AWS Certified Developer Associate DVA-C02 DVA-C02 Questions 226–300 | Page 4/10

226

MCQmedium

A developer needs to trace a request across API Gateway, Lambda, and downstream AWS service calls. Which service should be enabled?

A.AWS X-Ray

B.AWS Budgets

C.AWS Artifact

D.AWS License Manager

AnswerA

AWS X-Ray is the correct service for tracing requests across distributed applications, such as those involving API Gateway, Lambda functions, and other downstream AWS services. It provides an end-to-end view of requests as they travel through various components, helping identify performance bottlenecks and operational issues. X-Ray generates a service map that visualizes the application's architecture and shows latency data for each node and connection, enabling detailed analysis of request flow and performance. This capability is precisely what's needed to "trace a request" through the specified AWS services.

Why this answer

AWS X-Ray is the correct service because it provides end-to-end tracing for requests flowing through distributed applications, including API Gateway, Lambda functions, and downstream AWS services like DynamoDB or S3. It captures trace data as the request traverses each component, allowing developers to identify performance bottlenecks and errors across the entire request path. X-Ray integrates natively with API Gateway and Lambda via the X-Ray SDK or active tracing configuration, requiring no code changes for basic tracing.

Exam trap

The trap here is that candidates may confuse AWS X-Ray with CloudWatch Logs or CloudTrail, thinking those services provide the same distributed tracing capability, but X-Ray is the only service that correlates trace data across multiple components in a single request.

How to eliminate wrong answers

Option B (AWS Budgets) is wrong because it is a cost management service that monitors AWS spending and sends alerts when usage exceeds thresholds, not a tracing or observability tool. Option C (AWS Artifact) is wrong because it provides access to AWS compliance reports, security documentation, and agreements, such as SOC and PCI reports, not request tracing capabilities. Option D (AWS License Manager) is wrong because it manages software licenses (e.g., Microsoft, Oracle) to prevent license violations, and has no role in tracing API requests or debugging distributed applications.

Full explanation →

227

Multi-Selectmedium

Which TWO actions should a developer take to ensure that an AWS CodeDeploy deployment is successful when deploying to an Auto Scaling group? (Choose TWO.)

Select 2 answers

A.Create an IAM service role that allows CodeDeploy to access the instances.

B.Attach an Application Load Balancer to the Auto Scaling group.

C.Enable the Application Discovery Service for the instances.

D.Configure the deployment to use a blue/green deployment type.

E.Install the CodeDeploy agent on each EC2 instance in the Auto Scaling group.

AnswersA, E

Creating an IAM service role is mandatory because CodeDeploy uses this role to assume permissions to call Amazon EC2 and Auto Scaling APIs, letting it enumerate instances, read tags, and perform deployment actions. Without this role, CodeDeploy cannot even start a deployment or resolve the target instances in the Auto Scaling group, making it a fundamental prerequisite.

Why this answer

The correct actions are to create an IAM service role that allows CodeDeploy to access the instances (Option A) and install the CodeDeploy agent on each EC2 instance in the Auto Scaling group (Option E). The service role grants CodeDeploy the necessary permissions to deploy to the instances, and the agent must be running on each instance to receive and execute deployment commands. Option B is not required; a load balancer is optional and not necessary for successful deployments.

Option C is irrelevant; the Application Discovery Service is used for discovery and migration planning, not for CodeDeploy. Option D is not required; CodeDeploy supports both in-place and blue/green deployments, but the question does not specify which type, and a blue/green deployment is not mandatory for success.

Full explanation →

228

MCQeasy

A company wants to deploy an application using AWS Elastic Beanstalk. The application requires a relational database. What is the BEST practice for managing the database?

A.Create an Amazon RDS database instance separately and configure the application to connect to it.

B.Use the Elastic Beanstalk console to add an RDS database to the environment.

C.Use an S3 bucket to store data.

D.Use Amazon DynamoDB as the database.

AnswerA

Creating an Amazon RDS database instance separately and configuring the application to connect to it is a best practice for decoupling the database from the application's environment. This approach ensures that the database's lifecycle, including scaling, backups, and patching, is independent of the Elastic Beanstalk environment. This prevents accidental data loss if the Beanstalk environment is terminated or rebuilt, providing greater data persistence and operational flexibility.

Why this answer

The best practice for managing a relational database in Elastic Beanstalk is to decouple the database from the application lifecycle by creating an Amazon RDS instance separately. This ensures the database is not deleted when the Elastic Beanstalk environment is terminated, provides better control over backups, scaling, and maintenance, and allows the application to connect via environment variables or configuration files. Using a separate RDS instance aligns with production best practices for durability and operational flexibility.

Exam trap

The trap here is that candidates assume the integrated RDS option in Elastic Beanstalk is the simplest and therefore best approach, but the exam tests the understanding that decoupling the database from the environment lifecycle is the production best practice to avoid accidental data loss.

How to eliminate wrong answers

Option B is wrong because adding an RDS database via the Elastic Beanstalk console ties the database lifecycle to the environment, meaning the database is deleted when the environment is terminated, which is risky for production workloads. Option C is wrong because Amazon S3 is an object storage service, not a relational database; it cannot support SQL queries, transactions, or relational data models required by the application. Option D is wrong because Amazon DynamoDB is a NoSQL key-value and document database, not a relational database; it does not support SQL joins, ACID transactions across multiple tables, or schema enforcement needed for relational workloads.

Full explanation →

229

MCQmedium

A developer is creating a REST API using Amazon API Gateway with Lambda proxy integration. The API needs to accept and return binary data such as images or PDF files. The developer has configured the API to use the Lambda proxy integration. What additional configuration is required to support binary data?

A.Set the Content-Type header to application/octet-stream in the Lambda response.

B.In API Gateway, add the binary media types to the API settings, e.g., image/png, application/pdf.

C.Use an API Gateway custom domain with an SSL certificate.

D.Enable API caching with binary support.

AnswerB

This is the correct and essential step for API Gateway to properly handle binary data from a Lambda integration. By explicitly listing media types like `image/png` or `application/pdf` in the API Gateway's binary media types settings, you instruct API Gateway to treat incoming and outgoing payloads of these types as raw binary data. This ensures that API Gateway correctly base64-encodes binary responses from Lambda before sending them to the client and decodes binary requests before passing them to Lambda, preventing data corruption.

Why this answer

With Lambda proxy integration, API Gateway passes the client request as-is to Lambda and returns the Lambda response as-is to the client. To handle binary data, you must explicitly declare the binary media types (e.g., image/png, application/pdf) in the API Gateway REST API settings. This tells API Gateway to base64-encode the binary payload before sending it to Lambda and to decode the base64-encoded response from Lambda back to binary for the client.

Without this configuration, API Gateway treats all payloads as text and will corrupt binary data.

Exam trap

The trap here is that candidates assume Lambda proxy integration automatically handles binary data because it passes everything through, but in reality, API Gateway requires explicit binary media type configuration to avoid corrupting binary payloads during base64 encoding/decoding.

How to eliminate wrong answers

Option A is wrong because setting the Content-Type header to application/octet-stream in the Lambda response alone does not enable API Gateway to handle binary data; API Gateway must be explicitly configured with the binary media types in the API settings, and the Lambda response must also include the correct isBase64Encoded flag set to true. Option C is wrong because using a custom domain with an SSL certificate is related to HTTPS endpoint configuration and custom domain names, not to enabling binary data support in API Gateway. Option D is wrong because API caching is a performance optimization feature that caches responses; it does not provide or enable binary data handling, and there is no 'binary support' toggle in API caching.

Full explanation →

230

MCQmedium

A developer is optimizing a Node.js Lambda function that processes CSV files from S3. The function reads the entire file into memory, processes it, and writes results to DynamoDB. For large files, the function runs out of memory. What is the MOST effective optimization?

A.Increase the Lambda timeout to allow more processing time.

B.Increase the Lambda function memory to 3008 MB.

C.Use the AWS SDK's S3 GetObject with a stream and process in chunks.

D.Use S3 Select to retrieve only necessary columns.

AnswerC

Using the AWS SDK's S3 GetObject with a stream allows the Node.js Lambda function to read the large CSV file incrementally, rather than loading the entire object into memory at once. By processing data in small, manageable chunks as it arrives, the function significantly reduces its peak memory footprint. This approach directly addresses memory exhaustion by avoiding the need to hold the entire file in RAM, making it highly efficient for large file processing.

Why this answer

Using the AWS SDK's S3 GetObject with a stream allows the function to process the CSV file in chunks, avoiding loading the entire file into memory. This directly addresses the memory issue for large files. Option A is incorrect because increasing timeout does not reduce memory usage.

Option B is incorrect because while increasing memory might help, it does not solve the root cause and may increase costs; streaming is more efficient. Option D is incorrect because S3 Select is used to filter columns from S3 objects using SQL, but it does not solve the problem of loading the entire file into memory; it could reduce the data transferred but the function still needs to handle streaming or chunking.

Full explanation →

231

MCQhard

A company uses AWS CodePipeline with a manual approval step before deployment. The developer wants to ensure that if a pipeline execution is waiting for approval and new code is pushed, the awaiting execution is canceled and a new one starts with the latest code. Which pipeline execution mode should be configured?

A.Queued

B.Superseded

C.Parallel

D.Single

AnswerB

The Superseded execution mode is designed to prioritize the latest changes by canceling any currently running pipeline execution when a new source revision is detected. This ensures that the manual approval step, if present, will always apply to the most recent code changes, preventing the deployment of outdated versions. A new pipeline execution is then immediately initiated with the latest code, requiring a fresh approval for the most current state.

Why this answer

The Superseded execution mode is correct because it automatically cancels any currently running or waiting pipeline execution when a new one is triggered, ensuring that only the latest code proceeds through the pipeline. This is ideal for scenarios with manual approval steps where stale executions should not block or delay the deployment of the most recent commit.

Exam trap

The trap here is that candidates may confuse Superseded with Queued, assuming that queuing is the default or safest option, but they miss that Superseded is specifically designed to replace pending executions with the latest code push.

How to eliminate wrong answers

Option A is wrong because Queued mode places executions in a queue and runs them sequentially, meaning a waiting approval would not be canceled and the new push would wait until the previous execution completes. Option C is wrong because Parallel mode allows multiple executions to run concurrently, which would not cancel the awaiting execution and could lead to conflicting deployments. Option D is wrong because Single mode is not a valid execution mode in AWS CodePipeline; the available modes are Queued, Superseded, and Parallel.

Full explanation →

232

Multi-Selectmedium

A SAM application should gradually shift Lambda traffic and roll back on errors. Which two pieces are needed?

Select 2 answers

A.An S3 lifecycle rule

B.A Lambda alias/deployment preference

C.CloudWatch alarms tied to deployment health

D.A public S3 bucket

AnswersB, C

A Lambda alias, when combined with deployment preferences (often managed by AWS CodeDeploy), is the primary mechanism for implementing gradual traffic shifts for Lambda functions. This approach allows a new version of a Lambda function to incrementally receive a percentage of invocations, enabling canary or linear deployments and controlled rollouts to minimize risk.

Why this answer

AWS SAM uses Lambda aliases with deployment preferences (e.g., Canary10Percent5Minutes or Linear10PercentEvery10Minutes) to gradually shift traffic from the old version to the new version. Option C is correct because CloudWatch alarms can be tied to the deployment preferences to automatically roll back the traffic shift if the alarm enters the ALARM state, indicating errors or degraded health.

Exam trap

The trap here is that candidates often confuse deployment-related features (like S3 lifecycle rules or public buckets) with the actual AWS services (Lambda alias and CodeDeploy) that handle traffic shifting and rollback, leading them to select irrelevant options.

Full explanation →

233

MCQmedium

A developer is deploying a new version of an AWS Lambda function using the AWS CLI. The deployment fails with a 'ResourceConflictException' error. What is the MOST likely cause?

A.Another deployment is currently in progress for the same Lambda function.

B.The Lambda function code exceeds the maximum allowed size.

C.The Lambda function has an alias that conflicts with the version number.

D.The IAM role associated with the Lambda function does not have sufficient permissions.

AnswerA

AWS Lambda enforces serialization of updates to a function's code or configuration to maintain consistency. If an API call like `UpdateFunctionCode` or `UpdateFunctionConfiguration` is initiated while another update operation is already in progress for the same function, the subsequent call will fail. This contention for the resource's state results in a `ResourceConflictException`, preventing race conditions and ensuring the function's configuration remains coherent.

Why this answer

The 'ResourceConflictException' error in AWS Lambda occurs when you attempt to update a Lambda function while another update operation is already in progress. Lambda enforces a single in-flight update per function to prevent race conditions and ensure state consistency. The AWS CLI command (e.g., update-function-code) will fail immediately if a previous deployment has not completed, even if the previous deployment was triggered by the same or a different client.

Exam trap

The trap here is that candidates confuse 'ResourceConflictException' with permission errors or code size limits, but AWS specifically uses this exception to signal a concurrent update conflict, not a validation or authorization issue.

How to eliminate wrong answers

Option B is wrong because exceeding the maximum code size (250 MB for zip, 50 MB for direct upload) results in a 'RequestEntityTooLargeException' or 'InvalidParameterValueException', not a 'ResourceConflictException'. Option C is wrong because alias names and version numbers are separate namespaces; an alias cannot conflict with a version number, and such a conflict would cause a 'ResourceNotFoundException' or 'InvalidParameterValueException' if you tried to reference a non-existent version. Option D is wrong because insufficient IAM permissions would result in an 'AccessDeniedException' or 'AuthorizationError', not a 'ResourceConflictException'.

Full explanation →

234

MCQeasy

A developer is using Amazon API Gateway to create a REST API. The API must support CORS (Cross-Origin Resource Sharing) to allow requests from a web application hosted on a different domain. What must the developer do to enable CORS?

A.Use Amazon CloudFront to proxy the API and add CORS headers.

B.Enable CORS in the API Gateway settings and configure the required headers.

C.Nothing; API Gateway automatically handles CORS.

D.Add CORS headers in the Lambda function code.

AnswerB

API Gateway provides a dedicated feature to enable Cross-Origin Resource Sharing (CORS) directly within its console or via infrastructure as code. This involves configuring the `OPTIONS` method for resources, specifying allowed origins, methods, and headers, and ensuring the necessary `Access-Control-Allow-*` headers are automatically included in responses. This native capability simplifies CORS management, allowing the API Gateway to handle preflight requests and inject the required headers without custom backend logic.

Why this answer

Enabling CORS in API Gateway requires explicit configuration: you must enable CORS on the API Gateway resource, which automatically generates an OPTIONS method and adds the necessary CORS headers (Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers) to responses. This is done through the API Gateway console or API configuration, not by the backend Lambda function or CloudFront.

Exam trap

The trap here is that candidates assume API Gateway automatically handles CORS (Option C) or that adding headers only in the Lambda function is sufficient (Option D), forgetting that the browser's preflight OPTIONS request must be handled by API Gateway itself.

How to eliminate wrong answers

Option A is wrong because Amazon CloudFront does not automatically add CORS headers for API Gateway; it can only forward or modify headers if configured, but the CORS headers must originate from the API Gateway or backend. Option C is wrong because API Gateway does not automatically handle CORS; it requires explicit enabling and configuration of CORS headers and the OPTIONS preflight response. Option D is wrong because while you can add CORS headers in the Lambda function code, this only works for non-preflight requests; API Gateway must still handle the OPTIONS preflight request and return the appropriate CORS headers, which is why enabling CORS in API Gateway is the recommended approach.

Full explanation →

235

MCQmedium

A developer is deploying a new version of a Lambda function using the AWS CLI. The developer wants to shift 10% of traffic to the new version and then gradually increase to 100% over 10 minutes. Which CLI command should the developer use?

A.aws lambda publish-version --function-name my-function

B.aws lambda create-function --function-name my-function --zip-file fileb://my-code.zip

C.aws lambda update-alias --function-name my-function --name prod --function-version 2 --routing-config AdditionalVersionWeights={"1":0.9}

D.aws lambda invoke --function-name my-function --payload '{}'

AnswerC

This command precisely implements a canary deployment strategy by updating the `prod` alias. It configures the alias to direct 10% of the invocation traffic (calculated as 1.0 minus the specified `AdditionalVersionWeights` for the older version, 0.9) to the newly specified `function-version 2`. The remaining 90% of traffic continues to serve `version 1`, allowing for gradual rollout and monitoring of the new version before a full cutover.

Why this answer

The `update-alias` command with the `--routing-config` parameter allows you to implement canary deployments by assigning a percentage of traffic to a new Lambda function version. In this case, `AdditionalVersionWeights={"1":0.9}` routes 10% of traffic to version 2 (the new version) and 90% to version 1. However, note that this command only sets a static routing configuration; to gradually increase traffic to 100% over 10 minutes, you must update the alias multiple times (e.g., via a script) to adjust the weights progressively.

The command shown is the correct initial step to start the canary deployment.

Exam trap

The trap here is that candidates may confuse `publish-version` (which only creates a version) with the alias routing command needed to actually shift traffic, or they may think `invoke` can be used for deployment, but only `update-alias` with `--routing-config` enables the weighted traffic shift described in the question.

How to eliminate wrong answers

Option A is wrong because `publish-version` only creates a new immutable version of the Lambda function but does not route any traffic to it; it requires a separate alias update to shift traffic. Option B is wrong because `create-function` is used to create a new Lambda function from scratch, not to deploy a new version or manage traffic routing for an existing function. Option D is wrong because `invoke` is used to synchronously invoke a Lambda function with a payload, not to deploy or shift traffic between versions.

Full explanation →

236

MCQhard

A company uses AWS CodeBuild for building and testing their application. They have a build project that runs on a Linux environment. They want to run a build in a custom Docker image that is stored in Amazon ECR. How should they configure the build project?

A.Add a 'Dockerfile' to the source code and specify it in the buildspec.

B.In the environment configuration, set the 'Image' field to the ECR image URI.

C.Use a managed image provided by AWS CodeBuild.

D.Configure the pipeline to pass the image URI as an environment variable.

AnswerB

AWS CodeBuild projects allow you to define the build environment by specifying a custom Docker image. This is achieved by navigating to the "Environment" section of the CodeBuild project configuration and setting the "Image" field directly to the Amazon ECR image URI (e.g., `aws_account_id.dkr.ecr.region.amazonaws.com/repository-name:tag`). CodeBuild will then pull this specific image from ECR to execute the build commands, ensuring a consistent and controlled build environment.

Why this answer

AWS CodeBuild allows you to specify a custom Docker image from Amazon ECR by entering its URI directly in the 'Image' field under the environment configuration. This enables the build to run in a container that includes all necessary dependencies, without requiring a Dockerfile in the source code or a managed image.

Exam trap

The trap here is that candidates confuse specifying a Dockerfile to build a new image (Option A) with using an existing custom image as the build environment, leading them to overlook the direct ECR URI configuration in the environment settings.

How to eliminate wrong answers

Option A is wrong because adding a Dockerfile to the source code and specifying it in the buildspec is used for building a new Docker image, not for running the build in an existing custom image from ECR. Option C is wrong because managed images provided by AWS CodeBuild are pre-configured environments (e.g., Ubuntu, Windows) and do not include custom dependencies that the company needs. Option D is wrong because passing the image URI as an environment variable does not instruct CodeBuild to use that image as the runtime environment; the image must be specified in the environment configuration's 'Image' field.

Full explanation →

237

MCQeasy

A developer needs to grant cross-account access to an S3 bucket for an IAM user from another AWS account. The developer has added a bucket policy that allows the user's ARN. However, the user still cannot access the bucket. What additional step is required?

A.The user must have an IAM policy allowing the required S3 actions on that bucket

B.The bucket must be made public

C.The user must use a different AWS CLI profile

D.The resource-based policy must explicitly allow the user's ARN

AnswerA

For an IAM user in one AWS account to access an S3 bucket in another account, both the resource-based policy (bucket policy) and the identity-based policy (IAM user policy) must explicitly grant the necessary permissions. Even if the bucket policy permits the cross-account access, the IAM user's own policy must also authorize the specific S3 actions. This adherence to the principle of least privilege ensures that the user is explicitly allowed to perform the action from their identity's perspective.

Why this answer

A is correct because cross-account access to an S3 bucket requires both a resource-based policy (the bucket policy) that grants access to the user's ARN and an identity-based policy (an IAM policy attached to the user) that explicitly allows the required S3 actions on that bucket. Without the IAM policy, the user's account denies the request by default, even if the bucket policy permits it. This is the principle of 'permission delegation' in AWS: the resource owner can grant access, but the user's own account must also authorize the action.

Exam trap

The trap here is that candidates assume a bucket policy alone is sufficient for cross-account access, forgetting that the requesting account must also explicitly authorize the action via an IAM policy, which is a common oversight in AWS cross-account scenarios.

How to eliminate wrong answers

Option B is wrong because making the bucket public would grant access to all anonymous users, which is overly permissive and not a secure or necessary step for cross-account access; the bucket policy already specifies the user's ARN. Option C is wrong because using a different AWS CLI profile does not resolve the underlying permission issue; the user's IAM policy must allow the S3 actions regardless of the profile used. Option D is wrong because the developer has already added a bucket policy that explicitly allows the user's ARN, so this step is already done; the missing piece is the user's own IAM policy.

Full explanation →

238

MCQmedium

A developer is using AWS Elastic Beanstalk to deploy a web application. The application writes logs to the local file system. The developer wants to ensure that logs are automatically rotated and retained for 30 days. What should the developer do?

A.Modify the application code to write logs directly to an S3 bucket with lifecycle policies.

B.Add a cron job to the EC2 instances that compresses and deletes old logs.

C.Configure the Elastic Beanstalk environment to enable log rotation and set retention period to 30 days.

D.Install the CloudWatch Logs agent on the EC2 instances and configure it to stream logs to CloudWatch Logs with a 30-day retention.

AnswerC

Elastic Beanstalk provides built-in environment properties to manage log rotation and retention directly, making it the most appropriate and integrated solution for this requirement. Developers can configure settings like `LogRotationPeriod` and `LogRotationSizeThreshold` through the Elastic Beanstalk console, CLI, or configuration files. This ensures local log files are automatically rotated and old logs are removed, preventing disk space issues without requiring custom code or manual scripts.

Why this answer

Elastic Beanstalk provides a built-in configuration for log rotation and retention directly in the environment settings. By enabling log rotation and setting the retention period to 30 days, the developer can automatically manage logs without modifying application code or adding external agents. This leverages the Elastic Beanstalk health agent, which handles log rotation on the EC2 instances and stores rotated logs in Amazon S3 with lifecycle policies to enforce the retention period.

Exam trap

The trap here is that candidates often overcomplicate the solution by choosing CloudWatch Logs (Option D) because it is a common logging service, but the question specifically asks for automatic rotation and retention on the local file system, which Elastic Beanstalk's built-in feature handles directly without additional services.

How to eliminate wrong answers

Option A is wrong because writing logs directly to S3 from application code bypasses the local file system requirement and introduces unnecessary complexity, such as managing S3 permissions and handling network latency, while Elastic Beanstalk already provides a simpler built-in log rotation mechanism. Option B is wrong because adding a cron job to EC2 instances is a manual, non-scalable approach that does not integrate with Elastic Beanstalk's managed environment; it also lacks centralized retention control and can be lost during instance replacements. Option D is wrong because while CloudWatch Logs agent can stream logs with a 30-day retention, this requires additional setup and costs, and it does not perform local log rotation on the file system; Elastic Beanstalk's native log rotation is more straightforward for this specific requirement.

Full explanation →

239

MCQeasy

A developer is deploying a web application on EC2 instances behind an Application Load Balancer (ALB). The application needs to encrypt data in transit between the client and the ALB. Which AWS service should be used to manage the SSL/TLS certificate?

A.AWS Certificate Manager (ACM)

B.AWS Key Management Service (KMS)

C.AWS Secrets Manager

D.AWS Identity and Access Management (IAM)

AnswerA

AWS Certificate Manager (ACM) is the dedicated AWS service for provisioning, managing, and deploying SSL/TLS certificates, including those required for HTTPS on web applications. It integrates seamlessly with services like Application Load Balancer (ALB), allowing you to easily attach certificates to secure traffic. ACM handles the entire certificate lifecycle, including automatic renewal, which significantly reduces the operational overhead of manual certificate management and ensures continuous secure communication between clients and the load balancer.

Why this answer

AWS Certificate Manager (ACM) is the correct service because it provisions, manages, and deploys public and private SSL/TLS certificates that can be associated with an Application Load Balancer (ALB) to encrypt data in transit between clients and the ALB. ACM handles certificate renewal automatically and integrates natively with ALB, removing the need for manual certificate management. This ensures HTTPS termination at the load balancer, securing the client-to-ALB communication.

Exam trap

The trap here is that candidates may confuse AWS KMS (used for encryption at rest) with ACM (used for encryption in transit), or incorrectly assume IAM can manage SSL/TLS certificates for ALBs when it only supports legacy certificate uploads for CloudFront and Elastic Load Balancers in specific cases.

How to eliminate wrong answers

Option B (AWS KMS) is wrong because KMS is a key management service for creating and controlling encryption keys used for data at rest, not for managing SSL/TLS certificates for data in transit. Option C (AWS Secrets Manager) is wrong because Secrets Manager is designed to rotate and manage secrets such as database credentials and API keys, not SSL/TLS certificates for load balancers. Option D (AWS IAM) is wrong because IAM is an identity and access management service for controlling user and resource permissions, and while IAM can support SSL certificates for legacy CloudFront distributions, it does not manage or automate SSL/TLS certificates for ALBs and is not the recommended service for this purpose.

Full explanation →

240

MCQeasy

A developer wants to store application configuration data that can be accessed by multiple microservices. The data is sensitive and should be encrypted at rest. Which AWS service should be used to meet these requirements?

A.Amazon S3

B.AWS Identity and Access Management (IAM)

C.Amazon DynamoDB

D.AWS Systems Manager Parameter Store

AnswerD

AWS Systems Manager Parameter Store is a highly scalable, secure, and easy-to-use service for storing and managing configuration data and secrets. It supports hierarchical organization, versioning, and secure string types, allowing sensitive data like database credentials or API keys to be encrypted at rest using AWS KMS. Applications can securely retrieve parameters at runtime, making it the ideal solution for centralized application configuration management.

Why this answer

AWS Systems Manager Parameter Store provides a secure, hierarchical store for configuration data and secrets. It supports encryption at rest using AWS KMS, integrates with AWS IAM for fine-grained access control, and is designed for use by multiple microservices via the AWS SDK or CLI. This makes it the ideal choice for storing sensitive application configuration that must be encrypted at rest and accessed by distributed services.

Exam trap

The trap here is that candidates often choose Amazon S3 because they think of storing configuration files (e.g., JSON or YAML) in buckets, but they overlook that Parameter Store is purpose-built for secure, encrypted configuration management with native IAM integration and no need to manage file access or encryption manually.

How to eliminate wrong answers

Option A is wrong because Amazon S3 is an object storage service, not a configuration store; while it supports encryption at rest, it lacks native hierarchical parameter management, versioning of configuration values, and seamless integration with AWS SDKs for parameter retrieval without custom code. Option B is wrong because AWS Identity and Access Management (IAM) is an access management service for controlling permissions, not a data store; it cannot store application configuration data or secrets. Option C is wrong because Amazon DynamoDB is a NoSQL database designed for high-performance, scalable data storage, but it does not provide built-in encryption at rest by default (requires additional configuration with AWS KMS), and it lacks native parameter store features like tiered pricing, automatic rotation, or simple key-value retrieval without provisioning read/write capacity units.

Full explanation →

241

Multi-Selectmedium

A company is using Amazon RDS for MySQL with Multi-AZ deployment. The application writes to the database using the primary endpoint. The company wants to improve read performance and offload read traffic from the primary instance. Which TWO actions should the company take? (Choose TWO.)

Select 2 answers

A.Create an Amazon RDS read replica in the same region.

B.Add another primary instance and configure replication.

C.Modify the application to use the read replica endpoint for SELECT queries.

D.Use the Multi-AZ secondary instance endpoint for read queries.

E.Enable Amazon RDS Proxy to distribute read queries across instances.

AnswersA, C

Creating an Amazon RDS read replica in the same region provides an asynchronously replicated copy of the primary database instance. This replica is specifically designed to handle read-only queries, such as SELECT statements, thereby offloading the read workload from the primary instance. By distributing read traffic, the primary instance's CPU, I/O, and connection utilization are significantly reduced, allowing it to dedicate resources to write operations and maintain optimal performance for critical transactions.

Why this answer

Amazon RDS read replicas are designed to offload read traffic from the primary DB instance. A read replica is an asynchronous copy of the primary that can serve SELECT queries, improving read performance without impacting write operations on the primary. Option C is correct because the application must explicitly use the read replica's endpoint for read queries; the replica does not automatically balance traffic.

Together, creating a read replica and modifying the application to direct SELECT queries to its endpoint achieves the goal of improving read performance and offloading the primary.

Exam trap

The trap here is confusing Multi-AZ standby instances with read replicas—candidates often think the standby can serve reads, but it is a passive replica that only becomes active during failover and has no accessible endpoint for read queries.

Full explanation →

242

MCQeasy

A developer needs to store session state data for a web application running on multiple EC2 instances. The data must be highly available and durable. Which AWS service should be used?

A.Amazon ElastiCache

B.Amazon S3

C.Amazon EBS

D.Amazon CloudFront

AnswerA

Amazon ElastiCache provides managed in-memory data stores, such as Redis or Memcached, which offer extremely low-latency access and high throughput. This makes it an ideal choice for storing frequently accessed, transient session state data for web applications. By centralizing session state in ElastiCache, application servers can remain stateless, allowing for seamless horizontal scaling and high availability across multiple instances without losing user sessions.

Why this answer

Amazon ElastiCache is the correct choice because it provides a managed, in-memory caching service that is ideal for storing session state data with high availability and durability. By using ElastiCache for Redis or Memcached, session data is stored outside of individual EC2 instances, ensuring that if an instance fails, the session state is preserved and can be accessed by other instances in the application tier. ElastiCache supports replication and automatic failover, meeting the requirements for high availability and durability.

Exam trap

The trap here is that candidates often confuse Amazon ElastiCache with Amazon DynamoDB or Amazon S3 for session storage, but the question specifically requires a highly available and durable in-memory solution, and ElastiCache is the only option that provides low-latency, shared session state across multiple EC2 instances with built-in replication and failover.

How to eliminate wrong answers

Option B (Amazon S3) is wrong because S3 is an object storage service designed for large-scale data storage and retrieval, not for low-latency session state access; its eventual consistency model and higher latency make it unsuitable for real-time session management. Option C (Amazon EBS) is wrong because EBS provides block-level storage volumes attached to a single EC2 instance, so session data stored on an EBS volume is not shared across multiple instances and becomes unavailable if the instance fails, violating the high availability requirement. Option D (Amazon CloudFront) is wrong because CloudFront is a content delivery network (CDN) that caches static and dynamic content at edge locations; it does not provide a storage mechanism for session state data and is not designed for transactional, stateful data persistence.

Full explanation →

243

MCQeasy

A developer uses AWS CodeCommit to store source code. The developer wants to automatically trigger a build in AWS CodeBuild every time a new commit is pushed to the master branch. Which AWS service should the developer use to configure this integration?

A.Amazon CloudWatch Events (or EventBridge)

B.Amazon S3 events

C.AWS CodeDeploy

D.AWS CodePipeline

AnswerD

CodePipeline integrates CodeCommit and CodeBuild for continuous integration.

Why this answer

AWS CodePipeline is the correct service because it provides a fully managed continuous delivery service that can be configured to automatically start a pipeline execution whenever a new commit is pushed to a specific branch in AWS CodeCommit. By setting up a CodeCommit source action in a pipeline, CodePipeline uses webhooks or polling to detect changes and then triggers the build project in AWS CodeBuild as the next stage. This creates a seamless CI/CD workflow without requiring custom event rules or additional services.

Exam trap

The trap here is that candidates often confuse event-driven triggers (CloudWatch Events/EventBridge) with the purpose-built CI/CD orchestration service (CodePipeline), overlooking that CodePipeline natively integrates with CodeCommit and CodeBuild to provide a complete pipeline with stages, transitions, and error handling.

How to eliminate wrong answers

Option A is wrong because Amazon CloudWatch Events (or EventBridge) can detect CodeCommit repository state changes and invoke targets like CodeBuild, but it is not the primary or recommended service for orchestrating a multi-stage CI/CD pipeline; it requires custom event rules and does not provide built-in pipeline sequencing, approval gates, or stage transitions. Option B is wrong because Amazon S3 events are designed for object-level operations in S3 buckets, not for detecting commits in a CodeCommit repository; CodeCommit does not emit S3 events. Option C is wrong because AWS CodeDeploy is a deployment service that automates application deployments to compute services like EC2, Lambda, or on-premises instances; it does not detect source code changes or trigger builds, and it is typically used as a deployment action within a pipeline, not as the trigger mechanism.

Full explanation →

244

MCQeasy

A developer is creating an API with Amazon API Gateway that needs to accept binary data (e.g., images) and store them directly in an S3 bucket. The developer wants to minimize backend complexity. Which integration type should be used?

A.AWS service integration with S3

B.Lambda proxy integration

C.HTTP integration

D.Mock integration

AnswerA

AWS service integration enables API Gateway to directly invoke actions on other AWS services, such as S3, without requiring an intermediate compute layer like Lambda. For storing objects, this integration type allows API Gateway to map incoming request bodies directly to S3 PUT object operations. This approach significantly minimizes backend complexity and latency by leveraging S3's native capabilities for object storage, making it the most efficient solution for directly accepting and storing data.

Why this answer

AWS service integration with S3 allows API Gateway to directly proxy binary data (e.g., images) to an S3 bucket without invoking a Lambda function or other backend. This minimizes backend complexity because the API Gateway handles the request transformation and passes the payload directly to S3 via the PutObject API action, eliminating the need for custom code.

Exam trap

The trap here is that candidates often default to Lambda proxy integration for any data processing task, overlooking that direct AWS service integration can handle binary uploads to S3 without any compute layer, which is the simplest and most cost-effective approach.

How to eliminate wrong answers

Option B (Lambda proxy integration) is wrong because it introduces unnecessary backend complexity by requiring a Lambda function to receive the binary data and then upload it to S3, adding compute cost and latency. Option C (HTTP integration) is wrong because it would require a separate HTTP endpoint (e.g., on EC2 or on-premises) to receive the data and then forward it to S3, defeating the goal of minimizing backend complexity. Option D (Mock integration) is wrong because it only returns static responses from API Gateway without actually storing any data in S3, so it cannot fulfill the requirement of persisting binary data.

Full explanation →

245

MCQeasy

A developer wants to encrypt data in transit between an API Gateway REST API and its clients. Which configuration should be used?

A.Use a custom domain name with a certificate from ACM.

B.Implement client-side encryption using a JavaScript library.

C.Use the default HTTPS endpoint provided by API Gateway.

D.Attach an AWS WAF web ACL to the API Gateway.

AnswerC

The default HTTPS endpoint provided by API Gateway automatically ensures that all data transmitted between the client and the API Gateway is encrypted in transit. AWS manages the SSL/TLS certificates and the underlying infrastructure, providing robust transport layer security (TLS) out-of-the-box. This inherent feature means developers do not need to perform additional steps to secure the communication channel.

Why this answer

API Gateway REST APIs automatically provide an HTTPS endpoint using TLS for data in transit encryption. This default endpoint uses an Amazon-issued certificate, ensuring encryption between clients and API Gateway without any additional configuration. The developer only needs to use the default HTTPS URL provided by API Gateway to satisfy the requirement.

Exam trap

The trap here is that candidates often overcomplicate the solution by assuming a custom domain or additional services like WAF are needed for encryption, when the default HTTPS endpoint already provides TLS encryption for data in transit.

How to eliminate wrong answers

Option A is wrong because using a custom domain name with a certificate from ACM is an optional feature for branding or custom DNS, not a requirement for encrypting data in transit; the default HTTPS endpoint already provides encryption. Option B is wrong because client-side encryption using a JavaScript library encrypts data before sending it over the network, but it does not address the requirement of encrypting data in transit between the client and API Gateway; the transport layer (TLS) is already encrypted by the default HTTPS endpoint, and client-side encryption adds unnecessary complexity and is not a standard approach for transport encryption. Option D is wrong because AWS WAF is a web application firewall that protects against common web exploits, not a mechanism for encrypting data in transit; it operates at the application layer and does not provide TLS/SSL encryption.

Full explanation →

246

MCQmedium

A Lambda function processing SQS messages is failing with concurrency errors. The function is configured with reserved concurrency of 5. The SQS queue has a batch size of 10. What is the most effective way to prevent throttling?

A.Reduce the batch size to 1 to spread out invocations.

B.Increase the Lambda function memory to get more concurrency.

C.Increase the reserved concurrency to a higher value.

D.Set the SQS queue's concurrency limit to match the Lambda reserved concurrency.

AnswerC

Increasing the reserved concurrency for the Lambda function dedicates a specific number of concurrent execution slots exclusively to that function. This guarantees that the function will always have that many concurrent instances available, preventing it from being throttled by the overall account-level concurrency limit or by other functions consuming available capacity. By reserving more concurrency, the function can process a higher parallel load from SQS without interruption, directly addressing throttling issues.

Why this answer

The function is throttling due to insufficient reserved concurrency. With a batch size of 10, each SQS batch triggers one invocation, but the function's reserved concurrency of 5 limits concurrent executions to 5. Increasing reserved concurrency allows more concurrent invocations to handle the SQS messages without throttling.

Exam trap

The trap here is that candidates often confuse batch size with concurrency, thinking reducing batch size reduces load, but it actually increases invocation count and worsens throttling.

How to eliminate wrong answers

Option A is wrong because reducing the batch size to 1 would increase the number of invocations per message, worsening concurrency pressure and potentially increasing throttling. Option B is wrong because increasing Lambda memory does not affect concurrency limits; memory and concurrency are independent settings. Option D is wrong because SQS queues do not have a configurable concurrency limit; Lambda's event source mapping manages polling, and setting a non-existent queue concurrency limit is not a valid action.

Full explanation →

247

MCQhard

A developer is using AWS Lambda to process sensitive data. The Lambda function needs to access a DynamoDB table that is encrypted with a customer-managed CMK. The developer is using the default Lambda execution role. What must be done to allow Lambda to decrypt the DynamoDB table?

A.Add a policy to the Lambda execution role allowing dynamodb:GetItem.

B.Add a policy to the KMS key that allows the Lambda execution role to perform kms:Decrypt.

C.Configure a VPC endpoint for DynamoDB.

D.Modify the Lambda function to call KMS Decrypt API.

AnswerB

The KMS key policy must allow the Lambda execution role to perform kms:Decrypt. This is required because DynamoDB uses server-side encryption with KMS, and the service needs to decrypt data on behalf of the Lambda function.

Why this answer

The DynamoDB table is encrypted with a customer-managed CMK. The Lambda execution role must be granted permission to use that key. This is done by adding a statement to the KMS key's key policy that allows the Lambda execution role to perform kms:Decrypt.

DynamoDB will then perform the decryption on behalf of Lambda. Option A is incorrect because dynamodb:GetItem alone does not grant KMS decrypt permissions. Option C is incorrect because a VPC endpoint is not related to KMS permissions.

Option D is incorrect because Lambda does not need to directly call the KMS Decrypt API; the key policy handles the authorization.

Full explanation →

248

MCQeasy

A developer needs to grant an IAM role in the same AWS account read-only access to objects in a specific S3 bucket. The bucket is configured with a bucket policy that has an explicit Deny statement denying all principals except the root user. Which approach should the developer use to grant the required access?

A.Modify the bucket policy to allow the IAM role explicitly, or remove the Deny statement

B.Attach an IAM policy to the role that allows s3:GetObject on the bucket

C.Use an S3 access point instead of the bucket directly

D.Make the bucket public to allow all access

AnswerA

To grant an IAM role read-only access when an explicit Deny exists in the bucket policy, the Deny statement must be modified or removed. AWS IAM policy evaluation logic dictates that an explicit Deny always takes precedence over any Allow statement, whether from an identity-based policy (on the role) or a resource-based policy (on the bucket). Adjusting the bucket policy to explicitly allow the specific IAM role for `s3:GetObject` actions, or ensuring the existing Deny no longer applies to that role, is the only way to permit access.

Why this answer

The bucket policy contains an explicit Deny that overrides any allow permissions, including those granted by an IAM policy attached to the role. To grant the IAM role read-only access, the developer must either remove the Deny statement or add an explicit Allow for the role in the bucket policy, because an explicit Deny in a resource-based policy cannot be overridden by an identity-based policy.

Exam trap

The trap here is that candidates assume an IAM policy attached to the role is sufficient to override a bucket policy's explicit Deny, but they forget that explicit Deny always wins regardless of the source of the allow.

How to eliminate wrong answers

Option B is wrong because attaching an IAM policy that allows s3:GetObject to the role is insufficient; the explicit Deny in the bucket policy will still block access, as explicit Deny statements take precedence over any allow. Option C is wrong because an S3 access point uses the same underlying bucket policy; the explicit Deny in the bucket policy would still apply to requests made through the access point unless the bucket policy is modified. Option D is wrong because making the bucket public would grant access to everyone, which violates the principle of least privilege and does not specifically grant read-only access to the IAM role.

Full explanation →

249

MCQhard

A developer is using AWS CodeDeploy to deploy an application to an Auto Scaling group of EC2 instances. The application is critical and must have zero downtime. The Auto Scaling group currently has 4 instances spread across 2 Availability Zones. Which predefined deployment configuration minimizes the number of instances taken out of service at any given time?

A.CodeDeployDefault.AllAtOnce

B.CodeDeployDefault.HalfAtATime

C.CodeDeployDefault.OneAtATime

D.CodeDeployDefault.LambdaCanary10Percent5Minutes

AnswerC

OneAtATime deploys to a single instance at a time, minimizing the number of instances offline and best preserving availability.

Why this answer

CodeDeployDefault.OneAtATime, is correct because it deploys the application to only one instance at a time, ensuring that the remaining instances continue to serve traffic. This minimizes the number of instances taken out of service at any given moment, which is critical for achieving zero downtime in an Auto Scaling group with 4 instances across 2 Availability Zones.

Exam trap

The trap here is that candidates may confuse deployment configurations designed for EC2 instances (like OneAtATime) with those for Lambda (like LambdaCanary10Percent5Minutes), or incorrectly assume HalfAtATime is the safest option without considering that OneAtATime minimizes the number of instances out of service even further.

How to eliminate wrong answers

Option A is wrong because CodeDeployDefault.AllAtOnce deploys to all instances simultaneously, taking all 4 instances out of service at once, which violates the zero-downtime requirement. Option B is wrong because CodeDeployDefault.HalfAtATime deploys to 2 instances at a time (half of 4), which takes more instances out of service than necessary compared to OneAtATime. Option D is wrong because CodeDeployDefault.LambdaCanary10Percent5Minutes is a deployment configuration for AWS Lambda functions, not for EC2 instances in an Auto Scaling group, and is therefore inapplicable.

Full explanation →

250

MCQhard

A company uses an Amazon S3 bucket to store sensitive documents. The security team requires that all objects uploaded to the bucket must be encrypted at rest using server-side encryption with a customer-managed KMS key (SSE-KMS). A developer needs to enforce this by denying any PutObject request that does not specify the required encryption. Which bucket policy condition should be used?

A."Condition": {"StringNotEquals": {"s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:us-east-1:123456789012:key/abc123"}}

B."Condition": {"StringNotEquals": {"s3:x-amz-server-side-encryption": "aws:kms"}}

C."Condition": {"Null": {"s3:x-amz-server-side-encryption-aws-kms-key-id": "true"}}

D."Condition": {"ArnNotEquals": {"s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:us-east-1:123456789012:key/abc123"}}

AnswerA

This policy condition correctly enforces the use of a *specific* AWS KMS key for Server-Side Encryption (SSE-KMS) when objects are uploaded to the S3 bucket. The `s3:x-amz-server-side-encryption-aws-kms-key-id` condition key checks the value of the `x-amz-server-side-encryption-aws-kms-key-id` request header. By using `StringNotEquals` with the desired KMS key ARN, any PUT object request that does *not* specify this exact ARN in the header will be denied, effectively mandating its use. This ensures sensitive documents are encrypted with the designated corporate key.

Why this answer

The condition `s3:x-amz-server-side-encryption-aws-kms-key-id` with `StringNotEquals` explicitly denies any PutObject request that does not specify the exact customer-managed KMS key ARN. This enforces SSE-KMS with a specific key, meeting the security team's requirement that all objects must be encrypted at rest using that key.

Exam trap

The trap here is that candidates often confuse the condition key for the encryption type (`s3:x-amz-server-side-encryption`) with the condition key for the specific KMS key ID (`s3:x-amz-server-side-encryption-aws-kms-key-id`), leading them to pick Option B which only enforces SSE-KMS but not a specific customer-managed key.

How to eliminate wrong answers

Option B is wrong because `s3:x-amz-server-side-encryption` with `aws:kms` only checks that SSE-KMS is used, but does not enforce a specific customer-managed KMS key; it would allow any KMS key, including the default AWS-managed key. Option C is wrong because the `Null` condition on `s3:x-amz-server-side-encryption-aws-kms-key-id` would deny requests where the key ID is not present, but it would not enforce that the key is the specific customer-managed key; it could be any KMS key ID. Option D is wrong because `ArnNotEquals` is not a valid condition operator for S3 bucket policies; the correct operator for string comparison is `StringNotEquals`.

Full explanation →

251

MCQmedium

A developer is using AWS SAM to deploy a serverless application. The template includes a Lambda function that connects to an RDS MySQL database. The function works correctly in the developer's account but fails with a timeout when deployed to a production account. What is the MOST likely cause?

A.The Lambda function timeout is set too low for the database query.

B.The Lambda function is not attached to the same VPC as the RDS instance.

C.The SAM template does not support RDS as an event source.

D.The Lambda function uses a runtime that is not compatible with the MySQL client.

AnswerB

For a Lambda function to securely and privately access an Amazon RDS instance, it must be configured to operate within the same Virtual Private Cloud (VPC) as the database. RDS instances are typically deployed into private subnets without public internet access, requiring the Lambda function to be placed within that VPC to establish a private network connection. If the Lambda is not attached to the correct VPC, it will be unable to resolve the private IP address or reach the RDS endpoint, leading to connection failures.

Why this answer

The most likely cause is that the Lambda function is not attached to the same VPC as the RDS instance. Lambda functions run in a VPC by default only if explicitly configured; without VPC attachment, the function cannot reach the RDS database's private IP address, leading to a connection timeout. The developer's account may have had the RDS instance publicly accessible or the Lambda function was inadvertently in the same VPC, but the production account likely uses a private RDS instance in a VPC that the Lambda function is not connected to.

Exam trap

The trap here is that candidates often assume a Lambda function can always reach an RDS database by default, overlooking the critical VPC configuration requirement for private resources.

How to eliminate wrong answers

Option A is wrong because a low Lambda function timeout would cause a timeout error, but the symptom is a connection timeout (the function fails to connect at all), not a query execution timeout; the core issue is network connectivity, not the timeout value. Option C is wrong because SAM templates do not need to define RDS as an event source; Lambda connects to RDS via the database client library in the function code, not through an event source mapping. Option D is wrong because the Lambda function works correctly in the developer's account, proving the runtime is compatible with the MySQL client; the failure is environment-specific, not runtime-related.

Full explanation →

252

MCQeasy

A developer needs to store temporary session data for a web application running on Amazon EC2 behind an Application Load Balancer. The data must be accessible across multiple EC2 instances. Which AWS service should the developer use?

A.Amazon ElastiCache

B.Amazon EBS

C.Amazon DynamoDB

D.Amazon S3

AnswerA

Amazon ElastiCache, offering managed Redis or Memcached, is the optimal choice for storing temporary session data. Its in-memory nature provides sub-millisecond latency and high throughput, crucial for frequently accessed session information. By externalizing session state from individual web servers, ElastiCache enables horizontal scaling of application instances and ensures session continuity even if an instance fails, preventing the need for sticky sessions.

Why this answer

Amazon ElastiCache is the correct choice because it provides a managed, in-memory caching service (e.g., Redis or Memcached) that can store temporary session data with sub-millisecond latency. Since the data must be accessible across multiple EC2 instances behind an Application Load Balancer, ElastiCache offers a centralized, highly available data store that all instances can read from and write to, ensuring session persistence regardless of which instance handles a request.

Exam trap

The trap here is that candidates often confuse 'temporary session data' with 'persistent user data' and choose DynamoDB for its scalability, overlooking that ElastiCache is purpose-built for low-latency, ephemeral storage with automatic eviction policies.

How to eliminate wrong answers

Option B (Amazon EBS) is wrong because EBS volumes are block-level storage attached to a single EC2 instance in a specific Availability Zone; they cannot be shared across multiple instances for concurrent read/write access. Option C (Amazon DynamoDB) is wrong because while it is a fully managed NoSQL database that can store session data, it is a persistent, disk-based database with higher latency than an in-memory cache, and it is overkill for temporary session data that does not require durability. Option D (Amazon S3) is wrong because S3 is an object storage service designed for high-durability, long-term storage with eventual consistency (unless using S3 Select or versioning), and its higher latency and lack of native sub-millisecond access make it unsuitable for real-time session data that must be read and written on every request.

Full explanation →

253

MCQmedium

A developer is using AWS Elastic Beanstalk to deploy a web application. The application uses an Amazon RDS database instance that is included in the Elastic Beanstalk environment. The developer wants to update the application code without affecting the database. What is the recommended approach?

A.Update the application code directly on the EC2 instances without redeploying the environment.

B.Create a new environment configuration, update the code, and swap the CNAME of the environments.

C.Decouple the database from the Elastic Beanstalk environment by creating a separate RDS instance and connecting the application to it externally.

D.Use Elastic Beanstalk's platform updates while keeping the database attached to the environment.

AnswerC

Decoupling the database by provisioning a standalone Amazon RDS instance outside the Elastic Beanstalk environment ensures its independent lifecycle management, allowing for separate scaling, backups, and patching. The application then connects to this external database using environment properties, guaranteeing data persistence and availability even if the Elastic Beanstalk environment is rebuilt, terminated, or updated, which is critical for production workloads.

Why this answer

When an RDS instance is included in an Elastic Beanstalk environment, it is tied to the environment's lifecycle. If the environment is terminated or rebuilt, the database is also deleted. Decoupling the database by creating a standalone RDS instance and connecting the application to it externally ensures the database persists independently of application deployments, allowing code updates without risking data loss.

Exam trap

The trap here is that candidates assume swapping CNAMEs between environments (blue/green deployment) is sufficient to protect the database, but they overlook that the database is still lifecycle-managed within each environment and will be lost if the original environment is terminated.

How to eliminate wrong answers

Option A is wrong because directly updating code on EC2 instances bypasses Elastic Beanstalk's managed deployment process, leading to configuration drift and loss of rollback capability. Option B is wrong because swapping CNAMEs between environments does not decouple the database; the new environment would still have its own lifecycle-managed RDS instance, and the original database remains tied to the old environment. Option D is wrong because platform updates only update the Elastic Beanstalk platform version, not the application code, and the database remains lifecycle-coupled, so any environment rebuild or termination would still affect the database.

Full explanation →

254

MCQmedium

A developer is building a chat application using WebSockets. The application runs on multiple EC2 instances and needs to broadcast messages to all connected clients. Which AWS service can handle the WebSocket connections and route messages?

A.Amazon SQS with long polling

B.Application Load Balancer with WebSocket support

C.Amazon CloudFront with WebSocket support

D.Amazon API Gateway WebSocket API

AnswerD

Amazon API Gateway WebSocket API is purpose-built for managing persistent, bidirectional communication channels required by real-time applications like chat. It natively handles WebSocket connection management, including connection establishment and termination, and provides robust mechanisms to send messages to specific clients or broadcast messages to all connected clients, often integrating with backend services like AWS Lambda for message processing.

Why this answer

Amazon API Gateway WebSocket API is the correct choice because it natively manages WebSocket connections, maintains persistent bidirectional communication, and can broadcast messages to all connected clients using callback URLs. It handles connection lifecycle (connect, disconnect, default) and integrates with AWS Lambda or other backends to route messages efficiently.

Exam trap

The trap here is that candidates confuse Application Load Balancer's WebSocket support (which only proxies connections to a single target) with the need for a managed service that can broadcast to multiple clients, leading them to choose ALB over API Gateway.

How to eliminate wrong answers

Option A is wrong because Amazon SQS is a message queue service that uses polling (long or short) and does not support WebSocket connections or real-time bidirectional communication. Option B is wrong because Application Load Balancer supports WebSocket connections but only for routing traffic to backend targets; it cannot broadcast messages to all connected clients or manage the WebSocket protocol's pub/sub patterns. Option C is wrong because Amazon CloudFront does not natively support WebSocket connections; it is a CDN optimized for HTTP/HTTPS and cannot maintain persistent WebSocket state or route messages.

Full explanation →

255

MCQeasy

A developer is using Amazon DynamoDB with provisioned throughput. The application is receiving ProvisionedThroughputExceededException errors. What is the BEST way to handle this error?

A.Contact AWS Support to increase the DynamoDB service limits.

B.Reduce the read and write capacity units.

C.Implement exponential backoff and retry in the application code.

D.Switch the table to on-demand capacity mode.

AnswerC

Implementing exponential backoff and retry logic in the application code is a standard best practice for gracefully handling transient errors like `ProvisionedThroughputExceededException` in DynamoDB. This mechanism automatically retries failed requests after progressively longer delays, allowing the throttled table time to recover or for its burst capacity to replenish. It prevents a flood of immediate retries from overwhelming the table further, enabling the application to adapt to temporary capacity limitations.

Why this answer

The ProvisionedThroughputExceededException indicates that the application has exceeded the provisioned read/write capacity units for the DynamoDB table. The best practice to handle this error is to implement exponential backoff and retry logic in the application code, which progressively increases the wait time between retries to reduce request volume and allow the throttling to subside. This approach is recommended by AWS for handling throttling errors gracefully without manual intervention.

Exam trap

The trap here is that candidates often confuse 'handling the error' with 'preventing the error' and choose to switch to on-demand mode (Option D) instead of implementing proper retry logic, which is the immediate and correct response to a throttling exception.

How to eliminate wrong answers

Option A is wrong because contacting AWS Support to increase DynamoDB service limits does not address the root cause of exceeding provisioned throughput; service limits are separate from provisioned capacity and increasing them does not resolve throttling. Option B is wrong because reducing read and write capacity units would decrease the table's throughput, making throttling more likely, not less. Option D is wrong because switching to on-demand capacity mode is a valid long-term solution for unpredictable workloads but is not the best immediate fix for handling the exception in existing code; it also incurs higher costs and does not teach the application to handle throttling programmatically.

Full explanation →

256

Multi-Selecthard

A company uses AWS CodePipeline to automate deployments of a microservices application to Amazon ECS with Fargate. The pipeline has a deploy stage that uses Amazon ECS Blue/Green deployment. The deployment fails intermittently with a 'Task failed to start' error. The developer needs to troubleshoot the issue. Which THREE steps should the developer take? (Choose three.)

Select 3 answers

A.Review the CodeBuild build logs for errors.

B.Check the Amazon ECS service events for the task failure reason.

C.Validate that the task definition JSON is correctly formatted and references the correct container images.

D.Check the CloudFormation stack events for the ECS service.

E.Verify that the task execution IAM role has permissions to pull the container image from ECR.

AnswersB, C, E

The Amazon ECS service events tab is the authoritative source for recent service-level warnings and alarms, including deployment failures and stopped tasks. Each event often contains the exact error such as "CannotPullContainerError: Access Denied" or "task failed to start" along with a timestamp and the task ID. This is the first place an engineer should look because it directly records the reason ECS could not run the task.

Why this answer

Options B, C, and E are correct. Checking Amazon ECS service events (B) provides the task failure reason directly from the ECS service. Validating the task definition JSON (C) ensures correct container image references and configuration.

Verifying the task execution IAM role (E) ensures it has permissions to pull the container image from ECR. Option A (CodeBuild logs) is incorrect because the failure occurs during deployment, not build. Option D (CloudFormation stack events) is incorrect because the ECS service may not be created via CloudFormation or events there are not relevant for task failures.

Full explanation →

257

MCQhard

A Lambda function connects to an RDS database and causes too many database connections during traffic spikes. Which service should be introduced?

A.AWS Glue Data Catalog

B.Amazon RDS Proxy

C.Amazon Route 53 Resolver

D.AWS WAF

AnswerB

Amazon RDS Proxy is a fully managed, highly available database proxy that significantly improves application resilience and scalability for RDS databases. It establishes and maintains a pool of database connections, reusing them efficiently for new application connections from services like Lambda. This reduces the overhead of establishing new connections, prevents Lambda's concurrent invocations from overwhelming the RDS database with too many open connections, and handles credential management securely.

Why this answer

Amazon RDS Proxy sits between your Lambda function and the RDS database, managing a pool of established database connections. During traffic spikes, Lambda can rapidly scale up concurrent executions, each potentially opening a new database connection, which can exhaust the database's maximum connections. RDS Proxy reuses connections from the pool, reducing the number of open connections and preventing database overload, while also improving connection handling efficiency for serverless applications.

Exam trap

The trap here is that candidates might confuse AWS WAF (a web firewall) or Route 53 (DNS) with database connection management, or incorrectly think that Glue Data Catalog can somehow cache or pool database connections, when in fact only RDS Proxy directly addresses the connection scaling issue for Lambda and RDS.

How to eliminate wrong answers

Option A is wrong because AWS Glue Data Catalog is a metadata repository for data assets in AWS Glue and Athena, not a connection pooling or proxy service for RDS databases. Option C is wrong because Amazon Route 53 Resolver is a DNS service for resolving domain names within VPCs, and it does not manage database connections or connection pooling. Option D is wrong because AWS WAF is a web application firewall that protects against common web exploits like SQL injection and cross-site scripting, but it does not handle database connection management or pooling.

Full explanation →

258

MCQhard

Refer to the exhibit. A developer runs the AWS CLI command to invoke a Lambda function. The command succeeds, but the function returns an error. The developer wants to see the error message and logs from the function execution. What should the developer add to the command?

A.--client-context string

B.--qualifier alias

C.--invocation-type Event

D.--log-type Tail

AnswerD

The --log-type Tail parameter is specifically designed to retrieve the last 4 KB of log data generated by a synchronous Lambda function invocation. When used with RequestResponse invocation type, this option includes the base64-encoded log output in the LogResult field of the CLI response. This provides immediate access to recent execution logs directly within the terminal, which is invaluable for debugging and quick verification of function behavior.

Why this answer

The `--log-type Tail` parameter instructs the AWS CLI to retrieve the last 4 KB of log data from the function's execution and base64-encode it in the response. This allows the developer to see the error message and logs directly without needing to query CloudWatch Logs separately. The command must also use `--invocation-type RequestResponse` (the default) to get a synchronous response containing the logs.

Exam trap

The trap here is that candidates often confuse `--invocation-type Event` (async) with the ability to retrieve logs, not realizing that only synchronous invocations (`RequestResponse`) return execution results and logs via `--log-type Tail`.

How to eliminate wrong answers

Option A is wrong because `--client-context string` passes arbitrary JSON data to the Lambda function as part of the invocation request, but it does not retrieve or display any logs or error messages from the execution. Option B is wrong because `--qualifier alias` specifies a version or alias of the function to invoke, which controls which code runs but does not affect log retrieval. Option C is wrong because `--invocation-type Event` triggers an asynchronous invocation, which returns a 202 response immediately without any function output or logs, making it impossible to see error messages in the response.

Full explanation →

259

MCQmedium

A developer is using AWS CodePipeline to deploy a web application. The pipeline includes a source stage from CodeCommit, a build stage using CodeBuild, and a deploy stage using CodeDeploy to EC2 instances. The application stores sensitive data in an S3 bucket. The developer needs to ensure that the S3 bucket is only accessible from the EC2 instances and not from any other AWS service or account. The EC2 instances have an IAM role that allows s3:GetObject. What additional configuration is required?

A.Use SSE-KMS encryption on the bucket.

B.Enable S3 Block Public Access on the bucket.

C.Add a bucket policy that allows access only from the VPC endpoint or specific IP addresses of the EC2 instances.

D.Move the sensitive data to a different S3 bucket and update the application.

AnswerC

A well-crafted S3 bucket policy can precisely define which principals, from which network locations, can perform specific actions on the bucket and its objects. By incorporating conditions that check for a VPC endpoint ID (using `aws:sourceVpce`) or specific source IP addresses (using `aws:SourceIp` for public IPs or `aws:VpcSourceIp` for private IPs within a VPC), access can be strictly limited to the intended EC2 instances or services operating within a controlled network environment. This granular control directly addresses the requirement to restrict access to authorized resources.

Why this answer

A bucket policy that restricts access to the S3 bucket from a specific VPC endpoint or the EC2 instances' IP addresses ensures that only requests originating from those sources are allowed. This complements the IAM role's s3:GetObject permission by adding a network-level condition, preventing other AWS services or accounts from accessing the bucket even if they have valid IAM credentials. The condition key `aws:SourceVpce` or `aws:SourceIp` in the bucket policy enforces this restriction.

Exam trap

The trap here is that candidates often confuse encryption (SSE-KMS) or public access controls (Block Public Access) with network-level access restrictions, failing to realize that IAM permissions alone are insufficient to prevent access from other AWS services or accounts that have their own valid credentials.

How to eliminate wrong answers

Option A is wrong because SSE-KMS encryption protects data at rest but does not control access to the bucket; it only ensures data is encrypted, not who can read it. Option B is wrong because S3 Block Public Access prevents public access from the internet but does not restrict access from other AWS services or accounts that have valid IAM credentials. Option D is wrong because moving the data to a different bucket does not solve the access control issue; the same problem would persist unless additional restrictions are applied.

Full explanation →

260

Multi-Selecthard

A company has an IAM policy that allows s3:GetObject for all users in the account. However, a specific user is receiving access denied errors. Which THREE possible causes should the developer investigate?

Select 3 answers

A.An SCP at the organization level denies s3:GetObject.

B.The user is using an incorrect region endpoint.

C.The user's IAM role has an attached policy that denies s3:GetObject.

D.The S3 bucket is in a different AWS account.

E.A bucket policy explicitly denies the user.

AnswersA, C, E

Correct. An SCP at the organization level can deny s3:GetObject for all accounts, overriding any IAM allow.

Why this answer

The correct answers are A, C, and E. An organization-level SCP can deny s3:GetObject, overriding IAM allows. An explicit deny in the user's role policy also overrides any allow.

A bucket policy with an explicit Deny statement will cause access denied even if IAM allows. Option B is incorrect because using a wrong region endpoint results in a different error (e.g., NoSuchBucket or redirect), not an access denied. Option D is incorrect because cross-account access is possible with proper permissions; the bucket being in another account does not inherently deny access.

Full explanation →

261

MCQmedium

A company uses AWS OpsWorks to manage a stack of EC2 instances. After a deployment, the application becomes unresponsive. The engineer suspects that a configuration file was not updated correctly. What is the best way to verify the deployed configuration?

A.Use AWS Systems Manager Run Command to execute a script that outputs the configuration.

B.Check the OpsWorks stack's logs for any JSON syntax errors in the custom JSON.

C.SSH into an instance and inspect the configuration files in /var/lib/aws/opsworks.

D.Review the application logs in Amazon CloudWatch Logs for configuration errors.

AnswerC

When OpsWorks manages an EC2 instance, it uses Chef to apply configuration. The `/var/lib/aws/opsworks` directory on the instance is the authoritative location where Chef recipes, generated configuration files, and custom JSON are stored and executed. Directly inspecting these files allows a developer to verify the exact configuration that was actually deployed and applied to the instance, which is crucial for diagnosing why an application might be unresponsive due to misconfiguration.

Why this answer

OpsWorks stores its configuration data, including the applied custom JSON and stack settings, in /var/lib/aws/opsworks on each EC2 instance. By SSHing into the instance and inspecting these files, the engineer can directly verify whether the configuration file was updated correctly after deployment, bypassing any application-level logging or abstraction.

Exam trap

The trap here is that candidates assume CloudWatch Logs or Systems Manager Run Command are the best tools for configuration verification, overlooking the fact that OpsWorks stores its deployed configuration locally on the instance in a specific directory that can only be inspected directly via SSH.

How to eliminate wrong answers

Option A is wrong because AWS Systems Manager Run Command can execute scripts, but it does not provide direct access to the OpsWorks-specific configuration files stored on the instance; it would require the script to read those files, which is less direct than SSH inspection. Option B is wrong because OpsWorks stack logs may show JSON syntax errors in custom JSON, but they do not reveal whether the configuration file was correctly applied to the instance after deployment; syntax errors are only one possible cause. Option D is wrong because application logs in CloudWatch Logs may indicate configuration errors, but they are an indirect indicator and may not reflect the exact state of the configuration file on disk, especially if the application fails before logging.

Full explanation →

262

MCQeasy

A developer deploys a new version of an AWS Lambda function using the AWS CLI. After deployment, the function returns stale results. What is the most likely cause?

A.The function's environment variables are cached and not updated.

B.The Lambda function alias is still pointing to the previous version.

C.The Amazon CloudFront distribution is caching the old response.

D.The Lambda function's code is cached by the Lambda service.

AnswerB

Lambda aliases provide a stable endpoint for invoking a function, but they are explicitly configured to point to a specific function version. If a developer deploys a new version of the Lambda function but fails to update the associated alias to reference this new version, any invocations made through that alias will continue to execute the code and configuration of the older version it still references. This is a common operational oversight leading to unexpected behavior where new code doesn't appear to be running.

Why this answer

When a developer deploys a new version of a Lambda function using the AWS CLI without updating the function alias, the alias continues to point to the previous version. Invoking the function via the alias (e.g., via an API Gateway endpoint or a CloudFront origin) will execute the old code, returning stale results. The `$LATEST` version is updated, but unless the alias is repointed, it does not automatically use the new code.

Exam trap

The trap here is that candidates may assume deploying new code automatically updates the invoked version, overlooking that aliases must be explicitly repointed to the new version to change which code is executed.

How to eliminate wrong answers

Option A is wrong because environment variables are not cached; they are read from the function's configuration at invocation time and are updated immediately when the function is deployed with new environment variables. Option C is wrong because CloudFront caching is a separate concern; while it can serve stale responses, the question states the function itself returns stale results, and CloudFront would only cache the HTTP response, not the Lambda execution output directly. Option D is wrong because the Lambda service does not cache the function's code in a way that persists across deployments; the new code is immediately available when the function version is updated, and the issue is about which version is being invoked, not code caching.

Full explanation →

263

MCQmedium

A Lambda function must share reusable validation code across several functions without packaging the same library into every deployment artifact. What should be used?

A.Lambda layer

B.API Gateway usage plan

C.S3 multipart upload

D.CloudWatch metric filter

AnswerA

A Lambda layer is a ZIP archive containing supplementary code or data, such as libraries, custom runtimes, or common utility functions. By packaging reusable validation logic into a layer, multiple Lambda functions can reference it, significantly reducing deployment package sizes and promoting code consistency. This mechanism directly addresses the need to share common code across various serverless functions efficiently.

Why this answer

Lambda layers allow you to centrally manage reusable code (e.g., validation libraries) and share it across multiple Lambda functions without packaging it into each deployment artifact. When you attach a layer to a function, the layer's content is extracted into the /opt directory, making it available at runtime. This avoids duplication and simplifies updates, as you only need to update the layer version rather than every function's deployment package.

Exam trap

The trap here is that candidates may confuse Lambda layers with other AWS services that handle 'sharing' (like API Gateway usage plans for sharing API access) or 'packaging' (like S3 multipart upload for large files), but only Lambda layers are designed to share code and dependencies across functions without repackaging.

How to eliminate wrong answers

Option B is wrong because API Gateway usage plans are used to throttle and quota API requests, not to share code across Lambda functions. Option C is wrong because S3 multipart upload is a mechanism for uploading large objects in parts, not for distributing reusable code to Lambda functions. Option D is wrong because CloudWatch metric filters are used to extract metric data from log streams, not to share or package code for Lambda.

Full explanation →

264

MCQeasy

A developer is writing a Lambda function that processes images uploaded to an S3 bucket. The function needs to extract metadata from the image. Which S3 feature can be used to automatically trigger the Lambda function?

A.S3 Events

B.S3 Inventory

C.S3 Transfer Acceleration

D.S3 Batch Operations

AnswerA

S3 Event Notifications are the correct mechanism for triggering real-time actions in response to object changes within an S3 bucket. When an image is uploaded, S3 can publish an event to a configured destination, such as an AWS Lambda function. This allows for immediate, automated processing like image resizing, watermarking, or metadata extraction as soon as the object creation event occurs.

Why this answer

Amazon S3 Events can be configured to send a notification when an object is created (e.g., via PutObject) in an S3 bucket. This event can directly invoke an AWS Lambda function, making it the correct service to automatically trigger the function upon image upload. The developer simply needs to set up an S3 event notification with the Lambda function as the destination.

Exam trap

The trap here is that candidates may confuse S3 Batch Operations (which can invoke Lambda functions for batch processing) with real-time event triggers, but Batch Operations require a manual job initiation and do not automatically fire on each upload.

How to eliminate wrong answers

Option B (S3 Inventory) is wrong because it is used to generate a list of objects and their metadata for auditing or compliance, not to trigger real-time event-driven actions. Option C (S3 Transfer Acceleration) is wrong because it only speeds up uploads over long distances using edge locations, it has no mechanism to invoke Lambda functions. Option D (S3 Batch Operations) is wrong because it performs bulk actions (like copying or tagging) on existing objects via a job, not real-time event triggering upon object creation.

Full explanation →

265

MCQeasy

A developer uses AWS CodePipeline with a manual approval step before deployment. The developer wants to ensure that if a new commit is pushed while a pipeline execution is waiting for approval, the waiting execution is canceled and a new one starts with the latest commit. Which pipeline execution mode should be configured?

A.Queued

B.Superseded

C.Parallel

D.Single

AnswerB

Superseded mode is designed to prioritize the most recent changes by immediately stopping any currently active pipeline execution, including those paused at a manual approval step. Upon cancellation of the in-progress execution, a brand new pipeline execution is initiated using the latest source code revisions. This ensures that developers can quickly iterate and deploy updates without waiting for older, potentially stalled, deployments to complete, making it ideal for continuous integration/continuous delivery (CI/CD) workflows where rapid feedback is crucial.

Why this answer

The Superseded execution mode is designed to automatically cancel any in-progress pipeline execution when a new commit is pushed, and start a new execution with the latest source changes. This ensures that the manual approval step does not block newer commits, as the waiting execution is replaced by the one triggered by the latest commit. In contrast, other modes either queue or run executions in parallel, which would not cancel the waiting approval step.

Exam trap

The trap here is that candidates may confuse Superseded with Queued, thinking that queuing will handle the latest commit, but Queued only delays execution without canceling the waiting approval step.

How to eliminate wrong answers

Option A is wrong because Queued mode places new executions in a queue, waiting for the current execution to complete before starting the next one, which would not cancel the waiting approval step. Option C is wrong because Parallel mode allows multiple executions to run concurrently, which would not cancel the waiting execution and could lead to multiple approvals or deployments. Option D is wrong because Single mode is not a valid execution mode in AWS CodePipeline; the valid modes are Queued, Superseded, and Parallel.

Full explanation →

266

MCQeasy

A developer is designing a microservices architecture where each service runs in its own Amazon ECS container. Services need to communicate with each other. The developer wants to simplify service discovery and load balancing. Which AWS service should the developer use?

A.AWS Cloud Map

B.Elastic Load Balancing

C.Amazon ECS service discovery

D.Amazon Route 53

AnswerA

AWS Cloud Map provides a robust service discovery solution by registering dynamically changing microservices with custom names, allowing other services to discover them via API calls or DNS queries. It integrates seamlessly with Amazon ECS, enabling tasks to register and deregister automatically as they scale or become unhealthy. This dynamic registration is crucial for ephemeral microservices, ensuring services can find each other reliably without hardcoding network locations.

Why this answer

AWS Cloud Map is the correct choice because it provides a fully managed service discovery solution that allows microservices to dynamically discover each other using DNS or HTTP API calls. It integrates natively with Amazon ECS, enabling services to register themselves and resolve other services by logical names, which simplifies service discovery and load balancing across containers.

Exam trap

The trap here is that candidates often confuse the ECS service discovery feature (which is just a configuration option) with a standalone AWS service, leading them to pick option C instead of recognizing that AWS Cloud Map is the underlying service that actually provides the discovery mechanism.

How to eliminate wrong answers

Option B is wrong because Elastic Load Balancing (ELB) is a load balancer that distributes traffic to targets, but it does not provide service discovery; it requires manual configuration of target groups and does not automatically register/deregister ECS services as they scale. Option C is wrong because Amazon ECS service discovery is not a standalone AWS service; it is a feature that leverages AWS Cloud Map under the hood, so the correct service to use is Cloud Map itself. Option D is wrong because Amazon Route 53 is a DNS service primarily for domain name resolution and routing internet traffic, not designed for dynamic service discovery of ephemeral containers in ECS; it lacks native integration with ECS task registration and health checks for service discovery.

Full explanation →

267

MCQeasy

A developer is building a serverless REST API using Amazon API Gateway and AWS Lambda. The API should return JSON responses to client requests. The developer is using the Lambda proxy integration. What is the simplest way to return a JSON response from the Lambda function?

A.Return a string from the Lambda handler.

B.Return a dictionary containing 'statusCode', 'headers', and 'body' with 'body' as a JSON string.

C.Use API Gateway integration response and mapping templates to transform the Lambda output.

D.Return a JSON object from Lambda and set a Content-Type header in the API Gateway method response.

AnswerB

This format precisely adheres to the API Gateway Lambda proxy integration contract, where the Lambda function is solely responsible for constructing the entire HTTP response. By returning a dictionary containing `statusCode`, `headers` (as a dictionary of key-value pairs), and a `body` field (which itself must be a string, often a JSON string), the Lambda function provides all necessary information for API Gateway to directly pass through to the client. This ensures the client receives a properly formatted HTTP response with the correct status, custom headers, and a valid JSON payload.

Why this answer

With Lambda proxy integration, API Gateway passes the entire request to the Lambda function and expects the function to return a specific response format. The simplest way to return a JSON response is to return a dictionary (or object) containing 'statusCode', 'headers', and 'body', where 'body' is a JSON string. This format is required by API Gateway to correctly interpret the Lambda output and forward it to the client.

Exam trap

The trap here is that candidates often think returning a JSON object directly from Lambda is sufficient, but they overlook the requirement that the body must be a JSON string and the response must include the exact 'statusCode', 'headers', and 'body' keys for API Gateway proxy integration to work correctly.

How to eliminate wrong answers

Option A is wrong because returning a plain string from the Lambda handler will cause API Gateway to fail or return an unexpected response, as it expects a properly formatted response object. Option C is wrong because using API Gateway integration response and mapping templates adds unnecessary complexity; with proxy integration, the Lambda function itself is responsible for formatting the response, and mapping templates are not used. Option D is wrong because simply returning a JSON object from Lambda without the required 'statusCode', 'headers', and 'body' structure will not be parsed correctly by API Gateway, and setting a Content-Type header in the method response does not address the required Lambda response format.

Full explanation →

268

MCQhard

A developer is building a real-time chat application using WebSocket APIs in Amazon API Gateway. The backend is an AWS Lambda function that stores connection IDs in an Amazon DynamoDB table. After a few days, the application stops working for new users. The developer checks CloudWatch Logs and sees that the Lambda function is returning 'AccessDeniedException' when calling DynamoDB. What is the MOST likely cause?

A.The Lambda function code was updated but the IAM role was not reattached.

B.The Lambda function uses an outdated AWS SDK version.

C.The API Gateway route was updated without redeploying the API.

D.The DynamoDB table was recreated and the Lambda function's IAM role still references the old table ARN.

AnswerD

When a DynamoDB table is recreated, it is assigned a completely new Amazon Resource Name (ARN), even if it has the same name. IAM policies grant permissions to specific resources, often identified by their ARN. If the Lambda function's IAM role policy explicitly referenced the old table's ARN, recreating the table invalidates that specific resource permission. Consequently, the Lambda function attempting to access the newly created table (with its new ARN) would correctly receive an AccessDeniedException because its IAM role lacks permission for that specific new resource.

Why this answer

The most likely cause is that the DynamoDB table was recreated, which changes its ARN. The Lambda function's IAM role still references the old table ARN, so when the function attempts to perform DynamoDB operations (e.g., PutItem for storing connection IDs), the request is denied because the role no longer has permissions on the new table. This is a common issue when infrastructure is rebuilt without updating IAM policies.

Exam trap

The trap here is that candidates may confuse 'AccessDeniedException' with a network or API configuration issue (like an outdated SDK or missing redeployment), rather than recognizing it as a classic IAM permissions problem tied to resource ARN changes.

How to eliminate wrong answers

Option A is wrong because IAM roles are attached to Lambda functions at the function level, not to the code; updating code does not detach the role. Option B is wrong because an outdated SDK version would cause errors like 'UnknownOperationException' or 'UnsupportedMediaType', not 'AccessDeniedException', which is an IAM permissions error. Option C is wrong because API Gateway route updates without redeployment would cause 404 or 503 errors at the API level, not an 'AccessDeniedException' from Lambda when calling DynamoDB.

Full explanation →

269

MCQmedium

A company manages multiple AWS accounts using AWS Organizations. A developer needs to allow an IAM role in the production account to read objects from an S3 bucket in the development account. The bucket is encrypted with an AWS KMS customer managed key (CMK) in the development account. Which of the following is required to enable this cross-account access?

A.Grant the production account's root user access to the KMS key and the S3 bucket.

B.Add a bucket policy allowing the production account's IAM role and a KMS key policy granting the same role.

C.Create an IAM role in the production account with permissions to access the S3 bucket and KMS key.

D.Enable S3 bucket logging to allow cross-account access.

AnswerB

To enable secure cross-account access, a bucket policy must explicitly grant the production account's IAM role permissions for S3 actions like `s3:GetObject` on the bucket. Concurrently, a KMS key policy is essential to grant the *same* IAM role `kms:Decrypt` permissions, allowing it to decrypt objects encrypted with that KMS key. This combination of resource-based policies on the S3 bucket and KMS key establishes the necessary trust relationship, ensuring the production account's role can both access the bucket and decrypt its contents.

Why this answer

Cross-account access to an S3 bucket encrypted with a KMS customer managed key requires both a bucket policy that grants the production account's IAM role s3:GetObject permission and a KMS key policy that grants the same role kms:Decrypt permission. The bucket policy authorizes the S3 operation, while the key policy authorizes decryption of the object; both policies must explicitly allow the cross-account principal.

Exam trap

The trap here is that candidates often assume a bucket policy alone is sufficient for cross-account access, forgetting that KMS-encrypted objects require a separate key policy grant for the decrypt permission.

How to eliminate wrong answers

Option A is wrong because granting the production account's root user access is overly broad and unnecessary; the principle of least privilege requires granting only the specific IAM role, not the entire root account. Option C is wrong because creating an IAM role in the production account with permissions to access the S3 bucket and KMS key does not solve the cross-account authorization; the development account's bucket policy and KMS key policy must explicitly allow the production account's role, not just the role having permissions in its own account. Option D is wrong because enabling S3 bucket logging only records access events and does not grant any cross-account permissions; it is irrelevant to authorization.

Full explanation →

270

MCQmedium

A developer is using AWS CodePipeline to deploy a web application to an Auto Scaling group. The pipeline includes a deploy action that uses CodeDeploy. The deployment fails with the error: 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' Which of the following is the MOST likely cause?

A.The CodeDeploy agent is not sending logs to CloudWatch.

B.The deployment configuration has a minimum healthy instances setting that is too restrictive.

C.The application's lifecycle hooks are failing during the ApplicationStop event.

D.The instances were launched from an AMI that does not have the CodeDeploy agent installed.

AnswerB

CodeDeploy deployment configurations, such as `CodeDeployDefault.OneAtATime` or custom settings, include a `minimum healthy instances` threshold. If this setting is too restrictive, for example, requiring 100% of instances to remain healthy during a rolling update, the deployment will fail when even a single instance is taken offline for the update. The deployment cannot proceed if the number of healthy instances drops below the specified minimum, leading to a "too few healthy instances" error.

Why this answer

The error message indicates that the deployment failed because too many instances were unhealthy or failed. The most likely cause is that the deployment configuration's minimum healthy hosts setting is too restrictive, meaning it requires a higher percentage of healthy instances during deployment than the environment can sustain, causing CodeDeploy to stop the deployment when the threshold is breached.

Exam trap

The trap here is that candidates often confuse individual instance failures (e.g., missing agent, hook errors) with the deployment group-level threshold error, leading them to pick options that explain why a single instance failed rather than why the entire deployment was aborted.

How to eliminate wrong answers

Option A is wrong because the CodeDeploy agent not sending logs to CloudWatch would cause a lack of monitoring data, but it would not directly cause the deployment to fail with the given error; the deployment would proceed but logs would be missing. Option C is wrong because lifecycle hooks failing during the ApplicationStop event would cause individual instance failures, but the error message specifically points to a global deployment failure due to too few healthy instances, which is a deployment configuration issue, not a hook failure. Option D is wrong because if instances were launched from an AMI without the CodeDeploy agent, the agent would not run and the deployment would fail on each instance individually, but the error message about 'too few healthy instances' is a deployment group-level threshold issue, not a missing agent problem.

Full explanation →

271

MCQhard

A developer is building a REST API using API Gateway and Lambda. The API must support multiple HTTP methods and use a custom domain name with an SSL certificate. The developer wants to enable caching for the /products GET endpoint to reduce latency. Which step is essential to enable caching for this specific endpoint?

A.Set the TTL (time-to-live) for the /products GET method to a non-zero value.

B.Enable caching on the /products GET method and specify cache key parameters.

C.Flush the API cache to start fresh.

D.Enable caching on the API stage and set the 'Cache Status' to 'AVAILABLE'.

AnswerB

To implement caching for a specific API Gateway method like /products GET, caching must first be enabled at the API stage level. Subsequently, individual methods can be configured to utilize this cache. This involves explicitly enabling caching for the /products GET method and defining cache key parameters, which dictate how requests are uniquely identified for caching purposes, often including query string parameters, headers, or path parameters. This ensures relevant responses are stored and retrieved efficiently.

Why this answer

Enabling caching on a specific method (e.g., /products GET) in API Gateway allows you to configure cache key parameters, which control how the cache key is generated based on request parameters. This is essential for per-endpoint caching, as it ensures that only responses for the /products GET endpoint are cached, reducing latency for that specific method without affecting other endpoints.

Exam trap

The trap here is that candidates often confuse enabling caching at the stage level (which caches all methods) with enabling it on a specific method, and they overlook the requirement to specify cache key parameters for per-endpoint control.

How to eliminate wrong answers

Option A is wrong because setting a non-zero TTL on the /products GET method is not a step to enable caching; TTL is configured after caching is enabled and controls how long cached responses are retained, not the enabling itself. Option C is wrong because flushing the API cache clears existing cached data but does not enable caching; it is a maintenance action, not an enabling step. Option D is wrong because enabling caching on the API stage caches all methods in the stage by default, not specifically the /products GET endpoint, and the 'Cache Status' to 'AVAILABLE' is a status indicator, not an action to enable per-method caching.

Full explanation →

272

MCQhard

A team wants CloudFormation to prevent accidental deletion of a production DynamoDB table during stack updates. What should they configure?

A.A larger write capacity setting

B.A Lambda layer

C.An API Gateway usage plan

D.DeletionPolicy or UpdateReplacePolicy Retain as appropriate

AnswerD

CloudFormation provides the `DeletionPolicy` and `UpdateReplacePolicy` attributes specifically to control the lifecycle of resources during stack operations. Setting `DeletionPolicy` to `Retain` ensures that a resource is not deleted when its containing stack is deleted or the resource is removed from the template. Similarly, `UpdateReplacePolicy` set to `Retain` prevents the old physical resource from being deleted if it is replaced during a stack update, directly addressing the requirement to prevent accidental resource deletion.

Why this answer

The DeletionPolicy attribute with a value of Retain instructs AWS CloudFormation to preserve the DynamoDB table when its stack resource is deleted during a stack update or stack deletion. Similarly, UpdateReplacePolicy Retain ensures that if a resource replacement is required during an update, the existing table is kept rather than deleted. This directly prevents accidental data loss by overriding CloudFormation's default behavior of deleting resources that are removed from the template or replaced.

Exam trap

The trap here is that candidates may confuse operational settings (like write capacity) or unrelated services (Lambda layers, API Gateway) with CloudFormation's resource lifecycle policies, missing the direct purpose of DeletionPolicy and UpdateReplacePolicy.

How to eliminate wrong answers

Option A is wrong because a larger write capacity setting only affects DynamoDB's throughput performance and has no impact on resource lifecycle or deletion prevention. Option B is wrong because a Lambda layer is used to package runtime dependencies for Lambda functions and does not influence CloudFormation's resource deletion behavior. Option C is wrong because an API Gateway usage plan throttles and monitors API requests for billing or rate-limiting purposes and is unrelated to CloudFormation stack resource protection.

Full explanation →

273

MCQmedium

A developer is debugging an issue where an Amazon S3 bucket policy is not allowing cross-account access for a user from another AWS account. The bucket policy grants access to the other account's root user. The IAM user in the other account has an IAM policy that allows s3:GetObject on the bucket. When the user tries to download an object, they get an Access Denied error. What is the most likely cause?

A.The bucket is encrypted with SSE-KMS and the user does not have kms:Decrypt permission

B.The bucket policy does not specify the user's ARN

C.The object's ACL is set to private

D.The IAM policy does not include s3:ListBucket

AnswerA

When an S3 object is encrypted with Server-Side Encryption using AWS Key Management Service (SSE-KMS), the requesting principal requires two distinct permissions for GetObject operations. Beyond the s3:GetObject permission on the bucket, an explicit kms:Decrypt permission on the specific AWS KMS key used for encryption is mandatory. Without this crucial KMS permission, even a valid S3 bucket policy allowing s3:GetObject will result in an Access Denied error, as S3 cannot decrypt the object for the user.

Why this answer

The most likely cause is that the bucket is encrypted with SSE-KMS. When an S3 bucket uses AWS KMS customer master keys (CMKs) for server-side encryption, the bucket policy granting access to the root user of the other account is not sufficient. The IAM user in the other account must also have explicit kms:Decrypt permission on the KMS key, because S3 GetObject calls require decrypting the object before returning it.

Without this KMS permission, the request fails with Access Denied even though the S3 bucket policy and IAM policy appear correct.

Exam trap

The trap here is that candidates assume a valid S3 bucket policy and IAM policy are sufficient, forgetting that KMS encryption adds an independent authorization layer that requires explicit kms:Decrypt permissions, which is a common oversight in cross-account S3 access scenarios.

How to eliminate wrong answers

Option B is wrong because the bucket policy grants access to the other account's root user, which covers all IAM users and roles in that account by default; specifying the individual user's ARN is not required. Option C is wrong because object ACLs are evaluated after bucket policies, and if the bucket policy explicitly grants access, a private object ACL would be overridden (unless the bucket policy has a condition denying access). Option D is wrong because s3:ListBucket is only needed for listing objects (e.g., GET Bucket (List Objects) requests), not for downloading a specific object using s3:GetObject.

Full explanation →

274

MCQhard

A developer is designing a serverless application that processes large files uploaded to Amazon S3. Each file can be up to 5 GB. The processing involves extracting metadata and generating thumbnails. The developer wants to minimize processing time and cost. Which approach should the developer take?

A.Use S3 Object Lambda to process the object as it is being retrieved.

B.Use an S3 event notification to invoke a Lambda function that copies the object to an EC2 instance for processing.

C.Use AWS Fargate to run a container that polls S3 for new objects and processes them.

D.Use an S3 event notification to invoke a Lambda function that downloads the file, processes it, and uploads results.

AnswerD

Correct. S3 event notifications invoke a Lambda function directly when a new object is created. This allows processing the file in a serverless manner, minimizing cost and complexity. The Lambda function can efficiently handle the file by streaming and processing within its limits.

Why this answer

S3 event notifications can trigger a Lambda function immediately after an object is uploaded. The Lambda function can download the file from S3, extract metadata and generate thumbnails, then store the results. This approach is serverless and cost-effective, as you pay only for compute time.

While Lambda has execution time and memory limits, processing a 5 GB file for metadata and thumbnails can be optimized to fit within these limits, making it the most appropriate choice among the options.

Exam trap

Candidates often choose S3 Object Lambda for any processing, but it only acts on data retrieval. For upload-triggered processing, S3 event notification with Lambda is the standard serverless pattern.

How to eliminate wrong answers

Option B is wrong because copying the object to an EC2 instance introduces significant latency and cost from provisioning and managing a virtual machine, plus the overhead of data transfer and instance startup, which is not optimal for a serverless, event-driven architecture. Option C is wrong because AWS Fargate requires polling S3 for new objects, which is inefficient compared to event-driven notifications, and running a container adds complexity and cost for a task that can be handled by a lightweight Lambda function. Option D is wrong because invoking a Lambda function to download a 5 GB file exceeds the Lambda function's maximum execution time (15 minutes) and memory (10 GB), and the entire file must be downloaded before processing begins, increasing latency and cost.

Full explanation →

275

MCQeasy

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The developer runs 'sam deploy' and receives an error: 'Error: Failed to create changeset for the stack.' What is a common cause of this error?

A.The SAM template contains a syntax error.

B.The S3 bucket specified for artifacts does not exist.

C.The IAM user does not have permission to create CloudFormation stacks.

D.AWS CodeDeploy is not configured for the application.

AnswerA

When `sam deploy` (or `aws cloudformation deploy`) is executed, the CloudFormation service first validates the template's syntax and structure. If the SAM template, which is an extension of CloudFormation, contains a syntax error (e.g., incorrect YAML/JSON formatting, invalid intrinsic function usage, or malformed resource properties), CloudFormation will fail to parse it. This failure occurs early in the deployment process, specifically preventing the successful creation of a changeset, as the service cannot understand the desired state described by the invalid template.

Why this answer

The 'Failed to create changeset for the stack' error typically occurs when the SAM template contains a syntax error, such as invalid YAML formatting, missing required properties, or incorrect resource definitions. AWS CloudFormation validates the template before creating a changeset, and any syntax issue will cause the changeset creation to fail immediately. This is the most common cause because SAM templates are YAML-based and prone to indentation or structural mistakes.

Exam trap

The trap here is that candidates often confuse changeset creation failures with permission or bucket issues, but the error message specifically points to template validation, not infrastructure or IAM problems.

How to eliminate wrong answers

Option B is wrong because if the S3 bucket specified for artifacts does not exist, the error would be 'Unable to upload artifact...' or 'Bucket not found', not a changeset creation failure. Option C is wrong because insufficient IAM permissions to create CloudFormation stacks would result in an 'AccessDenied' or authorization error, not a changeset creation failure. Option D is wrong because AWS CodeDeploy is not required for SAM deployments; SAM uses CloudFormation for infrastructure provisioning, and CodeDeploy is only relevant if you configure a separate deployment pipeline.

Full explanation →

276

MCQmedium

A company is using Amazon CloudFront to distribute static content from an S3 bucket. The content is updated frequently, but users see stale content. The developer wants to ensure that new content is served as soon as possible after an update. Which action should be taken?

A.Enable 'Origin Shield' to reduce the number of requests to S3.

B.Set the 'Minimum TTL' to 0 and 'Default TTL' to 0.

C.Set the 'Object Caching' to 0 in the CloudFront distribution.

D.Create a CloudFront invalidation for the updated files.

AnswerD

Creating a CloudFront invalidation request specifically targets and removes specified objects from all CloudFront edge caches globally. Upon successful invalidation, the next request for those objects at any edge location will result in CloudFront fetching the latest version directly from the origin. This is the most direct and effective method to ensure users immediately receive updated content after changes have been deployed to the origin, overriding any existing TTL settings.

Why this answer

CloudFront caches content at edge locations based on TTL settings. When content is updated in the S3 origin, existing cached copies remain stale until they expire or are explicitly invalidated. Creating a CloudFront invalidation for the updated files immediately removes the cached objects from all edge locations, forcing CloudFront to fetch the latest version from S3 on the next request.

This ensures new content is served as soon as possible after an update.

Exam trap

The trap here is that candidates confuse TTL configuration (which controls how long new objects are cached) with invalidation (which removes already-cached objects), leading them to pick options that only affect future caching behavior without addressing the stale content already served.

How to eliminate wrong answers

Option A is wrong because enabling Origin Shield reduces the number of requests to the S3 origin by consolidating them at a regional cache layer, but it does not force CloudFront to serve fresh content; it can actually increase staleness by adding another caching layer. Option B is wrong because setting Minimum TTL and Default TTL to 0 tells CloudFront to respect the Cache-Control max-age=0 header from the origin, but if the S3 object does not have that header (or has a higher max-age), CloudFront will still cache the content for the origin's specified duration; TTL settings alone do not purge already-cached content. Option C is wrong because 'Object Caching' is not a configurable numeric field in CloudFront; the correct setting is 'Minimum TTL', 'Maximum TTL', and 'Default TTL' under the 'Cache Based on Selected Request Headers' behavior, and setting these to 0 does not invalidate existing cached objects.

Full explanation →

277

Multi-Selectmedium

A DynamoDB query must support lookup by email address as well as by user ID. Which two changes may be required?

Select 2 answers

A.Create a secondary index with email as a key

B.Scan the full table for every login

C.Choose projection attributes needed by the query

D.Disable partition keys

AnswersA, C

This is the primary mechanism in DynamoDB to efficiently query data using an attribute other than the table's primary key. By defining a Global Secondary Index (GSI) with email as its partition key, DynamoDB builds a separate, sparse table that allows direct, high-performance lookups based on email addresses. This approach avoids costly full table scans and ensures predictable, low-latency access for user authentication or profile retrieval.

Why this answer

A Global Secondary Index (GSI) or Local Secondary Index (LSI) on the email attribute allows DynamoDB to efficiently query by email address without scanning the entire table. Since the primary key is user ID, querying by email requires an index that uses email as the partition key or sort key. Option C is correct because specifying projection attributes limits the data returned from the index or table, reducing read capacity consumption and improving performance.

Exam trap

The trap here is that candidates may think a Scan is acceptable for low-volume logins, but the exam emphasizes that any production authentication system must use an index to avoid full table scans and meet latency requirements.

Full explanation →

278

MCQeasy

A developer is using AWS CloudFormation to create a stack that includes an EC2 instance. The stack creation fails because the instance type is not supported in the selected Availability Zone. What should the developer do?

A.Delete the stack and start over.

B.Change the instance type to one that is supported.

C.Update the stack to specify a different subnet or not specify an Availability Zone.

D.Create the stack in a different region.

AnswerC

Updating the stack to specify a different subnet or removing the explicit Availability Zone (AZ) specification is the most effective and flexible solution. If a specific AZ lacks capacity for the requested instance type, deploying into a different subnet, which is tied to another AZ, can resolve the issue. Alternatively, by not specifying an AZ, CloudFormation can automatically select an available AZ with sufficient capacity for the desired instance type, ensuring successful deployment while maintaining the intended resource configuration. This leverages CloudFormation's intelligence to handle underlying infrastructure constraints.

Why this answer

When an EC2 instance type is not supported in a specific Availability Zone (AZ), the developer can update the CloudFormation stack to either specify a different subnet (which implicitly selects a different AZ) or omit the Availability Zone parameter entirely, allowing AWS to automatically choose an AZ where the instance type is supported. This avoids the need to delete the stack or change the instance type, preserving other stack resources and configurations.

Exam trap

The trap here is that candidates assume the only fix is to change the instance type (Option B) or restart from scratch (Option A), overlooking CloudFormation's ability to update the stack's subnet or AZ selection to match the instance type's availability.

How to eliminate wrong answers

Option A is wrong because deleting the stack and starting over is unnecessary and inefficient; the issue can be resolved by updating the stack's subnet or AZ specification without losing existing resources. Option B is wrong because changing the instance type may not be desirable if the developer specifically needs that instance type for performance or cost reasons; the problem is the AZ constraint, not the instance type itself. Option D is wrong because creating the stack in a different region is an overreaction; the instance type is likely supported in other AZs within the same region, and changing regions could introduce latency, cost, or compliance issues.

Full explanation →

279

Multi-Selecteasy

A developer is creating an IAM policy for an EC2 instance to allow it to read from an S3 bucket. Which of the following are required? (Choose TWO.)

Select 2 answers

A.Create an IAM role with s3:GetObject permissions

B.Use KMS to encrypt the S3 objects

C.Configure an S3 bucket policy allowing the role

D.Attach the IAM role to the EC2 instance

E.Create an instance profile and assign a key pair

AnswersA, D

An IAM role is the fundamental identity construct used to grant permissions to AWS services, including EC2 instances. Creating an IAM role with the specific `s3:GetObject` permission ensures that the EC2 instance is authorized to retrieve objects from an S3 bucket, adhering to the principle of least privilege by granting only the necessary read access for the intended operation.

Why this answer

An IAM role is the recommended way to grant temporary, secure credentials to an EC2 instance for accessing AWS services. The s3:GetObject permission allows the instance to read objects from an S3 bucket, which is the specific action required for read access.

Exam trap

The trap here is that candidates often think an S3 bucket policy is always required when using an IAM role, but it is only necessary for cross-account access or when the bucket policy explicitly restricts access; for same-account access, the role's permissions alone are sufficient.

Full explanation →

280

MCQmedium

A developer is using AWS CodeDeploy to deploy a new version of an AWS Lambda function. The developer wants to gradually shift traffic from the old version to the new version in 10-minute increments. Which deployment configuration should the developer use?

A.Canary10Percent10Minutes

B.Canary10Percent30Minutes

C.Linear10PercentEvery10Minutes

D.AllAtOnce

AnswerC

This CodeDeploy configuration precisely aligns with the requirement for gradual, incremental traffic shifts. It systematically routes 10% of traffic to the new Lambda version, waits for 10 minutes, then shifts another 10%, repeating this process until 100% of traffic is successfully moved. This ensures a controlled, step-by-step rollout, allowing for continuous monitoring and potential rollback at each 10-minute interval.

Why this answer

The Linear10PercentEvery10Minutes configuration shifts traffic from the old Lambda version to the new version in 10% increments every 10 minutes, which matches the developer's requirement of gradually shifting traffic in 10-minute increments. This is a linear deployment type in AWS CodeDeploy that provides a steady, incremental traffic shift over time.

Exam trap

The trap here is confusing canary deployments (which shift a small percentage immediately and then the remainder after a wait) with linear deployments (which shift traffic in equal increments over time), leading candidates to select a canary configuration when a linear one is required.

How to eliminate wrong answers

Option A is wrong because Canary10Percent10Minutes shifts 10% of traffic to the new version immediately, then waits 10 minutes before shifting the remaining 90% all at once, which does not provide gradual 10-minute increments. Option B is wrong because Canary10Percent30Minutes shifts 10% immediately, then waits 30 minutes before shifting the remaining 90%, which does not match the 10-minute increment requirement. Option D is wrong because AllAtOnce shifts 100% of traffic to the new version immediately with no gradual traffic shifting, which contradicts the developer's requirement.

Full explanation →

281

MCQmedium

A developer is deploying a new version of an AWS Lambda function using the AWS CLI. The developer wants to create a new version and update the alias to point to the new version. Which sequence of CLI commands should the developer use?

A.Update alias, update function code, publish version

B.Create alias, update function code, publish version

C.Publish version, update function code, update alias

D.Update function code, publish version, update alias

AnswerD

First, updating the function code ensures the `$LATEST` version contains the desired new logic. Next, publishing a version creates an immutable snapshot of this updated code, providing a stable reference point. Finally, updating the alias to point to this newly published version allows for controlled traffic shifting, enabling safe deployments, rollbacks, and advanced strategies like canary releases.

Why this answer

The correct sequence is to first update the function code, then publish a new version, and finally update the alias to point to that new version. The `update-function-code` command uploads the new code to the $LATEST version, `publish-version` creates an immutable numbered version from $LATEST, and `update-alias` updates the alias to reference that specific version. This ensures the alias always points to a stable, published version rather than the mutable $LATEST.

Exam trap

The trap here is that candidates often think they can update the alias before publishing the version, or they confuse the order of operations by assuming the alias can point to $LATEST, but the exam requires the alias to reference a specific published version for immutability and rollback safety.

How to eliminate wrong answers

Option A is wrong because it attempts to update the alias before the new version exists, which would fail or point to a non-existent version. Option B is wrong because it creates a new alias instead of updating an existing one, and also attempts to update the alias before the version is published. Option C is wrong because it publishes a version before updating the function code, which would publish the old code, and then updates the function code to $LATEST without publishing a new version, leaving the alias pointing to the old published version.

Full explanation →

282

MCQmedium

A developer is building a mobile application that uses Amazon Cognito for user authentication. After a user signs in, the application needs to access an Amazon DynamoDB table. The developer has set up an identity pool with an authenticated role. The IAM role attached to the authenticated identity has a policy allowing the required DynamoDB actions. However, users report that they cannot perform DynamoDB operations. What is the MOST likely cause of this issue?

A.The identity pool is not configured to use the authenticated role.

B.The app is not passing the correct identity ID.

C.The IAM role's trust policy does not allow Cognito to assume it.

D.The DynamoDB table is encrypted with a different KMS key.

AnswerC

The trust policy of an IAM role explicitly defines which entities are permitted to assume that role. For Amazon Cognito Identity Pools to issue temporary AWS credentials to an authenticated user, the IAM role associated with the authenticated identity must have a trust policy that grants the Cognito Identity service principal (cognito-identity.amazonaws.com) the sts:AssumeRole permission. Without this crucial trust relationship, Cognito cannot generate the necessary temporary credentials, leading to 'Access Denied' errors when the application attempts to interact with other AWS services, regardless of the permissions policy attached to the role.

Why this answer

The most likely cause is that the IAM role's trust policy does not include a statement allowing Amazon Cognito (specifically the `cognito-identity.amazonaws.com` service principal) to assume the role. Even if the identity pool is configured to use the authenticated role and the role's permissions policy grants DynamoDB actions, Cognito must be able to assume the role via AWS Security Token Service (STS) `AssumeRoleWithWebIdentity`. Without the correct trust relationship, Cognito cannot obtain temporary credentials for the user, so all DynamoDB operations fail.

Exam trap

The trap here is that candidates often focus on the permissions policy (allowing DynamoDB actions) and overlook the trust policy, which is a separate and critical requirement for Cognito to assume the role and generate credentials.

How to eliminate wrong answers

Option A is wrong because if the identity pool were not configured to use the authenticated role, the developer would not have been able to set it up in the first place; the configuration is a prerequisite that is explicitly stated as done. Option B is wrong because the identity ID is used to identify the user within the identity pool, but passing an incorrect identity ID would cause authentication failures or mismatched credentials, not a permissions issue on DynamoDB after sign-in; the core problem is the lack of a trust policy allowing role assumption. Option D is wrong because KMS key encryption on the DynamoDB table would only cause access failures if the IAM role lacked `kms:Decrypt` permissions or the key policy denied access, but the question states the role's policy allows the required DynamoDB actions, and KMS key mismatch would produce a different error (AccessDeniedException for KMS), not a generic inability to perform DynamoDB operations.

Full explanation →

283

MCQeasy

A developer needs to allow an IAM user to manage only their own access keys (create, list, update, delete). Which IAM policy statement achieves this?

A.{"Effect":"Allow","Action":"iam:*AccessKey*","Resource":"arn:aws:iam::*:user/${aws:username}"}

B.{"Effect":"Allow","Action":"iam:*AccessKey*","Resource":"arn:aws:iam::*:user/JohnDoe"}

C.{"Effect":"Allow","Action":"iam:*AccessKey*","Resource":"*"}

D.{"Effect":"Allow","Action":["iam:ListAccessKeys","iam:GetAccessKeyLastUsed"],"Resource":"*"}

AnswerA

This policy correctly grants comprehensive permissions for managing access keys through the `iam:*AccessKey*` action wildcard, which includes actions like Create, Delete, and Update. Crucially, the `Resource` element utilizes the `arn:aws:iam::*:user/${aws:username}` policy variable. This dynamic variable ensures that the policy's scope is strictly limited to the IAM user's own user resource, allowing them to create, delete, update, and list *only their own* access keys, thereby adhering to the principle of least privilege and the specific requirement.

Why this answer

It uses the `iam:*AccessKey*` wildcard action to cover all access key management operations (create, list, update, delete) and restricts the resource to `arn:aws:iam::*:user/${aws:username}`. The `${aws:username}` policy variable dynamically resolves to the IAM user's own username, ensuring that each user can only manage their own access keys. This follows the principle of least privilege by scoping permissions to the user's own resource.

Exam trap

The trap here is that candidates often choose Option C (resource `*`) thinking it grants access to all users' keys, but they overlook that the wildcard resource would allow a user to manage other users' keys, violating the 'only their own' requirement.

How to eliminate wrong answers

Option B is wrong because it hardcodes the username 'JohnDoe', which would only allow that specific user to manage their own access keys, not any IAM user as required by the question. Option C is wrong because the resource `*` grants access to all IAM users' access keys, violating the requirement that each user manages only their own keys. Option D is wrong because it only includes read-only actions (`iam:ListAccessKeys` and `iam:GetAccessKeyLastUsed`) and omits the create, update, and delete actions needed to fully manage access keys.

Full explanation →

284

Matchingmedium

Match each AWS storage class to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Frequent access, low latency

Automatic cost optimization

Long-term archival

Infrequent access, single AZ

Lowest cost retrieval

Why these pairings

The correct matches are S3 Standard with frequently accessed data, S3 Intelligent-Tiering with automatic cost optimization, S3 Glacier Instant Retrieval with archive and fast retrieval, and S3 One Zone-IA with infrequent data in one AZ. Common confusions include mixing up storage class descriptions.

Full explanation →

285

MCQmedium

A company wants to store database credentials securely and rotate them automatically on a schedule. The credentials are used by an AWS Lambda function to access an Amazon RDS instance. Which AWS service should the developer use to meet these requirements?

A.AWS Secrets Manager

B.AWS Systems Manager Parameter Store

C.AWS Key Management Service (KMS)

D.AWS Certificate Manager (ACM)

AnswerA

AWS Secrets Manager is specifically designed for securely storing and managing secrets such as database credentials, API keys, and other sensitive data. It offers robust capabilities for automatic rotation of credentials, particularly for services like Amazon RDS, Amazon Redshift, and Amazon DocumentDB, significantly enhancing security posture by reducing the lifespan of individual credentials. This built-in automation directly addresses the requirement for secure storage and regular rotation, minimizing the risk of compromise.

Why this answer

AWS Secrets Manager is the correct choice because it is specifically designed to securely store, retrieve, and automatically rotate database credentials on a schedule. It natively supports automatic rotation for Amazon RDS databases (including MySQL, PostgreSQL, Oracle, SQL Server, and MariaDB) by integrating with Lambda to update the credentials in both Secrets Manager and the RDS instance. This meets the requirement for both secure storage and scheduled rotation without custom infrastructure.

Exam trap

The trap here is that candidates often confuse AWS Systems Manager Parameter Store (which can store secrets but lacks native rotation) with Secrets Manager, leading them to choose Parameter Store for its lower cost, but the requirement for automatic rotation disqualifies it.

How to eliminate wrong answers

Option B is wrong because AWS Systems Manager Parameter Store does not support automatic rotation of secrets; it requires custom solutions or integration with Secrets Manager for rotation. Option C is wrong because AWS KMS is a key management service for encryption keys, not for storing or rotating secrets like database credentials. Option D is wrong because AWS Certificate Manager (ACM) is used for managing SSL/TLS certificates, not for database credentials or rotation.

Full explanation →

286

MCQeasy

A developer in Account A has an Amazon S3 bucket that contains sensitive data. The developer wants to grant an IAM user in Account B read-only access to objects in the bucket. The developer has added a bucket policy in Account A that grants s3:GetObject access to the IAM user's ARN. However, the IAM user in Account B still receives Access Denied errors. What additional configuration is required?

A.Add an IAM policy in Account B that allows the user to perform s3:GetObject on the bucket's ARN.

B.Create an S3 access point and grant the user access through it.

C.Change the bucket policy to grant access to the entire AWS account B instead of the specific user.

D.Enable S3 object ownership and set the bucket ACL to grant read access to the user in Account B.

AnswerA

The core principle for cross-account S3 access dictates that both the resource owner (Account A) and the identity owner (Account B) must explicitly grant permission. While the bucket policy in Account A grants permission *to* Account B, the IAM user in Account B still requires an identity-based policy attached to them that explicitly allows the `s3:GetObject` action on the specified bucket ARN. This two-policy evaluation ensures that both accounts agree on the access, making this the correct and necessary step.

Why this answer

Cross-account access to S3 requires both a bucket policy in the source account (Account A) granting the necessary permissions to the target IAM user, and an IAM identity-based policy in the target account (Account B) that explicitly allows the same action (s3:GetObject) on the bucket's ARN. Without the IAM policy in Account B, the user lacks the authorization to initiate the request, even though the bucket policy permits it. This dual-permission model is a fundamental security requirement for cross-account S3 access.

Exam trap

The trap here is that candidates often assume a bucket policy alone is sufficient for cross-account access, overlooking the mandatory IAM policy in the target account that must explicitly allow the action.

How to eliminate wrong answers

Option B is wrong because creating an S3 access point does not bypass the need for an IAM policy in Account B; access points still require both the bucket policy and the user's IAM policy to grant cross-account permissions. Option C is wrong because granting access to the entire AWS account B instead of the specific user would allow all principals in Account B (including unintended users) to access the bucket, which violates the principle of least privilege and does not resolve the missing IAM policy issue. Option D is wrong because S3 object ownership and bucket ACLs are legacy mechanisms that do not apply to cross-account access when a bucket policy is already in use; ACLs are disabled by default for new buckets and are not a substitute for the required IAM policy in Account B.

Full explanation →

287

MCQeasy

A developer needs to securely store database credentials for a Lambda function. Which AWS service should be used?

A.AWS Secrets Manager

B.AWS CloudHSM

C.AWS KMS

D.Amazon DynamoDB

AnswerA

AWS Secrets Manager enables automatic rotation of database credentials on a configurable schedule, satisfying the developer's need to avoid hard-coded secrets in Lambda environment variables. Its built-in integration with Amazon RDS, Redshift, and DocumentDB allows the Lambda function to retrieve current credentials at runtime via the GetSecretValue API, eliminating manual secret management.

Why this answer

AWS Secrets Manager is the correct service because it is purpose-built for securely storing, rotating, and managing database credentials and other secrets throughout their lifecycle. It integrates natively with Lambda via the AWS Secrets Manager API, allowing the function to retrieve credentials at runtime without hardcoding them, and supports automatic rotation using built-in or custom Lambda rotation functions. This makes it the ideal choice for securely handling database credentials in a serverless application.

Exam trap

The trap here is that candidates often confuse AWS KMS (which only manages encryption keys) with AWS Secrets Manager (which manages the full lifecycle of secrets), leading them to choose KMS because they think 'encryption' is the primary requirement, when in fact the question asks for secure storage and management of credentials, not just encryption.

How to eliminate wrong answers

Option B (AWS CloudHSM) is wrong because it provides dedicated hardware security modules (HSMs) for cryptographic key generation and storage, not for managing application secrets like database credentials; it lacks built-in secret rotation and retrieval APIs. Option C (AWS KMS) is wrong because it is a key management service for creating and controlling encryption keys used to encrypt data, not for storing or rotating secrets; while it can encrypt secrets stored elsewhere, it does not natively manage the secret lifecycle. Option D (Amazon DynamoDB) is wrong because it is a NoSQL database designed for high-performance, scalable data storage, not a secrets management service; storing credentials in DynamoDB would require manual encryption, rotation, and access control, increasing security risk and operational overhead.

Full explanation →

288

MCQmedium

A company is developing a serverless application using AWS Lambda and API Gateway. The application needs to process user uploads to Amazon S3. The Lambda function must be invoked asynchronously after an object is uploaded to an S3 bucket. Which configuration should the developer use to invoke the Lambda function?

A.Configure the S3 bucket to send events to Lambda by adding a Lambda trigger in the S3 bucket properties.

B.Configure the S3 bucket to send events to an Amazon SQS queue and have Lambda poll the queue.

C.Configure the S3 bucket to send events to Amazon CloudWatch Events and have CloudWatch invoke Lambda.

D.Configure the S3 bucket to send events to an Amazon API Gateway endpoint that triggers the Lambda function.

AnswerA

This is the most direct and efficient method. Amazon S3 natively supports event notifications, allowing you to configure a bucket to send events, such as s3:ObjectCreated:*, directly to an AWS Lambda function. When an object is uploaded, S3 asynchronously invokes the specified Lambda function, passing the event details as payload, which simplifies the architecture and minimizes latency. This setup requires granting S3 permissions to invoke the Lambda function.

Why this answer

S3 can directly invoke Lambda asynchronously via a bucket notification configuration. When an object is uploaded, S3 publishes an event to the Lambda service, which then executes the function without requiring any intermediary services. This is the simplest and most direct way to trigger a Lambda function from an S3 event.

Exam trap

The trap here is that candidates may overcomplicate the solution by introducing unnecessary intermediary services (like SQS or API Gateway) when the direct S3-to-Lambda trigger is the simplest and most appropriate asynchronous invocation method.

How to eliminate wrong answers

Option B is wrong because while S3 can send events to SQS and Lambda can poll the queue, this introduces unnecessary complexity and latency; the requirement is for asynchronous invocation, which S3-to-Lambda direct trigger already provides without an intermediary. Option C is wrong because S3 cannot send events directly to CloudWatch Events; S3 events can be sent to EventBridge (formerly CloudWatch Events) only via S3 Event Notifications configured for EventBridge, and even then, EventBridge would invoke Lambda, but this is not the standard or simplest configuration. Option D is wrong because routing S3 events through API Gateway adds an unnecessary HTTP layer and introduces potential latency and cost; API Gateway is designed for RESTful API endpoints, not for direct S3 event processing.

Full explanation →

289

MCQeasy

A developer is deploying an application using AWS Elastic Beanstalk. The application needs to connect to an Amazon RDS database. What is the best practice for storing database credentials?

A.Hardcode the credentials in the application code.

B.Store credentials in Elastic Beanstalk environment properties.

C.Store credentials in an Amazon S3 bucket with public read access.

D.Store credentials in AWS Secrets Manager and retrieve them at runtime.

AnswerD

AWS Secrets Manager is the recommended and most secure service for storing and managing sensitive credentials. It encrypts secrets at rest and in transit, allows for automatic rotation of credentials, and provides fine-grained access control through AWS IAM policies, ensuring only authorized applications or services can retrieve them at runtime. This approach minimizes the exposure window and enhances the overall security posture by centralizing secret management.

Why this answer

AWS Secrets Manager provides a secure, auditable service for rotating and managing database credentials. By retrieving secrets at runtime via the AWS SDK, the application avoids embedding sensitive data in code or configuration, which is a key security best practice for Elastic Beanstalk deployments.

Exam trap

The trap here is that candidates often confuse Elastic Beanstalk environment properties with secure storage, not realizing they are stored in plaintext and accessible via the environment configuration, unlike Secrets Manager which provides encryption and rotation.

How to eliminate wrong answers

Option A is wrong because hardcoding credentials in application code exposes them in version control and static analysis, violating the principle of least privilege and making rotation impossible without redeployment. Option B is wrong because Elastic Beanstalk environment properties are stored in plaintext in the environment configuration and can be viewed by anyone with access to the Elastic Beanstalk console or API, offering no encryption at rest or rotation capabilities. Option C is wrong because storing credentials in an S3 bucket with public read access exposes them to the entire internet, directly violating AWS security best practices and potentially leading to data breaches.

Full explanation →

290

MCQmedium

A company uses an S3 bucket to store sensitive customer data. The bucket policy currently allows access to a specific IAM role used by an EC2 instance. A security audit reveals that the bucket is also accessible from an external AWS account. Which action should the security team take to restrict access to only the intended role?

A.Use S3 Object Ownership to disable ACLs.

B.Enable S3 Block Public Access on the bucket.

C.Modify the IAM role trust policy to only allow the EC2 instance.

D.Add a condition in the bucket policy to allow access only when the request includes the specific IAM role ARN.

AnswerD

Adding a condition in the S3 bucket policy is the precise method for restricting access to a specific IAM role. By utilizing a condition key like `aws:PrincipalArn` or `aws:SourceArn` within the bucket policy's `Condition` block, you can ensure that S3 operations are permitted only when the requesting principal's ARN matches the specified IAM role. This directly enforces the principle of least privilege by granting access exclusively to the intended role, even across accounts.

Why this answer

Adding a condition in the bucket policy using the `aws:PrincipalArn` condition key allows you to restrict access exclusively to the specific IAM role ARN. This ensures that even if the bucket policy grants access to an external AWS account, only requests made by the designated IAM role (e.g., `arn:aws:iam::123456789012:role/EC2AppRole`) will be allowed, effectively blocking any other principals, including those from external accounts.

Exam trap

The trap here is that candidates often confuse IAM role trust policies with resource-based policies (like S3 bucket policies), thinking that modifying the trust policy will control access to the bucket, when in fact the bucket policy itself must explicitly restrict the principal.

How to eliminate wrong answers

Option A is wrong because disabling ACLs via S3 Object Ownership does not restrict access based on IAM roles or external accounts; it only controls whether ACLs are used to manage permissions, not the bucket policy or IAM policies. Option B is wrong because S3 Block Public Access only prevents public (anonymous or authenticated AWS users) access, but the external AWS account is a trusted AWS principal, not a public user, so Block Public Access would not block that access. Option C is wrong because the IAM role trust policy controls which entities can assume the role, not which principals can access the S3 bucket; the bucket policy must be modified to restrict access to the role.

Full explanation →

291

MCQhard

A company uses AWS Elastic Beanstalk to deploy a web application. The development team wants to ensure that the deployment does not cause any downtime and that new instances are fully registered with the load balancer before old instances are terminated. Which deployment policy should they use?

A.Immutable

B.Rolling with an additional batch

C.Rolling

D.All at once

AnswerB

This policy adds new instances before removing old ones, ensuring zero downtime.

Why this answer

The Rolling with an additional batch deployment policy launches a new batch of instances in addition to the current ones, registers them with the load balancer, and only then terminates the old instances. This ensures zero downtime because the new instances are fully serving traffic before any old instances are removed, unlike standard rolling deployments which terminate old instances before new ones are fully ready.

Exam trap

The trap here is that candidates often confuse 'Rolling with an additional batch' with 'Immutable' deployment, but the key distinction is that Immutable creates a completely separate environment and swaps URLs, while Rolling with an additional batch operates within the same environment by temporarily adding extra instances.

How to eliminate wrong answers

Option A is wrong because Immutable deployment launches a completely new set of instances in a new Auto Scaling group, then swaps the load balancer target group; while it also avoids downtime, it does not use an 'additional batch' approach and is more resource-intensive. Option C is wrong because Rolling deployment terminates old instances in batches before new instances are fully registered with the load balancer, causing potential downtime during the transition. Option D is wrong because All at once deployment terminates all existing instances and deploys the new version simultaneously, causing downtime until the new instances are healthy and registered.

Full explanation →

292

MCQmedium

A developer is using AWS Elastic Beanstalk to deploy a web application. The application requires a highly available environment across multiple Availability Zones. The developer wants to update the application without any downtime while minimizing the number of new instances launched. Which deployment policy should the developer use?

A.All at once

B.Rolling

C.Rolling with additional batch

D.Immutable

AnswerC

This policy launches a new batch of instances alongside the existing ones, ensuring capacity is never reduced. It achieves zero downtime with minimal additional instances compared to immutable.

Why this answer

(Rolling with additional batch) is correct because it launches a new batch of instances before taking the old ones out of service, ensuring full capacity is maintained during the deployment. This provides high availability across multiple Availability Zones while minimizing the number of new instances compared to an immutable deployment, which would double the instance count. The additional batch absorbs the traffic during the rolling update, preventing any downtime.

Exam trap

The trap here is that candidates confuse 'Rolling' with 'Rolling with additional batch', assuming both provide zero downtime, but only the latter guarantees full capacity throughout the update by adding an extra batch to absorb traffic.

How to eliminate wrong answers

Option A is wrong because 'All at once' deploys the new version to all instances simultaneously, causing downtime as all instances are replaced at the same time. Option B is wrong because 'Rolling' updates instances in batches without an extra batch, which reduces capacity during the update and can lead to downtime if the application cannot handle reduced load. Option D is wrong because 'Immutable' launches a completely new set of instances in a new Auto Scaling group, then swaps the environment, which minimizes downtime but launches the maximum number of new instances (doubling the count), contradicting the requirement to minimize new instances.

Full explanation →

293

MCQeasy

A developer is creating an AWS Lambda function to process events from an Amazon SQS queue. The function must process each message exactly once and in order. Which SQS queue type should the developer use?

A.Standard queue.

B.FIFO queue.

C.Dead-letter queue.

D.Delay queue.

AnswerB

Amazon SQS FIFO (First-In-First-Out) queues are designed to guarantee message ordering and exactly-once processing. They ensure that messages are processed in the exact order they are sent and prevent duplicates from being delivered to the consumer, thanks to message deduplication IDs and message group IDs. This makes FIFO queues ideal for applications where the sequence of operations and the prevention of duplicate processing are critical for data integrity.

Why this answer

FIFO queue. FIFO (First-In-First-Out) queues guarantee exactly-once processing and preserve the order of messages, which is required by the use case. Standard queues offer at-least-once delivery and do not guarantee order, making them unsuitable for this requirement.

Exam trap

The trap here is that candidates often confuse the 'exactly-once' and 'in-order' requirements with Standard queues, assuming they can achieve this with idempotent processing, but Standard queues explicitly do not guarantee order and can deliver duplicates.

How to eliminate wrong answers

Option A is wrong because Standard queues provide at-least-once delivery, meaning a message can be delivered more than once, and they do not guarantee message order. Option C is wrong because a Dead-letter queue is not a primary queue type; it is a secondary queue used to store messages that failed processing, not to process events in order with exactly-once semantics. Option D is wrong because a Delay queue is a feature of both Standard and FIFO queues that introduces a message delivery delay, but it does not provide exactly-once processing or ordering guarantees.

Full explanation →

294

MCQhard

A development team is building a real-time chat application using Amazon API Gateway WebSocket APIs and AWS Lambda. The application needs to maintain a connection to each user and broadcast messages to all connected clients. Which approach should the developer use to scale the application efficiently?

A.Store connection IDs in Amazon DynamoDB and use the API Gateway Management API to send messages to all connections.

B.Use Amazon ElastiCache to cache connection IDs and have Lambda send messages using the Redis pub/sub feature.

C.Use Amazon SNS to publish messages to all connected clients via the WebSocket API.

D.Use Amazon SQS to queue messages and have Lambda poll the queue to send messages to all connections.

AnswerA

This is the correct and standard architectural pattern for serverless WebSocket applications on AWS. When a client connects, API Gateway invokes an onConnect Lambda function which stores the unique connectionId in a DynamoDB table. To send a message to all connected clients, a backend service (e.g., another Lambda function) retrieves all active connectionId's from DynamoDB and then iteratively calls the API Gateway Management API's postToConnection action for each ID, pushing the message directly to the client.

Why this answer

DynamoDB provides a scalable, serverless key-value store to persist WebSocket connection IDs, and the API Gateway Management API allows Lambda to send messages directly to any connected client via its connection ID. This combination efficiently handles the broadcast requirement without managing infrastructure, as Lambda can iterate over stored connection IDs and call the Management API for each message.

Exam trap

The trap here is that candidates may confuse the pub/sub or queuing services (SNS, SQS, ElastiCache) as direct communication channels to WebSocket clients, overlooking that API Gateway requires the Management API for server-to-client messaging and that DynamoDB is the simplest way to store and retrieve connection IDs at scale.

How to eliminate wrong answers

Option B is wrong because ElastiCache with Redis pub/sub is designed for decoupled messaging between services, not for directly sending messages to WebSocket clients via API Gateway; it would require additional custom logic to map Redis channels to connection IDs and invoke the Management API. Option C is wrong because Amazon SNS is a pub/sub notification service that pushes messages to endpoints like HTTP/S, email, or Lambda, but it cannot directly send messages to WebSocket connections managed by API Gateway. Option D is wrong because Amazon SQS is a message queue that decouples producers and consumers, but it does not provide a mechanism to send messages to WebSocket clients; Lambda would still need to poll the queue and use the Management API, adding latency and complexity without benefit for real-time broadcasting.

Full explanation →

295

MCQmedium

A company runs a batch processing job on Amazon ECS using Fargate. The job processes files from an S3 bucket and writes results to another S3 bucket. The job runs once per day and takes about 30 minutes. The company wants to reduce costs by stopping the ECS service when not in use. Which solution should the developer implement?

A.Use an AWS Lambda function to run the job and configure a scheduled event in Amazon EventBridge.

B.Use AWS Batch with a Fargate launch type and schedule the job with Amazon EventBridge.

C.Use Amazon ECS Service Auto Scaling to scale the service down to zero tasks when not in use.

D.Use an Amazon EC2 Auto Scaling group to launch an instance, run the job, and then terminate.

AnswerB

AWS Batch is specifically designed for running batch computing workloads, efficiently managing job queues, compute environments, and job execution. Utilizing the Fargate launch type eliminates the need to provision and manage EC2 instances, providing a serverless experience where resources are automatically provisioned and scaled down to zero when jobs are not running. Scheduling the job with Amazon EventBridge ensures reliable, time-based invocation of the batch process, making this a robust, serverless, and cost-effective solution for a 30-minute batch job.

Why this answer

AWS Batch with a Fargate launch type is the ideal solution because it is purpose-built for batch processing jobs that run to completion. By scheduling the job with Amazon EventBridge, you can trigger the job once per day, and AWS Batch automatically provisions the Fargate compute environment only when the job runs, then scales down to zero after completion—eliminating costs during idle periods. This approach directly addresses the requirement to reduce costs by stopping the ECS service when not in use, without manual intervention.

Exam trap

The trap here is that candidates often confuse ECS Service Auto Scaling with AWS Batch's job-based scaling; while ECS can scale to zero tasks, it does not automatically manage job completion and termination, leading to residual costs and complexity, whereas AWS Batch is designed for exactly this use case.

How to eliminate wrong answers

Option A is wrong because while a Lambda function could process files from S3, it has a maximum execution timeout of 15 minutes, which is insufficient for a job that takes about 30 minutes, and it cannot directly write results to another S3 bucket in the same manner as a batch job. Option C is wrong because Amazon ECS Service Auto Scaling can scale the desired count to zero, but it does not automatically stop the service after the job completes; the service remains defined and incurs costs for the Fargate infrastructure even at zero tasks (e.g., load balancer or network costs), and it lacks native job scheduling and lifecycle management for batch workloads. Option D is wrong because using an EC2 Auto Scaling group to launch an instance for a 30-minute job is inefficient; it requires managing the instance lifecycle, patching, and termination, and incurs costs for the running instance and associated resources, whereas Fargate with AWS Batch provides a serverless, cost-effective alternative that scales to zero automatically.

Full explanation →

296

MCQeasy

A developer is deploying a containerized application on Amazon ECS using Fargate. The application needs to store sensitive configuration data, including database passwords, that must be rotated regularly. Which service should the developer use to manage these secrets securely?

A.Amazon S3 with server-side encryption

B.AWS Secrets Manager

C.Amazon DynamoDB with server-side encryption

D.AWS Systems Manager Parameter Store

AnswerB

Secrets Manager provides automatic secret rotation and fine-grained access control.

Why this answer

AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, retrieving, and automatically rotating sensitive configuration data such as database passwords. It integrates natively with Amazon ECS (via the `secrets` container definition parameter) and supports automatic rotation using AWS Lambda, which meets the requirement for regular rotation without custom code.

Exam trap

The trap here is that candidates often confuse AWS Systems Manager Parameter Store (which can store secrets but lacks native rotation) with AWS Secrets Manager, overlooking the explicit requirement for 'regular rotation' in the question.

How to eliminate wrong answers

Option A is wrong because Amazon S3 with server-side encryption provides static encryption at rest but lacks native secret rotation capabilities and does not integrate directly with ECS task definitions for injecting secrets as environment variables. Option C is wrong because Amazon DynamoDB with server-side encryption is a NoSQL database service designed for high-performance data storage, not for managing secrets with built-in rotation or fine-grained access control for secret lifecycle management. Option D is wrong because AWS Systems Manager Parameter Store can store secrets (using SecureString parameters) but does not support automatic rotation of secrets; it requires custom automation to rotate values, whereas the question explicitly requires regular rotation.

Full explanation →

297

MCQmedium

A developer is using AWS SAM to define a serverless application. The application includes an AWS Lambda function and an Amazon API Gateway REST API. The developer wants to configure the API Gateway stage to enable logging and set the stage name based on the SAM parameter Stage. In the SAM template, which property of the AWS::Serverless::Api resource should the developer use to set the stage name?

A.StageName

B.DefinitionBody

C.StageDescription

D.EndpointConfiguration

AnswerA

The StageName property within an AWS::Serverless::Api resource in AWS SAM is precisely what defines the name of the Amazon API Gateway deployment stage. This critical property allows developers to specify a logical identifier for a particular deployment, such as Prod, Dev, or Test, which is essential for managing different environments. It frequently leverages SAM parameters, like !Ref Stage, enabling dynamic stage naming based on deployment inputs, ensuring flexibility and reusability across various CI/CD pipelines.

Why this answer

The `StageName` property of the `AWS::Serverless::Api` resource directly sets the stage name for the API Gateway REST API. By using a SAM parameter like `Stage` (e.g., `StageName: !Ref Stage`), the developer can dynamically control the stage name at deployment time. This is the intended and simplest way to configure the stage name in an AWS SAM template.

Exam trap

The trap here is that candidates confuse `StageName` with `StageDescription` (Option C) because both relate to stage configuration, but `StageDescription` only provides metadata and does not control the actual stage identifier used in the API endpoint URL.

How to eliminate wrong answers

Option B (`DefinitionBody`) is wrong because it defines the OpenAPI specification for the API, not the stage name; it can include a `stageName` field within the OpenAPI definition, but that is not the SAM-level property for setting the stage name. Option C (`StageDescription`) is wrong because it provides a description of the stage (e.g., for documentation or tagging), not the stage name itself. Option D (`EndpointConfiguration`) is wrong because it specifies the endpoint type (e.g., REGIONAL, EDGE, PRIVATE) for the API, not the stage name.

Full explanation →

298

MCQmedium

A company has a DynamoDB table that stores order data. The table has a partition key of OrderID and a sort key of OrderDate. The company frequently queries orders by CustomerID, which is not a key attribute. The queries are slow and consume a lot of read capacity. Which design change would MOST improve query performance?

A.Increase the provisioned read capacity for the table.

B.Create a Global Secondary Index (GSI) with CustomerID as the partition key.

C.Change the table's primary key to use CustomerID as the partition key.

D.Use a FilterExpression on the CustomerID attribute in a Scan operation.

AnswerB

Creating a Global Secondary Index (GSI) with `CustomerID` as its partition key is the most effective solution for efficiently querying items based on `CustomerID`. A GSI stores a copy of a subset of the base table's attributes, indexed by its own primary key (in this case, `CustomerID`). This allows `Query` operations to directly access items matching a specific `CustomerID` without scanning the entire base table, significantly improving performance and reducing cost for targeted lookups.

Why this answer

Creating a Global Secondary Index (GSI) with CustomerID as the partition key allows DynamoDB to efficiently query orders by CustomerID using the index's key structure, avoiding full table scans. This directly addresses the slow performance and high read capacity consumption by enabling targeted lookups instead of scanning all items and filtering.

Exam trap

The trap here is that candidates often think increasing provisioned capacity (Option A) or using FilterExpression (Option D) will fix performance, but they fail to recognize that these do not change the underlying inefficient data access pattern of scanning all items.

How to eliminate wrong answers

Option A is wrong because increasing provisioned read capacity only adds more throughput capacity but does not change the underlying query pattern; the query still performs a full Scan or inefficient query, so it would still be slow and consume more capacity units. Option C is wrong because changing the table's primary key to CustomerID would break existing access patterns that rely on OrderID as the partition key, and it would not support queries by OrderID without a separate index. Option D is wrong because using a FilterExpression on a Scan operation still reads every item in the table, consuming the same amount of read capacity and providing no performance improvement; FilterExpressions only reduce the data returned, not the data read.

Full explanation →

299

MCQhard

A developer is troubleshooting an AWS Lambda function that is invoked from an Amazon S3 bucket via event notifications. The function processes images and stores metadata in Amazon DynamoDB. The developer notices that some images are being processed multiple times, resulting in duplicate entries in DynamoDB. The S3 event notification is configured to send events to the Lambda function with the 's3:ObjectCreated:*' event type. The function uses the 'uuid' library to generate a unique ID for each image upon processing. What is the most likely cause of the duplicate processing?

A.S3 event notifications are delivered at least once, and the Lambda function is not idempotent.

B.The Lambda function's concurrency is set too high, causing race conditions.

C.The DynamoDB table does not have a primary key that prevents duplicates.

D.The S3 bucket is configured with versioning, causing multiple object creation events.

AnswerA

S3 event notifications operate on an "at least once" delivery model, meaning that a single S3 event, such as an object creation, might trigger the associated Lambda function multiple times. If the Lambda function's logic is not designed to be idempotent, each duplicate invocation will independently process the event and perform its side effects, leading to duplicate data entries or actions. Implementing idempotency, often by using a unique identifier from the S3 event (like the object key) as a check, is crucial to prevent these redundant operations.

Why this answer

Amazon S3 event notifications are delivered on an 'at least once' basis, meaning the same event can be sent to Lambda multiple times. If the Lambda function is not idempotent—i.e., processing the same event multiple times produces duplicate side effects—then duplicate DynamoDB entries will occur. The use of a 'uuid' library inside the function does not help because a new UUID is generated on each invocation, so the same image gets different IDs and is stored as a separate item each time.

Exam trap

The trap here is that candidates assume generating a unique ID inside the function solves duplication, but they miss that idempotency requires using a stable, external identifier (like the S3 object key) to detect and skip already-processed events.

How to eliminate wrong answers

Option B is wrong because high concurrency can cause race conditions, but the core issue here is duplicate event delivery, not concurrent writes; even with low concurrency, duplicate events would still be processed. Option C is wrong because the DynamoDB table's primary key design does not cause duplicate processing; it only affects whether duplicate writes are rejected or overwritten—the problem is that the function is invoked multiple times for the same image. Option D is wrong because S3 versioning generates separate object versions, each with a unique version ID, and the 's3:ObjectCreated:*' event fires once per version; versioning does not cause multiple events for the same object version.

Full explanation →

300

MCQhard

An ECS blue/green deployment with CodeDeploy and an Application Load Balancer fails because the replacement task set never receives test traffic. Which configuration should be checked?

A.S3 bucket versioning

B.Lambda provisioned concurrency

C.The test listener and target group mapping in the deployment group

D.DynamoDB TTL

AnswerC

In an AWS CodeDeploy Blue/Green deployment for Amazon ECS, the test listener and its mapping to a new target group are fundamental for validating the new task set (the 'green' environment). CodeDeploy uses this listener to route a small amount of traffic, or traffic from a specific test client, to the new target group associated with the updated application tasks. This crucial step allows for pre-validation and ensures the new application version is healthy and functional before the final production traffic cutover, enabling safe rollouts and easy rollbacks.

Why this answer

In an ECS blue/green deployment with CodeDeploy and an Application Load Balancer, the test listener and its associated target group are responsible for routing test traffic to the replacement task set. If the replacement task set never receives test traffic, the most likely cause is that the test listener is not correctly mapped to the target group in the CodeDeploy deployment group configuration. This mapping ensures that traffic from the test listener is directed to the replacement task set during the deployment lifecycle.

Exam trap

The trap here is that candidates may confuse the test listener with the production listener or assume the issue is with the ALB itself, rather than recognizing that the test listener-to-target-group mapping in the CodeDeploy deployment group is the specific configuration that controls test traffic routing.

How to eliminate wrong answers

Option A is wrong because S3 bucket versioning is unrelated to ECS deployment traffic routing; it is used for object version control and rollback in S3, not for CodeDeploy traffic routing. Option B is wrong because Lambda provisioned concurrency is a feature for managing concurrent execution capacity of Lambda functions, not for ECS task set traffic routing in blue/green deployments. Option D is wrong because DynamoDB TTL (Time to Live) is a feature for automatically expiring items in DynamoDB tables, and it has no role in CodeDeploy or ALB traffic routing.

Full explanation →

AWS Certified Developer Associate DVA-C02 (DVA-C02) — Questions 226–300