AWS Certified Developer Associate DVA-C02 (DVA-C02) — Questions 976–1050

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because ALB target groups do not handle authentication; authentication is configured at the listener rule level, not on the target group. Option B is wrong because Lambda@Edge is designed for content delivery and request/response manipulation at CloudFront edge locations, not for offloading OIDC authentication directly to an ALB or for assuming IAM roles via web identity federation. Option D is wrong because while Amazon Cognito can act as an OIDC provider and integrate with ALB, the question specifies an external OIDC provider, and using Cognito would introduce an unnecessary intermediary; the ALB supports direct integration with any OIDC-compliant identity provider without requiring Cognito.

Why this answer

How to eliminate wrong answers

Option A is wrong because an IAM role policy allowing kms:Decrypt is necessary but not sufficient; the KMS key policy must also grant the role permission to use the key, and if the key policy does not include the role, the IAM policy alone will not allow decryption. Option B is wrong because S3 bucket policies control access to S3 actions (like s3:GetObject) but cannot grant KMS decryption permissions; KMS actions are governed solely by KMS key policies and IAM policies. Option D is wrong because allowing the service principal s3.amazonaws.com to decrypt would grant decryption to any S3 request that uses the key, bypassing the IAM role restriction and violating the requirement that only certain IAM roles can decrypt.

Why this answer

How to eliminate wrong answers

Option B is wrong because the Lambda function timeout is already at 900 seconds (15 minutes), which is the maximum allowed; increasing it further is impossible. Option C is wrong because S3 Select filters data before the Lambda function is invoked, which would require modifying the S3 event notification or adding a separate trigger, thus requiring code changes to the Lambda function or infrastructure. Option D is wrong because increasing the batch size of the S3 event notification would invoke the function with multiple files at once, which would increase the processing load and worsen the timeout issue, not resolve it.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because UPDATE_ONLY will fail if the stack does not exist, as it only updates an existing stack. Option C is wrong because REPLACE_ON_FAILURE is used to replace a stack if the update fails, but it still requires an existing stack and does not create one from scratch. Option D is wrong because CREATE_ONLY will fail if the stack already exists, preventing updates and breaking the pipeline on subsequent runs.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS Certificate Manager (ACM) only issues certificates that are trusted by major browsers and operating systems; if ACM issued the certificate, it is automatically from a trusted CA, so this is not the cause. Option C is wrong because while the API must be deployed to a stage and the stage must be mapped to the custom domain name for the API to respond, an SSL error occurs at the TLS handshake level before any API routing happens; a missing stage mapping would cause a 404 or 403 error, not an SSL error. Option D is wrong because the developer created the custom domain name in API Gateway and uploaded the certificate to ACM in the same region, so the region mismatch is not the issue; the certificate must be in the same region as the API Gateway regional endpoint, which it is.

Why this answer

How to eliminate wrong answers

Option B (AWS CloudFormation) is wrong because it is an infrastructure-as-code service for provisioning resources, not a runtime configuration store; it cannot dynamically serve configuration to running microservices or rotate secrets automatically. Option C (Amazon S3) is wrong because while it can store encrypted objects, it lacks native secret rotation capabilities and is not designed for low-latency, parameter-style access from ECS tasks without additional client logic. Option D (AWS Secrets Manager) is wrong because although it supports automatic secret rotation and encryption, it is specifically designed for managing secrets like database credentials, not general application configuration; the question asks for storing 'application configuration' that must be rotated, and Parameter Store is the more appropriate service for configuration data with optional rotation via integration.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because point-in-time recovery (PITR) enables continuous backups and restores to any point within the last 35 days; it does not affect request distribution or throttling. Option B is wrong because reducing item size can lower consumed capacity per operation but does not change how requests are distributed across partitions; the hot partition remains throttled if the same customerId still receives high traffic. Option C is wrong because strongly consistent reads consume twice the RCU of eventually consistent reads and do not alter partition key distribution; they would actually increase throttling risk on the hot partition.

Why this answer

How to eliminate wrong answers

Option B is wrong because `s3:ObjectRestore:*` is used for S3 Glacier or S3 Deep Archive restore lifecycle events, not for new object creation. Option C is wrong because `s3:ReducedRedundancyLostObject:*` is a deprecated event that only fires when an object stored with Reduced Redundancy Storage (RRS) is lost, which is unrelated to new object creation. Option D is wrong because `s3:ObjectRemoved:*` is triggered when objects are deleted (e.g., via DELETE or lifecycle expiration), not when they are created.

Why this answer

How to eliminate wrong answers

Option A is wrong because `buildspec.yml` is used by AWS CodeBuild to define build commands and output artifacts, not by Elastic Beanstalk for environment configuration. Option C is wrong because `appspec.yml` is used by AWS CodeDeploy to manage deployment lifecycle hooks and file permissions, not by Elastic Beanstalk for custom EC2 settings. Option D is wrong because `cron.yaml` is used by Elastic Beanstalk for periodic tasks (worker environment cron jobs), not for setting environment variables or general configuration.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because increasing memory to 3008 MB provides more CPU than needed for a CPU-bound task, leading to unnecessary cost without proportional performance gain (Lambda CPU scales linearly up to ~1769 MB, then plateaus). Option B is wrong because provisioned concurrency addresses cold starts, not timeout issues caused by insufficient CPU during peak load; it does not reduce execution time for CPU-bound processing. Option D is wrong because increasing the timeout to 5 minutes does not fix the root cause (CPU-bound processing is too slow); it only delays the timeout, allowing the function to run longer but still at the same slow speed, potentially increasing costs due to longer execution duration.

Why this answer

How to eliminate wrong answers

Option A is wrong because an incorrect handler name causes a different error (e.g., `InvalidParameterValueException` or a runtime 'handler not found' error), not `ResourceConflictException`. Option B is wrong because missing IAM permissions produce `AccessDeniedException` or `KMSAccessDeniedException`, not a conflict error. Option C is wrong because insufficient memory for the deployment package is not a Lambda error condition — package size limits are enforced separately (50 MB zipped direct upload, 250 MB unzipped), and memory is a runtime setting unrelated to deployment conflicts.

Why this answer

How to eliminate wrong answers

Option A is wrong because storing AWS access keys and secret keys in a configuration file on the EC2 instance introduces long-term static credentials, which violates the requirement to avoid storing long-term credentials and increases the risk of credential leakage. Option C is wrong because using an IAM user and storing credentials in AWS Secrets Manager still requires the EC2 instance to retrieve and use long-term credentials (the IAM user's access keys) at some point, and the instance would need to authenticate to Secrets Manager, typically with another set of credentials, creating a circular dependency; the recommended approach for EC2 is always an IAM role. Option D is wrong because DynamoDB does not support resource-based policies that grant access to EC2 instances directly; resource-based policies in DynamoDB are used for cross-account access or service-to-service authorization, not for granting permissions to compute resources like EC2 instances.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because security groups operate at the network layer and do not affect outbound traffic to S3 by default; outbound traffic is allowed unless explicitly denied, and S3 access uses HTTPS over port 443 which is typically open. Option B is wrong because while SSE-KMS requires kms:Decrypt permissions, the question states the bucket policy allows s3:GetObject for the role, and the error could be due to missing KMS permissions, but the most likely cause given the scenario is the missing instance profile, not KMS. Option C is wrong because block public access settings only restrict public (unauthenticated) access, not access from an IAM role that has been explicitly granted permissions via a bucket policy.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because CodeDeployDefault.ECSAllAtOnce is a deployment configuration that shifts all traffic to the green task set immediately, which does not ensure the green task set is fully healthy before the blue task set is terminated; it also lacks automatic rollback on health check failure. Option C is wrong because CodeDeployDefault.ECSLinear10PercentEvery1Minutes is a linear traffic shifting configuration that gradually moves traffic in 10% increments every minute, but it does not automatically roll back to the blue task set if the green task set fails health checks; it only controls the traffic shift rate. Option D is wrong because while an Application Load Balancer is required for blue/green deployments on ECS, it alone does not provide the automatic rollback behavior needed; the rollback configuration must be explicitly enabled in the deployment group.

Why this answer

How to eliminate wrong answers

Option B is wrong because a missing VPC subnet would cause a different error, such as 'VPCIdNotSpecified' or 'SubnetIDNotSpecified', not a null groupId parameter. Option C is wrong because a syntax error in user data would result in a script execution failure, not a parameter validation error during stack creation. Option D is wrong because an invalid key pair name would produce an error like 'InvalidKeyPair.NotFound', not a null parameter value for groupId.

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS Secrets Manager is optimized for managing secrets with automatic rotation, which is overkill for general configuration data and incurs additional cost per secret; the question does not require rotation. Option B is wrong because Amazon S3 with server-side encryption can store configuration data but lacks native integration with ECS for secure, low-latency parameter retrieval and does not provide the same level of auditability via CloudTrail for individual parameter access without additional configuration. Option D is wrong because Amazon DynamoDB with encryption at rest is a NoSQL database designed for high-scale application data, not for storing simple configuration parameters, and it requires custom code to manage access control and auditing, adding unnecessary complexity.

Why this answer

How to eliminate wrong answers

Option B (AdministratorAccess) is wrong because it grants full administrative permissions to all AWS services, which violates the principle of least privilege and is overly permissive for a Lambda function that only needs to write logs. Option C (AmazonDynamoDBFullAccess) is wrong because it provides full access to DynamoDB operations but does not include any CloudWatch Logs permissions, so the Lambda function would fail to write logs. Option D (AmazonS3FullAccess) is wrong because it grants full access to S3 buckets and objects but lacks the necessary CloudWatch Logs actions, making it irrelevant for logging purposes.

Why this answer

How to eliminate wrong answers

Option A is wrong because AdministratorAccess grants full control over the account, violating least privilege and giving the auditor far more than read-only compliance access. Option C is wrong because a custom policy allowing all actions is effectively admin access and is both over-permissive and unnecessary when SecurityAudit already exists. Option D is wrong because sharing root credentials is a severe security anti-pattern — root has unrestricted access, cannot be scoped, and its compromise is catastrophic; AWS explicitly advises against root usage for anything but a few account-level tasks.

Why this answer

How to eliminate wrong answers

Option B is wrong because enabling automatic rollback on deployment failure only triggers after the deployment has already failed (e.g., timeout exceeded), not when health checks fail during the deployment's lifecycle. Option C is wrong because increasing the timeout merely delays the failure detection; it does not implement a rollback mechanism. Option D is wrong because the ECS service's deployment circuit breaker rolls back the ECS service itself, but it does not integrate with CodeDeploy's Blue/Green deployment lifecycle or trigger a rollback of the CodePipeline pipeline stage.

Why this answer

How to eliminate wrong answers

Option B is wrong because Lambda@Edge runs at CloudFront edge locations but is not an authentication service — it would require custom token validation code and adds complexity without the managed OIDC integration Cognito provides. Option C is wrong because Cognito Identity Pools provide AWS credentials for authenticated users (federation for AWS access), not user authentication/session tokens for API Gateway authorization. Option D is wrong because a custom Lambda authorizer requires writing and maintaining token validation logic, increasing latency and operational overhead compared to the native Cognito User Pool authorizer.

Why this answer

How to eliminate wrong answers

Option B is wrong because the LogResult field contains base64-encoded logs, not error information; the FunctionError field specifically indicates an unhandled exception. Option C is wrong because a timeout would result in a FunctionError of 'Unhandled' with a specific timeout message, but the question states the function returned a status code 200, which would not happen on timeout. Option D is wrong because a network error would typically result in a different error, such as a connection error, not a FunctionError field in the response.

Why this answer

How to eliminate wrong answers

Option B is wrong because DynamoDB does not support resource-based policies that grant access to IAM roles for data-plane operations; DynamoDB resource policies are limited and not a substitute for identity-based policies on the Lambda execution role. Option C is wrong because embedding IAM user credentials in environment variables is a serious security anti-pattern — credentials can be exposed via logs, console, or code, and they are long-lived. Option D is wrong because Lambda already assumes an execution role automatically; manually calling STS AssumeRole inside the function adds unnecessary complexity and latency, and still requires an execution role with sts:AssumeRole permissions.

Why this answer

How to eliminate wrong answers

Option B is wrong because missing IAM permissions produce an 'Access Denied' or 'not authorized to perform: cloudformation:UpdateStack' error, not a resource-level cancellation event. Option C is wrong because a missing required parameter fails template validation before any resource update begins, yielding a 'Parameters: [X] must have values' error rather than a mid-update cancellation. Option D is wrong because a stopped EC2 instance does not prevent CloudFormation from updating its properties; the instance state is irrelevant to the update API call.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because storing secrets in an S3 bucket with a pre-signed URL introduces a long-lived URL that can be intercepted or leaked, and it does not provide native secret rotation or fine-grained access control compared to AWS Secrets Manager. Option B is wrong because defining secrets as environment variables in the ECS task definition stores them in plaintext within the task definition, which can be viewed by anyone with access to the ECS API or console, violating security best practices. Option C is wrong because encrypting secrets with KMS and storing the encrypted blob in a Docker image embeds the encrypted data in the image, making it difficult to rotate secrets without rebuilding the image, and the decryption key must be managed separately, increasing complexity and risk.

Why this answer

How to eliminate wrong answers

Option A is wrong because S3 Transfer Acceleration is a feature that speeds up uploads over long distances using edge locations, but it does not replace the need for multipart upload for large objects; the PutObject API still has a 5 GB limit and is not recommended for objects over 100 MB. Option B is wrong because the PutObject API operation is designed for objects up to 5 GB, but for a 200 MB object, using a single PutObject call is less reliable and efficient than multipart upload due to potential network interruptions and lack of parallel uploads. Option D is wrong because a pre-signed URL grants temporary access for an HTTP PUT upload, but it still uses the PutObject API under the hood, which is not optimal for a 200 MB object; multipart upload is the recommended approach for objects over 100 MB.

Why this answer

How to eliminate wrong answers

Option A is wrong because it denies `s3:PutObject` if the request includes the `x-amz-server-side-encryption` header, which would block all encrypted uploads, not enforce them. Option C is wrong because it only allows `s3:PutObject` if a specific KMS key is used, but it does not enforce that encryption is present at all; a request without encryption could still be allowed if no explicit Deny is present. Option D is wrong because it enforces SSE-S3 (AES256) rather than SSE-KMS (aws:kms), which does not meet the requirement for server-side encryption with AWS KMS.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because stack policies control updates to stack resources after creation, not who can create stacks from templates. Option C is wrong because CloudTrail logs API calls for auditing but does not enforce any access control or authorization. Option D is wrong because setting the S3 bucket to private and relying solely on bucket policies does not prevent an authorized S3 user from creating a stack with the template; it also fails to control the CreateStack API call itself, which is governed by IAM.

Why this answer

How to eliminate wrong answers

Option A is wrong because increasing the batch size to 500 would likely cause the function to exceed the 5-minute timeout (since it already takes ~4 minutes for 100 records), leading to throttling and failed processing. Option B is wrong because increasing the number of shards incurs additional costs and is not the most cost-effective approach; the current 10 shards are underutilized due to the parallelization factor of 1. Option C is wrong because the function is not timing out (it completes in ~4 minutes with a 5-minute timeout), so increasing the timeout does not address the throughput bottleneck and only delays potential failures.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because the Lambda functions do not need the X-Ray SDK imported to send trace data; the X-Ray daemon automatically captures segments for Lambda invocations and downstream calls if the service supports it. Option C is wrong because the X-Ray daemon is already running in the Lambda execution environment by default when X-Ray tracing is enabled on the Lambda function. Option D is wrong because a low sampling rate would reduce the number of traces captured, not cause incomplete traces with missing segments for downstream calls.

Why this answer

How to eliminate wrong answers

Option B is wrong because a REQUEST authorizer passes the entire request context (headers, query parameters, path parameters) to the Lambda function, which is unnecessary overhead when only the JWT token from a header is needed; it also requires more complex parsing logic. Option C is wrong because Amazon Cognito User Pools are a managed identity service that handles JWT verification natively, not a Lambda authorizer; using them would bypass the requirement for a custom Lambda function to decode the token. Option D is wrong because resource policies control access based on IP addresses, VPCs, or AWS accounts, not on the contents of a JWT token; they cannot decode or validate token claims.

Why this answer

How to eliminate wrong answers

Option A is wrong because Secrets Manager does not include a built-in Lambda function for rotating secrets; you must provide your own custom Lambda function with the rotation logic. Option C is wrong because AWS Certificate Manager (ACM) is used for managing SSL/TLS certificates, not for rotating database credentials stored in Secrets Manager. Option D is wrong because AWS Systems Manager Parameter Store does not support automatic rotation of secrets; it is a simple key-value store without built-in rotation capabilities, and using a CloudWatch Events rule would require custom scripting and does not integrate with Secrets Manager's native rotation features.

Why this answer

How to eliminate wrong answers

Option A is wrong because simply increasing RCUs and WCUs to 50 is a manual, reactive fix that does not address the root cause of unpredictable traffic patterns; it may still lead to throttling if the workload spikes beyond the new limit, and it incurs unnecessary cost if the average usage is lower. Option C is wrong because DAX caches reads only, but the errors are DynamoDBProvisionedThroughputExceededException, which primarily affects writes (the function writes processed data); caching reads does not reduce write throttling. Option D is wrong because increasing Lambda memory only increases CPU and network throughput, not DynamoDB capacity; it does not resolve the throttling errors caused by exceeding the table's write capacity.

Why this answer

How to eliminate wrong answers

Option B is wrong because it omits `dynamodb:PutItem`, which is essential for writing to the DynamoDB table; without it, the function will fail with an access denied error. Option C is wrong because `dynamodb:*` grants all DynamoDB actions (including delete, scan, etc.), which violates the principle of least privilege and is not the minimum set. Option D is wrong because it includes `dynamodb:GetItem` (unnecessary for writing) and omits `logs:CreateLogGroup` and `logs:CreateLogStream`, which are required for Lambda to initialize CloudWatch log streams; without them, the function cannot write logs.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because if an ACL denies read access, it would conflict with the bucket policy, but the question states the bucket policy allows public read access, and S3 evaluates both ACLs and policies; however, Block Public Access settings are a more common and immediate cause. Option C is wrong because the bucket policy is stated to allow public read access, which implicitly includes the 's3:GetObject' action; if it were missing, the error would be Access Denied, but the policy is correctly configured per the question. Option D is wrong because if the bucket policy were not correctly attached, the bucket would not have any policy to evaluate, leading to default private access (403), but the question explicitly says the policy allows public read access, implying it is attached; the issue is the Block Public Access override.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because ELB health check settings are only relevant if the instance is behind an Elastic Load Balancer, and the question does not mention an ELB; even if it were, the health check would fail due to the same security group issue, making it a secondary check. Option C is wrong because instance status checks verify the OS and hypervisor health (e.g., system reachability), and since the instance is 'running' and the application is unreachable, the issue is likely at the network layer, not the instance's operational status. Option D is wrong because verifying the instance ID is a basic validation step that would have been done before running the CLI command; if the ID were incorrect, the CLI command would have failed with an error, not left the instance running but unreachable.

Why this answer

How to eliminate wrong answers

Option A is wrong because Deny can absolutely be used with wildcard actions like s3:*; IAM policies support wildcards in both Action and Resource elements. Option B is wrong because encryption status of the object is irrelevant to the policy evaluation; the explicit Deny blocks access regardless of encryption. Option D is wrong because the Allow statement cannot override an explicit Deny; IAM evaluates explicit Deny first and it wins.

Why this answer

How to eliminate wrong answers

Option B is wrong because S3 Object Lock is designed to prevent objects from being deleted or overwritten for a fixed retention period, not to automate storage class transitions or scheduled deletions. Option C is wrong because S3 Replication asynchronously copies objects to another bucket for redundancy or compliance, but it does not manage lifecycle transitions or deletion schedules. Option D is wrong because S3 Event Notifications trigger actions (e.g., Lambda, SQS) on object events like PUT or DELETE, but they cannot enforce time-based transitions to Glacier or automatic deletion after a set number of days.

Why this answer

How to eliminate wrong answers

Option A is wrong because creating a separate CodeBuild project does not address the root cause—cache corruption—and adds unnecessary complexity. Option C is wrong because switching to HTTP disables TLS encryption, compromising security and violating best practices; the error is not caused by HTTPS. Option D is wrong because '--prefer-offline' still uses the corrupted cache and may fail integrity checks; it does not repair the cache and could mask the issue while potentially using stale packages.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because resource-based policies on DynamoDB tables are not supported; DynamoDB uses IAM policies attached to users, roles, or the table's own resource policy (only for cross-account access via VPC endpoints or AWS Organizations), not for granting access to a Lambda function in the same account. Option C is wrong because passing a shared secret via API Gateway to Lambda for DynamoDB access is insecure and unnecessary; secrets should never be passed through API Gateway payloads, and AWS recommends using IAM roles for service-to-service authentication. Option D is wrong because storing DynamoDB access keys (long-term credentials) in Lambda environment variables violates security best practices—they can be exposed in logs, console, or version history—and AWS strongly recommends using IAM roles with temporary credentials instead.

Why this answer

How to eliminate wrong answers

Option A is wrong because the 'setup' command runs the setup lifecycle event, which configures the instance's packages, dependencies, and custom cookbooks, but it does not deploy application code; deploying a new app version requires the 'deploy' command. Option B is wrong because cloning the stack and deleting the old stack is an unnecessarily disruptive and manual process that does not achieve a rolling update; OpsWorks supports in-place rolling updates via the 'deploy' command without stack recreation. Option D is wrong because modifying the Auto Scaling group to launch new instances with an updated app bypasses OpsWorks's deployment lifecycle and does not perform a controlled rolling update; it would replace instances without the orchestrated 'deploy' recipes that handle application-specific tasks like database migrations or cache clearing.

Why this answer

How to eliminate wrong answers

Option B is wrong because Lambda can access EFS mount targets in any Availability Zone within the same VPC; it does not need to be in the same AZ as the mount target, as Lambda uses ENIs in the VPC subnets to reach the mount target across AZs. Option C is wrong because the AmazonElasticFileSystemClientReadWriteAccess policy grants permissions to EFS API operations (e.g., CreateFileSystem, DescribeMountTargets) but does not include the specific efs:MountFileSystem permission or the VPC networking permissions required for Lambda to mount the file system. Option D is wrong because the efs:MountFileSystem permission is not a valid IAM action; EFS mounting is controlled by network connectivity (VPC configuration) and the execution role must include permissions for EC2 ENI management (ec2:CreateNetworkInterface, etc.), not a direct EFS mount action.

Why this answer

How to eliminate wrong answers

Option A is wrong because S3 static website hosting endpoints are region-specific (e.g., http://bucket-name.s3-website-us-east-1.amazonaws.com), but the bucket's region does not affect access permissions; a 403 Forbidden error is an authorization issue, not a routing issue. Option B is wrong because while a bucket name must match the domain name for custom domain mapping (e.g., via Route 53), the 403 Forbidden error occurs regardless of domain name mismatch; a mismatch would cause a DNS resolution failure or a different error (e.g., 404 NoSuchBucket), not a 403. Option D is wrong because CloudFront is not required for S3 static website hosting; S3 can serve content directly via its website endpoint, and the absence of CloudFront does not cause a 403 Forbidden error—it would only affect performance, caching, or HTTPS support if not configured.

Why this answer

How to eliminate wrong answers

Option B is wrong because adding object-level encryption settings after upload does not enforce encryption at rest for all objects; it requires manual intervention and does not change the default encryption behavior for future uploads. Option C is wrong because enabling S3 Bucket Keys reduces the number of KMS API calls for SSE-KMS but does not change the encryption type from SSE-S3 to SSE-KMS; it is an optimization feature, not a method to enforce customer-managed KMS encryption. Option D is wrong because a bucket policy that denies uploads without the required KMS key can enforce encryption requirements but does not change the default encryption configuration; it would still allow objects encrypted with SSE-S3 if the policy is not correctly crafted, and it does not automatically encrypt objects—it only denies unencrypted uploads, which is not the same as ensuring all data is encrypted at rest with the specified KMS key.

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS WAF is a web application firewall that filters traffic based on rules (e.g., IP sets, SQL injection), but it does not natively support per-API-key rate limiting; implementing such a limit would require custom logic and is not the simplest solution. Option B is wrong because reserved concurrency on a Lambda function limits the number of concurrent executions, not the request rate per second per API key; it also applies globally to the function, not per API key, and does not prevent abuse at the API Gateway level. Option C is wrong because a CloudWatch alarm can only trigger actions (e.g., disable an API key) after the limit is exceeded, but it cannot enforce a hard throttle in real time; the alarm would react after the fact, allowing bursts beyond 100 requests per second before any action is taken.

Why this answer

How to eliminate wrong answers

Option B is wrong because creating two separate RDS databases and using Route 53 weighted routing would introduce data inconsistency and complexity, as users would write to different databases, defeating the purpose of a single application state. Option C is wrong because using an ALB with stickiness would route users to either the blue or green task set based on session affinity, but it does not address the root cause of different database endpoints; the task sets would still connect to different databases, causing data fragmentation. Option D is wrong because using CloudFormation to create a new database stack for each deployment is overly complex and unnecessary; it would require managing multiple databases and updating the task definition dynamically, which is not the simplest solution and could lead to data loss or inconsistency.

Why this answer

How to eliminate wrong answers

Option A is wrong because API Gateway has a 10 MB payload limit and a 29-second integration timeout, making it unsuitable for large file uploads; passing the entire request body to Lambda also forces the function to handle raw multipart parsing, which is inefficient and error-prone. Option B is wrong because it still requires the client to send the file through API Gateway and Lambda, hitting the same size and timeout constraints; the Lambda function would need to receive the entire file payload before uploading to S3, defeating the purpose of direct upload. Option D is wrong because it introduces unnecessary infrastructure management (EC2) and does not leverage serverless benefits; it also does not address the requirement to use API Gateway and Lambda, and a custom web server on EC2 adds operational overhead without improving efficiency.

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail records API calls for auditing and governance, not for tracing individual request paths or performance bottlenecks across microservices. Option B is wrong because Amazon CloudWatch Logs aggregates log data but does not provide distributed tracing or service maps to correlate requests across multiple Lambda functions and API Gateway. Option D is wrong because Amazon Inspector is a vulnerability management service that scans for software vulnerabilities and network exposure, not for tracing application requests or performance analysis.

Why this answer

How to eliminate wrong answers

Option B is wrong because redeploying the API Gateway stage does not update the signing key used by the Lambda authorizer; it only deploys the current API configuration. Option C is wrong because deleting and recreating the authorizer is unnecessary and inefficient; the authorizer can be updated programmatically or by modifying its logic. Option D is wrong because updating an environment variable and publishing a new Lambda version still requires manual key rotation and does not address the root cause of dynamic key changes; the authorizer would still need to be updated each time the key changes.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because placing the environment behind an Application Load Balancer (ALB) alone does not address under-provisioned instances; an ALB distributes traffic but does not add compute capacity, so latency persists if instances are overloaded. Option C is wrong because changing to a larger instance type increases cost for all hours, including low-traffic periods, and does not dynamically adapt to peak demand, making it less cost-effective than Auto Scaling. Option D is wrong because decreasing the minimum number of instances reduces the baseline capacity, worsening latency during both peak and normal loads, as fewer instances handle the same traffic.

Why this answer

How to eliminate wrong answers

Option A is wrong because separating into two stacks introduces unnecessary complexity and cross-stack output references, which is not required when SAM can handle the dependency within a single stack. Option B is wrong because `DependsOn` only ensures resource creation order but does not provide the endpoint URL as an environment variable; the developer still needs to reference the API Gateway output, and `DependsOn` alone does not pass the URL. Option D is wrong because using a custom resource to create the API Gateway endpoint is over-engineered and redundant; SAM already provides a built-in implicit API resource that handles creation and dependency resolution automatically.

Why this answer

How to eliminate wrong answers

Option A is wrong because the `Principal` element in an S3 bucket policy specifies the AWS account or IAM entity allowed to access the bucket, not the network IP range; adding a different Principal would not fix the IP-based restriction. Option B is wrong because changing the condition to only `203.0.113.0/24` would deny access to the original `192.0.2.0/24` network, simply swapping which network is blocked. Option C is wrong because removing the `Condition` block entirely would allow all IP addresses to access the bucket, which is overly permissive and violates the principle of least privilege.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because validating in the Lambda function incurs unnecessary compute cost and latency, as the function must be invoked even for invalid requests, and it does not leverage API Gateway's native validation capabilities. Option C is wrong because Amazon CloudFront is a content delivery network (CDN) that caches and distributes content at the edge; it does not perform request validation against a schema or model, and its primary purpose is not to validate API requests. Option D is wrong because using API Gateway request parameters to enforce required headers only validates the presence of headers, not the payload body or complex parameter constraints, and it lacks the schema-based validation needed for payload structure.

Why this answer

How to eliminate wrong answers

Option A is wrong because Amazon EventBridge rules cannot directly capture SQS events; SQS does not emit events to EventBridge for queue messages. Option B is wrong because Amazon SNS cannot subscribe to an SQS queue; SNS publishes messages to SQS subscriptions, not the reverse, and SNS cannot trigger Lambda from SQS messages. Option C is wrong because AWS Step Functions can poll SQS using a service integration, but it is not designed to trigger Lambda directly from new messages; it would require a custom polling loop or callback pattern, adding unnecessary complexity compared to the native SQS event source mapping.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because redeploying the API Gateway stage is necessary after any configuration change, but the question states the developer enabled CORS on the resource, implying the stage was redeployed; the core issue is the Lambda response missing headers. Option B is wrong because setting the allowed origin to '*' is a valid wildcard for CORS, but it does not fix the missing headers from the Lambda function; the problem is not the origin value but the absence of headers entirely. Option C is wrong because the browser automatically sends the preflight OPTIONS request for cross-origin requests with non-simple methods or custom headers; the developer enabled CORS on API Gateway, which handles the OPTIONS response, so the preflight is not the issue.