AWS Certified Developer Associate DVA-C02 (DVA-C02) — Questions 376–450

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because changing the deployment configuration to AllAtOnce does not enable rollback; it only deploys to all instances simultaneously, which could increase the blast radius of a failed deployment. Option B is wrong because lifecycle hooks are used to perform custom actions (e.g., draining connections) during instance launch or termination, not to trigger automatic rollbacks of a deployment. Option C is wrong because while blue/green deployment can reduce risk, it does not inherently provide automatic rollback on health check failure; rollback must be explicitly enabled in the deployment group configuration.

Why this answer

How to eliminate wrong answers

Option B is wrong because implementing a local cache inside a Lambda function is ephemeral and not shared across concurrent invocations, so it cannot reduce backend load for repeated requests from different clients. Option C is wrong because while ElastiCache Redis can cache data, it requires additional code in the Lambda function to check the cache first, adding complexity and latency compared to API Gateway's built-in caching. Option D is wrong because CloudFront caches content at the edge, but it does not reduce backend load for API Gateway itself unless combined with API Gateway caching; CloudFront alone still forwards cache misses to API Gateway, which then invokes the backend.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because hardcoding the bucket name in the Lambda function code violates the separation of configuration from code, making the function environment-specific and requiring code changes to point to a different bucket. Option C is wrong because reading the bucket name from a text file stored in the same bucket creates a circular dependency: the function needs the bucket name to access the bucket, but it must first read the file from the bucket to get the name, which is impossible without prior knowledge of the bucket. Option D is wrong because using a KMS key to encrypt the bucket name and decrypt it in the function adds unnecessary complexity and overhead; environment variables are already encrypted at rest by default, and the bucket name is not sensitive data that requires custom encryption—this approach does not solve the configuration problem.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because reserved concurrency controls the maximum number of concurrent executions for a function, not storage capacity. Option C is wrong because the function URL auth type (e.g., AWS_IAM or NONE) determines authentication for HTTP invocations, not storage. Option D is wrong because a dead-letter queue target (e.g., SQS or SNS) is used for capturing failed asynchronous invocations, not for providing scratch space.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because placing an Application Load Balancer in public subnets would expose the services to the internet, violating the requirement that services be accessible only from the internal network via VPN. Option C is wrong because a NAT Gateway is used for outbound traffic from private subnets to the internet, not for inbound traffic from a VPN; it cannot accept inbound connections initiated from outside the VPC. Option D is wrong because an Internet Gateway is designed for direct internet access, and routing VPN traffic through it would expose services to the public internet, defeating the purpose of private subnets and internal-only access.

Why this answer

How to eliminate wrong answers

Option A is wrong because an IAM group is a collection of IAM users and cannot be directly attached to an EC2 instance; groups are used to manage permissions for users, not for AWS resources. Option C is wrong because an IAM user has long-term credentials (access key ID and secret access key) that would need to be stored on the EC2 instance, which is a security risk and not a best practice for granting permissions to an AWS service. Option D is wrong because a resource-based policy on the DynamoDB table can grant access to principals (like IAM roles or users) but cannot be attached to an EC2 instance; the EC2 instance itself must have an identity (role) to authenticate against the policy.

Why this answer

How to eliminate wrong answers

Option A is wrong because while CloudTrail logs root account events, SNS notifications cannot be directly configured on CloudTrail; you need a CloudWatch Events rule to filter and route the events to an SNS topic. Option C is wrong because VPC Flow Logs capture network traffic metadata (IP addresses, ports, protocols) at layer 3/4, not API call details; they cannot log or monitor AWS API calls. Option D is wrong because AWS Config rules evaluate resource configuration compliance (e.g., whether an S3 bucket is public), not user activity or API call patterns; they cannot detect root account usage.

Why this answer

How to eliminate wrong answers

Option A is wrong because HTTPS health checks require the target to support HTTPS; if the instances only support HTTP, the health check would fail and the instances would be marked unhealthy, leading to 503 errors (not 504). Option B is wrong because disabling cross-zone load balancing affects traffic distribution across Availability Zones, not the timeout behavior that causes 504 errors. Option D is wrong because a missing inbound security group rule for the load balancer would prevent the load balancer from establishing connections to the instances, resulting in 502 errors or health check failures, not intermittent 504 timeouts.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because storing IAM user access keys in environment variables introduces long-term credentials that can be leaked, and it violates the AWS best practice of using temporary credentials via IAM roles. Option B is wrong because resource-based policies on DynamoDB tables cannot grant access to a Lambda function directly; DynamoDB does not support resource-based policies for Lambda invocation, and the Lambda function still needs an execution role to assume permissions. Option D is wrong because hardcoding credentials in code is insecure, makes rotation difficult, and violates the principle of never embedding secrets in application code.

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS::ApiGateway::DomainName only defines the custom domain name and its TLS certificate; it does not automatically create the base path mapping or integrate with the API stage, so additional resources and manual wiring are needed. Option C is wrong because AWS::ApiGateway::BasePathMapping maps a base path to an API stage but does not create the custom domain name itself; it must be used in conjunction with a DomainName resource, increasing complexity. Option D is wrong because AWS::Route53::RecordSet creates a DNS record (e.g., CNAME or A alias) to point a custom domain to the API Gateway endpoint, but it does not configure the API Gateway custom domain name or TLS termination; it is a DNS-only resource and cannot replace the DomainName configuration.

Why this answer

How to eliminate wrong answers

Option B is wrong because the bucket policy condition checking aws:SourceVpce is necessary to restrict access to the VPC endpoint, but the question states the policy already allows access only from a specific VPC endpoint; the issue is that requests are denied, so the condition is likely present but the endpoint policy is blocking. Option C is wrong because the route table does not need a route to the S3 endpoint; VPC endpoints use prefix lists and route tables direct traffic to the endpoint via a gateway or interface endpoint, but missing routes would cause a timeout or connection failure, not an IAM denial. Option D is wrong because security groups do not apply to VPC endpoint traffic; S3 uses a gateway endpoint which is not associated with security groups, and outbound HTTPS traffic from the EC2 instance is allowed by default in the VPC.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because saving to EC2 instance store is ephemeral (data is lost on instance stop/termination) and adds an unnecessary intermediate step with no benefit for reliability or efficiency. Option B is wrong because a single PutObject operation for a 5 GB file is prone to network interruptions, requires the entire upload to restart on failure, and has a hard limit of 5 GB (the maximum object size in a single PUT is 5 GB, but multipart is still recommended for files over 100 MB). Option D is wrong because S3 Transfer Acceleration optimizes network path and speed for long-distance transfers but does not provide the reliability benefits of parallel uploads or retry granularity; it can be combined with multipart upload but is not the primary solution for reliability.

Why this answer

How to eliminate wrong answers

Option B (S3CrudPolicy) is wrong because it grants create, read, update, and delete permissions, which exceeds the required read-only access and violates the principle of least privilege. Option C (S3FullAccessPolicy) is wrong because it provides full administrative access to the S3 bucket, including delete and write operations, far beyond the read-only requirement. Option D (S3StreamPolicy) is wrong because it is not a valid SAM policy template; SAM does not include a template named S3StreamPolicy, and streaming permissions are typically associated with services like Kinesis or DynamoDB Streams, not S3.

Why this answer

How to eliminate wrong answers

Option A is wrong because S3 bucket ACLs are legacy and do not support granting access to IAM users in another AWS account; they only grant access to AWS accounts or predefined groups, not specific IAM users. Option C is wrong because generating pre-signed URLs is a workaround for temporary access, not a required step to fix the existing bucket policy and IAM user configuration; it would bypass the need for proper IAM policies but is not the missing step for the described setup. Option D is wrong because adding an IP address condition is unrelated to the cross-account permission issue; it would restrict access based on network location but does not resolve the missing identity-based policy in Account B.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because an expired SSL certificate on the ALB would cause TLS handshake failures (e.g., 502 Bad Gateway or connection errors), not intermittent 503 errors; the ALB would still route traffic to healthy targets. Option C is wrong because if the ALB DNS name were not resolving, clients would receive a DNS resolution failure (NXDOMAIN) or timeout, not an HTTP 503 error from the ALB. Option D is wrong because if the security group for the ALB were blocking traffic, clients would receive a timeout or connection refused error, not an HTTP 503 response; the ALB would not be reachable at all.

Why this answer

How to eliminate wrong answers

Option A is wrong because disabling retries does not prevent duplicates; Kinesis can still deliver the same record multiple times due to its at-least-once delivery guarantee, and disabling retries would cause data loss on transient failures. Option B is wrong because record ordering (enabled by default in Kinesis streams) controls the sequence of records within a shard but does not eliminate duplicate records; duplicates can still occur from producer retries or consumer rebalancing. Option D is wrong because sending records to an SQS FIFO queue does not deduplicate records already delivered by Kinesis; the deduplication ID in SQS FIFO only prevents duplicates within the queue itself, and the Lambda function would still need to handle duplicates from the Kinesis source.

Why this answer

How to eliminate wrong answers

Option B is wrong because `s3:x-amz-server-side-encryption-aws:kms` is not a valid condition key; the correct key is `s3:x-amz-server-side-encryption` and the value should be `aws:kms`, not a boolean. Option C is wrong because using `Null: 's3:x-amz-server-side-encryption': 'true'` only denies requests where the header is absent, but it does not enforce that the encryption type is `aws:kms`; a request with `AES256` would still be allowed. Option D is wrong because `StringNotEquals: 's3:x-amz-server-side-encryption': 'AES256'` denies requests that do not use AES256, which would incorrectly allow `aws:kms` but also block legitimate SSE-KMS uploads if the policy is meant to require KMS; it also fails to block requests with no encryption header.

Why this answer

How to eliminate wrong answers

Option A is wrong because manually creating a CloudFront invalidation after each deployment is inefficient, error-prone, and does not scale; it also contradicts the goal of an automated CI/CD pipeline. Option B is wrong because setting the default TTL to 0 would force CloudFront to re-fetch every object from the origin on every request, defeating the purpose of a CDN and significantly increasing latency and origin load. Option D is wrong because the S3 bucket policy for public read access is unrelated to CloudFront cache invalidation; CloudFront can serve private S3 content via Origin Access Control (OAC) and still serve stale cached content.

Why this answer

How to eliminate wrong answers

Option A is wrong because `s3:x-amz-server-side-encryption-key-id` is not a valid S3 condition key; AWS S3 does not recognize this key. Option B is wrong because `s3:x-amz-server-side-encryption` only checks whether server-side encryption is enabled (e.g., AES256 or aws:kms), but it cannot enforce a specific KMS key ID, so it would allow SSE-S3 or any KMS key. Option C is wrong because `s3:x-amz-server-side-encryption-kms-key-id` is not a valid condition key; the correct key name includes 'aws' as `s3:x-amz-server-side-encryption-aws-kms-key-id`.

Why this answer

How to eliminate wrong answers

Option A is wrong because if the developer lacked permissions to create S3 buckets, the error would be an authorization failure (e.g., 'Access Denied'), not a 'bucket already exists' error. Option C is wrong because a syntax error in the CloudFormation template would produce a validation error (e.g., 'Template format error') before any resource creation attempt. Option D is wrong because if the bucket name was used by another stack in the same account, the error would still be 'already exists', but the question asks for the MOST likely cause; since bucket names are globally unique, the name being taken by any account (including another account) is the primary reason, and the error message does not specify it was from the same account.

Why this answer

How to eliminate wrong answers

Option B is wrong because hardcoding credentials in application code violates security best practices, does not encrypt credentials at rest, and requires manual rotation. Option C is wrong because AWS Systems Manager Parameter Store SecureString parameters encrypt at rest but do not support automatic rotation natively; rotation would require a custom AWS Lambda function or manual intervention. Option D is wrong because Elastic Beanstalk environment properties store credentials as plaintext environment variables, which are not encrypted at rest and cannot be rotated automatically.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'CodeDeployDefault.EC2AllAtOnce' is a deployment configuration that controls the traffic shifting speed (all instances at once), not a rollback mechanism based on health checks. Option C is wrong because enabling automatic rollback for 'DEPLOYMENT_FAILURE' or 'DEPLOYMENT_STOP_ON_REQUEST' only triggers rollback on deployment failures or manual stops, not on post-deployment health check failures within a time window. Option D is wrong because 'LoadBalancerInfo' and 'originalInstanceTermination' are used to configure traffic routing and instance termination behavior in blue/green deployments, not to trigger automatic rollbacks based on health checks.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because switching to asynchronous invocation does not change the maximum execution duration; Lambda's synchronous and asynchronous invocations both have a maximum timeout of 15 minutes (900 seconds), so the function would still time out after 15 seconds unless the timeout is increased. Option C is wrong because increasing memory to 3 GB would increase processing speed but also triples the cost per GB-second, making it less cost-effective than simply extending the timeout at 1 GB. Option D is wrong because using AWS Step Functions to orchestrate processing in smaller chunks adds complexity and cost (per state transition) without addressing the root cause—the function's timeout limit—and may still require increasing the Lambda timeout for each chunk.

Why this answer

How to eliminate wrong answers

Option A is wrong because an SCP that denies s3:PutBucketEncryption would prevent any encryption changes, but it does not enforce encryption on newly created buckets (which default to no encryption) and does not provide automatic remediation. Option C is wrong because deploying a CloudFormation template via StackSets only creates buckets with encryption at deployment time; it does not detect or remediate buckets created outside of CloudFormation, such as those created manually or by other services. Option D is wrong because S3 Block Public Access controls public access settings, not encryption; it does not address the requirement to enforce SSE-S3 encryption.

Why this answer

How to eliminate wrong answers

Option A is wrong because resource-based policies on Lambda functions control which other AWS services or accounts can invoke the function, not the function's own access to downstream resources like DynamoDB; Lambda uses execution roles for outbound permissions. Option B is wrong because AmazonDynamoDBFullAccess is a managed policy that grants unrestricted access to all DynamoDB actions on all tables, violating the principle of least privilege. Option C is wrong because S3 bucket policies are used to control access to S3 resources, not DynamoDB tables; DynamoDB access is governed by IAM policies attached to the caller's role, not by S3 policies.

Why this answer

How to eliminate wrong answers

Option B is wrong because hardcoding access keys in a script violates AWS security best practices and creates a long-term credential exposure risk; the keys could be compromised if the script is shared, logged, or stored in version control. Option C is wrong because AWS Secrets Manager is designed for storing and retrieving secrets like database passwords or API keys, not for obtaining temporary credentials for an EC2 instance that already has an IAM role; it adds unnecessary complexity and cost when the instance metadata service provides credentials automatically. Option D is wrong because while the AWS SDK's default credential provider chain does automatically retrieve credentials from the instance metadata service, the question asks which method the developer should use to 'securely obtain temporary credentials' — the chain is an automatic process, not a method the developer explicitly calls to retrieve credentials in a script; the developer would need to use the metadata endpoint directly or rely on the SDK's automatic resolution, but the chain itself is not a method to call.

Why this answer

How to eliminate wrong answers

Option B is wrong because hardcoding a single access key in the app violates security best practices — the key could be extracted from the mobile binary, granting unrestricted access to the entire bucket. Option C is wrong because making the bucket public and validating names client-side is insecure; a malicious user can bypass client-side checks and upload to any prefix. Option D is wrong because granting AmazonS3FullAccess to every user violates least privilege by giving all users full administrative control over all S3 buckets, including the ability to delete or modify any object.

Why this answer

How to eliminate wrong answers

Option A is wrong because storing credentials in Systems Manager Parameter Store and retrieving them in User Data still requires the credentials to be stored as a secret, and User Data runs only at instance launch, leaving the credentials on the instance's local storage or memory, which violates the security requirement of not storing long-term credentials. Option C is wrong because using an AWS Lambda function to generate temporary credentials and pass them to the instances introduces unnecessary complexity and a potential security risk of passing credentials over the network; the instances can directly obtain temporary credentials via an IAM role without external orchestration. Option D is wrong because generating access keys for a dedicated IAM user and storing them in a file on the AMI embeds long-term credentials directly into the AMI, which persists across instances and violates the core security principle of avoiding stored credentials.

Why this answer

How to eliminate wrong answers

Option B is wrong because hardcoding ARNs in every function violates the principle of environment isolation and requires manual changes for each environment, increasing the risk of misconfiguration and deployment errors. Option C is wrong because using one AWS root account per environment is an anti-pattern; it introduces unnecessary administrative overhead, security risks, and violates the AWS Well-Architected Framework's recommendation to use separate AWS accounts (not root accounts) for environment isolation. Option D is wrong because disabling stack updates prevents any future changes to the stack, making it impossible to update configuration values or deploy new features, which is impractical for ongoing development and deployment.

Why this answer

How to eliminate wrong answers

Option A is wrong because SSE-S3 does not support customer-controlled key rotation; S3 manages the keys entirely and rotates them automatically every year, but the developer cannot set or control a custom key rotation policy. Option C is wrong because SSE-C requires the developer to provide and manage their own encryption keys, including manually rotating them, which increases operational overhead. Option D is wrong because client-side encryption requires the developer to implement encryption logic in the application and manage key rotation on the client side, adding significant operational overhead compared to a server-side solution.

Why this answer

How to eliminate wrong answers

Option A is wrong because Lambda functions do not have a configurable retry count for SQS-triggered invocations; Lambda's built-in DLQ is for asynchronous invocations (e.g., from S3 or SNS), not for SQS event source mappings, and setting retry attempts on the function itself is not supported. Option B is wrong because setting reserved concurrency to 0 would prevent the Lambda function from executing at all, causing all messages to fail immediately, and the DLQ on the function is again irrelevant for SQS-triggered invocations. Option D is wrong because SNS topics are not used to retry or manage DLQ behavior for SQS-triggered Lambda functions; the retry and DLQ logic must be configured on the SQS queue itself, not via an SNS topic.

Why this answer

Why this answer

How to eliminate wrong answers

Option B (AWS Systems Manager Parameter Store) is wrong because while it can store secrets securely, it does not support automatic rotation of credentials out of the box; you would need to build custom rotation logic. Option C (Amazon DynamoDB) is wrong because it is a NoSQL database service, not a secrets management service, and storing credentials there would require manual encryption and rotation, violating security best practices. Option D (AWS KMS) is wrong because it is a key management service for creating and controlling encryption keys, not for storing or rotating secrets; it can be used to encrypt secrets but does not manage the secret lifecycle or rotation.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because `CanarySetting` is a property of the API Gateway `Stage` resource in AWS CloudFormation, not a SAM-specific attribute; SAM abstracts this into `DeploymentPreference` for simplicity. Option C is wrong because `StageName` is a property that defines the stage name (e.g., 'prod') but does not control traffic shifting or canary deployments. Option D is wrong because `MethodSettings` configures per-method settings like throttling or caching, not deployment strategies like canary releases.

Why this answer

How to eliminate wrong answers

Option B is wrong because an S3 bucket policy alone cannot enable the initial assumption of a role; it only grants direct access to the bucket, not the ability to assume an IAM role. Option C is wrong because an IAM user policy in the external account allowing sts:AssumeRole is necessary but not sufficient—the developer's account must also have a trust policy that accepts the assumption request; the question asks for the policy required in the developer's account. Option D is wrong because AWS Organizations SCPs can restrict permissions but cannot grant cross-account access; they are used to set permission boundaries, not to allow role assumption.

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS KMS is a service for creating and controlling encryption keys used to encrypt data at rest, not for managing SSL/TLS certificates. Option C is wrong because IAM is used for managing user identities and permissions, not for issuing or managing SSL/TLS certificates. Option D is wrong because AWS Secrets Manager is designed to securely store and rotate secrets like database credentials or API keys, not for managing SSL/TLS certificates.

Why this answer

How to eliminate wrong answers

Option A is wrong because CodeCommit is a Git-based source control service, not a dependency cache; storing dependencies there would require manual management and does not integrate with CodeBuild's caching mechanism. Option B is wrong because downloading dependencies from S3 in each build still incurs network latency and download time, negating the performance benefit of caching. Option D is wrong because mounting an EFS file system adds network filesystem overhead and latency, and EFS is designed for shared file storage across multiple instances, not for low-latency build caching within a single build environment.

Why this answer

Why this answer

How to eliminate wrong answers

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS Key Management Service (KMS) is a managed service for creating and controlling encryption keys, not for storing secrets like database credentials; it can encrypt secrets but does not provide secret rotation or retrieval APIs. Option B is wrong because Amazon DynamoDB is a NoSQL database designed for high-performance key-value and document storage, not a secure secrets store; storing credentials there would require manual encryption and lack built-in rotation, access auditing, or automatic secret management. Option D is wrong because AWS Systems Manager Parameter Store is a service for storing configuration data and secrets, but it lacks native automatic rotation for database credentials (unless combined with a custom Lambda function) and does not offer the same level of integration with RDS or secret-specific features like cross-account access or secret versioning with staging labels.

Why this answer

Why this answer

How to eliminate wrong answers

Option B (AWS CodeCommit) is wrong because it is a source control service for storing code, not a service for executing build or test commands. Option C (AWS CloudFormation) is wrong because it is an infrastructure-as-code service for provisioning AWS resources, not for running unit tests. Option D (AWS CodeDeploy) is wrong because it automates code deployment to compute services like EC2 or Lambda, but it does not execute unit tests; tests must be run before deployment.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because API Gateway caching is unrelated to Lambda's ability to access Secrets Manager; caching affects API responses, not secret retrieval permissions. Option C is wrong because the number of VPC subnets (three) is irrelevant to secret rotation access; Lambda requires at least one subnet per AZ for VPC connectivity, but this does not cause AccessDeniedException from Secrets Manager. Option D is wrong because CloudFront invalidation is a CDN cache-clearing mechanism and has no bearing on Lambda's IAM permissions or secret access.

Why these pairings

Why this answer

How to eliminate wrong answers

Option A is wrong because embedding IAM user credentials in application code is a security anti-pattern; it exposes long-term static credentials that can be compromised and are difficult to rotate. Option C is wrong because storing the secret in EC2 user data is insecure; user data is visible to anyone who can describe the instance or view the console, and it does not provide access control or audit logging. Option D is wrong because storing the secret in a configuration file on the instance, even with restricted file permissions, does not protect against unauthorized access if the instance is compromised, and it lacks centralized management and rotation capabilities.

Why this answer

How to eliminate wrong answers

Option B is wrong because increasing Lambda reserved concurrency only ensures more concurrent function executions, but it does not resolve the bottleneck at the DynamoDB layer; if the table is throttling, more concurrent invocations will only increase the number of throttled requests and worsen latency. Option C is wrong because moving the Lambda function into a VPC with a DynamoDB VPC endpoint reduces network latency and avoids NAT gateway costs, but it does not address the throughput capacity of the DynamoDB table itself; the primary latency issue is throttling, not network path. Option D is wrong because DynamoDB Accelerator (DAX) is an in-memory cache for read-heavy workloads and does not improve write performance; the Lambda function is storing metadata (write operations), so DAX would not reduce write latency.

Why this answer

How to eliminate wrong answers

Option B is wrong because if the security group blocked traffic from the load balancer, the instances would be unreachable entirely, not just failing health checks, and the logs would likely show connection timeouts or refused connections. Option C is wrong because unlogged exceptions would still typically result in a non-200 response or an error page, which would be reflected in the health check status; the question states logs show no errors, making this unlikely. Option D is wrong because Elastic Beanstalk configures the load balancer to forward traffic to the correct port (e.g., 8080 for Tomcat), and the health check is sent to that same port; listening on a different port would cause a connection failure, not a health check failure with no errors in logs.

Why this answer

How to eliminate wrong answers

Option A is wrong because the ValidateService hook runs after the deployment completes to verify the application is running correctly; a failure there would not cause the ApplicationStop hook to fail. Option B is wrong because the BeforeInstall hook runs after ApplicationStop and before the new application version is installed; an incorrect configuration there would not affect the ApplicationStop hook. Option C is wrong because insufficient Auto Scaling group capacity would cause a different error related to instance launch or health checks, not a specific hook failure on existing instances.

Why this answer

How to eliminate wrong answers

Option A is wrong because Amazon S3 with server-side encryption only encrypts objects at rest but does not provide automatic rotation of secrets or native secret management features. Option B is wrong because AWS KMS is a key management service that creates and controls encryption keys, not a service for storing application configuration data or rotating secrets directly. Option C is wrong because AWS Systems Manager Parameter Store can store configuration data securely with encryption via KMS, but it does not offer built-in automatic rotation of secrets; rotation requires custom implementation using AWS Lambda or other automation.

Why this answer

How to eliminate wrong answers

Option B is wrong because sticky sessions (session affinity) only route a user to the same instance, but they do not preserve session data when that instance is terminated and replaced; the session is still lost. Option C is wrong because the Application Load Balancer does not store session data; it only forwards requests and can manage cookies for stickiness, but the session state itself must be stored elsewhere. Option D is wrong because S3 is an object store with higher latency and is not designed for low-latency, frequent read/write operations required for session management; it would introduce unacceptable performance overhead and is not a session store.

Why this answer

How to eliminate wrong answers

Option A is wrong because KEYS_ONLY captures only the key attributes of the modified item, not the full old or new images, so the processor would lack the complete item data needed for downstream logic. Option C is wrong because NEW_IMAGE only captures the item's state after the update, omitting the previous state, which fails the requirement to receive both old and new images. Option D is wrong because OLD_IMAGE only captures the item's state before the update, omitting the new state, which also fails the requirement for both images.

Why this answer

How to eliminate wrong answers

Option A is wrong because a sparse index on player ID would not help retrieve top scores; it only indexes items where player ID is present, and querying by player ID does not sort by score. Option B is wrong because a local secondary index (LSI) on score is constrained to the same partition key as the base table, requiring a full partition scan to get top scores across all partitions, which consumes more RCUs. Option C is wrong because DynamoDB Accelerator (DAX) is an in-memory cache that reduces latency and read load, but it does not change the underlying query pattern or RCU consumption for fetching top scores; the base table or index still needs to be queried, and DAX caches results after the first read, not reducing RCUs for the initial query.

Why this answer

How to eliminate wrong answers

Option A is wrong because in-place deployments are not supported for Amazon ECS with the Fargate launch type; ECS deployments using CodeDeploy must use blue/green deployments. Option C is wrong because CodeDeployDefault.OneAtATime is a deployment configuration for Lambda or EC2/On-Premises, not for ECS; ECS deployments use a different set of configurations like CodeDeployDefault.ECSAllAtOnce. Option D is wrong because CloudWatch alarms can be configured to trigger a rollback, but they are an additional optional feature, not the primary mechanism to ensure automatic rollback on health check failure; the core requirement is enabling rollback in the deployment group settings.

Why this answer

How to eliminate wrong answers

Option A is wrong because polling a CodeCommit repository every minute introduces unnecessary latency and cost, and AWS recommends event-driven triggers over polling for efficiency. Option B is wrong because CodeCommit does not support configuring webhooks directly; webhooks are typically used with third-party repositories like GitHub, not CodeCommit. Option D is wrong because an SNS topic cannot directly trigger a CodePipeline execution; SNS can send notifications but not invoke pipeline executions without a custom integration or Lambda function.

Why this answer

How to eliminate wrong answers

Option B is wrong because AWS IAM is designed for signing AWS API requests with access keys and is not suitable for authenticating mobile app users against a REST API without modifying the backend code. Option C is wrong because Amazon API Gateway with a Lambda authorizer would require replacing the existing ALB and EC2 setup, which is not a direct integration with the current architecture. Option D is wrong because Amazon CloudFront with Lambda@Edge can perform authentication but requires custom code and does not natively integrate with an ALB to offload authentication without backend changes.

Why this answer

How to eliminate wrong answers

Option A is wrong because in-place deployment updates instances in the existing Auto Scaling group one at a time, which can cause partial downtime and does not support automatic rollback to a previous version without manual intervention or a separate rollback configuration. Option C is wrong because canary is a traffic-shifting pattern used in AWS CodeDeploy for Lambda or ECS deployments, not for EC2 Auto Scaling groups, and it does not inherently provide automatic rollback. Option D is wrong because linear is also a traffic-shifting pattern for Lambda or ECS, not applicable to EC2 Auto Scaling groups, and it lacks built-in automatic rollback behavior.

Why this answer

How to eliminate wrong answers

Option A is wrong because Amazon Cognito User Pools authorizer is a proprietary solution that requires users to authenticate through Cognito, not a generic OIDC identity provider; it does not support arbitrary OIDC providers. Option B is wrong because a Custom Lambda authorizer involves writing and managing custom code to validate tokens, which contradicts the requirement to offload authentication and authorization to API Gateway. Option D is wrong because AWS IAM authorizer uses AWS Signature Version 4 for request signing and is designed for AWS credentials, not OIDC tokens from a third-party identity provider.

Why this answer

How to eliminate wrong answers

Option A is wrong because increasing the session timeout would keep sessions in memory longer, worsening the memory pressure and potentially causing more timeouts and errors. Option C is wrong because reducing the number of EC2 instances behind the load balancer does not affect the Redis cluster's memory usage; it only reduces application capacity and could increase load on remaining instances. Option D is wrong because Memcached does not support replication, persistence, or advanced eviction policies like LRU, and migrating would not resolve the memory issue—it would only change the caching engine without addressing the root cause of memory exhaustion.

Why this answer

How to eliminate wrong answers

Option A is wrong because enabling encryption on the ALB with a custom SSL certificate protects data in transit between the client and ALB, but it does not secure the cookie itself from being read by JavaScript or transmitted over non-HTTPS connections if the application sets the cookie without the Secure flag. Option B is wrong because storing session data in ElastiCache instead of cookies changes where session state is stored (server-side vs. client-side), but it does not inherently protect the session identifier cookie from hijacking; the cookie still needs Secure and HttpOnly flags to prevent interception and script access. Option D is wrong because AWS WAF can block requests based on rules, but it cannot validate the integrity or security attributes of a session cookie; it would only filter based on presence or content, not prevent hijacking if the cookie is already stolen.

Why this answer

How to eliminate wrong answers

Option B is wrong because a missing Procfile would cause the environment to fail at the platform initialization stage, not produce intermittent 502 errors after a successful deployment. Option C is wrong because the load balancer configuration did not change between deployments; if it were misconfigured, the application would have been unhealthy before the deployment as well. Option D is wrong because environment variables are managed separately from the application source code and are not typically altered during a code deployment; incorrect variables would likely cause application logic errors, not a complete crash leading to 502 responses.

Why this answer

How to eliminate wrong answers

Option A is wrong because a public NAT gateway enables outbound internet access from private subnets but does not provide a private path to Secrets Manager; traffic would still traverse the internet. Option B is wrong because an internet gateway attached to the Lambda subnet would expose the Lambda function to the public internet, defeating the requirement to avoid public internet traversal and introducing security risks. Option C is wrong because VPC peering connections connect VPCs within the same or different regions but do not provide access to AWS services like Secrets Manager; they are used for inter-VPC communication, not service endpoints.