Correct : B

To allow cross-account access to a Kinesis Data Stream, you must add a resource-based policy to the Kinesis stream in Account A, explicitly granting the Lambda execution role in Account B the required permissions.

SCPs (A & C) set permissions boundaries, but do not grant access.

Option D incorrectly refers to the Lambda function -- but the Kinesis resource must allow access.

''You must add a resource-based policy to the Kinesis Data Stream in Account A to allow a Lambda function in Account B to consume from the stream.''

Correct : A

Option A is correct. The MERGE INTO statement is used to conditionally update, insert, or delete rows based on a match condition between a target table and a source table. In this statement, the target table is accounts and the source table is monthly_accounts_update. The join condition is t.customer = s.customer. Because the statement uses WHEN MATCHED THEN DELETE, every row in accounts that has a matching customer value in monthly_accounts_update will be deleted from the target table.

AWS documentation for MERGE INTO states that it conditionally updates, deletes, or inserts rows into an Apache Iceberg table, and the syntax explicitly includes WHEN MATCHED THEN DELETE. AWS Glue guidance and examples for Iceberg also show MERGE INTO as a supported pattern for row-level changes in Glue ETL workflows. This means the syntax is valid for supported Glue-Iceberg use cases, so option D is incorrect. Options B and C are also incorrect because the statement does not retain only matching rows and does not delete the entire table. It deletes only the rows in the target table that satisfy the match condition.

Correct : B

AWS Lake Formation is a service that allows you to easily set up, secure, and manage data lakes. One of the features of Lake Formation is row-level security, which enables you to control access to specific rows or columns of data based on the identity or role of the user. This feature is useful for scenarios where you need to restrict access to sensitive or regulated data, such as customer data from different countries. By registering the S3 bucket as a data lake location in Lake Formation, you can use the Lake Formation console or APIs to define and apply row-level security policies to the data in the bucket. You can also use Lake Formation blueprints to automate the ingestion and transformation of data from various sources into the data lake. This solution requires the least operational effort compared to the other options, as it does not involve creating or moving data, or managing multiple tables, views, or roles.Reference:

AWS Lake Formation

Row-Level Security

AWS Certified Data Engineer - Associate DEA-C01 Complete Study Guide, Chapter 4: Data Lakes and Data Warehouses, Section 4.2: AWS Lake Formation

Correct : C

Apache Parquet is a columnar storage format that is much more space-efficient than row-based formats like CSV, especially for analytics workloads. Transforming data from CSV to Parquet significantly reduces storage costs and improves query performance. According to the study guide:

''Parquet is a columnar storage file format that is optimized for use with analytics workloads, providing efficient storage and fast query performance.''

-- Ace the AWS Certified Data Engineer - Associate Certification - version 2 - apple.pdf

By switching to Parquet, the company can reduce both storage size and retrieval times, making it the optimal choice for cost-effective data analysis.

Correct : B

Option B is correct because Amazon MSK Replicator is the AWS-managed feature specifically designed to reliably replicate data across Amazon MSK clusters in different AWS Regions. AWS states that MSK Replicator can be used to build regionally resilient streaming applications for availability and business continuity, which directly supports the disaster recovery requirement. It is also the choice with the least operational effort because it avoids deploying and managing self-hosted replication tools such as Kafka Connect or MirrorMaker 2. AWS documentation for cross-Region setup also shows support for secure connectivity and notes that MSK environments support IAM, TLS, and SASL/SCRAM authentication schemes for private connectivity scenarios.

Option A and C would require the company to deploy, scale, patch, and monitor custom replication infrastructure in every Region, which increases operational overhead. Option D is not appropriate because Kinesis Data Firehose is not the native service for replicating data between MSK clusters. For ordering and consistency, Kafka-based replication preserves partitioned stream semantics better than mixing in a different streaming service. Therefore, a mesh of MSK Replicator relationships between regional MSK clusters is the best AWS-native answer for near real-time, encrypted, cross-Region replication with minimal administration.