AWS Certified Developer Associate DVA-C02 (DVA-C02) — Questions 451–525

Why this answer

How to eliminate wrong answers

Option A is wrong because CodeDeployDefault.AllAtOnce does not require a minimum of 3 instances; it deploys to all instances simultaneously and the minimum healthy hosts threshold is 0, meaning it can work with any number of instances as long as at least one remains healthy. Option B is wrong because CodeDeployDefault.AllAtOnce is fully compatible with Auto Scaling groups; in-place deployments to Auto Scaling groups are a standard use case for CodeDeploy. Option C is wrong because the error message specifically indicates a lack of instances to deploy to, not a health check failure; while health check failures could cause instances to be terminated, the error here is about the deployment group size, not instance health status.

Why this answer

How to eliminate wrong answers

Option A is wrong because resolvers are functions that map GraphQL operations (queries, mutations, subscriptions) to data sources like DynamoDB; they do not themselves provide real-time push capabilities. Option C is wrong because queries are request-response operations that fetch data on demand, not real-time updates. Option D is wrong because mutations are write operations that modify data; while they can trigger subscriptions, they are not the mechanism for delivering real-time updates to clients.

Why this answer

How to eliminate wrong answers

Option B is wrong because CodeBuild managed images already include the necessary package repositories and permissions to download and install runtimes specified in 'runtime-versions'; insufficient permissions would cause a different error (e.g., access denied to S3 artifacts). Option C is wrong because if the buildspec.yml were not in the root directory, CodeBuild would fail with a 'buildspec.yml not found' error, not a Java installation error. Option D is wrong because a non-existent Maven dependency would produce a Maven build error (e.g., 'Could not resolve dependency'), not a missing Java installation error.

Why this answer

How to eliminate wrong answers

Option A is wrong because creating an IAM role in Account A with a trust policy for the user in Account B would require the user to assume the role, which is a valid cross-account access method but is less direct and adds unnecessary complexity for simple S3 bucket access; it is not the most secure or straightforward approach for this specific scenario. Option B is wrong because sharing access keys of an IAM user in Account A with a user in Account B violates security best practices by exposing long-term credentials, increasing the risk of credential leakage and unauthorized access. Option D is wrong because attaching an IAM policy to the user in Account B alone cannot grant access to an S3 bucket in Account A; cross-account access requires a resource-based policy (bucket policy or ACL) in the owning account to explicitly allow the external user.

Why this answer

How to eliminate wrong answers

Option B is wrong because AWS X-Ray is a distributed tracing service for analyzing and debugging request flows across microservices, not for viewing real-time log output from a single Lambda function. Option C is wrong because Amazon S3 is an object storage service and does not provide any capability for streaming or viewing real-time logs; it can store log files after they are generated but not display them live. Option D is wrong because AWS CloudTrail records API activity and management events for auditing, not the runtime logs or real-time output of a Lambda function's execution.

Why this answer

How to eliminate wrong answers

Option A is wrong because increasing the number of replicas does not increase the total memory capacity of the cluster; replicas are read-only copies that improve read scalability and fault tolerance, but they share the same memory limit as the primary node, so evictions and cache hit rate remain unchanged. Option B is wrong because enabling cluster mode and adding more shards distributes data across multiple nodes, which can increase total memory, but it requires application changes to support sharding and is more complex than simply scaling up the instance size; the immediate, simplest fix for a single-node cluster under memory pressure is to increase memory. Option C is wrong because increasing the TTL of cached items only delays their expiration, but if the cache is already full and evicting items due to memory pressure, longer TTLs will not prevent evictions—they may even worsen the problem by keeping stale data in memory longer.

Why this answer

How to eliminate wrong answers

Option A is wrong because a deployment group does not need to be associated with an Auto Scaling group; it can contain manually registered EC2 instances or on-premises instances, and the lack of an Auto Scaling group does not cause a '0 instances' error. Option B is wrong because the deployment configuration requiring a minimum of 1 healthy host is not excessive; it is the standard minimum, and the issue is that there are zero hosts, not that the requirement is too high. Option C is wrong because the CodeDeploy agent not being installed would cause a different error (e.g., 'agent not reachable' or 'timeout') during deployment, not a failure due to zero instances in the group.

Why this answer

How to eliminate wrong answers

Option A is wrong because the Lambda rotation function and the secret must be in the same AWS region; cross-region rotation is not supported, but this would cause a different error (e.g., 'AccessDenied' or 'ResourceNotFoundException'), not a JSON parsing error. Option C is wrong because secret names are not required to be base64-encoded; they are plain text strings that identify the secret, and base64 encoding is irrelevant to JSON validity. Option D is wrong because version labels (e.g., AWSCURRENT, AWSPREVIOUS) are managed automatically by Secrets Manager during rotation; an incorrect version label would cause a versioning error, not a JSON parsing failure.

Why this answer

How to eliminate wrong answers

Option B is wrong because it sets MaxAttempts to 5, which exceeds the required 3 retries, and uses a BackoffRate of 3, which is not the standard exponential backoff pattern requested. Option C is wrong because it sets MaxAttempts to 2, which is fewer than the required 3 retries. Option D is wrong because it retries on 'Lambda.ServiceException', which is a different error type; the actual error from a Lambda timeout is 'States.Timeout', not 'Lambda.ServiceException'.

Why this answer

How to eliminate wrong answers

Option A is wrong because a single target group cannot support blue/green deployments; it would force an in-place update, which defeats the purpose of having separate environments for traffic shifting and rollback. Option C is wrong because three target groups are not required; the blue/green model only needs one for the current version and one for the new version, with no third group needed for routing or testing. Option D is wrong because four target groups are excessive and would add unnecessary complexity; the standard blue/green deployment with ECS and CodeDeploy uses exactly two target groups.

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS CloudFormation Parameters are used to pass values into CloudFormation templates at stack creation or update time, not for runtime retrieval of feature flags with low latency and controlled rollout. Option B is wrong because AWS IAM Access Analyzer is a security tool that analyzes resource policies to identify unintended access, not a service for managing feature flags or application configuration. Option C is wrong because Amazon Inspector is a vulnerability management service that scans workloads for software vulnerabilities and network exposure, not a runtime configuration or feature flag service.

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS Systems Manager Parameter Store with a SecureString parameter can store encrypted credentials but does not support automatic rotation of the secret value; rotation would require custom automation via AWS Lambda or other services. Option C is wrong because IAM roles for EC2 provide temporary credentials for AWS API access, not for storing or rotating database credentials (username/password); they cannot be used to store secrets. Option D is wrong because AWS KMS is a key management service for encryption keys, not a secret storage service; it cannot store credentials or perform rotation.

Why this answer

How to eliminate wrong answers

Option A is wrong because increasing read capacity units (RCUs) only affects throughput and cost, not the consistency model; eventually consistent reads still return stale data regardless of RCU count. Option B is wrong because DynamoDB Accelerator (DAX) is an in-memory cache that improves read performance but does not guarantee strong consistency; it can serve stale data from its cache. Option D is wrong because DynamoDB transactions are designed for atomic, isolated multi-item operations (using `TransactGetItems` or `TransactWriteItems`), not for ensuring single-item strong consistency; using transactions for simple reads adds unnecessary overhead and cost.

Why this answer

Why this order

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a rolling update with minimum healthy percent of 50% and maximum percent of 200% can cause a brief period where only 50% of the original tasks remain, potentially reducing capacity and risking downtime if traffic spikes or tasks fail during the update. Option B is wrong because setting the task placement strategy to REPLICA only controls how tasks are distributed across Availability Zones, not the deployment method, and does not inherently provide zero-downtime updates. Option C is wrong because the DAEMON scheduling strategy is not supported with the Fargate launch type (it is only for EC2), and a deployment circuit breaker only stops a failed deployment but does not prevent downtime during the update process.

Why this answer

How to eliminate wrong answers

Option B is wrong because there is no 'Encrypt' property in the SAM template for environment variables; encryption at rest is automatic and not controlled via a template property. Option C is wrong because encrypting environment variables in code before deployment is unnecessary and would require the function to decrypt them at runtime, adding complexity without benefit since Lambda already handles encryption at rest. Option D is wrong because while you can specify a customer managed KMS key for encryption, it is not the most straightforward way; the default AWS managed key works without any extra configuration.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because SSE-KMS uses AWS KMS keys, where AWS manages the key store and you share control with AWS via key policies and grants, so you do not have the most control. Option C is wrong because client-side encryption encrypts data before sending it to S3, which gives you full control over the key, but the question specifically asks about server-side encryption, so this is out of scope. Option D is wrong because SSE-S3 uses S3-managed keys (AES-256) where AWS fully manages the key lifecycle, giving you the least control over the encryption key.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because increasing Lambda memory only increases CPU and network bandwidth, but does not change the DynamoDB API's 1 MB page size limit or the need to handle pagination; the query would still return only the first page. Option C is wrong because a global secondary index (GSI) with the same key would not solve the pagination issue; it would simply provide an alternative query path that also returns paginated results. Option D is wrong because strongly consistent reads ensure the most up-to-date data but do not affect the number of items returned per page or the pagination mechanism; they are unrelated to the pagination problem.

Why this answer

How to eliminate wrong answers

Option A is wrong because a resource-based policy on S3 that denies access would also cause AccessDenied, but the question states the user has a Deny policy attached, making the explicit Deny in the IAM policy the most likely reason. Option B is wrong because AWS evaluates all policies in a single pass, and the order of evaluation (Allow before Deny) does not matter; the explicit Deny always takes precedence. Option D is wrong because while an SCP could deny the action, the question specifically mentions the user has a Deny policy attached, and SCPs apply at the account or OU level, not directly to the user; the most direct cause is the attached Deny policy.

Why this answer

How to eliminate wrong answers

Option B is wrong because if the security group did not allow inbound traffic from the ALB on the health check port, health checks would fail consistently, not intermittently. Option C is wrong because a misconfigured health check path returning a 404 would cause persistent health check failures, not intermittent ones. Option D is wrong because an incorrect target group protocol (e.g., HTTP vs HTTPS) would cause all health checks to fail consistently, not intermittently.

Why this answer

How to eliminate wrong answers

Option B is wrong because low memory affects execution performance (e.g., duration, CPU allocation) but does not prevent the function from being triggered; the trigger mechanism is independent of memory settings. Option C is wrong because the Lambda function does not need permission to read from the S3 bucket to be triggered; the S3 event notification invokes the function via a resource-based policy, and the function only needs read permissions if it explicitly calls S3 GetObject in its code. Option D is wrong because S3 event notifications can invoke Lambda functions across regions; cross-region triggers are supported as long as the Lambda function's resource-based policy allows the S3 bucket's account to invoke it.

Why this answer

How to eliminate wrong answers

Option A is wrong because ACM automatically manages renewal for DNS-validated certificates; a Lambda function is unnecessary and not part of the renewal process. Option B is wrong because ACM certificates are fully supported with CloudFront (when issued in us-east-1), not limited to ALB. Option D is wrong because ACM handles automatic renewal for eligible certificates; manual re-request is only needed if validation fails or the certificate is not eligible.

Why this answer

How to eliminate wrong answers

Option A is wrong because a bucket policy alone is insufficient for cross-account access; the user in Account B must also have an IAM policy that allows the S3 actions, as the user's account must explicitly authorize the request. Option C is wrong because creating an IAM role in Account B and having the user assume it is an alternative approach, but it is not required; the question asks for the additional step given that a bucket policy is already in place, and the simplest correct step is to attach an IAM policy to the user, not to create a role. Option D is wrong because S3 ACLs are legacy and not recommended; more importantly, ACLs grant access to AWS accounts or canonical user IDs, not to specific IAM users, and enabling ACLs does not replace the need for an IAM policy in Account B.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because SSEAlgorithm is not a valid parameter in the put_object call; the correct parameter is ServerSideEncryption, and 'AES256' is used for SSE-S3, not SSE-KMS. Option B is wrong because SSEKMSKeyId is an optional parameter used to specify a specific KMS key ID or alias, but it is not the parameter that enables SSE-KMS; you must first set ServerSideEncryption to 'aws:kms'. Option D is wrong because ServerSideEncryption: 'AES256' is the value for SSE-S3, not SSE-KMS; SSE-KMS requires 'aws:kms'.

Why this answer

How to eliminate wrong answers

Option A is wrong because Amazon S3 is an object storage service, not optimized for frequently changing small configuration data; it lacks built-in validation, staged rollouts, and real-time deployment controls. Option B is wrong because AWS Systems Manager Parameter Store is designed for static or infrequently changing parameters (e.g., database passwords, AMI IDs) and has a throughput limit of 40 transactions per second per region by default, making it unsuitable for high-frequency updates. Option D is wrong because Amazon DynamoDB is a NoSQL database for high-scale transactional workloads, not a configuration management service; it requires additional code for validation, rollback, and deployment orchestration, adding unnecessary complexity.

Why this answer

How to eliminate wrong answers

Option A is wrong because DynamoDB auto scaling adjusts read/write capacity for a DynamoDB table, not for an ECS service or SQS queue depth, and it cannot scale compute tasks. Option C is wrong because while Lambda can be triggered from SQS, the question specifically asks for scaling the ECS service, not replacing it with Lambda; reserved concurrency controls Lambda execution capacity, not ECS task count. Option D is wrong because a scheduled scaling policy adjusts tasks based on time, not on the actual SQS queue depth, so it cannot dynamically respond to varying message volumes.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because S3 Transfer Acceleration is a feature for speeding up uploads to S3 over long distances, not for DynamoDB throughput issues. Option C is wrong because disabling CloudWatch metrics would remove visibility into table performance and prevent monitoring of throttling events, making troubleshooting harder. Option D is wrong because strongly consistent reads consume more read capacity units than eventually consistent reads, which would worsen the throughput problem instead of solving it.

Why this answer

How to eliminate wrong answers

Option B is wrong because increasing read capacity to 10000 RCUs would double the provisioned throughput cost without addressing the root cause of latency, and it does not leverage caching to reduce response times. Option C is wrong because DynamoDB global tables replicate data across regions for disaster recovery and low-latency writes, not to improve read performance within a single region; they add complexity and cost without reducing read latency for GetItem calls. Option D is wrong because DynamoDB Streams capture item-level changes for asynchronous processing (e.g., triggers or replication), but they do not cache data or accelerate read operations; they are irrelevant to improving GetItem latency.

Why this answer

How to eliminate wrong answers

Option A is wrong because CodePipeline does not poll SQS queues; it relies on event-driven triggers via CloudWatch Events or webhooks, not queue-based polling. Option C is wrong because using a periodic Lambda function to check for new files introduces unnecessary latency, cost, and complexity; it is an anti-pattern when a native event-driven trigger exists. Option D is wrong because CodePipeline cannot be directly subscribed to an SNS topic; SNS can send notifications but cannot invoke a pipeline—only CloudWatch Events/EventBridge can target CodePipeline directly.

Why this answer

How to eliminate wrong answers

Option B is wrong because `aws:SourceIp` restricts access based on public IP addresses, but requests from a VPC using a VPC endpoint have private IPs and the source IP is not the VPC's public IP, making this condition ineffective for VPC-based access control. Option C is wrong because S3 bucket ACLs do not support VPC IDs; ACLs can only grant access to AWS accounts or predefined groups (e.g., AllUsers, AuthenticatedUsers), not to specific VPCs. Option D is wrong because a VPC Endpoint policy controls what actions principals within the VPC can perform on the S3 service, but it does not restrict access from the bucket's perspective; the bucket policy is the mechanism to enforce inbound restrictions based on the VPC.

Why this answer

How to eliminate wrong answers

Option A is wrong because the Retry clause in a Lambda function's configuration (e.g., in the function's reserved concurrency or event source mapping) does not control Step Functions retries; Step Functions retries are defined in the state machine definition, not in the Lambda function itself. Option C is wrong because wrapping the Lambda invocation in a custom while loop within the function code would not integrate with Step Functions' retry mechanism and would violate the serverless orchestration pattern, as Step Functions manages retries at the state machine level. Option D is wrong because the Catch field is used to handle errors by redirecting to a different state (e.g., a fallback or error-handling state), not to implement retry logic; retries are handled exclusively by the Retry field.

Why this answer

How to eliminate wrong answers

Option A is wrong because Amazon S3 with mountpoint-s3 is an object storage service that uses a custom FUSE-based mount, which is not POSIX-compliant (e.g., it does not support file locking, hard links, or atomic renames) and is designed for high-latency, throughput-oriented workloads rather than low-latency shared file system access. Option C is wrong because Amazon EBS with multi-attach enabled supports only up to 16 Nitro-based EC2 instances, not Fargate tasks, and requires the volume to be attached to instances in the same Availability Zone, making it unsuitable for a serverless container environment. Option D is wrong because Amazon FSx for Windows File Server uses the SMB protocol and is not POSIX-compliant; it is designed for Windows-based workloads and does not natively support Linux containers without additional translation layers.

Why this answer

How to eliminate wrong answers

Option B is wrong because `AutoScalingRollingUpdate` is a policy for Auto Scaling groups, not for RDS DB instances; it updates instances in a rolling fashion but does not apply to database resources. Option C is wrong because `UpdateReplacePolicy` is not a valid CloudFormation policy; the correct attribute is `DeletionPolicy` (which controls what happens when a resource is deleted), and `UpdateReplacePolicy` does not exist. Option D is wrong because `CreationPolicy` is used to control the creation of resources (e.g., waiting for signals from EC2 instances), not for updating existing resources like RDS instances.

Why this answer

How to eliminate wrong answers

Option A is wrong because Amazon EFS is a file storage service, not a credential store; it cannot be used to store or provide access keys for IAM permissions. Option B is wrong because Fargate tasks do not use instance profiles; instance profiles are used with EC2 launch type to grant permissions to the underlying EC2 instance, not to the containers. Option D is wrong because storing AWS credentials in the container image violates security best practices, as credentials would be exposed in the image layers and cannot be rotated or scoped to least privilege.

Why this answer

Why this answer

Why this order

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B (CodeDeployDefault.AllAtOnce) is wrong because it deploys to all 10 instances simultaneously, which can cause a complete outage if the deployment fails or the application has issues. Option C (CodeDeployDefault.HalfAtATime) is wrong because it deploys to 5 instances at a time, which does not guarantee that a minimum number of instances (e.g., 9) are always running; it only ensures half are updated at once, potentially leaving only 5 healthy instances. Option D (CodeDeployDefault.MinHealthyHostsPercentage: 90) is wrong because it is not a valid predefined deployment configuration in AWS CodeDeploy; it is a custom configuration option that can be set via the API or CLI, but it is not a built-in named configuration like the others.

Why this answer

How to eliminate wrong answers

Option A (SSE-S3) is wrong because it uses AWS-managed keys, not customer-managed keys, so it does not meet the policy requirement for customer control over the encryption key. Option C (SSE-C) is wrong because it requires the customer to provide their own encryption keys in each request, and AWS does not manage or store the key, which contradicts the requirement for a customer-managed AWS KMS key. Option D (Client-side encryption) is wrong because it encrypts data before sending it to S3, not at rest on the server side, and does not use S3 server-side encryption at all.

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS KMS is a key management service for symmetric and asymmetric encryption keys used for data at rest, not for managing SSL/TLS certificates for data in transit. Option B is wrong because AWS Secrets Manager is designed to rotate and manage secrets such as database credentials and API keys, not SSL/TLS certificates. Option C is wrong because AWS CloudHSM provides dedicated hardware security modules for generating and storing encryption keys, but it does not manage SSL/TLS certificates or integrate directly with AWS services for automatic certificate deployment and renewal.

Why this order

Why this answer

How to eliminate wrong answers

Option B is wrong because usage plans with quota and throttle settings limit the rate or total number of requests, but they do not return previously computed responses for duplicate payloads; they simply reject or delay requests. Option C is wrong because request validation in API Gateway only checks the structure and presence of required headers or body fields, not the content or duplication of payloads; it cannot reject requests based on a client ID being repeated. Option D is wrong because reducing the Lambda batch size to 1 is irrelevant (Lambda functions process one event at a time by default) and implementing caching inside the function with ElastiCache would still invoke Lambda for every request, missing the goal of reducing invocations; API Gateway caching avoids Lambda invocation entirely for cached responses.

Why this answer

How to eliminate wrong answers

Option B is wrong because AWS Systems Manager Parameter Store is a hierarchical store for configuration data and secrets, but it lacks native automatic rotation for database credentials and does not provide the same level of integration with RDS or other database services as Secrets Manager. Option C is wrong because Amazon S3 is an object storage service designed for storing files and static data, not for securely managing sensitive credentials with built-in rotation and access control via IAM policies. Option D is wrong because AWS Certificate Manager (ACM) is specifically for managing SSL/TLS certificates, not for storing database credentials or other secrets.

Why this answer

How to eliminate wrong answers

Option A is wrong because Elastic Load Balancing handles traffic distribution but does not provide service discovery by logical names or built-in encryption for service-to-service communication, and AWS Systems Manager is for operational management, not service mesh. Option B is wrong because Amazon Route 53 can provide DNS-based service discovery, but AWS Direct Connect is a dedicated network connection to on-premises, not relevant for service-to-service encryption or discovery within ECS. Option C is wrong because AWS Lambda and Amazon API Gateway are for serverless API backends, not for managing inter-service communication and discovery in a microservices architecture on ECS.

Why this answer

How to eliminate wrong answers

Option A is wrong because setting API Gateway throttling limits to a high value only controls the request rate at the API layer, not the Lambda concurrency; if Lambda concurrency limits are exceeded, requests will still be throttled with 429 errors regardless of API Gateway settings. Option B is wrong because using an SQS queue to buffer requests introduces asynchronous processing, which is unsuitable for a synchronous API Gateway integration that expects immediate responses; the queue would decouple the request-response cycle and cause timeouts or lost responses. Option D is wrong because increasing the Lambda function timeout to the maximum value (900 seconds) does not address concurrency limits or cold starts; it only allows the function to run longer, which does not prevent throttling errors when traffic spikes exceed the available concurrency.

Why this answer

How to eliminate wrong answers

Option B is wrong because the Event invocation type is asynchronous; it queues the invocation and returns immediately with an HTTP status code of 202, without waiting for the function to execute or return a result. Option C is wrong because DryRun is not a valid Lambda invocation type; it is a parameter used with other AWS services (e.g., EC2) to test permissions without executing the action. Option D is wrong because 'None of the above' is incorrect since RequestResponse is a valid and correct invocation type for synchronous invocation.

Why this answer

How to eliminate wrong answers

Option B is wrong because the `Conditions` section is used to define conditions that control whether certain resources are created or properties are set, not to define API Gateway stage names. Option C is wrong because the `Outputs` section is used to declare values that are returned after the stack is created (e.g., API endpoint URLs), not to configure deployment properties like stage names. Option D is wrong because the `Parameters` section is used to accept custom input values at deployment time (e.g., environment names), but it does not directly define a stage name for API Gateway; you would still need to reference a parameter in the resource or Globals section to set the stage name.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because migrating to DynamoDB changes the database paradigm entirely, which is not a connection management solution and may not be feasible for existing relational workloads. Option B is wrong because increasing Lambda concurrency would actually worsen the problem by allowing more concurrent invocations to compete for the same limited pool of database connections. Option D is wrong because ElastiCache caches data, not database connections; it cannot pool or share TCP connections to RDS.

Why this answer

How to eliminate wrong answers

Why this answer

How to eliminate wrong answers

Option B is wrong because `s3:x-amz-server-side-encryption-aws-kms-key-id` is used to enforce a specific KMS key ID for SSE-KMS, not to require the presence of any server-side encryption header. Option C is wrong because `s3:x-amz-acl` controls access control list settings, not encryption. Option D is wrong because `s3:x-amz-storage-class` controls the storage class (e.g., STANDARD, GLACIER), not encryption.

Why this answer

How to eliminate wrong answers

Option A is wrong because DynamoDB global tables replicate data across regions for low-latency access and disaster recovery, not for automatic expiration of items. Option B is wrong because DynamoDB transactions provide ACID guarantees for multi-item operations, not scheduled deletion based on time. Option C is wrong because DynamoDB export to S3 is used for point-in-time backups or data lake integration, not for expiring items within the table.

Why this answer

How to eliminate wrong answers

Option A is wrong because the Resource ARN 'arn:aws:s3:::example-bucket' is correct for the s3:ListBucket action, which targets the bucket itself, not individual objects. Option B is wrong because the question does not mention any bucket policy, and the IAM policy alone is sufficient to grant the listed permission; a bucket policy that denies access would be an explicit denial, but the issue is about missing permissions, not an explicit deny. Option C is wrong because S3 ACLs are not required for IAM users to list objects; IAM policies and bucket policies are the primary mechanisms for access control, and ACLs are legacy and disabled by default for new buckets.

Why this answer

How to eliminate wrong answers

Option A is wrong because adding -Xmx1024m to the buildspec commands modifies the build process (a command-line change), which violates the constraint of not changing the source code; also, it only adjusts the JVM heap limit, not the underlying compute resources. Option B is wrong because changing the build image to a smaller one would reduce available memory, worsening the out-of-memory error. Option C is wrong because CodeBuild does not have a configurable 'memory parameter' in the build project settings; memory is tied directly to the compute type selection.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the Configure lifecycle event runs whenever an instance enters or leaves the online state, not for deploying application code; it is used for updating configuration files or adjusting settings based on the stack's current state. Option B is wrong because Undeploy is not a standard lifecycle event in AWS OpsWorks; the correct event for removing an application is the Shutdown lifecycle event, which runs when an instance is stopped or terminated. Option C is wrong because the Setup lifecycle event runs only once when an instance is first booted, to install packages and configure the instance, not for deploying new application versions.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because S3 operations work across regions; a bucket in a different region does not cause an access denied error—it would instead result in a redirect or a different error. Option B is wrong because if SSE-KMS were used, the function would need kms:GenerateDataKey or kms:Encrypt, not kms:Decrypt, and the error would typically be a 403 Forbidden with a KMS-specific message, not a generic access denied. Option C is wrong because the question states the IAM role has an inline policy allowing s3:PutObject, so the execution role is correctly assigned; the error is not due to a missing role but due to a conflicting bucket policy.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because IAM policies cannot reference a Cognito user pool ARN as a principal or resource for API Gateway; IAM policies control access based on IAM users/roles, not user pool identities. Option C is wrong because API Gateway resource policies control access by source IP, VPC, or AWS account, not by Cognito user pool tokens or user pool ARN. Option D is wrong because while a Lambda authorizer could validate a JWT against a user pool, it is unnecessary overhead and not the 'best approach' when a built-in Cognito User Pool authorizer exists that is simpler, faster, and requires no custom code.

Why this answer

How to eliminate wrong answers

Option A is wrong because S3 throttling returns a 503 SlowDown error, not an AccessDenied error. Option B is wrong because an overly long object key would cause a 400 Bad Request error, not an AccessDenied error. Option C is wrong because an outdated SDK version might cause compatibility issues or missing features, but it would not result in an AccessDenied error; the error is a permissions issue, not a client version issue.

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS CloudHSM provides dedicated hardware security modules for cryptographic key storage and operations, but it does not offer a managed service for storing or rotating secrets like database passwords; it is a lower-level key management solution. Option C is wrong because AWS KMS is a key management service that creates and controls encryption keys used to encrypt data, but it does not store secrets or provide automatic rotation of secrets; it only supports automatic rotation of the KMS key itself, not the secret value. Option D is wrong because AWS Systems Manager Parameter Store can store secrets as SecureString parameters with KMS encryption, but it lacks built-in automatic rotation capabilities; any rotation would require custom implementation using AWS Lambda or other automation.

Why this answer

How to eliminate wrong answers

Option A is wrong because storing AWS access keys as environment variables in the task definition exposes long-term credentials in plaintext, violating the principle of least privilege and increasing the risk of credential leakage. Option C is wrong because embedding IAM user credentials in the container image is a security anti-pattern that hardcodes long-lived secrets, making rotation difficult and violating best practices for container security. Option D is wrong because S3 bucket policies cannot grant permissions based on security groups; security groups are network-level constructs for EC2 instances and are not evaluated by AWS S3 for access control decisions.

Why this answer

How to eliminate wrong answers

Option A is wrong because DynamoDB Streams capture a time-ordered sequence of item-level changes in a table, but they do not provide atomicity or transactional coordination across multiple tables. Option C is wrong because DynamoDB Accelerator (DAX) is an in-memory caching layer that improves read performance but does not offer transactional write capabilities. Option D is wrong because DynamoDB Global Tables provide multi-region replication for disaster recovery and low-latency reads, but they do not enable atomic multi-table transactions within a single region.

Why this answer

How to eliminate wrong answers

Option A is wrong because configuring the bucket to use SSE-S3 by default encrypts objects with S3-managed keys, not AWS KMS, which does not meet the requirement for KMS encryption. Option B is wrong because enabling default encryption with SSE-KMS only applies when the client does not specify encryption headers; a client can still upload without KMS encryption by explicitly setting a different encryption header (e.g., `AES256`), bypassing the default. Option C is wrong because allowing only PutObject with KMS encryption does not deny requests that lack KMS encryption; it merely permits some requests, but without a deny statement, unencrypted uploads could still succeed if other permissions allow them.