. The scaled 200 to 1000 scale means the raw-to-scaled conversion is never published; two people who miss the same five items can finish with different scaled scores. Do not reverse-engineer a pass mark, the only rule you can act on is 720.

---

7. Grading Set B and routing to your weak areas

7.1 Score by domain, not by total

7.2 The thresholds

7.3 The routing table: every wrong item points to a lesson

7.4 What Set B does not tell you

• It never tells you your scaled score. Twenty items are a signal, not a 720 forecast: the live exam converts a 50-item raw count onto a 200 to 1000 scale with a never-published conversion.
• It never tells you which items were unscored. On the live form, 15 of 65 are unscored and you cannot identify them.
• It never tells you your pacing unless you timed yourself. 2.00 minutes per item is the average; a hard item may take 4 and an easy one 30 seconds.
• It never tells you about form difficulty. AWS recalibrates forms continuously; a hard form and an easy form both convert to 720 at different raw counts.

---

8. The final 7-day plan

The last week is retention and logistics, not new content. Nothing below adds a service; everything below is retrieval practice and scheduling hygiene.

• 📚 Did you know? The AWS Data Analytics Specialty (DEA-C01) Official Practice Question Set (practice.exams.aws.qa) is 20 questions with an answer key, not a timed simulator, and it is the only free official question set AWS publishes for this exam. Do it in the last week, treat every wrong answer as a routing-table entry, and never treat its difficulty as a proxy for the live form: the live form is calibrated continuously, the practice set is a fixed snapshot.

---

2026 Updates (as of October 2026)

Never assert on this exam (digest 18 §G; these are the things AWS has never published, and inventing them is the fastest way to lose a point):

1. Any pass rate. AWS publishes no pass percentage for DEA-C01 or any certification.
2. The raw-to-scaled conversion. The 200 to 1000 scale is scaled; the conversion is never published.
3. How many MR items are on a form. The exam guide describes the shape of MR, not the count.
4. Whether an item is unscored. The 15 unscored items are indistinguishable from scored items on screen.
5. Credly badge timing. "Within X days" is not an AWS guarantee; typical is days, not hours.
6. A pacing rule. 2.00 minutes per item is an average of published numbers (130 min ÷ 65 items), not an AWS instruction.
7. Scratch paper. No paper, online or on site; do not let a forum post convince you otherwise.

• 📚 Did you know? AWS Glue 6.0 became generally available on 2026-08-21 with Spark 4.1.1, Python 3.13, a 30 % price reduction and full Apache Iceberg v3 support, and it breaks jobs: EMRFS is removed (S3A is the only S3 filesystem) and the AWS SDK for Java v1 is gone (boto3 is unaffected). A distractor that mentions fs.s3.consistent.* or a com.amazonaws.* import is not testing style, it is testing whether you know the runtime moved; Glue 5.1 remains the default for new jobs, and 0.9 / 1.0 / 2.0 reached end of support on 2026-04-01 (digest 17 S12, S17, accessed Oct 2026).

---

---

---

Last verified 2026-10-10 against the DEA-C01 exam guide v1.1, AWS documentation, and AWS Training and Certification pages.