← Data Sources and Connectivity

Q1 Quiz — data sources and connectivity

Exam-style. One correct answer each, no partial credit. Answers with explanations at the end.

---

1. A team asks you to create a Quick Sight data source directly against AWS Glue Data Catalog. What do you do?

• A. Use Type: GLUE in CreateDataSource
• B. Create an Athena data source; Athena reads the Glue catalog
• C. Enable Glue on the Security & permissions screen first, then use Type: GLUE
• D. Export the Glue tables to S3 and use an S3 manifest

2. aws quicksight create-data-source returns HTTP 200 with "CreationStatus": "CREATION_IN_PROGRESS". What is true?

• A. The connection to the source has been validated
• B. The data source exists but the connection may still fail; poll DescribeDataSource
• C. The call must be retried until it returns CREATION_SUCCESSFUL
• D. Credentials were verified but network connectivity was not

3. Which credential configuration produces the failure COPY_SOURCE_NOT_FOUND?

• A. A SecretArn whose secret was deleted
• B. A CredentialPair with a rotated password
• C. A data source borrowing credentials via CopySourceArn from a since-deleted data source
• D. A KMS key that Quick Sight cannot decrypt

4. Which two SaaS source types cannot use Secrets Manager credentials?

• A. Salesforce and GitHub
• B. Jira and ServiceNow
• C. Adobe Analytics and Salesforce
• D. GitHub and Jira

5. An engineer edits an API-managed data source in the console to fix a typo in its display name. The next scheduled refresh fails with an authentication error. Most likely cause?

• A. The console edit invalidated the connection pool
• B. Console edits reset SslProperties to defaults
• C. The UI edit silently removed the data source's SecretArn
• D. The engineer lacked quicksight:UpdateDataSource

6. Both aws-quicksight-s3-consumers-role-v0 and aws-quicksight-service-role-v0 exist in an account. Athena connections fail with insufficient permissions. An S3 policy was added to aws-quicksight-service-role-v0 and nothing changed. Why?

• A. The policy needs 24 hours to propagate
• B. Athena connections use the s3-consumers role whenever it exists; the fix went to the fallback
• C. Athena requires the policy on the secretsmanager role
• D. Roles are cached per data source at creation time

7. Athena data encrypted with a customer KMS key fails from Quick Sight but works in the Athena console. The documented fix is:

• A. Add kms:* to the user's IAM policy
• B. Re-encrypt the data with an AWS-managed key
• C. aws kms create-grant --grantee-principal <QuickSight role ARN> --operations Decrypt
• D. Disable SSL on the data source

8. Which pair of sources is reached through the lesson-3 service roles and not through a VPC connection?

• A. Redshift and RDS
• B. Athena and S3
• C. Aurora and MariaDB
• D. Snowflake and Databricks

9. CreateVPCConnection rejects your call. You supplied one subnet ID, three security group IDs, and a role ARN. What violated the API contract?

• A. Security groups: maximum is 2
• B. Subnets: minimum is 2
• C. The role ARN must be a service-linked role
• D. DnsResolvers is required

10. Why must the QNI security group's inbound rule allow all TCP ports 0–65535?

• A. Quick Sight load-balances queries across ephemeral listener ports
• B. The QNI's SG is not stateful, and return packets arrive on randomly allocated ports
• C. It's a legacy requirement removed in 2023 but kept for compatibility
• D. NACLs override security groups unless all ports are open

11. A VPC connection reports CreationStatus: CREATION_SUCCESSFUL and AvailabilityStatus: PARTIALLY_AVAILABLE. The matching symptom is:

• A. All connections fail with ACCESS_DENIED
• B. Connections work intermittently — some ENIs/subnets are healthy, others aren't
• C. The connection works but only for Standard edition users
• D. DNS resolution fails for all sources

12. A database hostname lives in a Route 53 private hosted zone and only resolves inside the VPC. Which is the documented mechanism to make a Quick Sight VPC connection work?

• A. Put the QNI in a public subnet
• B. Add the zone to the VPC's DHCP options set
• C. Supply Route 53 Resolver inbound endpoint IPs in DnsResolvers
• D. Use the instance's public IP instead

13. Users report Quick Sight "can't connect" to Redshift; the DBA reports the cluster is suddenly slow. Visuals use direct query. The most likely mechanism is:

• A. The VPC connection dropped and is retrying
• B. Visuals hit the non-adjustable 120-second timeout, but the Redshift driver doesn't cancel the queries — retries are stacking zombie queries on the cluster
• C. SPICE capacity is exhausted, forcing fallback to direct query
• D. The QNI security group is throttling throughput

14. Which manifest is valid for a Quick Sight-format S3 import?

• A. manifest.txt containing fileLocations with URIs
• B. manifest.json containing entries with url and mandatory
• C. manifest.json containing fileLocations, mixing one CSV and one JSON file
• D. manifest.json containing fileLocations with URIPrefixes covering a folder of same-schema CSVs

15. Your security baseline requires TLS 1.2 to an Aurora MySQL source. Engine version is 5.7.21. What actually happens, per the docs?

• A. The connection fails with SSL_CERTIFICATE_VALIDATION_FAILURE
• B. Quick Sight silently falls back to TLS 1.1
• C. Quick Sight refuses to create the data source
• D. TLS 1.2 is negotiated anyway; the version floor is about ciphers

16. For creating a data source with a SecretArn, whose permissions authorize secretsmanager:GetSecretValue at creation time?

• A. The API caller's IAM identity
• B. aws-quicksight-secretsmanager-role-v0
• C. aws-quicksight-service-role-v0
• D. The data source's Permissions principals

---

Answers and explanations

1 — B. There is no Glue Type in the 38-value enum. The user guide's own list says Glue Data Catalog is "accessed using AWS Glue data catalog compatible services, such as Athena or Redshift Spectrum." A and C invent an enum value; D works but abandons the catalog and live queries.

2 — B. Creation is asynchronous; the 200 acknowledges the request. Connection testing resolves later into CREATION_SUCCESSFUL/CREATION_FAILED — read it with DescribeDataSource. A and D claim validations that haven't happened; C retries a non-idempotent create (you'd hit ResourceExistsException).

3 — C. COPY_SOURCE_NOT_FOUND is the borrowing chain breaking. A deleted secret (A) fails as an access/auth error; B as authentication; D as a KMS/decrypt failure.

4 — B. Verbatim from the Secrets Manager integration page: "Jira and ServiceNow are not currently supported."

5 — C. "Secrets are automatically removed from a data source when the data source is altered in the UI" — any console edit, even cosmetic. A and B aren't documented behaviors; D would have blocked the edit, not broken the refresh.

6 — B. The troubleshooting page: the s3-consumers role is the default for Athena/S3/Federation; the service role is used only "if the s3-consumers-role is not present." Policy went to the inactive role. A, C, D aren't documented mechanisms.

7 — C. The documented remedy is a KMS grant for Decrypt to the Quick Sight role. A grants to the wrong principal and over-broadly; B is surrender, not a fix; D is unrelated to KMS.

8 — B. Athena and S3 are absent from the supported-VPC-sources list — they're authorized via the service roles. All other pairs listed are on the VPC list.

9 — B. SubnetIds: "Minimum number of 2 items. Maximum number of 15." Security groups allow 1–16 (A wrong); the role is a normal IAM role you supply (C wrong); DnsResolvers is optional (D wrong).

10 — B. Verbatim: the QNI's security group "isn't stateful", so return traffic isn't auto-admitted, and "the destination port number of any inbound return packets is set to a randomly allocated port number." C gets the 2023 date backwards — the docs scope the documented rules to pre-2023 connections and are silent about after; D misstates how NACLs and SGs compose.

11 — B. PARTIALLY_AVAILABLE means part of the connection's capacity is healthy. With ENIs across ≥2 subnets, some paths work — the classic intermittent failure. A is an auth symptom; C and D aren't real mechanisms.

12 — C. The requirement is that the DNS name resolve from outside the VPC; DnsResolvers (Route 53 Resolver inbound endpoints, per the setup page) is the documented answer. A doesn't fix resolution and worsens security posture; D violates the private-IP requirement.

13 — B. The data-source-limits page: visuals time out at 2 minutes, "not all database drivers react to the 2-minute timeout, for example Amazon Redshift" — queries keep running server-side. Each user retry adds load; the docs tell you to cancel from the Redshift side. The others don't explain both symptoms.

14 — D. URIPrefixes importing a folder of same-format, same-schema files is exactly the documented use. A fails the .json-extension rule for Quick Sight format; B mixes Redshift-format keys into a claim about Quick Sight format; C violates "all files… must use the same file format."

15 — B. "TLS 1.2 for MySQL connections requires MySQL version 5.7.28 or higher. For MySQL versions below 5.7.28, Quick Sight falls back to TLS 1.1." No error, no refusal — which is why the DB version is the compliance control.

16 — A. "Amazon Quick authorizes secretsmanager:GetSecretValue access to the secret based on the API caller's IAM policy, not the IAM service role's policy." The secretsmanager role (B) is assumed at analysis/dashboard view time.

Scoring