AWS Certified Data Analytics Specialty Exam 2026: Professional
Certification Practice Test — Data Collection, Storage, Processing,
Analytics, Visualization & Security — 190 Multiple-Choice Questions
with Answers & Detailed Rationales
Domain 1: Data Collection Systems (Questions 1–36)
Question 1
A logistics company collects GPS telemetry from 25,000 delivery vehicles. Each vehicle emits
a location record every 3 seconds. The company needs to retain records for 7 days and allow
multiple independent applications to process the data at their own pace. Which service
meets these requirements?
A. Amazon SQS with a 7-day message retention period
B. Amazon Kinesis Data Streams with enhanced fan-out and 168-hour retention
C. AWS Lambda writing directly to Amazon S3
D. Amazon SNS with HTTP endpoints for each consumer
Correct Answer: B
Explanation: Kinesis Data Streams supports configurable retention up to 365 days and
enhanced fan-out gives each consumer dedicated throughput. SQS deletes messages after
consumption, and SNS does not support replay for independent consumers.
Question 2
A media analytics firm ingests clickstream data where the source system occasionally sends
duplicate events due to retry logic. The analytics pipeline must not double-count clicks in
downstream aggregations. Which design approach best addresses this requirement?
,A. Use Kinesis Data Firehose with Lambda transformation to filter duplicates
B. Implement idempotent processing using deterministic event IDs and deduplication logic in
the consumer
C. Configure Kinesis Data Streams with exactly-once semantics at the producer
D. Store all events in S3 and rely on Athena to deduplicate at query time
Correct Answer: B
Explanation: Kinesis guarantees at-least-once delivery, not exactly-once. Deduplication must
be implemented in the consumer using deterministic identifiers, which ensures correctness
regardless of upstream retries.
Question 3
A financial institution requires that all market data ingested through Amazon Kinesis Data
Streams be encrypted both in transit and at rest without managing encryption keys
manually. Which configuration satisfies this requirement with minimal operational
overhead?
A. Enable server-side encryption with AWS KMS managed keys on the stream and use TLS for
producer connections
B. Encrypt records at the producer using a custom AES implementation before PutRecord
C. Use HTTPS only, as Kinesis encrypts data at rest by default
D. Store data in S3 with SSE-S3 after streaming through Lambda
Correct Answer: A
Explanation: Kinesis Data Streams supports server-side encryption with KMS-managed keys,
and producers connect via HTTPS by default. This provides both in-transit and at-rest
encryption without key management burden.
,Question 4
An IoT company needs to ingest device telemetry into Amazon S3 with automatic format
conversion to Parquet, compression, and delivery in batches of at least 128 MB or every 5
minutes. Which solution requires the least development effort?
A. Amazon Kinesis Data Streams with a custom consumer application
B. AWS Lambda triggered by Kinesis with S3 PutObject calls
C. Amazon Kinesis Data Firehose with record format conversion and buffering hints
D. AWS Glue streaming ETL job reading from Kinesis
Correct Answer: C
Explanation: Kinesis Data Firehose natively supports Parquet conversion, GZIP compression,
and configurable buffering by size and time, requiring no custom code for these
transformations.
Question 5
A healthcare provider collects HL7 messages containing protected health information (PHI).
The data must be ingested into AWS for analytics while ensuring PHI is not exposed to
unauthorized analysts. Which combination addresses ingestion and access control?
A. Amazon Kinesis Data Streams with IAM policies restricting access to the stream and de-
identification Lambda before storage
B. Amazon SQS with message-level encryption and S3 bucket policies
C. AWS Database Migration Service with column-level encryption
D. Amazon MSK with SASL/SCRAM authentication only
Correct Answer: A
, Explanation: IAM policies control who can access the stream, while a Lambda function can
de-identify PHI before downstream storage. This layered approach satisfies both ingestion
and access control requirements.
Question 6
A company observes that one shard in their Kinesis Data Stream receives 80% of writes
because the partition key is a customer ID with highly skewed distribution. What is the most
effective remediation?
A. Increase the number of shards to 10 times the current count
B. Enable enhanced fan-out to distribute read load
C. Redesign the partition key to use a higher-cardinality composite key such as customer ID +
timestamp
D. Reduce the record size to allow more records per second per shard
Correct Answer: C
Explanation: Hot shards result from partition key skew. A composite key increases cardinality
and distributes records evenly across shards, resolving the imbalance at the source rather
than adding capacity.
Question 7
A retail company uses Amazon MSK to ingest point-of-sale transactions. They need to retain
all events indefinitely for audit purposes while keeping broker storage costs low. Which
approach best achieves this?
A. Increase the Kafka topic retention.ms to unlimited
Certification Practice Test — Data Collection, Storage, Processing,
Analytics, Visualization & Security — 190 Multiple-Choice Questions
with Answers & Detailed Rationales
Domain 1: Data Collection Systems (Questions 1–36)
Question 1
A logistics company collects GPS telemetry from 25,000 delivery vehicles. Each vehicle emits
a location record every 3 seconds. The company needs to retain records for 7 days and allow
multiple independent applications to process the data at their own pace. Which service
meets these requirements?
A. Amazon SQS with a 7-day message retention period
B. Amazon Kinesis Data Streams with enhanced fan-out and 168-hour retention
C. AWS Lambda writing directly to Amazon S3
D. Amazon SNS with HTTP endpoints for each consumer
Correct Answer: B
Explanation: Kinesis Data Streams supports configurable retention up to 365 days and
enhanced fan-out gives each consumer dedicated throughput. SQS deletes messages after
consumption, and SNS does not support replay for independent consumers.
Question 2
A media analytics firm ingests clickstream data where the source system occasionally sends
duplicate events due to retry logic. The analytics pipeline must not double-count clicks in
downstream aggregations. Which design approach best addresses this requirement?
,A. Use Kinesis Data Firehose with Lambda transformation to filter duplicates
B. Implement idempotent processing using deterministic event IDs and deduplication logic in
the consumer
C. Configure Kinesis Data Streams with exactly-once semantics at the producer
D. Store all events in S3 and rely on Athena to deduplicate at query time
Correct Answer: B
Explanation: Kinesis guarantees at-least-once delivery, not exactly-once. Deduplication must
be implemented in the consumer using deterministic identifiers, which ensures correctness
regardless of upstream retries.
Question 3
A financial institution requires that all market data ingested through Amazon Kinesis Data
Streams be encrypted both in transit and at rest without managing encryption keys
manually. Which configuration satisfies this requirement with minimal operational
overhead?
A. Enable server-side encryption with AWS KMS managed keys on the stream and use TLS for
producer connections
B. Encrypt records at the producer using a custom AES implementation before PutRecord
C. Use HTTPS only, as Kinesis encrypts data at rest by default
D. Store data in S3 with SSE-S3 after streaming through Lambda
Correct Answer: A
Explanation: Kinesis Data Streams supports server-side encryption with KMS-managed keys,
and producers connect via HTTPS by default. This provides both in-transit and at-rest
encryption without key management burden.
,Question 4
An IoT company needs to ingest device telemetry into Amazon S3 with automatic format
conversion to Parquet, compression, and delivery in batches of at least 128 MB or every 5
minutes. Which solution requires the least development effort?
A. Amazon Kinesis Data Streams with a custom consumer application
B. AWS Lambda triggered by Kinesis with S3 PutObject calls
C. Amazon Kinesis Data Firehose with record format conversion and buffering hints
D. AWS Glue streaming ETL job reading from Kinesis
Correct Answer: C
Explanation: Kinesis Data Firehose natively supports Parquet conversion, GZIP compression,
and configurable buffering by size and time, requiring no custom code for these
transformations.
Question 5
A healthcare provider collects HL7 messages containing protected health information (PHI).
The data must be ingested into AWS for analytics while ensuring PHI is not exposed to
unauthorized analysts. Which combination addresses ingestion and access control?
A. Amazon Kinesis Data Streams with IAM policies restricting access to the stream and de-
identification Lambda before storage
B. Amazon SQS with message-level encryption and S3 bucket policies
C. AWS Database Migration Service with column-level encryption
D. Amazon MSK with SASL/SCRAM authentication only
Correct Answer: A
, Explanation: IAM policies control who can access the stream, while a Lambda function can
de-identify PHI before downstream storage. This layered approach satisfies both ingestion
and access control requirements.
Question 6
A company observes that one shard in their Kinesis Data Stream receives 80% of writes
because the partition key is a customer ID with highly skewed distribution. What is the most
effective remediation?
A. Increase the number of shards to 10 times the current count
B. Enable enhanced fan-out to distribute read load
C. Redesign the partition key to use a higher-cardinality composite key such as customer ID +
timestamp
D. Reduce the record size to allow more records per second per shard
Correct Answer: C
Explanation: Hot shards result from partition key skew. A composite key increases cardinality
and distributes records evenly across shards, resolving the imbalance at the source rather
than adding capacity.
Question 7
A retail company uses Amazon MSK to ingest point-of-sale transactions. They need to retain
all events indefinitely for audit purposes while keeping broker storage costs low. Which
approach best achieves this?
A. Increase the Kafka topic retention.ms to unlimited
