724 questions total · 10pages · All types, answers revealed
Page 1 of 10
Page 2Match each AWS service to its port number (if applicable).
Drag a concept onto its matching description — or click a concept then click the description.
3306
6379
5432
11211
1521
Why these pairings
Default ports are important for configuring security groups and connecting to databases.
A developer is using Amazon S3 to store application logs. The logs are generated every hour and must be retained for 90 days. After 90 days, the logs should be deleted automatically. Which S3 lifecycle policy should the developer configure?
Implementing an S3 Lifecycle rule to Expire objects after 90 days directly addresses the requirement for automatic deletion of application logs. This action permanently removes the objects from the S3 bucket 90 days after their creation, ensuring that old logs are automatically purged. This approach optimizes storage costs and maintains data hygiene without requiring manual intervention, aligning perfectly with a deletion mandate.
Why this answer
The requirement is to delete logs after 90 days, and the S3 lifecycle 'Expire' action permanently removes objects once they reach the specified age. No transitions are needed since the logs are not required to be stored in a different storage class before deletion.
Exam trap
The trap here is that candidates often overcomplicate the solution by adding unnecessary transitions (like Option D) or confuse 'transition' with 'expiration', thinking moving to Glacier after 90 days automatically deletes the data, which it does not.
How to eliminate wrong answers
Option A is wrong because expiring objects after 30 days would delete them far earlier than the required 90-day retention period. Option B is wrong because transitioning objects to S3 Glacier after 90 days does not delete them; it only moves them to a colder storage class, and they would continue to incur storage costs indefinitely unless an expiration action is also configured. Option D is wrong because while it includes an expiration after 90 days, the transition to S3 Standard-IA after 30 days is unnecessary and adds cost; the requirement only specifies deletion after 90 days, not tiering.
A developer is building a serverless application using AWS Lambda to process images uploaded to an S3 bucket. The Lambda function needs to resize the image and store the result in another S3 bucket. The developer notices that the Lambda function fails intermittently with timeout errors for large images. What is the MOST efficient solution to resolve this issue?
Increasing the Lambda function's memory allocation directly scales its CPU power proportionally, providing more computational resources to process larger and more complex images efficiently. Concurrently, extending the timeout allows the function sufficient time to complete computationally intensive tasks like high-resolution image resizing or complex transformations without premature termination. This direct adjustment of allocated resources and execution duration is the most straightforward solution for handling larger image files within a single Lambda invocation.
Why this answer
Increasing the Lambda function timeout and memory allocation directly addresses the root cause of the failure: large images require more processing time and memory. Lambda's CPU and I/O throughput scale proportionally with allocated memory, so raising both parameters provides the necessary resources to complete the resize operation within the function's execution environment.
Exam trap
The trap here is that candidates often overcomplicate the solution by considering orchestration or parallel processing (Options C and D), when the simplest and most efficient fix is to adjust the Lambda function's resource limits, which directly control execution time and processing capacity.
How to eliminate wrong answers
Option B is wrong because limiting S3 event notifications to images smaller than 5 MB does not resolve the issue for larger images; it merely avoids processing them, which is not a solution for handling large images as required. Option C is wrong because Lambda functions run in a single-threaded execution environment by default, and multi-threading for image chunks is not supported; even with provisioned concurrency, image processing libraries like Pillow are not designed for parallel chunk processing within a single invocation. Option D is wrong because AWS Step Functions adds orchestration overhead and does not increase the per-invocation timeout or memory limits of the Lambda function; the underlying timeout error would still occur when a single step processes a large image.
An application in ECS Fargate needs to read a secret and decrypt it with KMS. Which two permissions/configurations are needed?
Assigning an IAM Task Role to the ECS Fargate task and granting it `secretsmanager:GetSecretValue` permissions is the secure and recommended approach. This allows the application running within the container to programmatically retrieve the necessary secret from AWS Secrets Manager at runtime. This method ensures secrets are never hardcoded, facilitates centralized management and rotation, and adheres to the principle of least privilege by granting only the necessary access.
Why this answer
The ECS task role is an IAM role that the Fargate task assumes to make AWS API calls. To read a secret from AWS Secrets Manager, the task role must have an IAM policy granting `secretsmanager:GetSecretValue` permission. Option D is correct because the secret is encrypted with a KMS key, so the task role also needs a KMS key policy or IAM permission that allows `kms:Decrypt` on that specific key.
Exam trap
The trap here is that candidates often confuse EC2 instance profiles with ECS task roles, forgetting that Fargate is serverless and has no underlying EC2 host to attach an instance profile to.
A developer needs to allow users from another AWS account (account ID: 123456789012) to read objects in an S3 bucket owned by the developer's account. The developer wants to use a bucket policy and does not want to create IAM users in the other account. Which bucket policy statement achieves this securely?
The root ARN of the trusted account (arn:aws:iam::123456789012:root) is used as the Principal. This delegates control to the other account's administrator, who can then grant read access to specific IAM users or roles in their account.
Why this answer
It uses the AWS account root principal ARN (arn:aws:iam::123456789012:root) to grant cross-account access to the S3 bucket. This allows any IAM user or role in the external account to read objects, provided the external account's administrator delegates permissions via IAM policies. The bucket policy does not require creating IAM users in the other account, aligning with the requirement.
Exam trap
The trap here is that candidates often confuse the root principal ARN with a specific IAM entity, leading them to choose options that require pre-existing users or roles in the external account, or they misuse conditions like aws:SourceAccount with a wildcard principal, which does not securely restrict access.
How to eliminate wrong answers
Option A is wrong because the aws:SourceAccount condition is used for ensuring the request originates from a specific AWS account in resource-based policies, but it is typically paired with aws:SourceArn to prevent confused deputy issues; here, it is used alone with a wildcard principal, which is insecure and does not restrict to the intended account. Option C is wrong because it specifies a specific IAM user ARN, which requires that user to exist in the external account, contradicting the requirement not to create IAM users. Option D is wrong because it specifies a specific IAM role ARN, which requires that role to exist in the external account, also contradicting the requirement not to create IAM users or roles.
A developer is building a serverless application using AWS Lambda and Amazon API Gateway. The API must support different HTTP methods (GET, POST, PUT, DELETE) for the same resource path. The developer wants to define the API in a single Lambda function that can handle all methods without additional mapping configuration. Which Lambda integration type should the developer use?
Lambda proxy integration is the correct choice because it forwards the complete client request, including HTTP method, headers, query string parameters, and body, directly to the integrated Lambda function as a single input event. This allows the Lambda function to act as a unified handler, inspecting the 'httpMethod' property within the event object to implement distinct logic for different operations (e.g., GET, POST, PUT, DELETE) on the same resource path. This approach significantly simplifies API Gateway configuration by eliminating the need for separate integration request mappings per method.
Why this answer
Lambda proxy integration (option A) is correct because it allows a single Lambda function to handle all HTTP methods (GET, POST, PUT, DELETE) for the same resource path without additional mapping configuration. In this integration type, API Gateway passes the entire client request (method, headers, query parameters, body) as a JSON event to the Lambda function, and the function must return a response in a specific format that includes status code, headers, and body. This eliminates the need for manual mapping templates or method-specific configurations.
Exam trap
The trap here is that candidates often confuse Lambda custom integration with Lambda proxy integration, thinking that custom integration provides more control, but they overlook that proxy integration is specifically designed to handle multiple HTTP methods without additional mapping configuration.
How to eliminate wrong answers
Option B (Lambda custom integration) is wrong because it requires explicit mapping templates to transform the client request into the Lambda function's input format and to transform the Lambda response back to the HTTP response, which adds configuration overhead and does not support handling all methods in a single function without additional mapping. Option C (AWS service integration) is wrong because it is designed to integrate API Gateway directly with other AWS services (e.g., DynamoDB, SQS) without invoking a Lambda function, and it does not support routing multiple HTTP methods to a single Lambda function. Option D (HTTP integration) is wrong because it is used to proxy requests to an external HTTP endpoint, not to a Lambda function, and it requires mapping templates or VPC link configurations, making it unsuitable for a serverless Lambda-based API.
A developer is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment must be as fast as possible while ensuring that at least 50% of instances remain healthy throughout. Which deployment configuration should be used?
The CodeDeployDefault.HalfAtATime configuration updates half of the instances in the Auto Scaling group at a time, ensuring that at least 50% of the instances remain healthy and available throughout the deployment process. This default strikes an optimal balance between deployment speed and application availability, making it a robust choice for production environments where some temporary capacity reduction is acceptable. It is significantly faster than `OneAtATime` while still providing strong resilience.
Why this answer
CodeDeployDefault.HalfAtATime is the correct choice because it deploys to half of the instances in the Auto Scaling group at a time, ensuring that at least 50% of instances remain healthy throughout the deployment. This configuration balances speed (by deploying to multiple instances concurrently) with the required availability constraint, making it the fastest option that satisfies the 'at least 50% healthy' requirement.
Exam trap
The trap here is that candidates may confuse 'HalfAtATime' with 'OneAtATime' thinking slower is safer, or incorrectly assume 'AllAtOnce' is fastest without considering the health constraint, or invent a configuration name like 'MinHealthyPercent' that does not exist in CodeDeploy.
How to eliminate wrong answers
Option A (CodeDeployDefault.OneAtATime) is wrong because it deploys to only one instance at a time, which is the slowest deployment configuration and does not meet the requirement for maximum speed. Option C (CodeDeployDefault.AllAtOnce) is wrong because it deploys to all instances simultaneously, which can cause all instances to become unhealthy at once, violating the 'at least 50% healthy' requirement. Option D (CodeDeployDefault.MinHealthyPercent) is wrong because it is not a valid deployment configuration name in CodeDeploy; the correct parameter is 'minimumHealthyHosts' which can be set to a percentage, but 'MinHealthyPercent' is not a predefined configuration.
A company wants to ensure that no Amazon S3 buckets in the AWS account can be made publicly accessible, even if a bucket policy or ACL is later configured to allow public access. Which AWS feature should the developer enable to enforce this at the account level?
S3 Block Public Access, when configured at the account level, provides a comprehensive safeguard against unintended public exposure of S3 buckets and objects. It enforces four distinct settings (BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, RestrictPublicBuckets) that collectively override any bucket policies, ACLs, or object configurations that might otherwise grant public access. This powerful feature ensures that no S3 bucket within the AWS account can be made public, regardless of individual bucket settings.
Why this answer
S3 Block Public Access is the correct choice because it provides account-level settings that override any bucket-level policies or ACLs that would grant public access. When enabled at the account level, these settings apply to all current and future S3 buckets, effectively preventing any bucket from becoming publicly accessible regardless of subsequent configuration changes.
Exam trap
The trap here is that candidates often choose a bucket policy with a Deny clause (Option D) thinking it can enforce account-wide restrictions, but they overlook that such policies are bucket-specific and can be removed or modified by users with appropriate IAM permissions, whereas S3 Block Public Access provides a centralized, immutable account-level control.
How to eliminate wrong answers
Option B is wrong because S3 Object Lock is designed to prevent objects from being deleted or overwritten for a fixed period, not to control public access permissions. Option C is wrong because S3 Transfer Acceleration is a feature that speeds up uploads over long distances using AWS edge locations, and it has no effect on access control or public accessibility. Option D is wrong because a bucket policy with a Deny clause is applied at the individual bucket level, not at the account level, and it can be overridden or removed by anyone with sufficient permissions; it does not provide the centralized, enforceable control that Block Public Access offers.
A company's S3 bucket policy includes a condition that uses 'aws:SourceIp' to restrict access to a specific IP range. However, requests from that IP range are still denied. What is a possible reason?
When requests to S3 originate from within a VPC and are routed through a VPC endpoint for S3, the 'aws:SourceIp' condition key in the S3 bucket policy evaluates the private IP address of the VPC endpoint, not the original client's public IP address. Consequently, if the bucket policy's allowed IP range does not include the VPC endpoint's private IP, the request will be denied. To correctly permit access from a VPC endpoint, the 'aws:SourceVpce' condition key, specifying the VPC endpoint ID, should be used instead.
Why this answer
When a request is made through a VPC endpoint (specifically a Gateway Endpoint for S3), the source IP address seen by S3 is the private IP of the VPC endpoint, not the client's original public IP. The 'aws:SourceIp' condition key evaluates the IP address from which the request originates at the network layer, but VPC endpoints use private IPs from the VPC CIDR range, which will not match the public IP range specified in the policy. This causes the condition to fail and the request to be denied, even though the client is within the intended IP range.
How to eliminate wrong answers
Option A is wrong because CloudFront does not change the source IP for S3 bucket policy evaluation; CloudFront uses its own IP addresses when forwarding requests to the origin, but the 'aws:SourceIp' condition in a bucket policy would see CloudFront's IP, not the client's IP, so this could also cause denial, but the question specifies the request is from the correct IP range and still denied, making VPC endpoint the more precise reason. Option B is wrong because IAM user policies do not override bucket policies; if both exist, the request must be allowed by at least one policy, but an explicit deny in the bucket policy would still block the request, and an IAM policy cannot override a bucket policy deny. Option D is wrong because if 'aws:SourceIp' were misspelled, the condition would be ignored (not evaluated), and the policy would likely allow the request (assuming other conditions are met), not deny it.
A company uses AWS KMS to encrypt data in Amazon S3. They have a Customer Master Key (CMK) with key rotation enabled. The S3 bucket has default encryption using SSE-KMS with this CMK. An application writes objects to the bucket. Which statement about the encryption is correct?
This statement accurately describes AWS KMS envelope encryption, which is the standard mechanism for encrypting data in Amazon S3 using KMS. The Customer Master Key (CMK) never directly encrypts the large object data; instead, it is used to generate and encrypt a unique data key. This data key then performs the actual encryption of the S3 object, and its encrypted form is securely stored alongside the object within its metadata, enabling decryption later.
Why this answer
AWS KMS uses envelope encryption: when an object is written to S3 with SSE-KMS, KMS generates a unique data key from the CMK, encrypts the object with that data key, and then stores the encrypted data key alongside the object in S3. The CMK itself never directly encrypts the object data; it only encrypts the data key. This ensures that the CMK can be rotated without affecting the encrypted objects, as the encrypted data key remains decryptable by the new key material if the key ID is the same.
Exam trap
The trap here is that candidates often confuse the role of the CMK and the data key, mistakenly thinking the CMK directly encrypts the object (Option B), or they assume key rotation triggers re-encryption of existing data (Option C), when in fact envelope encryption decouples the key rotation from the stored ciphertext.
How to eliminate wrong answers
Option B is wrong because the CMK never directly encrypts the object data; AWS KMS uses envelope encryption where the CMK encrypts a data key, and that data key encrypts the object. Option C is wrong because key rotation creates new backing key material for the CMK but does not re-encrypt existing objects; the old backing key remains available for decryption, and objects encrypted before rotation are not automatically re-encrypted. Option D is wrong because while each object is encrypted with a unique data key, that data key is not stored alongside the object in plaintext; it is stored encrypted under the CMK, and the statement omits the critical detail that the data key is encrypted.
A Lambda function receives events from EventBridge. The developer wants failed invocations to be retried and then stored for later analysis if retries are exhausted. Which configuration should be used?
Configuring an EventBridge retry policy ensures that events are re-attempted if the initial Lambda invocation fails, improving resilience. Pairing this with a dead-letter queue (DLQ) for the EventBridge target is crucial. If all retries are exhausted and the Lambda function still fails to process an event, EventBridge will send that event to the specified DLQ, preventing data loss and allowing for subsequent investigation and reprocessing of failed events.
Why this answer
EventBridge supports a configurable retry policy (with a maximum event age up to 24 hours and up to 185 retries by default) and can route events that exceed the retry limit to an Amazon SQS dead-letter queue (DLQ). This ensures failed invocations are retried automatically and, if all retries are exhausted, the event is stored durably in the DLQ for later analysis or reprocessing.
Exam trap
The trap here is that candidates may confuse the Lambda function's own DLQ configuration (which applies to synchronous and asynchronous invocations) with EventBridge's rule-level retry policy and DLQ, but EventBridge manages retries and DLQ delivery independently of the Lambda service's built-in retry mechanism.
How to eliminate wrong answers
Option A is wrong because API Gateway access logging captures HTTP request/response data for REST or HTTP APIs, not Lambda invocation failures from EventBridge, and it does not provide retry or dead-letter storage. Option C is wrong because setting reserved concurrency to zero would prevent the Lambda function from executing at all, causing every invocation to fail immediately without retries or storage. Option D is wrong because CloudFormation outputs are used to export stack resource information (e.g., ARNs, endpoints) for cross-stack references, not for storing event data or handling failed invocations.
A CloudFormation update may replace an RDS database. The developer wants to preview replacement risk before executing. What should be created?
A CloudFormation change set provides a comprehensive preview of the proposed modifications that CloudFormation will make to your stack's resources before you execute an update. It explicitly lists which resources will be added, modified, or replaced, including critical resources like an RDS database. This allows you to review the exact impact, such as a potential database replacement, and confirm it aligns with your intentions before applying the update to your infrastructure.
Why this answer
A change set in AWS CloudFormation allows you to preview how proposed changes to a stack will be executed, including whether any resources will be replaced (e.g., an RDS database). By reviewing the change set, you can see if the update will cause replacement (indicated by 'Replacement: True') before you actually apply the changes, enabling risk assessment without modification.
Exam trap
The trap here is that candidates confuse a stack policy (which controls update permissions) with a change set (which provides a preview of changes), or they think monitoring tools like CloudWatch can predict infrastructure changes.
How to eliminate wrong answers
Option A is wrong because a stack policy only protects specified resources from being updated or deleted during a stack update; it does not provide a preview of replacement risk. Option C is wrong because a nested stack output is used to return values from a nested stack to the parent stack, not to preview update impacts. Option D is wrong because a CloudWatch dashboard is a monitoring tool for metrics and logs, not a mechanism to preview CloudFormation stack update behavior.
A developer is deploying a microservices application on Amazon ECS using Fargate. The application uses an Application Load Balancer (ALB) to distribute traffic. The developer needs to perform a blue/green deployment with automatic rollback if health checks fail. What should the developer use?
AWS CodeDeploy, when configured for blue/green deployments with Amazon ECS, provides a robust and automated solution for deploying new application versions. It creates a new 'green' environment with the updated tasks alongside the existing 'blue' environment, allowing for thorough testing before traffic is shifted. CodeDeploy manages the traffic routing via a load balancer and can automatically roll back to the stable 'blue' version if deployment health checks fail, ensuring minimal downtime and risk.
Why this answer
AWS CodeDeploy natively supports blue/green deployments for Amazon ECS, allowing you to specify a blue/green configuration that automatically shifts traffic from the old (blue) task set to the new (green) task set. It integrates with the ALB to perform health checks and can automatically roll back the deployment if the health checks fail, meeting the requirement without manual intervention.
Exam trap
The trap here is that candidates often confuse ECS service auto scaling or CloudFormation updates with deployment strategies, but neither provides the built-in blue/green traffic shifting and automatic health-check-based rollback that CodeDeploy offers.
How to eliminate wrong answers
Option A is wrong because ECS service auto scaling adjusts the number of tasks based on load, not the deployment strategy; it does not perform blue/green deployments or automatic rollback on health check failures. Option B is wrong because manually updating the ECS service via the AWS Management Console does not provide a built-in blue/green deployment mechanism or automatic rollback; it would require manual monitoring and intervention. Option C is wrong because AWS CloudFormation can update an ECS service with a new task definition, but it does not natively support blue/green deployments or automatic rollback based on health checks; it would require custom logic or additional resources to achieve this.
A company uses AWS KMS to encrypt S3 objects. A developer needs to allow an IAM user to decrypt objects but not encrypt them. Which IAM policy action should be allowed?
The `kms:Decrypt` permission is essential for retrieving and accessing S3 objects that have been encrypted using AWS KMS. When an application attempts to download an S3 object encrypted with a KMS key, S3 internally requests the KMS service to decrypt the data key associated with that object. This action allows the S3 service, on behalf of the requesting principal, to decrypt the object's content and return it in plaintext.
Why this answer
The correct action is `kms:Decrypt` because the developer's requirement is to allow an IAM user to decrypt S3 objects but not encrypt them. AWS KMS uses separate permissions for encryption and decryption operations; `kms:Decrypt` specifically grants the ability to decrypt ciphertext without granting any encryption capabilities. By allowing only this action, the user can decrypt objects encrypted with the KMS key but cannot encrypt new data or perform any key management operations.
Exam trap
The trap here is that candidates often confuse `kms:Decrypt` with `kms:GenerateDataKey` or `kms:ReEncrypt`, mistakenly thinking those actions are required for decryption, when in fact they also enable encryption capabilities that violate the requirement.
How to eliminate wrong answers
Option B is wrong because `kms:GenerateDataKey` is used to generate a data key for client-side encryption, which involves creating both a plaintext key and an encrypted key; allowing this would enable the user to encrypt new data, violating the requirement to prevent encryption. Option C is wrong because `kms:Encrypt` directly allows the user to encrypt plaintext into ciphertext using the KMS key, which is explicitly prohibited. Option D is wrong because `kms:ReEncrypt` allows decrypting ciphertext and re-encrypting it under a different KMS key, which includes decryption capability but also introduces encryption operations, violating the restriction against encryption.
Refer to the exhibit. A developer is trying to deploy an EC2 instance using AWS CloudFormation. The stack creation fails with an 'AccessDenied' error when CloudFormation tries to create the EC2 instance. The developer has the IAM policy above. What is the MOST likely reason for the failure?
This is correct. When CloudFormation creates an EC2 instance with an IAM instance profile, the user or role making the API calls must have iam:PassRole permission with a Resource that explicitly includes the ARN of the role being passed. In this case, the template specifies one IAM role (via its instance profile), but the PassRole statement in the policy points to a different role ARN. Because the role ARN in the policy resource does not match the role ARN in the template, CloudFormation is denied the iam:PassRole action, which prevents the instance from launching even though all EC2 actions are allowed. To fix it, either change the template to use the role allowed by the PassRole policy or extend the policy's Resource to include the template's role ARN, using least privilege.
Why this answer
CloudFormation needs permission to pass the IAM role specified in the template. The policy allows PassRole only for a specific role ARN. If the template specifies a different role, CloudFormation cannot pass it, resulting in an AccessDenied error.
Option A is incorrect because ec2:DescribeImages is allowed in the policy. Option C is incorrect because ec2:RunInstances is allowed. Option D is incorrect because ec2:TerminateInstances is not called during stack creation, and the policy allows it anyway.
A developer is building a serverless application using AWS SAM. The application includes an Amazon API Gateway endpoint with a Lambda function that processes user uploads. The developer wants to enable API caching in the development stage to speed up repeated requests, but disable caching in the production stage. What is the most efficient way to achieve this?
This is the most robust and automated approach. The AWS::Serverless::Api resource in a SAM template can define Stage properties, including CacheClusterEnabled. By integrating a CloudFormation Condition that evaluates a StageName parameter, caching can be enabled specifically for the dev stage while remaining disabled for prod, all within a single, version-controlled template. This ensures consistent, environment-specific deployments via CI/CD pipelines.
Why this answer
AWS SAM extends AWS CloudFormation, allowing you to use CloudFormation conditions to conditionally enable the `CacheClusterEnabled` property on the `AWS::ApiGateway::Stage` resource. By defining a condition that evaluates to true only for the dev stage (e.g., based on a parameter like `StageName`), you can enable caching in dev and disable it in prod within a single SAM template, avoiding duplication and manual steps.
Exam trap
The trap here is that candidates may think caching must be configured per-deployment manually (Option C) or that separate templates are required (Option B), missing the power of CloudFormation conditions to conditionally enable features within a single SAM template.
How to eliminate wrong answers
Option B is wrong because creating two separate SAM templates introduces unnecessary duplication and maintenance overhead; the same effect can be achieved with a single template using CloudFormation conditions, which is more efficient. Option C is wrong because manually enabling caching in the API Gateway console after each deployment is error-prone, not repeatable, and violates infrastructure-as-code best practices; it also requires post-deployment steps that can be forgotten. Option D is wrong because using a custom CloudFormation resource to toggle caching is overly complex and introduces additional Lambda functions or custom logic when the native `CacheClusterEnabled` property combined with conditions already provides a straightforward, built-in solution.
A company wants to allow cross-account access to an S3 bucket in Account A from a role in Account B. The S3 bucket policy in Account A allows the role's ARN. However, access is denied. What is the most likely missing step?
For successful cross-account access, both the resource-based policy (S3 bucket policy) and the identity-based policy (IAM policy attached to the role in Account B) must explicitly grant the necessary permissions. While the bucket policy grants the Account B role permission to *assume* access to the bucket, the role itself must possess an IAM policy allowing it to perform specific S3 actions like `s3:GetObject` or `s3:PutObject`. This dual authorization model ensures granular control and adherence to the principle of least privilege.
Why this answer
Cross-account S3 access requires both a resource-based policy (the bucket policy in Account A) that grants access to the role ARN, and an identity-based policy (an IAM policy attached to the role in Account B) that explicitly allows the S3 actions. Without the IAM policy in Account B, the role lacks permission to perform the S3 operations, even though the bucket policy permits the access. This is a fundamental principle of AWS cross-account authorization: both the resource side and the principal side must grant the necessary permissions.
Exam trap
The trap here is that candidates often assume a bucket policy alone is sufficient for cross-account access, overlooking the requirement for an IAM policy on the requesting role to explicitly allow the S3 actions.
How to eliminate wrong answers
Option A is wrong because adding a bucket policy that denies access to all principals would explicitly block all access, including the intended cross-account access, making the problem worse. Option C is wrong because block public access settings are irrelevant to cross-account access via IAM roles; they only affect public access from the internet, not authenticated cross-account requests. Option D is wrong because enabling ACLs on the S3 bucket is not required for cross-account access; ACLs are a legacy access control mechanism and are not needed when using IAM policies and bucket policies, and they would not resolve the missing IAM policy issue.
A developer uses AWS SAM (Serverless Application Model) to define a serverless application. The developer wants to run the application locally for testing. Which AWS SAM CLI command should be used?
This command is specifically designed for local development and testing of serverless applications defined by AWS SAM. It emulates the API Gateway service on your local machine, creating HTTP endpoints that route requests to your Lambda functions running in a Docker container. This allows developers to test their API endpoints and Lambda logic without deploying to the AWS cloud, significantly accelerating the development cycle.
Why this answer
`sam local start-api` starts a local HTTP server that emulates the API Gateway endpoint and invokes your Lambda functions defined in the SAM template. This allows you to test API requests and responses locally without deploying to AWS, making it the appropriate command for local testing of a serverless application.
Exam trap
The trap here is that candidates confuse `sam build` or `sam package` as commands that also run the application locally, but these commands are solely for packaging and deployment preparation, not for local execution.
How to eliminate wrong answers
Option B is wrong because `sam build` is used to prepare the application for deployment by resolving dependencies and creating build artifacts, but it does not run the application locally. Option C is wrong because `sam deploy` deploys the application to the AWS cloud using CloudFormation, which is not a local testing command. Option D is wrong because `sam package` uploads the deployment artifacts to an S3 bucket and generates a packaged template, but it does not execute or test the application locally.
A developer uses AWS CodePipeline to deploy a serverless application defined with AWS SAM. The pipeline consists of Source (S3), Build (CodeBuild), and Deploy (CloudFormation) stages. The developer wants to run integration tests after the stack is deployed but before the pipeline completes. Which approach should the developer use?
AWS CodePipeline is designed for continuous delivery, allowing developers to define multiple stages, including a dedicated 'Test' stage. Within this stage, an 'Invoke' action can be configured to execute an AWS Lambda function. This Lambda function can then contain the logic to perform various integration or end-to-end tests against the newly deployed serverless application, ensuring automated validation post-deployment. This approach fully automates the testing process within the pipeline.
Why this answer
AWS CodePipeline allows you to add a test stage after the Deploy stage, and you can configure an action that invokes an AWS Lambda function to run integration tests. This ensures tests run automatically after the CloudFormation stack is deployed but before the pipeline completes, meeting the requirement without manual intervention.
Exam trap
The trap here is that candidates may confuse CloudFormation Outputs with event-driven triggers or assume SAM has built-in post-deployment hooks, when in fact CodePipeline's custom action with Lambda is the correct mechanism for running automated tests after deployment.
How to eliminate wrong answers
Option B is wrong because CloudFormation stack Outputs are used to export values for cross-stack references, not to trigger Lambda functions; triggering Lambda from CloudFormation requires custom resources or event subscriptions, not Outputs. Option C is wrong because AWS SAM does not support post-deployment hooks in the SAM template; SAM uses lifecycle hooks (e.g., PreTraffic, PostTraffic) only for Lambda canary deployments, not for general integration testing. Option D is wrong because a manual approval step requires human intervention to run tests, which contradicts the requirement to run tests automatically before the pipeline completes.
A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The application consists of an API Gateway, a Lambda function, and a DynamoDB table. The developer wants to enable canary deployments for the Lambda function. What should the developer do?
This is the correct and most efficient method for enabling canary deployments with SAM. The AutoPublishAlias property in a SAM Lambda function resource automatically creates a new Lambda version and an alias pointing to it upon deployment, facilitating robust version management. The DeploymentPreference property then configures the traffic shifting strategy, including options for canary or linear deployments, automated rollback alarms, and pre/post-traffic hooks, all orchestrated by AWS CodeDeploy under the hood, enabling fully automated canary deployments.
Why this answer
The AWS SAM template supports canary deployments for Lambda functions by adding the `AutoPublishAlias` property (which automatically creates and publishes a new version to a Lambda alias) and the `DeploymentPreference` property (which defines the traffic-shifting strategy, such as `Canary10Percent5Minutes`). This enables CodeDeploy to gradually shift traffic from the current version to the new version without manual intervention.
Exam trap
The trap here is that candidates may think they need to manually create a Lambda alias or use CodePipeline for canary deployments, when in fact SAM's `AutoPublishAlias` and `DeploymentPreference` properties automate the entire canary deployment workflow via CodeDeploy.
How to eliminate wrong answers
Option A is wrong because CodeDeploy deployment groups are not directly configured in a SAM template; SAM abstracts this by generating the necessary CodeDeploy resources automatically when you use `DeploymentPreference`. Option B is wrong because manually creating a Lambda alias and configuring traffic shifting defeats the purpose of using SAM's built-in canary deployment support, which automates the entire process and integrates with CodeDeploy. Option D is wrong because AWS CodePipeline can orchestrate the overall CI/CD pipeline but is not required for canary deployments; SAM's `DeploymentPreference` property alone enables canary deployments without needing CodePipeline.
A company is running a serverless application using AWS Lambda and Amazon API Gateway. The application experiences increased latency during peak hours. CloudWatch metrics show that Lambda function duration remains stable, but API Gateway latency spikes. Which THREE actions should the developer take to reduce API Gateway latency?
Enabling compression in API Gateway allows it to gzip response bodies when the client sends an Accept-Encoding: gzip header, shrinking the payload before transmission over the wire. Because the largest components of a JSON API response are often whitespace and repeated field names, gzip can reduce the transfer size by 70–80%, cutting network round-trip time significantly. This directly targets the latency component caused by response transfer time without altering Lambda execution or API Gateway routing.
Why this answer
Options B, D, and E are correct. Enabling compression reduces payload size, decreasing response time. API Gateway caching reduces backend calls by serving cached responses, lowering latency.
Switching to Regional endpoint reduces network latency by eliminating the global edge network hop. Option A is wrong because increasing Lambda timeout does not reduce API Gateway latency; it only allows functions to run longer. Option C is wrong because throttling limits cap request rates but do not reduce latency for individual requests.
An application running on Amazon ECS Fargate is experiencing intermittent connection timeouts when calling an external API. The task has a public IP and a security group that allows outbound HTTPS. What is the most likely cause?
ECS Fargate tasks deployed into a private subnet require a NAT Gateway to establish outbound connections to the internet. Private subnets are intentionally isolated from direct internet routing, meaning tasks within them cannot directly access external services or pull container images without an intermediary. A NAT Gateway, placed in a public subnet and configured with a route table entry for the private subnet, translates private IP addresses to its public IP, enabling secure and managed outbound internet access. This is the standard and necessary architecture for internet connectivity from private subnets.
Why this answer
ECS Fargate tasks running in a private subnet do not have direct internet access. Without a NAT gateway, outbound traffic to the external API is routed to the subnet’s route table, which lacks an internet gateway target, causing connection timeouts. The task’s public IP assignment is irrelevant in a private subnet, as the subnet itself has no route to the internet.
Exam trap
The trap here is that candidates assume a public IP on the task guarantees internet access, overlooking that the subnet’s route table determines whether traffic can reach the internet, and a private subnet without a NAT gateway blocks all outbound internet traffic regardless of the task’s public IP assignment.
How to eliminate wrong answers
Option A is wrong because the task already has a public IP assigned (as stated in the question), so the ECS service configuration for auto-assigning public IP is not the issue. Option B is wrong because inbound traffic rules are irrelevant for outbound HTTPS connections; the security group only needs to allow outbound traffic, which it does. Option C is wrong because the security group outbound rules are correctly configured to allow HTTPS (port 443), so misconfiguration is not the cause.
A developer is troubleshooting an AWS Lambda function that times out when processing large files from Amazon S3. The function has a 15-minute timeout and 512 MB memory. What should the developer do to resolve this issue?
Increasing the Lambda function memory to 3008 MB is a highly effective strategy for resolving timeout issues. In the AWS Lambda execution environment, the amount of allocated memory directly correlates with the proportional share of CPU power and network bandwidth provided to the function. By increasing memory, the function gains access to more computational resources, enabling it to process data faster, complete its tasks within the allowed timeout period, and improve overall performance for compute- or I/O-intensive workloads.
Why this answer
Increasing the Lambda function memory to 3008 MB is correct because Lambda allocates CPU proportionally to memory, and more CPU reduces processing time for CPU-bound tasks like file parsing. The 15-minute timeout is already the maximum, so the issue is insufficient compute resources, not timeout duration. With 512 MB, the function lacks the CPU throughput to process large files within the timeout, so boosting memory (and thus CPU) directly addresses the root cause.
Exam trap
The trap here is that candidates assume the 15-minute timeout is the problem and try to reduce it (Option C) or change invocation patterns (Option B), when the real issue is that Lambda's CPU allocation scales with memory, and insufficient memory leads to insufficient CPU for large file processing.
How to eliminate wrong answers
Option A is wrong because Amazon S3 Batch Operations are designed for bulk actions on existing objects (e.g., tagging, copying) and cannot split files before processing; splitting would require a separate preprocessing step, not a batch operation. Option B is wrong because adding an S3 Event Notification to trigger the function asynchronously does not change the function's execution environment or resource limits; it only changes invocation mode, and the function will still time out if it cannot process the file within the timeout. Option C is wrong because reducing the Lambda timeout to 5 minutes would make the problem worse—it would force the function to fail even faster, as it already times out at 15 minutes due to insufficient CPU.
A developer is building a serverless application that uses Amazon DynamoDB. The application needs to retrieve an item by its primary key frequently. Which DynamoDB API call should the developer use to achieve the lowest latency?
The GetItem operation is the most efficient and recommended method for retrieving a single item from a DynamoDB table. It directly accesses the item using its complete primary key (partition key, and sort key if applicable), resulting in minimal latency and consuming the fewest provisioned read capacity units (RCUs). This direct lookup mechanism makes it ideal for precise, single-item data retrieval.
Why this answer
The GetItem API call is the most efficient way to retrieve a single item by its primary key in DynamoDB, as it directly accesses the item using the hash key (and optionally the sort key) with consistent, single-digit millisecond latency. Unlike Scan or Query, GetItem does not need to evaluate any conditions or filter through other items, making it the lowest-latency option for this specific use case.
Exam trap
The trap here is that candidates often confuse Query with GetItem, assuming Query is always faster because it uses a key condition, but Query still requires evaluating the sort key and can return multiple items, whereas GetItem is the only API optimized for a single-item primary key lookup.
How to eliminate wrong answers
Option A is wrong because Scan reads every item in the table or index and then filters out the results, which incurs high latency and consumes significant read capacity, especially on large tables. Option B is wrong because Query retrieves all items with a given partition key value and can return multiple items, requiring additional processing and potentially higher latency than a direct key-based lookup. Option D is wrong because BatchGetItem is designed for retrieving multiple items in a single operation, but it adds overhead for batching and may return partial results, making it slower than GetItem for a single item retrieval.
A company has an S3 bucket that stores sensitive data. They want to ensure that any object uploaded to the bucket is automatically encrypted with server-side encryption using AWS KMS (SSE-KMS). They also want to deny any uploads that do not specify the correct encryption. Which bucket policy condition should be used to enforce this requirement?
This condition key directly inspects the `x-amz-server-side-encryption` request header, which clients must include to specify the desired server-side encryption method. By setting `aws:kms` as the required value, a bucket policy with a Deny effect ensures that any object uploaded to the S3 bucket *must* explicitly request Server-Side Encryption with AWS Key Management Service (SSE-KMS). This effectively enforces the use of KMS-managed keys for sensitive data at rest, preventing uploads that do not comply with this encryption standard.
Why this answer
The condition `s3:x-amz-server-side-encryption equals aws:kms` enforces that any PUT request to the S3 bucket must include the `x-amz-server-side-encryption` header set to `aws:kms`, which triggers SSE-KMS encryption. This policy condition ensures that objects uploaded without specifying SSE-KMS are denied, meeting the requirement to automatically encrypt all uploaded objects with AWS KMS.
Exam trap
The trap here is that candidates confuse the condition for specifying a particular KMS key ARN (Option C) with the condition for simply requiring SSE-KMS encryption, leading them to pick an overly restrictive policy that would break uploads using the default KMS key.
How to eliminate wrong answers
Option B is wrong because `AES256` corresponds to SSE-S3 (S3-managed keys), not SSE-KMS, so it would enforce the wrong encryption type. Option C is wrong because `s3:x-amz-server-side-encryption-aws-kms-key-id` enforces a specific KMS key ARN, but the question only requires SSE-KMS encryption, not a particular key; using this condition would be overly restrictive and could deny valid uploads using the default KMS key. Option D is wrong because `aws:SecureTransport` enforces HTTPS (TLS) for all requests, which is a transport-layer security requirement, not an encryption-at-rest requirement for object uploads.
A company's application runs on Amazon EC2 instances in an Auto Scaling group. The application experiences intermittent failures, and the developer suspects the application is not properly handling termination notifications. Which TWO steps should the developer take to diagnose the issue?
A CloudWatch Events (now Amazon EventBridge) rule can match Auto Scaling lifecycle events such as EC2 Instance-terminate or EC2 Instance Launch. When a termination event occurs, the rule can trigger a Lambda function, SNS topic, or SQS queue to log, alert, or execute remediation. This directly captures termination signals and is the appropriate fully managed way to react to Auto Scaling terminations without modifying the group's behavior.
Why this answer
Options B and D are correct. B: CloudWatch Events can capture termination events, which can be used to trigger notifications. D: Lifecycle hooks allow the instance to perform actions before termination.
Option A is wrong because detailed monitoring does not capture termination signals. Option C is wrong because CloudWatch Logs agent is for logs, not for termination notifications. Option E is wrong because replacing instances does not diagnose the issue.
A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment'. The deployment configuration is set to CodeDeployDefault.OneAtATime. What is the most likely cause of this failure?
CodeDeploy deployment configurations, such as `CodeDeployDefault.OneAtATime`, often specify a minimum healthy host threshold, which can be 100%. If a deployment fails on even a single instance due to issues like a failed lifecycle hook or an application startup problem, it immediately violates this strict healthy host requirement. This single failure is sufficient to cause the entire deployment to stop or roll back, triggering an error that indicates the minimum number of healthy hosts could not be maintained.
Why this answer
CodeDeployDefault.OneAtATime deploys to one instance at a time. The deployment stops immediately if a single instance fails, because the deployment configuration expects no failures. The error 'too many individual instances failed' is triggered by that single failure, since the deployment cannot proceed to the next instance without violating the minimum healthy hosts requirement, which is set to maintain availability.
Exam trap
The trap here is that candidates assume 'too many individual instances failed' means multiple instances failed independently, when in fact with OneAtATime a single instance failure is enough to fail the entire deployment because the minimum healthy hosts requirement is not maintained.
How to eliminate wrong answers
Option A is wrong because an unsupported operating system would cause a different error (e.g., 'Unsupported OS') and would affect all instances uniformly, not trigger a per-instance failure that cascades due to the OneAtATime configuration. Option B is wrong because changing to AllAtOnce would increase risk by deploying to all instances simultaneously, potentially causing a full outage; the error is not about the deployment speed but about the minimum healthy hosts requirement being violated. Option C is wrong because insufficient IAM permissions would typically result in an authorization error (e.g., 'AccessDenied') during the deployment setup or agent communication, not a per-instance failure that triggers the 'too many individual instances failed' message.
A company is using AWS CloudFormation to deploy infrastructure. The developer wants to create a custom resource that runs a Lambda function during stack creation and update. What must the developer do to ensure the custom resource works correctly?
When a CloudFormation custom resource invokes a Lambda function, CloudFormation provides a unique, time-limited S3 pre-signed URL within the event data. The Lambda function is absolutely required to send a JSON response to this specific URL, indicating the success or failure of the custom resource operation. This response mechanism allows CloudFormation to asynchronously track the status and retrieve any output attributes from the custom resource's execution, which is crucial for stack progression.
Why this answer
AWS CloudFormation custom resources require the Lambda function to send a response to an S3 pre-signed URL to signal completion. CloudFormation waits for this response to proceed with stack operations; without it, the stack creation or update will time out and fail.
Exam trap
The trap here is that candidates assume the Lambda function's return value is automatically captured by CloudFormation, but in reality, the function must explicitly send a response to the pre-signed URL to signal completion.
How to eliminate wrong answers
Option B is wrong because the Lambda function does not need to be defined in the same CloudFormation template; it can be referenced via an ARN from another stack or account. Option C is wrong because the Lambda function must send a response to the pre-signed URL using an HTTPS PUT request, not simply return a JSON object from the function invocation. Option D is wrong because the Lambda function can be written in any supported runtime (e.g., Node.js, Python, Java, Go), not exclusively Python.
A company uses AWS Elastic Beanstalk to run a web application. They want to deploy a new version with zero downtime and roll forward if successful. They have two environments: a production environment (current version) and a staging environment (new version). After verifying the staging environment, they want to swap the URLs so that production now points to the new version. Which deployment strategy should they use?
Blue/green deployment with environment CNAME swap is the most robust strategy for zero-downtime deployments and easy rollback. It involves creating a completely new, separate Elastic Beanstalk environment (the "green" environment) running the new application version, while the existing "blue" environment continues to serve traffic. After thorough testing of the green environment, the CNAME record of the load balancer is atomically swapped, redirecting all traffic to the new environment instantly. This approach ensures the new version is fully validated before going live and allows for immediate rollback by swapping the CNAME back.
Why this answer
Blue/green deployment with an environment CNAME swap allows you to run two separate Elastic Beanstalk environments (production and staging) simultaneously. After verifying the new version in the staging environment, you swap the CNAME records so that the production URL points to the staging environment, achieving zero downtime and a roll-forward strategy. This approach decouples the deployment from the existing environment, ensuring no disruption to live traffic during the swap.
Exam trap
The trap here is that candidates confuse immutable deployments (which also launch new instances) with blue/green deployments, but immutable deployments do not create a separate environment with its own URL for a CNAME swap, making them unsuitable for the described two-environment swap requirement.
How to eliminate wrong answers
Option B (All at once deployment) is wrong because it deploys the new version to all instances simultaneously, causing downtime during the deployment process and not allowing a roll-forward strategy with separate environments. Option C (Rolling deployment with additional batch) is wrong because it updates instances in batches while keeping the same environment, which can cause temporary capacity reduction and does not provide a separate staging environment for verification before swapping URLs. Option D (Immutable deployment) is wrong because it launches a new set of instances in the same environment and then swaps them in, but it does not create a separate environment with its own URL for a CNAME swap; it still operates within a single environment, making it unsuitable for the described two-environment swap scenario.
Amazon API Gateway's request validation feature allows developers to define a JSON schema for the request body, as well as specify required headers, query string parameters, and path parameters. This mechanism ensures that incoming requests conform to the API's expected structure and data types before they reach the backend integration. By rejecting malformed requests early, it enhances API security and reduces unnecessary processing by downstream services.
Why this answer
API Gateway's request validation feature allows you to define a JSON schema (using JSON Schema Draft 4) for the request body and automatically reject requests that do not conform before they reach the backend. This offloads validation from the Lambda function, reducing cold start overhead and ensuring only valid payloads are processed. The developer can configure this in the API Gateway console or via the OpenAPI specification.
Exam trap
The trap here is that candidates often confuse request validation with mapping templates, assuming that mapping templates can validate the request body, but mapping templates only transform data and do not enforce schema constraints.
How to eliminate wrong answers
Option B is wrong because mapping templates transform the request body or parameters into a different format (e.g., from JSON to XML) for the backend, but they do not perform schema-based validation. Option C is wrong because the integration request defines how API Gateway passes the request to the backend (e.g., HTTP method, headers, query strings) and can include mapping templates, but it does not natively validate the request body against a JSON schema. Option D is wrong because stage variables are key-value pairs used to configure deployment stages (e.g., Lambda function aliases, endpoint URLs) and have no role in request body validation.
A company uses AWS CodePipeline to deploy a static website to Amazon S3. The pipeline includes a deploy action that uses AWS CloudFormation to create the S3 bucket and upload files. The developer notices that the deploy action fails intermittently with a 'BucketAlreadyExists' error. What is the most likely cause?
S3 bucket names are globally unique across all AWS accounts and regions, acting as a universal namespace. Therefore, if any other AWS account, anywhere in the world, has already registered a bucket with the exact name specified in the CloudFormation template, the creation attempt will fail. The `BucketAlreadyExists` error precisely indicates this global naming conflict, preventing the new bucket from being provisioned.
Why this answer
The 'BucketAlreadyExists' error occurs when an S3 bucket name is globally unique across all AWS accounts. If the bucket name specified in the CloudFormation template has already been claimed by another AWS account, the deployment will fail intermittently if the bucket is deleted and recreated or if the pipeline runs in a different region where the name is taken. This is a common issue when using hardcoded or non-unique bucket names.
Exam trap
The trap here is that candidates often confuse 'BucketAlreadyExists' with permission or policy errors, but AWS specifically tests the global uniqueness constraint of S3 bucket names as a distinct failure mode in deployment pipelines.
How to eliminate wrong answers
Option A is wrong because enabling versioning on an S3 bucket does not cause a 'BucketAlreadyExists' error; versioning affects object version management, not bucket creation. Option B is wrong because incorrect IAM permissions would result in an 'AccessDenied' error, not a 'BucketAlreadyExists' error, as the CloudFormation service would fail to call the S3 CreateBucket API due to lack of authorization. Option D is wrong because a restrictive bucket policy would cause errors during object uploads or access, not during bucket creation; the 'BucketAlreadyExists' error occurs at the bucket creation step, before any policy is evaluated.
Drag and drop the steps to create a Lambda function that processes S3 events in the correct order.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
First set up permissions, then code, create function, configure trigger, and test.
A developer needs to grant an IAM role in Account B read-only access to objects in an S3 bucket in Account A. The bucket is encrypted with server-side encryption using AWS KMS (SSE-KMS) with a customer managed key (CMK) in Account A. Which combination of policies is required for the cross-account access to succeed?
All three policies are required: bucket policy and key policy in Account A grant the necessary permissions, and the IAM role in Account B must have the corresponding IAM policy to authorize the use of those grants.
Why this answer
Cross-account access to an SSE-KMS encrypted S3 bucket requires three layers of permissions: the bucket policy in Account A must grant s3:GetObject to the IAM role in Account B, the KMS key policy must grant kms:Decrypt to the same role, and the role's IAM policy in Account B must allow both s3:GetObject and kms:Decrypt. Without any one of these, the request will fail due to either an S3 authorization error or a KMS decryption failure.
Exam trap
The trap here is that candidates assume bucket and key policies alone are sufficient for cross-account access, forgetting that the requesting principal (the IAM role) must also have an IAM policy that explicitly allows the required actions.
How to eliminate wrong answers
Option B is wrong because SSE-KMS with a customer managed key (CMK) requires explicit kms:Decrypt permissions; AWS managed keys are not used here, and omitting KMS permissions will cause a 'KMS.AccessDeniedException' when the role tries to read encrypted objects. Option C is wrong because the role in Account B must have an IAM policy that allows s3:GetObject and kms:Decrypt; bucket and key policies alone cannot grant permissions to a principal in another account—the role's trust policy and IAM permissions are necessary to authorize the action. Option D is wrong because KMS is always involved when SSE-KMS is used; the bucket is encrypted with a CMK, not the default KMS key, and the role must have kms:Decrypt permissions to decrypt the objects.
An IAM policy is attached to an EC2 instance role. The instance is part of a CodeDeploy deployment group. The deployment fails because the CodeDeploy agent cannot download the revision. What is the most likely reason?
This policy statement correctly identifies a common issue: the CodeDeploy agent needs explicit `s3:GetObject` permissions for the *exact* S3 bucket and path where the application revision is stored. If the IAM policy only grants access to a generic bucket like 'my-bucket', but the actual deployment package resides in a different bucket, such as 'another-bucket', the agent will be unable to download the necessary files, causing the deployment to fail due to an access denied error.
Why this answer
The CodeDeploy agent on the EC2 instance downloads the application revision from an S3 bucket. For this to succeed, the IAM role attached to the instance must include an s3:GetObject permission on the specific bucket and object. Without it, the agent cannot retrieve the revision file, causing the deployment to fail.
Options A and B are irrelevant because the agent does not call CodeDeploy API actions like GetDeployment or CreateDeployment; those are used by the user or CI/CD pipeline initiating the deployment. Option C is incorrect because IAM policies for S3 actions do not require a region in the resource ARN.
Exam trap
The trap here is that candidates confuse the permissions needed by the CodeDeploy agent (S3 read access) with the permissions needed by the user or pipeline (CodeDeploy API actions), leading them to select a CodeDeploy action instead of the correct S3 action.
How to eliminate wrong answers
Option A is wrong because the CodeDeploy agent does not call the codedeploy:GetDeployment action; that action is used by the AWS CLI, SDK, or console to retrieve deployment details. Option B is wrong because the codedeploy:CreateDeployment action is performed by the user or automation tool initiating the deployment, not by the CodeDeploy agent on the instance. Option C is wrong because S3 is a global service and its resource ARNs do not include a region element; specifying a region in an S3 ARN would be syntactically invalid.
A company uses AWS CloudFormation to manage its infrastructure. The developer wants to update a stack but only if the update does not cause any resource replacement. Which CloudFormation stack update option should be used?
Creating a change set allows you to preview the exact modifications CloudFormation will perform on your stack before applying them. The change set details which resources will be added, modified, or, critically, replaced, along with the specific properties that trigger these actions. By reviewing this detailed summary, administrators can identify and adjust the template to avoid unintended resource replacements, ensuring a controlled and predictable update process.
Why this answer
A change set allows you to preview the changes that CloudFormation will make to your stack, including whether any resources will be replaced. By reviewing the change set, you can see if any resource replacement is listed and choose not to execute it if you want to avoid replacements. This gives you full control to update the stack only when no replacements are required.
Exam trap
The trap here is that candidates may confuse change sets with direct updates, thinking that direct updates also provide a preview, or they may invent fictional options like 'Force rollback' or 'Preserve stack settings' that sound plausible but are not part of the CloudFormation service.
How to eliminate wrong answers
Option A is wrong because the direct update option immediately applies the template changes without any preview, so you cannot know in advance whether resource replacement will occur. Option C is wrong because the 'Force rollback' option is not a standard CloudFormation feature; rollback is triggered automatically on update failure, not used to prevent replacement. Option D is wrong because there is no 'Preserve stack settings' option in CloudFormation; this is a fictional option that does not exist in the AWS API.
A developer is building a serverless application using AWS Lambda functions that need to read and write to an Amazon DynamoDB table. What is the best practice for granting the Lambda function access to DynamoDB?
The standard and most secure method for a Lambda function to interact with other AWS services, such as DynamoDB, is by assuming an IAM execution role. This role requires a trust policy allowing `lambda.amazonaws.com` to assume it, and an attached permissions policy explicitly granting the necessary DynamoDB actions. This mechanism provides temporary, scoped credentials, adhering to the principle of least privilege and ensuring secure access.
Why this answer
AWS Lambda functions require an IAM role (execution role) with a trust policy that allows Lambda to assume it, and a permissions policy that grants the necessary DynamoDB actions (e.g., GetItem, PutItem). This is the standard and secure method for granting permissions to Lambda, as it avoids hardcoding credentials and follows the principle of least privilege.
Exam trap
The trap here is that candidates confuse resource-based policies (used for Lambda function invocation permissions) with execution roles (used for granting the Lambda function access to other AWS services), leading them to incorrectly choose Option C.
How to eliminate wrong answers
Option B is wrong because storing IAM user access keys in Lambda environment variables is insecure and violates best practices; keys can be exposed in logs or through the console, and they do not automatically rotate. Option C is wrong because Lambda functions do not support resource-based policies for granting access to other AWS services like DynamoDB; resource-based policies are used for cross-account access to the Lambda function itself, not for the function to access external resources. Option D is wrong because a VPC role or VPC endpoint does not grant IAM permissions; VPC endpoints enable private network connectivity but do not replace the need for an IAM role with DynamoDB access policies.
A developer must locally test a SAM-based Lambda function with an API event before deployment. Which tool command family is designed for this?
The AWS SAM CLI `local invoke` and `local start-api` commands are specifically designed for testing serverless applications locally. `sam local invoke` allows developers to execute a single Lambda function with a provided event payload, simulating a direct invocation. `sam local start-api` launches a local HTTP server that emulates Amazon API Gateway, enabling testing of Lambda functions integrated with API Gateway by making actual HTTP requests to the local endpoint, providing a comprehensive local testing environment for SAM-based applications.
Why this answer
The AWS SAM CLI provides the `local invoke` and `local start-api` commands specifically for testing Lambda functions locally with simulated API Gateway events before deployment. `sam local start-api` creates a local HTTP server that mimics API Gateway, allowing developers to send requests to their Lambda functions as if they were deployed, while `sam local invoke` directly invokes the function with a specified event payload. This is the only tool family designed for local testing of SAM-based Lambda functions with API events.
Exam trap
The trap here is that candidates may confuse the AWS SAM CLI with other AWS CLI tools or services, mistakenly thinking that general-purpose CLI commands or unrelated security tools can perform local Lambda testing with API events.
How to eliminate wrong answers
Option B is wrong because AWS Shield Advanced CLI is a tool for managing DDoS protection services, not for testing Lambda functions or API events locally. Option C is wrong because AWS Organizations policy simulator is used to test IAM and SCP policies for multi-account environments, not for local Lambda or API Gateway testing. Option D is wrong because Amazon Inspector SBOM export is used to generate a software bill of materials for vulnerability assessment, not for testing Lambda functions or API events.
A company has an Amazon S3 bucket that stores sensitive documents. The security team wants to ensure that all GET requests to the bucket are authenticated and that the requester does not have public access. Which combination of S3 features should the developer implement?
This combination directly addresses the security of sensitive documents by preventing any public exposure. S3 Block Public Access is a critical account-level or bucket-level setting that overrides all other permissions, ensuring no object can be publicly accessed, regardless of bucket policies or ACLs. S3 Access Points, when configured with a network origin policy, allow granular control, restricting access to specific VPCs or IP ranges, further enhancing security by limiting the network attack surface while still enabling authenticated access for authorized users or applications within the defined network boundaries.
Why this answer
Blocking public access at the bucket level ensures that no anonymous or public requests can reach the bucket, while S3 Access Points with a network origin policy restrict access to requests originating from a specific VPC or on-premises network. This combination enforces that all GET requests must be authenticated (via the Access Point's IAM policies) and cannot come from public internet sources, meeting the security team's requirements.
Exam trap
The trap here is that candidates often confuse MFA Delete or encryption with authentication controls, not realizing that only explicit public access blocking combined with network-level restrictions (like Access Points) can prevent unauthenticated GET requests.
How to eliminate wrong answers
Option B is wrong because S3 Object Lock and versioning prevent object deletion or overwrite and maintain object history, but they do not control authentication or public access for GET requests. Option C is wrong because S3 Transfer Acceleration speeds up uploads over long distances and server-side encryption protects data at rest, neither of which authenticates requests or blocks public access. Option D is wrong because a bucket policy allowing only specific IAM users can restrict access, but MFA Delete only adds multi-factor authentication to delete operations, not to GET requests, and this combination does not inherently block public access from unauthenticated sources.
In a Lambda proxy integration, API Gateway expects the Lambda function's response to adhere to a specific JSON structure, including `statusCode`, `headers`, and a `body` field (which must be a string). If the Lambda function returns a response that deviates from this required format—for example, missing the `statusCode` or `body` fields, or if the `body` is not a string—API Gateway cannot properly parse it. Consequently, API Gateway will fail to construct a valid HTTP response for the client and will return a 500 Internal Server Error.
Why this answer
Lambda proxy integration requires the response to be in a specific JSON format: `{"statusCode": ..., "headers": ..., "body": ...}`. If the Lambda function returns a plain string or an object missing these keys, API Gateway cannot map it to an HTTP response, resulting in a 502 Internal Server Error. The successful business operation in logs confirms the Lambda code ran correctly, but the malformed response format causes the gateway error.
Exam trap
The trap here is that candidates see 'successful business operation' in logs and assume the Lambda is fine, overlooking that API Gateway proxy integration enforces a strict response contract, not just any valid return value.
How to eliminate wrong answers
Option A is wrong because a missing `dynamodb:PutItem` permission would cause a 403 Forbidden or 500 error from Lambda, not a 502, and the logs would show an access denied exception, not a successful operation. Option C is wrong because API cache TTL affects cached responses and latency, not the response format or 502 errors; a short TTL would cause more frequent cache misses, not gateway errors. Option D is wrong because enabling X-Ray tracing adds tracing headers and logs but does not alter the response format or cause 502 errors; it is purely a monitoring feature.
A developer needs to store configuration parameters securely for a Lambda function. The parameters include database credentials and API keys. Which AWS service should be used?
Secrets Manager is purpose-built for storing and rotating secrets securely.
Why this answer
AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, rotating, and managing sensitive configuration parameters such as database credentials and API keys throughout their lifecycle. It offers automatic rotation of secrets with built-in integration for Amazon RDS, Redshift, and DocumentDB, and enforces fine-grained access control via IAM policies. This makes it the most suitable service for the developer's requirement of securely storing and managing database credentials and API keys for a Lambda function.
Exam trap
The trap here is that candidates often confuse AWS Systems Manager Parameter Store (Option A) with Secrets Manager because both can store strings, but Parameter Store lacks automatic rotation and secret-specific lifecycle management, making it unsuitable for credentials that require regular rotation as per security best practices.
How to eliminate wrong answers
Option A is wrong because AWS Systems Manager Parameter Store is a general-purpose parameter store for configuration data like instance IDs or AMI IDs, but it lacks native automatic rotation of secrets and does not provide the same level of secret-specific features (e.g., cross-account access, versioning with staging labels) that Secrets Manager offers for sensitive credentials. Option C is wrong because Amazon DynamoDB with encryption is a NoSQL database service designed for storing application data, not for managing secrets; it requires custom code to handle secret rotation, access auditing, and lifecycle management, adding unnecessary complexity and security risk. Option D is wrong because Amazon S3 with server-side encryption is an object storage service that can store encrypted files, but it does not provide native secret rotation, automatic credential generation, or integration with AWS services like RDS for password management, making it a poor fit for dynamic secrets like database credentials and API keys.
A company is using AWS CodePipeline to automate their CI/CD pipeline. The pipeline includes a stage that runs a set of integration tests using AWS CodeBuild. The tests require access to a database running on a private subnet in a VPC. The CodeBuild project is configured to use a managed compute image. How can the CodeBuild project access the database?
Configuring the CodeBuild project to use a custom VPC with the appropriate subnet and security group is the correct solution. This allows CodeBuild to launch its build environments directly within your specified Amazon VPC, enabling it to access private resources like an Amazon RDS database using their private IP addresses. By placing the CodeBuild environment in a private subnet and associating it with a security group that permits outbound traffic to the database's security group, secure and private network communication is established.
Why this answer
CodeBuild projects using managed compute images run in an AWS-managed VPC by default, which cannot access resources in a customer VPC. By configuring the CodeBuild project to use a custom VPC with the appropriate subnet and security group, the build environment is launched directly into that VPC, enabling it to reach the database on the private subnet without needing a NAT gateway or internet access.
Exam trap
The trap here is that candidates assume a NAT gateway or VPC peering is required to bridge network boundaries, but they overlook that CodeBuild's default environment is isolated from the customer VPC, and the correct solution is to launch the build directly into the customer VPC using a custom VPC configuration.
How to eliminate wrong answers
Option A is wrong because placing a CodeBuild project in a public subnet is not a valid configuration; CodeBuild projects are not assigned to subnets directly—they run in an AWS-managed environment unless a custom VPC is specified, and using a NAT gateway would not grant access to a private subnet from the managed VPC. Option C is wrong because VPC peering connects two VPCs, but the CodeBuild project's default environment is not in a customer VPC, so there is no VPC to peer with; even if a custom VPC were used, peering would be unnecessary since the database is already in the same VPC. Option D is wrong because VPC endpoints are used to privately connect to AWS services (e.g., S3, DynamoDB) via the AWS network, not to access a customer-managed database running on an EC2 instance or RDS in a private subnet.
A company is using AWS KMS to encrypt sensitive data stored in S3. The security team wants to ensure that only a specific IAM role can decrypt the data. What is the most secure way to achieve this?
A KMS key policy is the primary authorization mechanism for a Customer Managed Key (CMK), explicitly defining which IAM principals can perform cryptographic operations. Granting the `kms:Decrypt` permission to a specific role within the key policy directly enables that role to decrypt data encrypted by the CMK. This direct control over key usage is fundamental for fine-grained access management, ensuring only authorized entities can access sensitive data.
Why this answer
KMS key policies are the most direct and secure way to control who can perform cryptographic operations like kms:Decrypt on a specific CMK. By granting only the specific IAM role the kms:Decrypt permission in the key policy, you ensure that no other principal (including the root user or other roles) can decrypt the data, even if they have S3 access. This follows the principle of least privilege and decouples data access from infrastructure access.
Exam trap
The trap here is that candidates often confuse S3 bucket policies with KMS key policies, assuming that restricting S3 access is sufficient to prevent decryption, when in fact the KMS key policy is the only way to enforce decryption restrictions at the cryptographic level.
How to eliminate wrong answers
Option A is wrong because SSE-S3 uses S3-managed keys, which do not allow you to restrict decryption to a specific IAM role; any principal with S3 GetObject permission can decrypt the data. Option C is wrong because automatic key rotation only changes the backing key material over time for security hygiene, but does not restrict who can decrypt; it does not address access control. Option D is wrong because an S3 bucket policy can control access to the S3 object itself, but it cannot prevent decryption of the underlying KMS-encrypted data if the caller has both S3 GetObject and KMS Decrypt permissions; the KMS key policy is the authoritative control for decryption.
A development team is using AWS Elastic Beanstalk to deploy a web application. The team wants to perform a blue/green deployment. Which THREE steps are required to complete the blue/green deployment?
Elastic Beanstalk assigns each environment a CNAME (e.g., myapp-env.eba-123.us-east-1.elasticbeanstalk.com), and the 'Swap environment CNAMEs' action atomically exchanges the DNS names of the blue and green environments. This makes the new environment assume the old environment's URL, instantly redirecting all traffic to the green stack with zero downtime. It is the core traffic-shifting mechanism for blue/green on Elastic Beanstalk, and you can roll back by swapping the CNAMEs again.
Why this answer
In a blue/green deployment with Elastic Beanstalk, you first deploy the new application version to a separate environment (E). Then, you swap the CNAMEs of the two environments to route traffic to the new environment (B). After verifying the new environment works correctly, you terminate the old environment (C).
Option A is incorrect because you do not update the existing environment; you create a new one. Option D is incorrect because you swap CNAMEs, not manually update Route 53 DNS records.
A developer needs to securely store database credentials for a Lambda function. The credentials must be automatically rotated every 30 days. Which service should be used?
AWS Secrets Manager is purpose-built for securely storing, managing, and retrieving sensitive information such as database credentials, API keys, and other secrets. Its primary advantage for database credentials is the automatic rotation capability, which integrates directly with various AWS services and databases to periodically change credentials without requiring application downtime. This service also provides fine-grained access control, auditing, and automatic encryption of stored secrets, making it the ideal solution for this requirement.
Why this answer
AWS Secrets Manager is the correct choice because it is specifically designed to securely store, manage, and automatically rotate database credentials and other secrets. It supports built-in rotation with AWS Lambda, allowing you to set a rotation schedule (e.g., every 30 days) without custom infrastructure. This service integrates directly with Amazon RDS, Redshift, and DocumentDB for seamless credential rotation.
Exam trap
The trap here is that candidates often confuse AWS Systems Manager Parameter Store (which can store secrets with encryption) with AWS Secrets Manager, but Parameter Store lacks native automatic rotation, making it unsuitable for the 30-day rotation requirement.
How to eliminate wrong answers
Option A is wrong because AWS KMS is a key management service for creating and controlling encryption keys, not for storing or rotating secrets like database credentials. Option C is wrong because AWS Systems Manager Parameter Store can store secrets but does not natively support automatic rotation of credentials; it requires custom Lambda functions and manual setup for rotation. Option D is wrong because AWS CloudHSM provides dedicated hardware security modules for cryptographic operations, not a service for storing or rotating application secrets.
A developer is troubleshooting an AWS Lambda function that processes records from an Amazon Kinesis Data Stream. The function is configured with a batch size of 100 and a parallelization factor of 1. The developer notices that the function is processing records slowly, and the iterator age is increasing. CloudWatch Logs show that the function is not experiencing errors or throttling, but the execution time per invocation is close to the 5-minute timeout. The stream has 10 shards. What is the most cost-effective way to increase processing throughput?
The parallelization factor determines the number of concurrent Lambda invocations per shard. Increasing it allows multiple invocations to process records from the same shard simultaneously, dramatically increasing throughput without additional shard costs.
Why this answer
Increasing the parallelization factor to 10 allows each shard to be processed by up to 10 concurrent Lambda invocations, which directly increases throughput without additional shard costs. Since the function is not throttled or erroring, the bottleneck is the per-invocation processing time; parallelization reduces the iterator age by processing multiple batches per shard simultaneously.
Exam trap
The trap here is that candidates often assume increasing shards is the only way to scale Kinesis processing, but the parallelization factor is a cost-effective Lambda-specific tuning knob that increases concurrency without additional shard costs.
How to eliminate wrong answers
Option A is wrong because the batch size is already 100, and increasing it to 1000 would likely cause the function to exceed the 5-minute timeout even more, as it would need to process more records per invocation, worsening the iterator age. Option C is wrong because increasing memory may reduce execution time for CPU-bound tasks, but the logs show the function is close to timeout, not CPU-bound, and memory increases cost without guaranteed throughput improvement for I/O-bound Kinesis processing. Option D is wrong because splitting the stream into more shards increases AWS costs and complexity, and the existing 10 shards are not fully utilized due to the parallelization factor of 1; adding shards does not address the per-shard concurrency bottleneck.
A company requires that all objects uploaded to an Amazon S3 bucket are encrypted at rest using server-side encryption with Amazon S3 managed keys (SSE-S3). The developer wants to enforce this with a bucket policy. Which condition key and value should be used in the policy to deny uploads that do not meet this requirement?
This condition key, "s3:x-amz-server-side-encryption", directly evaluates the "x-amz-server-side-encryption" header included in an S3 PUT request. Specifying "AES256" mandates the use of Server-Side Encryption with Amazon S3-managed keys (SSE-S3), ensuring that S3 automatically encrypts objects using the AES-256 algorithm before storing them. This is the precise and correct method within a bucket policy to enforce encryption at rest for all uploaded objects without requiring AWS KMS.
Why this answer
The condition key `s3:x-amz-server-side-encryption` with value `AES256` directly checks that the request header `x-amz-server-side-encryption` is set to `AES256`, which is the required value for SSE-S3. By using this condition in a bucket policy with a Deny effect, any upload that does not include this header or includes a different value (e.g., `aws:kms`) will be rejected, enforcing server-side encryption with Amazon S3 managed keys.
Exam trap
The trap here is that candidates often confuse the condition key for SSE-S3 (`s3:x-amz-server-side-encryption` with value `AES256`) with the condition key for SSE-KMS (`s3:x-amz-server-side-encryption-aws-kms-key-id`), or mistakenly think `aws:SecureTransport` enforces encryption at rest instead of in transit.
How to eliminate wrong answers
Option B is wrong because `s3:x-amz-server-side-encryption-aws-kms-key-id` is used to enforce a specific KMS key ID for SSE-KMS, not for SSE-S3; using `alias/aws/s3` would require SSE-KMS, not SSE-S3. Option C is wrong because `aws:SecureTransport` checks whether the request uses HTTPS (TLS), which enforces encryption in transit, not encryption at rest. Option D is wrong because `s3:object-lock-mode` is used to enforce S3 Object Lock governance mode, which prevents object deletion or overwrite, and has nothing to do with encryption at rest.
A developer is using Amazon DynamoDB for a new application. The developer wants to reduce read latency. Which design pattern should the developer use?
DynamoDB Accelerator (DAX) is a fully managed, in-memory cache specifically designed to sit in front of DynamoDB tables, providing microsecond read latency for frequently accessed items. By caching read-heavy workloads, DAX significantly reduces the response time for repeated requests, offloading the DynamoDB table and improving application performance for read-intensive operations.
Why this answer
DynamoDB Accelerator (DAX) is an in-memory cache designed specifically for DynamoDB, providing microsecond read latency for frequently accessed items. By caching read-heavy workloads, DAX offloads requests from the DynamoDB table, reducing read latency without requiring application-level caching logic. This directly addresses the developer's goal of reducing read latency.
Exam trap
The trap here is that candidates often confuse increasing provisioned capacity (Option B) with reducing latency, when in fact it only increases throughput, while DAX (Option D) directly addresses latency by caching reads in memory.
How to eliminate wrong answers
Option A is wrong because a Global Secondary Index (GSI) provides an alternative query pattern or sort key, but does not inherently reduce read latency; it may even add latency due to asynchronous replication. Option B is wrong because increasing provisioned read capacity units (RCUs) improves throughput (handling more requests per second) but does not reduce per-request latency, as DynamoDB's read latency is already low and consistent regardless of RCU level. Option C is wrong because DynamoDB Global Tables replicate data across regions for disaster recovery and low-latency reads in remote regions, but for a single-region application, it adds complexity and cost without reducing local read latency.
A company is running a monolithic application on an EC2 instance. The application currently stores session state in local memory on the instance. The company plans to scale the application horizontally by adding more instances behind a load balancer. What change is required to ensure that session state is preserved across requests?
Amazon ElastiCache provides a highly performant, in-memory data store, making it an ideal solution for externalizing session state. By storing session data in ElastiCache (e.g., Redis or Memcached), all EC2 instances can access a centralized, low-latency session store, enabling seamless horizontal scaling and high availability. This approach ensures that user sessions persist even if individual application instances are added, removed, or fail, promoting a truly stateless application design.
Why this answer
Amazon ElastiCache provides a managed, in-memory caching service (e.g., Redis or Memcached) that can store session state externally. By moving session data out of the EC2 instance's local memory and into a shared, low-latency data store, all instances behind the load balancer can access the same session state, ensuring persistence across requests regardless of which instance handles the request.
Exam trap
The trap here is that candidates often choose Option D (RDS) because they think a database is the only reliable external store, overlooking that ElastiCache is purpose-built for high-speed, ephemeral data like session state, while RDS introduces unnecessary latency and overhead for this use case.
How to eliminate wrong answers
Option A is wrong because Amazon S3 is an object storage service with high latency per request (typically 100-200 ms) and is not designed for frequent, sub-millisecond read/write operations required for session state; it would introduce unacceptable performance degradation. Option B is wrong because increasing the EC2 instance size only addresses vertical scaling (more sessions per instance) but does not solve the fundamental problem of session state being lost when a request is routed to a different instance in a horizontally scaled environment. Option D is wrong because Amazon RDS is a relational database with higher latency and connection overhead compared to in-memory caches; while it could technically store session state, it is not optimized for the high-throughput, low-latency access patterns of session management and would introduce unnecessary cost and complexity.
A company is deploying a Node.js application on AWS Elastic Beanstalk. The application uses environment variables for configuration. The development team wants to ensure that the environment variables are not exposed in the source code or in the deployment logs. Which TWO actions should the team take? (Choose TWO.)
Storing sensitive values in AWS Systems Manager Parameter Store as SecureString parameters encrypts them with a KMS key and keeps them out of both source code and Elastic Beanstalk environment properties. The Node.js application fetches each secret at runtime using the SSM GetParameter API, which is authorized via IAM roles attached to the Elastic Beanstalk instance profile. This approach supports per-environment separation, parameter versioning, and the ability to update credentials without redeploying or changing the environment configuration.
Why this answer
Options C and D are correct. Storing environment variables in AWS Systems Manager Parameter Store (C) or AWS Secrets Manager (D) prevents exposure in source code or logs, as they are retrieved at runtime via SDK calls. Option A (detailed logging) does not prevent exposure; it may actually log the values.
Option B (Elastic Beanstalk environment properties) stores values in plaintext in the environment configuration, which can be viewed. Option E (embedding in .env file) exposes them in the source code and deployment artifacts.
A developer is using AWS CodePipeline with multiple actions in a stage. The pipeline has a build action that produces artifacts, followed by a deploy action. The developer wants to ensure that if the deploy action fails, the pipeline stops and does not continue to the next stage. How can they achieve this?
AWS CodePipeline is designed to inherently stop the entire pipeline execution immediately upon the failure of any action within any stage. This default behavior is crucial for maintaining the integrity of the CI/CD process, preventing the deployment of potentially faulty code or artifacts to subsequent environments. No explicit configuration is required to enable this safety mechanism, as it is a fundamental aspect of CodePipeline's operational design.
Why this answer
AWS CodePipeline stages are sequential by default: if any action within a stage fails, the entire stage fails and the pipeline stops, preventing execution of subsequent stages. No additional configuration is needed to halt the pipeline on a deploy action failure, as this is the inherent behavior of a pipeline stage with multiple actions.
Exam trap
The trap here is that candidates may overthink and assume they need to configure a special failure behavior, when in fact the default sequential pipeline execution already stops on any action failure.
How to eliminate wrong answers
Option A is wrong because CodePipeline does not support an 'Abort' action configuration; the only failure behaviors are 'Fail' (default) and 'Succeed' (to ignore the failure). Option B is wrong because 'runOrder' controls the execution order of actions within a stage, not a blocking mechanism on failure; setting it to 'Blocked' is not a valid value. Option D is wrong because setting the execution mode to 'PARALLEL' would cause actions in the stage to run concurrently, which does not affect the pipeline's stopping behavior on failure and could even allow other actions to continue after a failure.
A developer is deploying a serverless application using AWS CloudFormation. The stack creation fails with the error 'CREATE_FAILED: The following resource(s) failed to create: [MyLambdaFunction]'. The developer checks the CloudFormation events and sees 'Resource creation cancelled'. What is the most likely cause?
When deploying resources using AWS CloudFormation, the deployment process is atomic. If any single resource within a CloudFormation stack fails to create, update, or delete, CloudFormation initiates an automatic rollback of the entire stack to its last stable state. In this scenario, if the Lambda function was pending creation or in the process of being created when another resource in the same stack encountered a failure, its creation would be explicitly cancelled as part of this rollback mechanism, resulting in the 'Resource creation cancelled' status.
Why this answer
The error 'Resource creation cancelled' indicates that the creation of the Lambda function was aborted because another resource in the stack failed. CloudFormation by default rolls back the stack on failure, cancelling any in-progress resource creations. Thus, option C is correct.
Option A is incorrect because large code would cause a different error (e.g., 'RequestEntityTooLargeException'). Option B is incorrect because a timeout would show 'CREATE_FAILED' with a timeout message, not 'cancelled'. Option D is incorrect because missing permissions would result in a different error (e.g., 'AccessDeniedException') during invocation, not creation.
A developer is deploying a static website to Amazon S3 and wants to use Amazon CloudFront for content delivery. The developer wants to ensure that only CloudFront can access the S3 bucket. Which S3 bucket policy should the developer use?
Granting CloudFront access through an Origin Access Identity (OAI) is the recommended and most secure method. An OAI is a special CloudFront user that you associate with your distribution, and then you modify the S3 bucket policy to explicitly grant read permissions only to this specific OAI. This ensures that content can only be accessed through your CloudFront distribution, preventing direct public access to the S3 bucket and securing your origin.
Why this answer
An Origin Access Identity (OAI) is a special CloudFront user that you can associate with your distribution. By configuring the S3 bucket policy to grant access only to that OAI, you ensure that direct S3 requests are denied, and only requests routed through CloudFront can retrieve objects. This provides a secure, private origin without exposing the bucket publicly.
Exam trap
The trap here is that candidates often choose IP-based restrictions (Option C) or Referer header checks (Option A) because they seem simpler, but AWS explicitly recommends OAI for secure S3 origin access in CloudFront, and the exam tests this best practice.
How to eliminate wrong answers
Option A is wrong because the Referer header can be easily spoofed by clients, so it does not provide a reliable security mechanism to restrict access exclusively to CloudFront. Option B is wrong because making the bucket public defeats the purpose of restricting access to CloudFront only, and anyone with the S3 URL can bypass CloudFront entirely. Option C is wrong because CloudFront IP address ranges are shared with other AWS services and can change without notice, making this approach both insecure and difficult to maintain; it also does not prevent direct access from other sources within the same IP range.
A developer needs to grant an IAM user access to list objects in an S3 bucket named 'app-data'. Which IAM policy statement should be used?
This policy correctly grants the `s3:ListBucket` action, which is specifically used to retrieve a list of objects and common prefixes within a designated S3 bucket. The resource ARN `arn:aws:s3:::app-data` precisely targets the `app-data` bucket, ensuring the user can list its contents without gaining broader, unnecessary permissions. This aligns perfectly with the principle of least privilege for the stated requirement.
Why this answer
The s3:ListBucket action is required to list the objects in an S3 bucket, and the resource ARN must specify the bucket itself (arn:aws:s3:::app-data) without a trailing /*. This grants permission to list the contents of the 'app-data' bucket, which is the exact requirement.
Exam trap
The trap here is that candidates often confuse s3:ListBucket (bucket-level action) with s3:GetObject (object-level action) or incorrectly apply the resource ARN with a trailing '/*' for bucket-level permissions.
How to eliminate wrong answers
Option A is wrong because it grants full administrative access to all S3 actions on all resources, which violates the principle of least privilege and is overly permissive for the specific task of listing objects. Option B is wrong because s3:ListAllMyBuckets lists all buckets in the account, not the objects within a specific bucket, and the resource '*' does not restrict to 'app-data'. Option D is wrong because s3:GetObject is used to retrieve an object's data, not to list objects; additionally, the resource ARN includes a trailing '/*' which refers to objects within the bucket, not the bucket itself.
A developer is storing an API secret for a third-party service in AWS Secrets Manager. The secret needs to be accessed by an AWS Lambda function that runs in a VPC. The Lambda function must have the minimum required permissions. Which IAM policy statement should the developer attach to the Lambda execution role?
This policy correctly implements the principle of least privilege by granting access only to the specific secret identified by its Amazon Resource Name (ARN). Furthermore, the `aws:SourceVpce` condition key ensures that requests to retrieve the secret value must originate from the specified VPC endpoint, providing a critical layer of network-level security. This prevents unauthorized access attempts from outside the designated private network path, enhancing the overall security posture for confidential data.
Why this answer
It grants the minimum required permission (secretsmanager:GetSecretValue) scoped to the specific secret ARN, and uses the aws:SourceVpce condition key to restrict access to the VPC endpoint used by the Lambda function. This ensures that only requests originating from the specified VPC endpoint can retrieve the secret, aligning with the principle of least privilege and the requirement that the Lambda function runs in a VPC.
Exam trap
The trap here is that candidates often confuse aws:SourceIp with VPC-based access control, not realizing that Lambda functions in a VPC use private IPs and require VPC endpoint conditions (aws:SourceVpce or aws:SourceVpc) instead of IP-based conditions.
How to eliminate wrong answers
Option B is wrong because it grants secretsmanager:GetSecretValue for all secrets in the account, which violates the principle of least privilege by allowing access to secrets beyond the intended one. Option C is wrong because aws:SourceIp is not effective for Lambda functions in a VPC, as they use private IP addresses from the VPC subnet, and the condition would not match the source IP seen by Secrets Manager (which is the VPC endpoint's private IP). Option D is wrong because ec2:Vpc is not a valid condition key for Secrets Manager; the correct condition key for VPC endpoint restrictions is aws:SourceVpce, not ec2:Vpc.
A developer is debugging an AWS Lambda function that processes messages from an Amazon SQS queue. The function is failing with an error when processing certain messages. The developer wants to isolate the failed messages for later analysis without losing them. What should the developer do?
Configuring a dead-letter queue (DLQ) for the SQS queue is the standard and most robust solution for handling message processing failures. When a Lambda function fails to process a message a specified number of times (defined by the maxReceiveCount on the redrive policy), SQS automatically moves that message to the DLQ. This isolates problematic messages for later inspection and debugging, prevents them from continuously blocking the main queue, and ensures no data is lost, allowing developers to analyze and re-process them.
Why this answer
Configuring a dead-letter queue (DLQ) for the SQS queue is the correct approach because it automatically captures messages that cannot be processed successfully after a specified number of retries (the redrive policy). This isolates the failed messages for later analysis without losing them, while allowing the function to continue processing other messages from the source queue.
Exam trap
The trap here is that candidates may think logging and deleting the message (Option B) is sufficient for debugging, but this permanently loses the message payload, whereas a DLQ preserves the message for later analysis without manual intervention.
How to eliminate wrong answers
Option A is wrong because publishing failed messages to an SNS topic would require custom code and does not provide automatic retry management or isolation; SNS is a pub/sub service, not a message retention mechanism for failed SQS messages. Option B is wrong because logging the error and deleting the message discards the message permanently, preventing later analysis of the failed message content. Option C is wrong because increasing the visibility timeout only delays when the message becomes visible again for reprocessing; it does not isolate the message or prevent it from being retried indefinitely, and it does not preserve the message for later analysis.
A company is using AWS CodePipeline to automate its CI/CD pipeline. The pipeline has a source stage that uses Amazon S3. The developer updates a file in the S3 bucket, but the pipeline does not start automatically. What is the MOST likely cause?
Amazon S3 versioning is a mandatory prerequisite for CodePipeline source actions that monitor an S3 bucket for changes. CodePipeline relies on S3 event notifications, specifically s3:ObjectCreated:* events, to detect new or updated artifacts. Without versioning enabled on the S3 bucket, these critical event notifications may not be reliably generated or processed by CodePipeline, preventing the pipeline from automatically triggering upon artifact uploads.
Why this answer
CodePipeline requires S3 versioning to be enabled on the source bucket to automatically detect changes and start the pipeline. Without versioning, CodePipeline cannot uniquely identify new object versions, so it relies on manual or scheduled polling instead of event-based triggers. Enabling versioning ensures that each PUT operation generates a new version ID, which CodePipeline uses to invoke the pipeline automatically.
Exam trap
The trap here is that candidates often assume the IAM role permissions (Option A) are the root cause, but the actual requirement is S3 versioning, which is a bucket-level configuration that enables event-driven pipeline starts.
How to eliminate wrong answers
Option A is wrong because the IAM role for CodePipeline needs s3:GetObject permission to read the source artifact, but the lack of this permission would cause the pipeline to fail during execution, not prevent it from starting. Option B is wrong because polling is a fallback mechanism; the pipeline is configured to use event-based triggers by default when versioning is enabled, and the issue is that versioning is disabled, not that polling is explicitly configured. Option D is wrong because AWS CloudTrail is not required for CodePipeline to detect S3 events; CloudTrail logs API calls for auditing but does not trigger pipeline executions.
A developer is using AWS CodeDeploy to deploy an application to an Amazon EC2 Auto Scaling group. The deployment fails because the CodeDeploy agent on the instances is not running. Which TWO steps should the developer take to resolve this issue? (Choose TWO.)
Installing the CodeDeploy agent places the agent software on the instance (for example, under /opt/codedeploy-agent on Amazon Linux and Ubuntu) and creates the codedeploy-agent service. This agent is a long-running daemon that polls the CodeDeploy service for deployment commands, downloads the application revision artifacts from Amazon S3 or GitHub, and executes the AppSpec file hooks in the correct order. Until the agent binary is present, the instance cannot receive or process any CodeDeploy deployment, which is why this action is a required prerequisite before a deployment can even begin.
Why this answer
The issue is that the CodeDeploy agent is not running on the instances. To resolve this, the developer should first ensure the agent is installed (Option B) and then start the agent service (Option C). Option A is incorrect because attaching an IAM role allows permissions but does not install or start the agent.
Option D is incorrect because rebooting does not fix missing or stopped agents. Option E is incorrect because user data runs only at launch, not on existing instances; it is a preventive measure, not a fix for already-running instances.
A company uses CodePipeline to deploy a web application to Elastic Beanstalk. The deployment fails at the Build stage with an error 'BUILD FAILED'. Which step should the developer take first to troubleshoot?
When a CodePipeline build stage fails, the `buildspec.yml` file is the primary configuration for the AWS CodeBuild project responsible for compiling code, running tests, and packaging artifacts. Syntax errors within this YAML file, such as incorrect indentation, invalid commands, or missing required phases, will directly prevent CodeBuild from executing its defined steps successfully. Reviewing the CodeBuild project logs, which detail the execution of each command specified in `buildspec.yml`, is crucial for identifying the exact line or phase where the build process encountered an unrecoverable error.
Why this answer
The error 'BUILD FAILED' originates from the Build stage, which is executed by CodeBuild. The first step in troubleshooting a CodeBuild failure is to review the buildspec.yml file for syntax errors or misconfigurations, as this file defines the build commands, environment variables, and phases. Incorrect YAML formatting, missing required fields (e.g., 'phases'), or invalid commands will cause the build to fail immediately, making it the most direct and logical starting point.
Exam trap
The trap here is that candidates may jump to checking Elastic Beanstalk logs or CloudTrail, assuming the failure is related to deployment or API issues, when the error clearly indicates a build-stage failure that is most often caused by a misconfigured buildspec.yml file.
How to eliminate wrong answers
Option B is wrong because CodeDeploy is used in the Deploy stage, not the Build stage; verifying the application revision would only be relevant if the failure occurred during deployment, not during the build process. Option C is wrong because Elastic Beanstalk environment logs pertain to runtime issues with the deployed application, not to build-time failures in CodeBuild; the build fails before any deployment to Elastic Beanstalk occurs. Option D is wrong because AWS CloudTrail records API calls for auditing and security, but it does not provide granular details about build execution errors, such as syntax errors in buildspec.yml or command failures within CodeBuild.
A developer is using AWS CodePipeline to automate the deployment of a microservices application. The pipeline consists of a source stage (GitHub), a build stage (AWS CodeBuild), and a deploy stage (Amazon ECS). The developer wants to ensure that only approved changes are deployed to production. Which THREE actions should the developer take? (Choose THREE.)
In CodePipeline, a manual approval step is an action that pauses the pipeline execution at a specified stage and sends an SNS notification to designated reviewers. The reviewer must sign in, review the deployment details, and choose Approve or Reject before the Deploy stage can run, providing a human control point for production changes. This is the recommended way to satisfy a 'gates' requirement without removing automation.
Why this answer
To ensure only approved changes are deployed to production, the developer should implement a manual approval step (option C) to gate deployments, use separate pipelines for different environments (option D) to isolate changes, and include integration tests in the build stage (option E) to catch errors early. Automatic deployment to production (option A) bypasses approval, and deploying all feature branches directly (option B) introduces unverified code, making both risky.
A developer is building a serverless application using AWS Lambda and Amazon API Gateway. The application processes user uploads stored in an S3 bucket. The developer needs to ensure that the Lambda function can read objects from the S3 bucket. Which TWO steps should the developer take to meet this requirement? (Choose two.)
Because the Lambda function and the S3 bucket reside in different accounts (or because the bucket owner controls the resource), a bucket policy on the S3 bucket is the resource-based policy that can explicitly grant the Lambda execution role's ARN permission to s3:GetObject. S3 evaluates both the identity-based policy on the principal (the Lambda role) and the resource-based policy, and a statement in the bucket policy that allows the role's ARN satisfies the resource authorization. This is the recommended way to enable cross-account or cross-service access because it does not require creating or rotating IAM users.
Why this answer
To allow the Lambda function to read objects from S3, the developer must attach an IAM policy to the Lambda execution role that includes the s3:GetObject permission (Option D). Additionally, an S3 bucket policy can be used to explicitly grant access to the Lambda function's execution role (Option C). This provides cross-account access if needed.
Option A is incorrect because S3 object-level permissions are not set directly on objects; instead, bucket policies or IAM policies control access. Option B is incorrect because AWS KMS is used for encryption key management, not for granting access to S3. Option E is incorrect because Lambda functions use execution roles, not IAM users, to obtain permissions.
Which THREE are best practices for managing IAM users and roles? (Choose three.)
IAM user access keys are long-term credentials that remain valid until explicitly deactivated or deleted. Periodic rotation—for example, via an automated script or the AWS Console—shrinks the exploit window should a key leak into source code or logs. AWS provides 'last used' information to help identify and prune stale keys, and rotating keys is a fundamental part of any credential management policy.
Why this answer
Options A, B, and C are correct. Option A: Rotating IAM user access keys periodically reduces the risk of compromised credentials. Option B: Granting least privilege ensures users have only the permissions necessary to perform their tasks, minimizing security risks.
Option C: Using IAM roles for EC2 instances avoids the need to store long-term access keys on the instances, which is more secure. Option D is incorrect because the root account should not be used for daily tasks; it should be secured and used only for account-level administrative actions. Option E is incorrect because assigning full administrator access violates the principle of least privilege and increases security risk.
A developer is writing an AWS Lambda function that processes files uploaded to an S3 bucket. The function should only be triggered when a new object is created in a specific subfolder (e.g., /uploads/). Which S3 event notification configuration should the developer use?
This approach leverages Amazon S3's native event notification capabilities to precisely target specific object creation events. By setting a prefix filter to 'uploads/', the S3 bucket will only send notifications to the Lambda function when an object is created within that specific virtual folder. Combining this with the `s3:ObjectCreated:*` event type ensures that the Lambda function is invoked solely for new object uploads in the designated path, optimizing resource utilization and minimizing unnecessary Lambda invocations and associated costs.
Why this answer
S3 event notifications support prefix filtering, which allows you to specify a key prefix (e.g., 'uploads/') so that only object creation events in that subfolder trigger the Lambda function. By setting the event type to 's3:ObjectCreated:*', the function responds to all object creation operations (PUT, POST, Copy, etc.) within the filtered path, meeting the requirement precisely without unnecessary invocations.
Exam trap
The trap here is that candidates might think filtering inside the Lambda function is acceptable (Option B), but AWS best practice and the exam emphasize configuring filtering at the event source to minimize invocations and follow the principle of least privilege for triggers.
How to eliminate wrong answers
Option B is wrong because filtering on the prefix inside the Lambda function would still cause the function to be invoked for every object created in the bucket, leading to unnecessary executions and increased costs; S3 event notifications support prefix filtering natively, so this should be configured at the event source level. Option C is wrong because S3 event notifications do not support filtering by object tags; tag-based filtering is not a feature of S3 event notifications, and tags are not evaluated during event generation. Option D is wrong because AWS CloudTrail is not designed for real-time event-driven triggers; it logs API calls with a delay and is intended for auditing, not for invoking Lambda functions in response to S3 object creation events.
A company uses AWS Organizations with multiple accounts. A developer needs to grant an IAM user in Account A (111111111111) read-only access to an S3 bucket in Account B (222222222222). The bucket is encrypted with SSE-S3. Which combination of policies is required for cross-account access?
This combination correctly implements cross-account S3 access using the standard two-policy model. The bucket policy in Account B explicitly grants the `s3:GetObject` permission to the specific IAM user's ARN in Account A, acting as the resource-based policy. Concurrently, the IAM policy attached to the user in Account A allows that user to perform the `s3:GetObject` action, serving as the identity-based policy. Both policies must explicitly permit the action for access to be granted successfully.
Why this answer
Cross-account S3 access requires both a bucket policy in the resource account (Account B) that explicitly grants the IAM user ARN from Account A the s3:GetObject permission, and an IAM policy in the user's account (Account A) that allows the same action. The bucket policy acts as a resource-based policy that authorizes the cross-account principal, while the IAM policy is necessary to authorize the user to make the request. SSE-S3 encryption does not require additional configuration because S3 handles decryption automatically for authorized users.
Exam trap
The trap here is that candidates often think only a bucket policy is needed for cross-account access, forgetting that the IAM user must also have an explicit allow in their own account's IAM policy to actually invoke the S3 API call.
How to eliminate wrong answers
Option B is wrong because granting access to Account A's root user ARN would allow any principal in Account A to assume root-level permissions, which is overly broad and not a best practice; the correct approach is to grant access to the specific IAM user ARN. Option C is wrong because without an IAM policy in Account A allowing s3:GetObject, the IAM user lacks the necessary permissions to initiate the request, even if the bucket policy grants access; both policies are required for cross-account access. Option D is wrong because an S3 Access Point in Account B can simplify cross-account access but still requires a bucket policy that grants access to the Access Point, and the IAM user in Account A still needs an IAM policy allowing s3:GetObject; the Access Point alone does not eliminate the need for both policies.
A web application running on EC2 instances behind an Application Load Balancer (ALB) is experiencing intermittent 503 errors. The ALB target group health checks are succeeding. Which step should the developer take FIRST to diagnose the issue?
Examining ALB access logs is the most effective diagnostic step because these logs capture detailed information about every request processed by the load balancer, including the HTTP status code returned to the client and the target status code from the EC2 instance. Filtering for 503 responses ("HTTP 503" or "target_status_code:503") allows identification of specific request patterns, source IPs, or target groups that are experiencing issues. This data helps pinpoint whether the 503s are due to application errors, target connection issues, or other load balancer-related problems.
Why this answer
The correct first step is to examine the ALB access logs for 503 responses. Since health checks are succeeding, the EC2 instances are considered healthy by the target group, but the ALB itself may be returning 503 errors due to issues like request rate limits, connection limits, or backend response timeouts. Access logs provide detailed HTTP response codes and timestamps, allowing you to identify the pattern and cause of the 503 errors without making assumptions about instance count or state.
Exam trap
The trap here is that candidates assume 503 errors always mean unhealthy instances, so they jump to checking instance state or scaling, ignoring that health checks are passing and that ALB-level issues (like connection limits or timeouts) are the actual cause.
How to eliminate wrong answers
Option A is wrong because increasing the number of EC2 instances does not address the root cause of 503 errors when health checks are passing; it may mask the issue but does not diagnose it. Option C is wrong because Route 53 records only affect DNS resolution, not the ALB's ability to forward requests to healthy targets; a misconfigured Route 53 record would cause different errors (e.g., 503 or connection failures) but checking it first is premature when the ALB itself is reachable. Option D is wrong because the health checks are succeeding, which already confirms the EC2 instances are in a running state and responding to health check pings; verifying instance state again is redundant and does not explain the intermittent 503 errors.
A developer is using the AWS CLI to deploy a new version of a Lambda function. The developer runs the following command: aws lambda update-function-code --function-name my-function --zip-file fileb://my-code.zip After the command completes, the developer checks the function and sees that the code has been updated but the version number is still $LATEST. The developer wants to create a new version so that the previous version is preserved. What should the developer do next?
The publish-version command is the precise and correct mechanism to create an immutable, numbered version of a Lambda function based on the current state of its $LATEST qualifier. Since the developer has already successfully updated the function's code (which implicitly updates $LATEST), this command will capture that specific, updated code as a new, distinct version. This new version can then be referenced by aliases, enabling controlled deployments and reliable rollbacks.
Why this answer
The `update-function-code` command without the `--publish` flag only updates the `$LATEST` version of the Lambda function. To create an immutable, numbered version that preserves the previous code, the developer must explicitly run the `publish-version` command, which takes the current `$LATEST` code and publishes it as a new version (e.g., version 2). This ensures the previous version (version 1) remains unchanged and can be referenced via its version ARN.
Exam trap
The trap here is that candidates assume the `update-function-code` command automatically creates a new version, but it only updates `$LATEST` unless the `--publish` flag is explicitly used, leading them to incorrectly choose Option A or D.
How to eliminate wrong answers
Option A is wrong because the `--publish` flag is used with `update-function-code` to publish a new version in a single step, but running the command again without it will not retroactively publish the already-updated `$LATEST`; it would simply re-upload the same code. Option B is wrong because deleting and recreating the function is unnecessary and destructive—it removes all existing versions, aliases, and event source mappings, which is not required to simply create a new version from the updated code. Option D is wrong because `update-function-configuration` modifies settings like memory, timeout, or environment variables, not the version number; version numbers are immutable and can only be created via `publish-version` or the `--publish` flag during code update.
A Lambda function reading from Kinesis is falling behind. Which two metrics/settings should be reviewed first?
IteratorAge is a critical Amazon Kinesis Streams metric, reported by the Event Source Mapping, that measures the age of the last record successfully processed by the Lambda function. A consistently high or increasing IteratorAge directly indicates that the Lambda function is falling behind in processing records from the Kinesis stream. This metric provides a real-time, direct measurement of the processing lag, making it the primary indicator for diagnosing such issues.
Why this answer
The IteratorAge metric measures how far behind the Lambda function is in processing records from the Kinesis stream. A high IteratorAge indicates the function is falling behind, making it the primary metric to review. The batch size, parallelization factor, and shard count directly control the concurrency and throughput of the event source mapping, so adjusting these settings can help catch up.
Exam trap
The trap here is that candidates may overlook the direct performance-tuning metrics (IteratorAge, batch size, parallelization factor) and instead focus on unrelated AWS services like S3 or Route 53, which are red herrings in this troubleshooting context.
A developer is using AWS CloudFormation to deploy a stack that includes an Amazon RDS DB instance. The developer wants to update the DB instance to a larger instance type without causing downtime. The current template has DeletionPolicy set to 'Delete'. What should the developer do?
Blue/green deployment minimizes downtime by switching to a new stack.
Why this answer
A blue/green deployment allows you to create a new stack with the larger DB instance type in a separate environment (green), then switch the application traffic to the new database with minimal downtime. This approach avoids the downtime associated with in-place modifications, as CloudFormation updates to RDS instance types typically require a reboot, which causes an outage. By using a blue/green deployment, the developer can validate the new instance and cut over seamlessly.
Exam trap
The trap here is that candidates assume CloudFormation stack updates can resize RDS instances without downtime, but in reality, modifying the DBInstanceClass requires a reboot, making blue/green deployments the only zero-downtime option among the choices.
How to eliminate wrong answers
Option A is wrong because taking a snapshot and restoring to a larger instance type involves significant downtime during the restore process, and does not provide a zero-downtime update path. Option C is wrong because changing the DeletionPolicy to 'Retain' only affects stack deletion behavior, not updates; updating the stack with a larger instance type still triggers a reboot and downtime. Option D is wrong because promoting a read replica requires breaking replication and incurs downtime during the promotion process, and read replicas are not designed for zero-downtime instance type changes.
Which AWS service provides a managed, rotating secret store for database credentials?
AWS Secrets Manager is a dedicated, managed service designed for securely storing, managing, and automatically rotating database credentials, API keys, and other secrets throughout their lifecycle. It provides built-in, configurable rotation for supported AWS services like RDS, Redshift, and DocumentDB, as well as custom rotation logic via AWS Lambda functions. This automatic rotation capability significantly enhances security by regularly changing credentials, minimizing the impact of compromised secrets.
Why this answer
AWS Secrets Manager is the correct service because it is specifically designed to manage the entire lifecycle of secrets, including automatic rotation of database credentials on a configurable schedule (e.g., every 30 days). It natively integrates with Amazon RDS, Aurora, Redshift, and DocumentDB to rotate credentials without application downtime, using a built-in Lambda rotation function. This makes it the only fully managed, rotating secret store among the options.
Exam trap
The trap here is that candidates confuse AWS Systems Manager Parameter Store (which can store secrets) with Secrets Manager, but Parameter Store lacks native automatic rotation, making Secrets Manager the only correct answer for a managed rotating secret store.
How to eliminate wrong answers
Option B (AWS KMS) is wrong because it is a key management service for creating and controlling encryption keys, not a secret store; it does not store or rotate database credentials. Option C (AWS IAM Roles) is wrong because IAM roles provide temporary credentials for AWS service access via the AWS STS, but they are not a secret store and cannot store or rotate static database passwords. Option D (AWS Systems Manager Parameter Store) is wrong because while it can store secrets as SecureString parameters, it does not provide native automatic rotation of database credentials; rotation must be implemented manually or via custom automation.
A developer is building a RESTful API that allows clients to query a database and retrieve results. The backend logic is implemented in AWS Lambda, which queries an Amazon DynamoDB table. The developer wants to expose the API over HTTPS and manage authentication and throttling. Which AWS service should the developer use to create and manage the API endpoints?
Amazon API Gateway is a fully managed service specifically designed for creating, publishing, maintaining, monitoring, and securing REST, HTTP, and WebSocket APIs at any scale. It acts as a secure 'front door' for applications to access data, business logic, or functionality from backend services like AWS Lambda or DynamoDB. Key features include request/response transformation, authentication (e.g., API keys, IAM, Cognito), throttling, caching, and custom domain support, making it ideal for exposing a database query API.
Why this answer
Amazon API Gateway is the correct choice because it is a fully managed service that enables developers to create, publish, maintain, monitor, and secure RESTful APIs at any scale. It directly supports HTTPS endpoints, integrates natively with AWS Lambda for backend logic, and provides built-in features for authentication (e.g., IAM, Cognito, Lambda authorizers) and throttling (usage plans and rate limits). This makes it the ideal service for exposing a Lambda-backed DynamoDB query as a secure, managed API.
Exam trap
The trap here is that candidates may confuse an Application Load Balancer with API Gateway because both can invoke Lambda functions, but ALB lacks API management features like authentication, throttling, and API key validation, which are explicitly required in the question.
How to eliminate wrong answers
Option A is wrong because an Application Load Balancer operates at Layer 7 of the OSI model and distributes traffic to targets like Lambda functions, but it does not provide API management features such as authentication, throttling, or API key validation; it is designed for load balancing, not for creating and managing RESTful API endpoints. Option C is wrong because AWS CloudFront is a content delivery network (CDN) that caches and accelerates content delivery, but it does not natively create API endpoints or manage authentication and throttling for a RESTful API; it can be placed in front of API Gateway but is not a substitute for it. Option D is wrong because Amazon S3 is an object storage service that can host static websites and serve content over HTTPS, but it cannot execute backend logic like querying a DynamoDB table, nor does it provide authentication or throttling for API requests; it is not designed for dynamic API endpoints.
An organization uses AWS CodeCommit for source control and AWS CodeBuild for building a Java application. The build process needs to run integration tests that require a MySQL database. The team wants to ensure the database is provisioned only during the build and cleaned up afterward to minimize costs. What is the most efficient solution?
Using a Docker container running MySQL directly within the CodeBuild environment is an efficient and cost-effective solution. CodeBuild supports running services as Docker containers alongside the build environment, allowing MySQL to be spun up quickly and ephemerally for each build. This approach ensures a clean database instance for every integration test run, providing isolation and repeatability without incurring persistent costs for an always-on database.
Why this answer
Using CodeBuild's built-in support for Docker, you can run a MySQL container as part of the build. This provides an ephemeral database only during the build process, minimizing cost. Option A is wrong because keeping an RDS instance running incurs ongoing costs even when not in use.
Option B is wrong because using CloudFormation to provision an RDS instance at the start of each build and delete it at the end is slower than running a Docker container and may hit API rate limits. Option D is wrong because DynamoDB is a NoSQL database and may not support the SQL queries required by the integration tests.
Increasing the memory allocation for a Lambda function directly correlates with an increase in allocated CPU power. AWS Lambda provisions CPU cycles proportionally to the memory configured for the function. More CPU resources allow the function's execution environment to initialize faster, load dependencies more quickly, and execute the handler code more efficiently during a cold start, thereby reducing the overall latency experienced by the user.
Why this answer
Increasing the memory allocation of a Lambda function directly correlates to allocating more CPU power, which reduces the initialization time during a cold start. AWS Lambda provisions CPU proportionally to the configured memory, so a higher memory setting speeds up the runtime environment setup and code loading, thereby lowering cold start latency.
Exam trap
The trap here is that candidates often confuse increasing timeout with improving performance, but timeout only affects how long a function can run, not how quickly it starts.
How to eliminate wrong answers
Option B is wrong because placing a Lambda function in a VPC adds an Elastic Network Interface (ENI) setup step during cold starts, which actually increases latency, not reduces it. Option C is wrong because Lambda@Edge is designed for content delivery and caching at CloudFront edge locations, not for reducing cold start latency of an API Gateway backend Lambda function. Option D is wrong because increasing the function timeout to 15 minutes does not affect the initialization phase of a cold start; it only allows the function to run longer, which does not address the latency issue.
A company uses AWS Elastic Beanstalk to deploy a Python web application. After a successful deployment, the environment's health turns 'Severe' and the application returns HTTP 502 errors. What is the most likely cause?
When a Python application deployed on Elastic Beanstalk has a missing dependency in its `requirements.txt` file, the application server (e.g., Gunicorn, uWSGI) will fail to start correctly or crash immediately upon startup. The proxy server (e.g., Nginx, Apache) on the EC2 instance will then be unable to establish a connection or forward requests to the unresponsive application server. This common scenario directly leads to a 502 Bad Gateway error, as the proxy cannot communicate with the upstream application process.
Why this answer
A missing dependency in requirements.txt causes the Python application to fail during startup, leading to the EC2 instances reporting an unhealthy status to the Elastic Load Balancer. Elastic Beanstalk relies on the application process to respond to health checks; if the app crashes due to an ImportError, the load balancer receives no valid HTTP response and returns 502 Bad Gateway errors. The environment health turns 'Severe' because the platform detects that the application process is not running or is failing repeatedly.
Exam trap
The trap here is that candidates often confuse HTTP 502 with 503 or 504, or assume that a missing dependency would cause a deployment failure rather than a runtime error that still allows the environment to be created but with a broken application.
How to eliminate wrong answers
Option A is wrong because insufficient storage on EC2 instances would typically cause deployment failures or disk-full errors, not HTTP 502 errors; the load balancer would still receive a response from the web server, albeit potentially slow or incomplete. Option C is wrong because an incorrectly configured health check path would cause the load balancer to mark instances as unhealthy and return 503 Service Unavailable, not 502 Bad Gateway; 502 indicates the upstream server (the application) is not responding correctly. Option D is wrong because an incorrect RDS connection string would cause the application to fail at runtime when querying the database, but the web server would still start and respond to health checks with a 200 status unless the application crashes entirely on startup due to the misconfiguration.
An application running on Amazon ECS with Fargate is unable to pull an image from Amazon ECR. The task definition uses the 'default' task execution role. What is the most likely cause?
The Amazon ECS task execution role grants permissions to the ECS agent or the Fargate infrastructure to perform essential actions on your behalf, *before* your application code even starts. This includes crucial operations such as pulling container images from Amazon ECR, pushing container logs to Amazon CloudWatch Logs, and retrieving sensitive data from AWS Secrets Manager or Parameter Store for image pull authentication. For successful image retrieval, this role specifically requires permissions like `ecr:GetDownloadUrlForLayer`, `ecr:BatchGetImage`, and `ecr:BatchCheckLayerAvailability` to authenticate and download image layers, without which the task launch will fail.
Why this answer
When using Amazon ECS with Fargate, the task execution role (not the task role) is responsible for pulling container images from Amazon ECR. The 'default' task execution role is created automatically but lacks the necessary permissions (e.g., ecr:GetDownloadUrlForLayer, ecr:BatchGetImage, and ecr:BatchCheckLayerAvailability) unless explicitly attached via an IAM policy. Since the question states the task definition uses the 'default' task execution role, the most likely cause is that this role does not have the required ECR permissions.
Exam trap
The trap here is that candidates often confuse the task execution role with the task role, assuming the task role handles all permissions including image pulling, when in fact the task execution role is a separate IAM role specifically required for ECR image pulls and CloudWatch Logs.
How to eliminate wrong answers
Option A is wrong because the task role is used by the application code running inside the container to interact with AWS services (e.g., DynamoDB, S3), not for pulling images from ECR; image pulling is handled by the ECS agent using the task execution role. Option B is wrong because an ECS cluster itself does not have an IAM role or permissions; permissions are assigned to the task execution role or the ECS service role, not to the cluster resource. Option C is wrong because the ECS service role (formerly ecsServiceRole) is used for actions like registering/deregistering targets with a load balancer, not for pulling container images from ECR; image pulling is exclusively the responsibility of the task execution role.
A developer is designing a system that must meet the following security requirements: (1) Encrypt data at rest in S3, (2) Automatically rotate encryption keys annually, (3) Use an encryption key that is managed by AWS. Which services or features should the developer use? (Choose TWO.)
SSE-KMS uses AWS KMS to generate and manage your encryption keys, and the service applies envelope encryption where S3 encrypts objects with a data key that is itself encrypted by a customer master key. It supports automatic key rotation, provides a CloudTrail audit trail of every KMS API call, and lets you attach IAM policies and grants to restrict decryption access. This is the most appropriate option when you need centralised control, audibility, and permission-based access to the encrypted data.
Why this answer
The correct answers are B (SSE-KMS) and C (SSE-S3). SSE-KMS uses AWS KMS customer master keys (CMKs) which can be configured for automatic annual rotation via key rotation. SSE-S3 uses S3-managed keys that are automatically rotated by AWS.
Both provide encryption at rest with keys managed by AWS. Option A (SSE-C) uses customer-provided keys, not AWS-managed. Option D (AWS CloudHSM) provides customer-managed hardware security modules.
Option E (client-side encryption with AWS KMS) is client-side encryption, not server-side, and does not meet the requirement for AWS-managed key for S3.
A company is using AWS CodePipeline to automate deployments. The pipeline has a source stage that retrieves code from Amazon S3, a build stage using AWS CodeBuild, and a deploy stage using AWS CodeDeploy. The build stage is failing intermittently with errors related to missing dependencies. What should a developer do to ensure the build environment has all required dependencies?
Creating a custom `buildspec.yml` file in the source code is the standard and most effective method for automating dependency installation within AWS CodeBuild. By defining commands in the `install` phase of the `buildspec.yml` (e.g., `npm install`, `pip install`), CodeBuild automatically executes these steps every time the project is built. This ensures that all necessary dependencies are consistently fetched and installed, making the build process reproducible, reliable, and fully integrated with the source code version control.
Why this answer
The buildspec.yml file defines the build phases for AWS CodeBuild, including the install phase where you can specify commands to install dependencies (e.g., using package managers like pip, npm, or apt-get). By placing this file in the source code, the build environment automatically executes these commands on every build, ensuring all required dependencies are present and consistent across runs, which resolves intermittent failures caused by missing dependencies.
Exam trap
The trap here is that candidates may think environment variables (Option A) can solve dependency issues, but they confuse configuration with actual installation, or they assume changing the source repository (Option C) will somehow fix build failures, when the real solution lies in defining the build process within the source code itself.
How to eliminate wrong answers
Option A is wrong because environment variables in CodePipeline can set paths or configuration values but cannot install or fetch missing dependencies; they only influence runtime behavior of existing tools. Option B is wrong because manually installing dependencies on the CodeBuild build server is impractical and defeats automation—CodeBuild uses ephemeral, disposable build environments that are recreated for each build, so manual changes are lost. Option C is wrong because switching to CodeCommit as the source repository does not address missing dependencies; the source type (S3 vs.
CodeCommit) has no impact on dependency installation in the build stage.
Page 1 of 10
Page 2Practice DVA-C02 by domain
Target a specific domain to shore up weak areas.
See all domains with question counts →