Practice Test #1

Kinesis Data Streams is managed and can ingest streaming data, but producers and consumers must use Kinesis APIs and shard semantics instead of Kafka APIs. Trap: It sounds attractive because it is managed streaming, but it changes the application contract and becomes a refactor.

Provisioned MSK preserves Kafka APIs, but the team still has to choose broker capacity, scale the cluster, and manage more operational tuning. Trap: It is Kafka-compatible, but the question asks for automatic scaling and the least management overhead.

Kinesis Data Firehose is a delivery service for buffering and loading data to destinations, not a Kafka-compatible broker platform for CDC consumers. Trap: Firehose reduces ingestion management, but it does not provide Kafka topics, offsets, or consumer-group behavior.

Manual certificate generation, imports, scripts, and cron jobs increase outage risk and operational work for a CloudFront viewer certificate. Trap: It appears to satisfy a fixed rotation cadence, but it ignores ACM's managed CloudFront integration.

Secrets Manager does not natively issue and attach public viewer certificates to CloudFront, so this would require custom distribution and rotation automation. Trap: Secrets Manager can rotate secrets, but CloudFront certificates should be managed through ACM.

ECS Service Connect is for ECS service-to-service networking and does not manage public CloudFront certificates for API Gateway origins. Trap: It mentions certificate-like service connectivity, but the workload is CloudFront and API Gateway, not ECS mesh traffic.

AWS Config checks resource configuration such as policies or encryption, but it does not emit per-user S3 object access attempts. Trap: Compliance alarms sound policy-oriented, but the requirement is per-request access violation alerting.

S3 CloudWatch metrics are aggregate operational metrics and do not include exact username, object key, or AccessDenied event context. Trap: CloudWatch alarms are useful, but metrics alone cannot answer who performed a specific object API call.

S3 server access logs are delivered with variable delay and are not designed for under-3-minute alerting. Trap: They can contain requester information, but their delivery latency misses the near-real-time requirement.

A bucket policy deny could cause AccessDenied, but the scenario emphasizes valid S3 ListBucket/GetObject permissions and customer managed KMS encryption. Trap: AccessDenied sounds like an S3 policy issue, but the missing layer is KMS authorization.

Athena engine version problems usually appear as SQL feature, syntax, or execution compatibility issues, not as AccessDenied while reading S3 objects. Trap: Engine versions can matter, but this symptom is a permissions failure.

Latency or a regional mismatch would not turn an object read into AccessDenied. Trap: The question mentions us-west-2, but the decisive clue is encrypted object access.

Partitioning by reading_date is good, but Redshift introduces loading, maintenance, and warehouse cost for weekly ad hoc queries. Trap: Redshift is fast SQL, but it is not the most cost-effective default for occasional S3 lake queries.

Partitioning by ingestion_date does not match the reading_date predicate, and EMR/Spark is heavier than needed for simple SQL KPIs. Trap: Spark can process large data, but the partition key and cost model are wrong for this query pattern.

Aurora is an OLTP database, not a cost-effective engine for analytical scans over a growing Parquet data lake. Trap: It supports SQL, but loading lake data into Aurora adds cost and mismatches the analytics workload.

Bucketing changes how files are grouped within data, but it does not reduce the number of partitions Athena must resolve during planning. Trap: Bucketing can help some joins and reads, but the stated bottleneck is partition metadata planning.

Parquet would reduce scanned bytes and improve execution cost, but it does not by itself remove the planning overhead from 1.2 million partitions. Trap: Parquet is usually good for Athena, but this question is specifically about planning time.

Combining small objects can improve runtime by reducing file-open overhead, but it does not reduce Glue partition metadata enumeration. Trap: S3DistCP addresses the small-files problem, not a catalog partition explosion.

An hourly crawler cannot meet a 30-second partition visibility SLA and adds startup and S3 listing time. Trap: Crawlers discover partitions, but they are scheduled batch processes.

Calling CreatePartition twice per day is much slower than batches arriving every 5 minutes and does not keep Athena current. Trap: It uses the right API, but at the wrong cadence.

MSCK REPAIR TABLE scans S3 prefixes to discover missing partitions and is not designed for predictable sub-minute updates. Trap: It can repair metadata, but it is a periodic discovery operation rather than an ingestion-time update.

The expression uses $ before the group, which is the end-of-string anchor and does not enforce that port_code begins with NY or LA. Trap: The (NY|LA) alternation is correct, but the anchor is wrong.

This option uses $ instead of ^ and & instead of regex alternation, so it does not represent starts with NY or LA. Trap: The symbols look like logical operators, but regex has specific anchor and alternation syntax.

The ^ anchor is correct, but (NY&LA) does not mean NY or LA in regex; it would not match either prefix as requested. Trap: The start anchor may look promising, but the group uses the wrong either-or operator.

Kinesis Data Streams cannot deliver records directly to S3 without a consumer or Firehose delivery stream. Trap: Provisioned shards address stream write capacity, but they do not create S3 objects.

A KCL consumer can write to S3, but it adds custom application code, checkpointing, retries, object management, and an explicit application buffer. Trap: Custom consumers offer control, but the scenario asks for the least-latency managed delivery choice.

Managed Service for Apache Flink is unnecessary because no stream transformation is required, and a 60-second Firehose buffer increases delivery latency. Trap: Flink is powerful for real-time processing, but here it adds a processing layer the scenario does not need.