AWS Certified
Data Analytics – Specialty
The definitive DAS-C01 study guide covering all five domains, core analytics services, architecture patterns, data security, and 100 practice questions with detailed explanations.
About the DAS-C01 Exam
The AWS Certified Data Analytics – Specialty validates expertise in designing, building, securing, and maintaining analytics solutions on AWS. It tests deep knowledge of the complete AWS analytics stack from ingestion through visualization.
📋 Exam Format
- 65 questions total (50 scored + 15 unscored)
- Multiple choice & multiple response
- 170 minutes duration
- Scaled score 100–1,000
- Minimum passing score: 750
- No penalty for guessing
🎯 Domain Weightings
- Collection — 18%
- Storage & Data Management — 22%
- Processing — 24%
- Analysis & Visualization — 18%
- Data Security — 18%
🎓 Prerequisites
- 5+ years of data analytics experience
- 2+ years of hands-on AWS experience
- Experience designing analytics architectures
- Knowledge of data warehousing concepts
- Understanding of big data technologies
✅ Exam Validates
- Define AWS data analytics services and features
- Explain how AWS services fit together in analytics architectures
- Select services for data collection, storage, processing
- Design and maintain analytics solutions
- Apply data security controls on AWS
Collection
This domain covers services and strategies for collecting, ingesting, and transferring data from various sources into AWS. Understanding throughput, latency, and durability tradeoffs is critical.
Collection
Task Statements: 1.1 Operational characteristics of collection systems · 1.2 Select collection systems · 1.3 Select appropriate data transfer service
🌊 Kinesis Data Streams
- Real-time streaming, ordered records per shard
- Shard capacity: 1 MB/s write, 2 MB/s read
- Retention: 24 hrs default, up to 365 days
- Multiple consumers via Enhanced Fan-Out
- Use when: low latency, ordering, replay needed
🚒 Kinesis Data Firehose
- Fully managed, near-real-time (60-sec buffer min)
- Destinations: S3, Redshift, OpenSearch, Splunk, HTTP
- Auto-scales, no shard management
- Inline transformation via Lambda
- Use when: simple delivery to destinations
📊 Kinesis Data Analytics
- Real-time SQL or Apache Flink on streams
- Reads from KDS or Firehose
- Outputs to KDS, Firehose, or Lambda
- Flink app: stateful, complex event processing
- SQL app: sliding window, tumbling window
📡 Kinesis Video Streams
- Ingest video, audio, image streams
- HLS for live video playback
- Integrates with Rekognition Video
- WebRTC for two-way real-time media
- Fragment-based storage, searchable by timestamp
Kinesis Data Streams: Custom consumer code, real-time (ms latency), ordered, replay, multiple readers, shards must be managed manually. Kinesis Data Firehose: Managed delivery service, near-real-time (60s+ buffer), auto-scales, direct delivery to S3/Redshift/OpenSearch with optional Lambda transform — no consumer code needed.
🏗️ Amazon MSK (Managed Kafka)
- Fully managed Apache Kafka service
- MSK Serverless — no capacity provisioning
- MSK Connect for managed Kafka Connect
- Use Kafka when you need open-source compatibility
- Multi-AZ by default, TLS encryption
📦 AWS IoT Core
- Connects IoT devices to AWS cloud
- MQTT, HTTPS, WebSocket protocols
- Rules engine routes to Kinesis, S3, Lambda
- IoT Greengrass for edge processing
- Device registry and authentication
🔄 AWS DMS & DataSync
- DMS: Migrate databases (homo/heterogeneous), CDC for ongoing replication
- DataSync: Online transfer NFS/SMB → S3/EFS/FSx, scheduled recurring
- DataSync: up to 10x faster than open-source tools
- DMS uses Schema Conversion Tool (SCT) for schema changes
❄️ AWS Snow Family
- Snowcone: 8TB, edge computing + transfer
- Snowball Edge: 80TB, compute + storage
- Snowmobile: 100PB, exabyte scale
- Use when: limited bandwidth, large datasets, offline transfer
- OpsHub for local management
| Service | Latency | Use Case | Key Limit |
|---|---|---|---|
| KDS | <1 second | Real-time processing, ordered events | 1 MB/s per shard write |
| Firehose | 60s+ buffer | Deliver to S3/Redshift/OpenSearch | No direct replay |
| MSK | ms | Apache Kafka workloads | Managed Kafka compatibility |
| SQS | seconds | Decouple components, retry | 256 KB message size |
| DMS | Near-realtime CDC | Database migration with replication | Ongoing replication via CDC |
Storage and Data Management
This domain covers selecting appropriate storage solutions, managing data lifecycles, and architecting data lakes. Understanding S3 storage classes, Lake Formation, and data cataloging is essential.
Storage and Data Management
Task Statements: 2.1 Operational characteristics of storage solutions · 2.2 Select storage solutions · 2.3 Catalog data
🗄️ Amazon S3 — Data Lake Foundation
- Unlimited storage, 11 nines (99.999999999%) durability
- S3 Intelligent-Tiering: auto-moves objects between tiers
- S3 Select: query CSV/JSON/Parquet in-place with SQL
- S3 Event Notifications → Lambda, SQS, SNS
- Versioning, MFA delete, Object Lock (WORM)
🏞️ AWS Lake Formation
- Build, secure, and manage data lakes quickly
- Centralizes permissions on top of Glue Data Catalog
- Tag-Based Access Control (TBAC) for fine-grained
- Row-level and column-level security
- Cross-account data sharing via RAM
- Governed Tables: ACID transactions for S3
📚 AWS Glue Data Catalog
- Central metadata repository for all data assets
- Glue Crawlers auto-discover schema from S3, RDS, DynamoDB
- Used by Athena, EMR, Redshift Spectrum
- Stores table definitions, partition info, connection info
- Searchable and versionable
📈 S3 Storage Classes
- Standard: frequent access, lowest latency
- Standard-IA: lower cost, retrieval fee
- One Zone-IA: 20% cheaper, single AZ only
- Glacier Instant: ms retrieval, lowest frequent access cost
- Glacier Flexible: 1–12 hr retrieval
- Glacier Deep Archive: 12–48 hr, cheapest
A typical AWS data lake uses S3 as the central store, organized into raw/curated/processed zones. Lake Formation governs security centrally. Glue Crawlers populate the Data Catalog. Athena queries in-place. EMR runs Spark transforms. Redshift Spectrum extends the warehouse to S3.
🏛️ Amazon Redshift
- Petabyte-scale columnar data warehouse (OLAP)
- Massively Parallel Processing (MPP) architecture
- RA3 nodes: compute separate from storage (S3)
- Redshift Spectrum: query S3 without loading
- Redshift ML: CREATE MODEL statement for SageMaker
- AQUA: advanced query accelerator cache
⚡ Amazon DynamoDB
- Serverless NoSQL key-value / document store
- Single-digit millisecond performance at any scale
- DynamoDB Streams → Kinesis Data Streams → analytics
- Global Tables: multi-region, active-active
- DAX: in-memory cache, microsecond reads
- TTL: auto-expire items (good for session data)
🐘 Amazon RDS & Aurora
- Managed relational databases (MySQL, PostgreSQL, Oracle)
- Aurora: 5x MySQL speed, 6-way replication
- Aurora Serverless v2: auto-scales instantly
- Read Replicas: up to 15 cross-region for analytics
- DMS can replicate from RDS to Redshift/S3
🔴 Amazon ElastiCache
- In-memory caching: Redis or Memcached
- Redis: persistence, pub/sub, sorted sets, clustering
- Memcached: simpler, multi-threaded
- Sits in front of databases to reduce latency
- Sub-millisecond read latency
| Storage Service | Type | Best For | Key Differentiator |
|---|---|---|---|
| S3 | Object | Data lake, archives, static assets | Unlimited scale, 11 nines durability |
| Redshift | Data Warehouse | OLAP analytics, BI queries | Columnar, MPP, Spectrum for S3 |
| DynamoDB | NoSQL | Low latency K-V lookups | Serverless, global tables, Streams |
| RDS/Aurora | Relational | Transactional workloads | ACID, multi-AZ, Read Replicas |
| ElastiCache | In-memory | Caching, session store | Sub-ms latency, Redis pub/sub |
Processing
The largest domain. Covers ETL, data transformation, big data frameworks (Spark, Hive), Lambda-based processing, and orchestration. AWS Glue and EMR are the most heavily tested services.
Processing
Task Statements: 3.1 Operational characteristics of processing solutions · 3.2 Design a batch processing solution · 3.3 Design a streaming processing solution
🔧 AWS Glue — Serverless ETL
- Serverless Apache Spark ETL — no infrastructure
- Glue Studio: visual ETL authoring drag-and-drop
- Glue DataBrew: visual data preparation for analysts
- Glue Elastic Views: replicate/combine data across stores
- Job bookmarks: track processed data to avoid reprocessing
- Dynamic frames: flexible schema evolution
🐘 Amazon EMR
- Managed Hadoop ecosystem on EC2 or EKS
- Supports: Spark, Hive, HBase, Flink, Presto, Pig
- EMR Serverless: no cluster management required
- EMRFS: use S3 as durable HDFS replacement
- Spot Instances for cost savings on task nodes
- Master/Core/Task node types
⚡ AWS Lambda for Data Processing
- Event-driven, serverless compute (15-min max)
- Triggers: S3, Kinesis, DynamoDB Streams, SQS, SNS
- Process individual records in real-time streams
- Kinesis trigger: batch window, bisect on error
- Firehose transformation: up to 6MB payload
🗂️ File Formats for Analytics
- Parquet/ORC: Columnar, compressed, splittable — best for analytics
- Avro: Row-based, great for write-heavy, schema evolution
- JSON/CSV: Human-readable, but large and slow
- Convert CSV → Parquet with Glue for Athena cost savings
- Partition data by date/region in S3 for query efficiency
Use Glue when: you want fully serverless ETL, you're using the Glue Data Catalog, you need a managed Spark environment with minimal setup, or you're using Glue Studio for visual pipelines. Use EMR when: you need full Hadoop ecosystem control, custom Spark configuration, HBase, Presto, or need Spot Instances to optimize cost at massive scale.
🔬 AWS Batch
- Run batch jobs at any scale on EC2/Fargate/Spot
- Managed job queues with priority ordering
- Automatically provisions compute resources
- Multi-node parallel jobs (HPC workloads)
- Use for large-scale ML training, simulation, rendering
🔗 AWS Step Functions
- Serverless visual workflow orchestration
- State machine with retry, catch, parallel, map
- Integrates: Lambda, Glue, EMR, SageMaker, ECS
- Express Workflows: short-duration, high-rate (IoT)
- Standard Workflows: long-running (up to 1 year)
📅 AWS Data Pipeline (Legacy)
- Orchestrate data movement and transformation
- Schedule-based pipeline runs on EC2/EMR
- Being replaced by Glue Workflows + Step Functions
- Use Step Functions + Glue for new architectures
- Data Pipeline still appears on exam for legacy scenarios
🎯 Apache Flink on KDA
- Stateful stream processing with exactly-once semantics
- Event-time processing, watermarks for late data
- KDA Studio: interactive Flink notebooks (Zeppelin)
- Auto-scales: managed Flink application fleet
- Checkpointing to S3 for fault tolerance
| Processing Service | Type | Best For | Framework |
|---|---|---|---|
| Glue | Serverless ETL | Catalog-integrated ETL, Spark jobs | Apache Spark |
| EMR | Managed cluster | Full Hadoop ecosystem, custom tuning | Spark/Hive/HBase/Presto |
| Lambda | Serverless FaaS | Event-driven, stream record processing | Any runtime |
| KDA (Flink) | Managed Flink | Stateful real-time stream processing | Apache Flink |
| Batch | Batch compute | Long-running batch jobs, HPC | Docker/EC2/Fargate |
Analysis and Visualization
This domain covers querying, analyzing, and visualizing data. Athena, Redshift, QuickSight, and OpenSearch Service are the core services. Understanding SPICE, performance optimization, and ML insights is key.
Analysis and Visualization
Task Statements: 4.1 Design and create a data analysis solution · 4.2 Design a visualization solution
🔍 Amazon Athena
- Serverless SQL queries directly on S3
- Pay per query: $5/TB scanned
- Use Parquet/ORC + partitioning to reduce cost
- Federated Query: query across RDS, DynamoDB, Redshift
- Workgroups: separate users, enforce cost limits
- CTAS: CREATE TABLE AS SELECT into new S3 location
🏛️ Redshift & Spectrum
- Redshift Spectrum: query S3 from Redshift without COPY
- COPY command: bulk-load S3 data into Redshift (fast)
- VACUUM: reclaim space, re-sort data
- Distribution keys: EVEN, KEY, ALL strategies
- Sort keys: compound or interleaved — optimize range queries
- Materialized views: cache complex query results
🔎 Amazon OpenSearch Service
- Managed Elasticsearch + OpenSearch + Dashboards (Kibana)
- Full-text search, log analytics, clickstream analysis
- Index rotation (daily/monthly) for log management
- UltraWarm: S3-backed warm tier, lower cost
- Cold storage: S3 snapshot storage, reattach when needed
- Kinesis Firehose → OpenSearch: log pipeline pattern
📊 Amazon QuickSight
- Cloud-native BI service, serverless, auto-scales
- SPICE: Super-fast, Parallel, In-memory Calculation Engine
- ML Insights: anomaly detection, forecasting, narratives
- Row-level security (RLS) and column-level security (CLS)
- Embedded analytics via SDK/APIs
- Q: natural language query interface
Always convert data to columnar format (Parquet or ORC) before querying with Athena — this alone can reduce costs by 75–90%. Partition your S3 data by common filter keys (year/month/day, region) so Athena scans fewer files. Compress files with GZIP, Snappy, or ZSTD. Use CTAS to store query results in a more efficient format.
🤖 Amazon SageMaker for Analytics
- Build, train, deploy ML models end-to-end
- SageMaker Data Wrangler: visual data prep for ML
- SageMaker Feature Store: share/reuse ML features
- Bring predictions back to Redshift via Redshift ML
- Autopilot: AutoML for automated model selection
🎨 Visualization Best Practices
- QuickSight + SPICE: preload data for fast dashboards
- Athena → QuickSight: direct query mode (live data)
- OpenSearch Dashboards: operational real-time monitoring
- Redshift → QuickSight: large-scale OLAP dashboards
- EMR + Zeppelin Notebooks: exploratory data analysis
| Analysis Service | Best For | Key Feature | Data Source |
|---|---|---|---|
| Athena | Ad hoc SQL on S3 | Serverless, pay-per-scan | S3, Federated |
| Redshift | OLAP, BI, warehouse | MPP, Spectrum, ML | Internal + S3 via Spectrum |
| OpenSearch | Full-text search, logs | Kibana/Dashboards, UltraWarm | Firehose, Logstash |
| QuickSight | BI dashboards | SPICE, ML Insights, RLS | Athena, Redshift, S3, RDS |
Data Security
This domain covers encrypting data at rest and in transit, controlling access, auditing, and meeting compliance requirements across the AWS analytics stack.
Data Security
Task Statements: 5.1 Implement data encryption · 5.2 Apply data governance/access controls · 5.3 Implement data privacy policies
🔑 AWS KMS — Key Management
- Centralized encryption key management
- AWS-managed vs Customer-managed vs Customer-provided keys
- Automatic key rotation (annual for CMKs)
- Integrates with S3, Redshift, Glue, Kinesis, DynamoDB
- CloudHSM: single-tenant dedicated HSM, FIPS 140-2 Level 3
🔒 S3 Encryption Options
- SSE-S3: AWS manages keys (AES-256), simplest
- SSE-KMS: KMS CMK, audit trail, fine-grained control
- SSE-C: Customer provides key per request, AWS encrypts
- Client-side: Encrypt before upload, manage yourself
- Default encryption: enforce via bucket policy
- In-transit: HTTPS/TLS enforced via S3 bucket policy
🏞️ Lake Formation Security
- Fine-grained access control beyond IAM/S3 policies
- Column-level and row-level security (RLS)
- Data Filters: filter rows and select columns
- Cross-account sharing via AWS RAM
- Governed Tables: ACID transactions + row-level security
- Tag-Based Access Control (TBAC) for scale
🔐 Redshift Security
- Cluster encryption: KMS or CloudHSM
- VPC isolation: deploy in private subnets
- Database user authentication via IAM roles
- Column-level grants: GRANT COLUMN on specific columns
- Audit logging to S3: user activity + connection logs
- Enhanced VPC Routing: all COPY/UNLOAD through VPC
At rest: KMS (SSE-KMS), SSE-S3, SSE-C for S3; TDE for RDS; cluster encryption for Redshift; server-side encryption for DynamoDB, Kinesis, Glue jobs. In transit: TLS 1.2+ for all AWS service APIs; enforce HTTPS-only via S3 bucket policy (aws:SecureTransport); VPC endpoints eliminate internet exposure; Direct Connect for private network connectivity.
👤 IAM for Analytics
- IAM roles for Glue jobs, EMR clusters, Lambda
- Service-linked roles for cross-service access
- Resource-based policies on S3 buckets
- Condition keys: aws:SourceVpc, s3:prefix, kms:ViaService
- Permission boundaries to limit maximum permissions
📋 Auditing & Monitoring
- CloudTrail: All API calls — who did what, when
- AWS Config: Resource configuration compliance rules
- VPC Flow Logs: Network traffic in/out of VPC
- Redshift audit logs: User activity + connection logs
- Athena query history: Workgroup-level query logs
🔎 Amazon Macie
- ML-based S3 PII/sensitive data discovery
- Detects: SSN, credit cards, passwords, API keys
- Alerts on public S3 buckets and unencrypted objects
- Multi-account via AWS Organizations
- Findings → Security Hub → EventBridge → Lambda remediation
🌐 VPC & Network Security
- VPC endpoints (Interface/Gateway) for private AWS access
- S3 Gateway Endpoint: free, routes S3 traffic in VPC
- Kinesis Interface Endpoint: private Kinesis access
- Security Groups on Redshift clusters and EMR
- Glue Connection for JDBC sources in private VPC
| Security Control | Service | What It Does |
|---|---|---|
| Encryption at rest | KMS | CMK management, automatic rotation, audit via CloudTrail |
| Fine-grained access | Lake Formation | Column/row level security for Glue catalog resources |
| PII detection | Macie | Scans S3 for sensitive data patterns |
| API audit trail | CloudTrail | Records all management + data plane API calls |
| Network isolation | VPC Endpoints | Private access to S3, Kinesis, Glue without internet |
| Compliance checks | AWS Config | Evaluates resource configs against compliance rules |
100 Practice Questions
DAS-C01 Data Analytics Specialty · All 5 Domains · With Detailed Explanations