AWS Certified Developer Associate DVA-C02 DVA-C02 Questions 526–600 | Page 8/10

526

MCQmedium

A developer is deploying a new version of a Lambda function using AWS CodeDeploy with a linear canary deployment. The function is part of a serverless application. After the deployment starts, the developer notices that the new version is receiving only 10% of traffic initially, but after 10 minutes, the traffic increases to 100%. What should the developer do to ensure a more gradual traffic shift?

A.Use Lambda function aliases with weighted traffic shifting.

B.Use multiple Lambda function versions and update the alias gradually.

C.Configure AWS CloudFormation to update the Lambda alias.

D.Modify the CodeDeploy deployment configuration to use a linear 10% every 5 minutes instead of canary.

AnswerD

AWS CodeDeploy, when integrated with Lambda, provides robust capabilities for automating gradual deployments. A linear deployment configuration, such as "Linear10PercentEvery5Minutes," precisely matches the requirement for shifting traffic in fixed increments over a defined time period. This strategy allows for careful monitoring during the rollout and automatic rollback if issues are detected, ensuring a controlled and safe deployment process.

Why this answer

The developer is using a canary deployment configuration that shifts 10% of traffic immediately and then waits 10 minutes before shifting to 100%. To achieve a more gradual traffic shift, the developer should modify the CodeDeploy deployment configuration to use a linear 10% every 5 minutes, which will increment traffic by 10% every 5 minutes, taking 50 minutes to reach 100%.

Exam trap

The trap here is that candidates may confuse the built-in CodeDeploy deployment configurations (canary vs. linear) with manual alias weight adjustments, thinking that modifying the alias directly is the correct approach instead of changing the deployment configuration.

How to eliminate wrong answers

Option A is wrong because Lambda function aliases with weighted traffic shifting are used for manual or custom traffic routing, not for controlling the pace of a CodeDeploy deployment. Option B is wrong because using multiple Lambda function versions and updating the alias gradually is a manual process that does not leverage CodeDeploy's built-in deployment configurations for automated traffic shifting. Option C is wrong because configuring AWS CloudFormation to update the Lambda alias does not change the CodeDeploy deployment configuration; CloudFormation can manage the alias but cannot alter the traffic shift pattern defined in the CodeDeploy deployment group.

Full explanation →

527

MCQmedium

A developer monitors an AWS Lambda function that processes records from an Amazon SQS queue and writes results to an Amazon DynamoDB table. CloudWatch Logs show that execution time has increased over the past week, and the function frequently times out at the 5-minute timeout. The function's code has not been changed recently. CloudWatch metrics show a high rate of DynamoDBProvisionedThroughputExceededException errors. The DynamoDB table has 5 write capacity units (WCUs). What action will MOST effectively reduce the function's execution time?

A.Increase the Lambda function's timeout to 10 minutes.

B.Increase the write capacity units (WCUs) on the DynamoDB table.

C.Increase the Lambda function's memory allocation to 3008 MB.

D.Use an Amazon SQS FIFO queue instead of a standard queue for the Lambda trigger.

AnswerB

The `DynamoDBProvisionedThroughputExceededException` directly signifies that the DynamoDB table's allocated write capacity units (WCUs) are insufficient to handle the incoming write requests. Increasing the WCUs directly addresses this bottleneck by provisioning more throughput for the table. This action allows DynamoDB to process more writes per second, eliminating throttling, reducing Lambda retries, and consequently speeding up the Lambda function's overall execution time.

Why this answer

The high rate of DynamoDBProvisionedThroughputExceededException errors indicates that the Lambda function is being throttled by DynamoDB due to insufficient write capacity. When writes are throttled, the Lambda function must retry, which increases execution time and can lead to timeouts. Increasing the WCUs on the DynamoDB table directly addresses the root cause by allowing the function to write without throttling, thereby reducing execution time.

Exam trap

The trap here is that candidates often assume increasing Lambda timeout or memory will fix performance issues, but the real bottleneck is the DynamoDB write capacity, which directly causes the throttling errors and increased execution time.

How to eliminate wrong answers

Option A is wrong because increasing the timeout to 10 minutes does not resolve the underlying throttling issue; it only masks the symptom by allowing the function to run longer while still being throttled. Option C is wrong because increasing memory allocation (up to 3008 MB) primarily improves CPU performance and network throughput, but does not fix DynamoDB throttling caused by insufficient WCUs. Option D is wrong because switching to an SQS FIFO queue does not affect DynamoDB write capacity; FIFO queues enforce message ordering and deduplication but do not reduce the throttling rate from DynamoDB.

Full explanation →

528

MCQmedium

A developer is building a web application that uses Amazon DynamoDB as the database. The application needs to store user session data and must support eventual consistency reads for most use cases, but strongly consistent reads for critical operations. The developer wants to minimize costs. Which read capacity unit (RCU) configuration should the developer use?

A.Use on-demand capacity mode to pay per request, avoiding provisioned capacity costs.

B.Use provisioned capacity with 1 RCU per item, since eventually consistent reads consume half the RCUs.

C.Use provisioned capacity with sufficient RCUs to handle strongly consistent reads, as they consume the same as eventually consistent.

D.Use provisioned capacity with enough RCUs for peak traffic, and use DynamoDB Accelerator (DAX) for caching.

AnswerA

On-demand capacity mode is optimal for web applications with unpredictable or spiky traffic patterns because it automatically scales capacity up or down based on actual request volume. This pay-per-request model eliminates the need for capacity planning and avoids the costs associated with over-provisioning RCUs and WCUs that sit idle during low traffic periods. Consequently, it often results in significant cost savings for variable workloads, as you only pay for the reads and writes your application actually performs.

Why this answer

On-demand capacity mode charges per request (read/write), eliminating the need to provision fixed RCUs. For a session store with mixed consistency requirements, on-demand is cost-effective when traffic is unpredictable or low, as you only pay for actual reads and writes. Eventually consistent reads consume half the RCUs of strongly consistent reads, but on-demand pricing automatically accounts for this difference without manual configuration.

Exam trap

The trap here is that candidates assume provisioned capacity is always cheaper, but for variable workloads like session stores, on-demand can minimize costs by eliminating unused capacity, especially when mixed consistency models are needed.

How to eliminate wrong answers

Option B is wrong because 1 RCU per item is not a fixed rule; RCU consumption depends on item size (1 RCU = one strongly consistent read of up to 4 KB per second) and eventually consistent reads consume 0.5 RCUs, not a fixed 1 RCU per item. Option C is wrong because strongly consistent reads and eventually consistent reads do not consume the same RCUs; eventually consistent reads use half the RCUs (0.5 RCU per 4 KB item) compared to strongly consistent reads (1 RCU per 4 KB item). Option D is wrong because provisioning for peak traffic with DAX adds cost and complexity; DAX is a caching layer that reduces read load but incurs additional charges, contradicting the goal to minimize costs.

Full explanation →

529

MCQmedium

A developer launches an Amazon EC2 instance that needs to read and write data to an Amazon DynamoDB table. The developer must follow the principle of least privilege and ensure that no long-term credentials are stored on the instance. Which approach should the developer use?

A.Create an IAM user with programmatic access, store the access key and secret key in a configuration file on the EC2 instance.

B.Store the DynamoDB credentials in AWS Systems Manager Parameter Store as a SecureString, and retrieve them from the EC2 instance at runtime.

C.Create an IAM role with the necessary DynamoDB permissions, and attach the role to the EC2 instance profile. The SDK will automatically retrieve temporary credentials from the instance metadata.

D.Use a Lambda function to generate temporary credentials for the EC2 instance and pass them via user data at launch.

AnswerC

This is the recommended and most secure method. By attaching an IAM role to the EC2 instance profile, the instance is granted temporary, frequently rotated credentials via the Instance Metadata Service (IMDS). AWS SDKs and CLIs automatically query IMDS for these credentials, eliminating the need to store any long-term access keys directly on the instance. This significantly reduces the attack surface and simplifies credential management.

Why this answer

It uses an IAM role attached to the EC2 instance profile, which allows the AWS SDK to automatically retrieve temporary credentials from the instance metadata service (IMDS). This follows the principle of least privilege by granting only the necessary DynamoDB permissions and eliminates the need to store any long-term credentials on the instance, as the credentials are rotated automatically by AWS STS.

Exam trap

The trap here is that candidates may choose Option B (Parameter Store) thinking it securely stores credentials, but they overlook that the instance still needs an IAM role to access Parameter Store, and the retrieved credentials are static rather than automatically rotated temporary credentials, which fails the 'no long-term credentials' requirement.

How to eliminate wrong answers

Option A is wrong because storing an IAM user's access key and secret key in a configuration file on the EC2 instance violates the requirement of no long-term credentials on the instance and increases the risk of credential exposure. Option B is wrong because while Parameter Store can securely store credentials, the EC2 instance would still need an IAM role or long-term credentials to retrieve them, and the retrieved credentials (if stored as a SecureString) are static, not temporary, thus not fully meeting the 'no long-term credentials' requirement. Option D is wrong because using a Lambda function to generate temporary credentials and passing them via user data at launch would require the instance to store those credentials locally, and the credentials would not be automatically rotated or refreshed, leading to potential security issues and operational complexity.

Full explanation →

530

MCQmedium

A service needs loosely coupled asynchronous communication where one producer sends events to many different AWS service targets using rules. Which service fits best?

A.Amazon EFS

B.AWS CloudHSM

C.Amazon EventBridge

D.AWS DataSync

AnswerC

Amazon EventBridge is a serverless event bus service that enables building event-driven architectures by routing events from various sources to targets. It inherently supports loosely coupled asynchronous communication by allowing event producers to publish events without direct knowledge of their consumers, and consumers to subscribe to events without knowing the producers. This abstraction ensures that services can evolve independently, enhancing resilience and scalability as events are processed asynchronously.

Why this answer

Amazon EventBridge is a serverless event bus service that enables loosely coupled asynchronous communication. It allows a single producer to publish events, and then uses rules to route those events to multiple AWS service targets (e.g., Lambda, SQS, Step Functions) simultaneously, fulfilling the requirement exactly.

Exam trap

The trap here is that candidates may confuse Amazon EventBridge with Amazon SNS (Simple Notification Service), but the question explicitly mentions 'rules' to filter events, which is a core EventBridge feature, whereas SNS uses topic subscriptions without rule-based filtering.

How to eliminate wrong answers

Option A is wrong because Amazon EFS is a file storage service for EC2 instances, not an event-driven communication service; it cannot route events or support producer-to-multiple-target patterns. Option B is wrong because AWS CloudHSM provides hardware security modules for cryptographic key storage, not event routing or asynchronous messaging. Option D is wrong because AWS DataSync is a data transfer service for moving large datasets between on-premises and AWS storage, not for event-driven, loosely coupled communication with rules.

Full explanation →

531

MCQhard

A developer is building a real-time chat application using WebSockets via API Gateway. The backend uses AWS Lambda functions to handle connect, disconnect, and message events. The application needs to broadcast messages to all connected clients. What is the most scalable and cost-effective way to maintain the list of connection IDs and broadcast messages?

A.Use an SQS FIFO queue to store connection IDs and have a Lambda function poll the queue to broadcast.

B.Store connection IDs in a DynamoDB table. Use a Lambda function to query all connection IDs and send messages using the API Gateway Management API.

C.Maintain an in-memory list of connection IDs in a global variable of a single Lambda function.

D.Use Amazon ElastiCache Redis to store connection IDs and use Redis Pub/Sub for broadcasting.

AnswerB

Storing connection IDs in a DynamoDB table is the robust and scalable solution for managing WebSocket connections with API Gateway. DynamoDB provides a highly available, low-latency, and persistent store for these IDs. When a message needs to be broadcast, a Lambda function can efficiently query the DynamoDB table to retrieve all active connection IDs. It then uses the API Gateway Management API's `PostToConnection` action to send the message to each client, ensuring reliable and scalable real-time communication.

Why this answer

DynamoDB provides a scalable and cost-effective solution for storing connection IDs because it is a NoSQL database designed for high availability and low latency. The Lambda function can query the entire table to retrieve all connection IDs and then use the API Gateway Management API (via `postToConnection`) to send messages to each client. This approach scales horizontally because multiple Lambda instances can access the same DynamoDB table.

Option A is wrong because SQS FIFO queues are not suitable for broadcasting all messages to all connections; they are designed for point-to-point messaging and would require polling, adding latency and cost. Option C is wrong because an in-memory list in a single Lambda instance does not persist across cold starts and cannot be shared across multiple concurrent Lambda instances, leading to data loss and incorrect broadcasts. Option D is wrong because ElastiCache Redis adds operational complexity and cost, and using its Pub/Sub feature would require additional infrastructure; DynamoDB is simpler and more aligned with serverless best practices.

Exam trap

Candidates often think that in-memory storage (option C) is sufficient for Lambda functions, but Lambda instances are ephemeral and stateless; connection IDs must be stored in a persistent, shared data store like DynamoDB.

Full explanation →

532

MCQhard

A company uses an IAM role to allow an EC2 instance to access an S3 bucket. The bucket policy also grants access to the role. An application running on the instance is unable to read objects. The instance has the correct instance profile. What is the MOST likely cause?

A.The bucket policy has a condition that does not match the request context.

B.The EC2 instance's security group blocks outbound traffic to S3.

C.The S3 bucket is in a different AWS account.

D.The instance profile is not attached to the EC2 instance.

AnswerA

An S3 bucket policy's conditions evaluate specific attributes of an incoming request, such as source IP, VPC endpoint ID, or specific tags. If any condition in an allow statement is not met, or if a condition in a deny statement *is* met, the request will be implicitly or explicitly denied, respectively. Therefore, even if the IAM role attached to the EC2 instance has the necessary S3 permissions, a mismatch with a restrictive bucket policy condition will prevent access.

Why this answer

The most likely cause is that the bucket policy includes a condition (e.g., aws:SourceIp, aws:SourceVpce, or aws:SecureTransport) that does not match the request context from the EC2 instance. Even though the IAM role grants access, the bucket policy's explicit condition denies the request if the condition key evaluates to false, resulting in an implicit deny. This is a common misconfiguration where the role has permissions but the bucket policy's conditions are too restrictive.

Exam trap

The trap here is that candidates often overlook bucket policy conditions and assume that if the IAM role has S3 permissions and the instance profile is attached, access should work, ignoring that bucket policies can impose additional restrictions that override role permissions.

How to eliminate wrong answers

Option B is wrong because security groups operate at the network layer (stateful filtering) and do not block outbound traffic to S3 by default; S3 uses HTTPS (TCP/443) which is typically allowed, and security groups do not inspect application-layer conditions. Option C is wrong because cross-account access is fully supported with proper IAM roles and bucket policies; the bucket being in a different account would not inherently cause failure if permissions are correctly configured. Option D is wrong because the question explicitly states the instance has the correct instance profile, so the instance profile attachment is not the issue.

Full explanation →

533

MCQeasy

A developer is building a serverless application using AWS Lambda that processes files uploaded to an S3 bucket. The function needs to read the file content and store metadata in DynamoDB. Which AWS service should be used to trigger the Lambda function when a new object is created in S3?

A.Amazon CloudWatch Events

B.Amazon SQS

C.Amazon SNS

D.Amazon S3 Event Notifications

AnswerD

Amazon S3 Event Notifications provide a native, direct, and highly efficient mechanism for triggering AWS Lambda functions in response to specific object-level events, such as object creation, deletion, or restoration. When configured, S3 directly invokes the specified Lambda function asynchronously, passing event details like the bucket name, object key, and event time. This direct integration eliminates the need for intermediary services, making it the most straightforward and performant solution for reacting to S3 object changes.

Why this answer

Amazon S3 Event Notifications (Option D) are the native mechanism for S3 to publish events (e.g., s3:ObjectCreated:*) directly to AWS Lambda, SQS, or SNS when an object is created. This is the simplest and most direct way to trigger a Lambda function for file processing without needing additional services.

Exam trap

The trap here is that candidates may overcomplicate the solution by choosing SQS or SNS, thinking they need a decoupling layer, but the question asks for the service that directly triggers the Lambda when an object is created — which is S3 Event Notifications, not a message broker.

How to eliminate wrong answers

Option A is wrong because Amazon CloudWatch Events (now Amazon EventBridge) is used for scheduling or reacting to AWS service events via a rule, but it is not the direct trigger for S3 object creation; you would need S3 to send events to EventBridge, which adds unnecessary complexity. Option B is wrong because Amazon SQS is a message queue that can receive S3 notifications, but it cannot directly invoke a Lambda function; you would need an additional SQS trigger on the Lambda, making it an indirect and less efficient solution. Option C is wrong because Amazon SNS is a pub/sub messaging service that can receive S3 notifications and fan out to subscribers, but it cannot directly invoke Lambda; you would need to subscribe Lambda to the SNS topic, which is an extra hop and not the native integration.

Full explanation →

534

MCQhard

A developer is building a serverless application using AWS Lambda and Amazon API Gateway. The API has a REST endpoint that triggers a Lambda function to write data to an Amazon DynamoDB table. Under high traffic, some requests are failing with 5xx errors. The developer notices that the Lambda function's duration is spiking. Which combination of actions should the developer take to improve performance and reduce errors?

A.Enable DynamoDB Accelerator (DAX) for the table and set a Lambda reserved concurrency.

B.Use an Amazon SQS queue as a buffer between API Gateway and Lambda.

C.Increase the Lambda function's memory and enable DynamoDB auto-scaling.

D.Switch the API endpoint to HTTP API and enable API Gateway caching.

AnswerC

Correct. Increasing Lambda memory reduces execution duration, and DynamoDB auto-scaling prevents write throttling, together reducing 5xx errors and improving performance.

Why this answer

Increasing the Lambda function's memory allocation also increases CPU and network throughput, which can reduce execution duration and prevent timeouts. Enabling DynamoDB auto-scaling allows the table to handle write capacity bursts, reducing throttling and subsequent 5xx errors. Option A is incorrect because DynamoDB Accelerator (DAX) is a read cache and does not improve write performance.

Option B introduces unnecessary latency and does not directly address write capacity. Option D is focused on read performance and does not help with write-intensive workloads.

Exam trap

The trap is that DAX is often mistakenly applied to improve write performance, but it only caches reads. Candidates may also overlook the effectiveness of increasing Lambda memory to reduce duration, and they might not consider DynamoDB auto-scaling as a direct solution for write throttling.

How to eliminate wrong answers

Option B is wrong because using an SQS queue as a buffer between API Gateway and Lambda would introduce asynchronous processing, which is not suitable for a REST endpoint that expects synchronous responses; the client would not receive a timely response, and 5xx errors would persist. Option C is wrong because increasing Lambda memory may reduce duration but does not address DynamoDB throttling under high traffic, and DynamoDB auto-scaling reacts too slowly to sudden spikes, so errors would still occur. Option D is wrong because switching to HTTP API and enabling API Gateway caching only improves read performance for cached responses, not for write operations to DynamoDB, and does not address the Lambda duration spikes or database throttling.

Full explanation →

535

MCQmedium

A company uses AWS Elastic Beanstalk to deploy a web application. The developer has updated the application code and wants to deploy the new version with a rolling deployment strategy to minimize downtime. Which configuration should the developer use?

A.Set the deployment policy to 'Rolling'

B.Set the deployment policy to 'Immutable'

C.Set the deployment policy to 'All at once'

D.Set the deployment policy to 'Blue/green'

AnswerA

Setting the deployment policy to 'Rolling' is the correct approach for a rolling deployment strategy in AWS Elastic Beanstalk. This method updates instances in batches, ensuring that a portion of the application's capacity remains available to serve traffic throughout the deployment process. Elastic Beanstalk performs health checks on each batch before proceeding, minimizing downtime and allowing for a gradual, controlled update of the application version across the environment.

Why this answer

The 'Rolling' deployment policy in AWS Elastic Beanstalk updates instances in batches, moving the new application version into a subset of instances while keeping the rest serving traffic, which minimizes downtime by ensuring capacity is never fully reduced. This is the correct choice for a rolling update that balances speed and availability without requiring a full parallel environment.

Exam trap

The trap here is that candidates often confuse 'Rolling' with 'Blue/green' because both aim to reduce downtime, but Blue/green requires a separate environment and is not a rolling deployment within the same environment, while 'Immutable' is mistakenly chosen for its safety despite not being a rolling strategy.

How to eliminate wrong answers

Option B is wrong because 'Immutable' deployment launches a completely new Auto Scaling group with the new version, then swaps it with the old group, which minimizes risk but incurs higher cost and longer deployment time, not specifically minimizing downtime through a rolling approach. Option C is wrong because 'All at once' deploys the new version to all instances simultaneously, causing full downtime during the deployment as all instances are replaced at the same time. Option D is wrong because 'Blue/green' deploys a separate environment (green) alongside the existing one (blue), then swaps the CNAME, which avoids downtime but requires additional infrastructure and is not a rolling deployment strategy.

Full explanation →

536

MCQhard

A CodeDeploy deployment to Lambda should shift 10 percent of traffic for 10 minutes before full rollout and automatically roll back on alarms. Which configuration should be used?

A.Canary deployment preference with CloudWatch alarms

B.All-at-once deployment without alarms

C.Manual alias update after deployment

D.S3 static website deployment

AnswerA

A Canary deployment preference with CloudWatch alarms is the correct approach for shifting 10 percent of traffic to a new Lambda version. This strategy allows CodeDeploy to gradually shift a specified percentage of traffic (e.g., 10%) to the new function version, while the remaining traffic continues to serve the old version. Integrating CloudWatch alarms provides automated monitoring during this shift, triggering an automatic rollback to the stable version if predefined error thresholds or latency metrics are breached, ensuring a safe and controlled rollout.

Why this answer

A is correct because CodeDeploy's canary deployment preference shifts 10% of traffic to the new Lambda version for 10 minutes, then automatically shifts the remaining 90% after the specified interval. CloudWatch alarms are configured to trigger an automatic rollback if the alarm state is breached during the canary period, meeting the requirement for a gradual shift with automated rollback on failure.

Exam trap

The trap here is that candidates may confuse 'canary' with 'linear' deployments, or assume that any gradual shift (like 'linear10PercentEvery10Minutes') is equivalent, but the requirement specifies a single 10% shift for 10 minutes before full rollout, which matches the canary preference, not a linear incremental shift.

How to eliminate wrong answers

Option B is wrong because 'All-at-once' deploys all traffic instantly without a gradual 10% shift or a 10-minute waiting period, and it lacks any alarm-based rollback mechanism. Option C is wrong because manually updating an alias after deployment bypasses CodeDeploy's automated traffic shifting and rollback capabilities, requiring manual intervention for both the shift and any rollback. Option D is wrong because an S3 static website deployment is unrelated to Lambda traffic shifting; it is used for hosting static content, not for managing Lambda alias traffic or CodeDeploy deployments.

Full explanation →

537

MCQeasy

An S3 bucket has versioning enabled with MFA Delete. A developer tries to permanently delete a specific version of an object using the AWS CLI without providing MFA. What is the result?

A.A delete marker is created for the object version.

B.The object version is permanently deleted.

C.The request is denied with an AccessDenied error.

D.The object version is marked with a delete marker.

AnswerC

Since MFA Delete is configured for the S3 bucket, any operation that results in the permanent deletion of an object version, such as deleting a specific version ID, necessitates the inclusion of a valid MFA token in the request. If the DELETE request targeting a specific version ID lacks this required MFA authentication, Amazon S3 will strictly enforce the MFA Delete policy. Consequently, the request will be rejected, and an AccessDenied error will be returned to the caller.

Why this answer

When MFA Delete is enabled on an S3 bucket, any request to permanently delete an object version must include multi-factor authentication. Without MFA, the AWS CLI request is denied with an AccessDenied error, as S3 enforces this security requirement at the API level. The developer cannot bypass this by omitting the MFA token.

Exam trap

The trap here is that candidates often confuse MFA Delete with standard versioning behavior, assuming a delete marker is created as a fallback, but MFA Delete strictly denies any permanent deletion request without the required authentication.

How to eliminate wrong answers

Option A is wrong because a delete marker is created only when deleting the latest version of an object without specifying a version ID, not when attempting to permanently delete a specific version with MFA Delete enabled. Option B is wrong because permanent deletion of a specific version requires MFA authentication when MFA Delete is enabled; without it, the operation fails. Option D is wrong because marking an object version with a delete marker is not a valid S3 operation; delete markers are only applied to the current version of an object, not to specific versions.

Full explanation →

538

MCQmedium

A developer has an AWS Lambda function that needs to read objects from an S3 bucket in another account. The Lambda function's execution role includes an IAM policy that allows s3:GetObject on the bucket. The bucket owner has added a bucket policy that grants s3:GetObject to the Lambda execution role. However, the Lambda function receives Access Denied errors. The S3 bucket uses SSE-KMS for encryption. What is the most likely cause?

A.The S3 bucket does not have versioning enabled.

B.The Lambda function's execution role does not have an explicit allow for s3:GetObject.

C.The Lambda function is not in the same AWS region as the S3 bucket.

D.The Lambda function does not have kms:Decrypt permission on the KMS key used by the bucket.

AnswerD

When an S3 bucket utilizes Server-Side Encryption with AWS KMS (SSE-KMS) for object encryption, any entity attempting to read those encrypted objects requires two distinct sets of permissions. First, it needs `s3:GetObject` permission on the S3 bucket and object. Second, and critically, the Lambda function's execution role must also have `kms:Decrypt` permission on the specific AWS KMS key used to encrypt the objects. This `kms:Decrypt` permission is granted via the KMS key policy, not the S3 bucket policy, and without it, the Lambda cannot decrypt the object data even if it successfully retrieves the encrypted bytes from S3.

Why this answer

When an S3 bucket uses SSE-KMS, the Lambda function must have explicit kms:Decrypt permission on the KMS key to decrypt the object after s3:GetObject retrieves the encrypted data. Even though the bucket policy and execution role allow s3:GetObject, the missing KMS permission causes an Access Denied error because S3 returns the encrypted object and the Lambda runtime cannot decrypt it without the key.

Exam trap

The trap here is that candidates focus on the S3 bucket policy and IAM role for s3:GetObject, overlooking that SSE-KMS introduces a separate KMS authorization layer that must be explicitly configured.

How to eliminate wrong answers

Option A is wrong because S3 versioning is unrelated to access permissions or KMS decryption; it controls object version retention, not read access. Option B is wrong because the scenario explicitly states the execution role includes an IAM policy that allows s3:GetObject, so an explicit allow exists. Option C is wrong because cross-region access between Lambda and S3 is fully supported; region mismatch does not cause Access Denied errors unless the bucket policy explicitly restricts by source IP or VPC, which is not mentioned.

Full explanation →

539

Multi-Selectmedium

A developer is troubleshooting a slow-running query on an Amazon RDS for MySQL database. The query is used by a reporting application and takes over 30 seconds to complete. The database is a db.r5.large instance with 200 GB of gp2 storage. Which TWO actions should the developer take to improve query performance?

Select 2 answers

A.Terminate idle connections to free up resources.

B.Review the slow query log to identify the query and its execution plan.

C.Increase the allocated storage to 500 GB to improve I/O performance.

D.Add appropriate indexes to the tables involved in the query.

E.Enable Multi-AZ deployment for better read performance.

AnswersB, D

Reviewing the slow query log is the first diagnostic step because it captures queries that exceed a specified duration, along with their execution time and connection metadata. Once identified, use EXPLAIN to analyze the execution plan, exposing table scans, missing indexes, or poor join ordering. This evidence-based approach tells you exactly which query to optimize and whether to add indexes or rewrite the query.

Why this answer

Reviewing the slow query log helps identify the query and its execution plan, which is essential for diagnosing performance issues. Option D is correct: adding appropriate indexes can speed up query execution by reducing the number of rows scanned. Option A is incorrect: terminating idle connections frees up resources but does not directly improve query performance for a slow-running query.

Option C is incorrect: increasing storage to gp2 does not improve I/O performance; gp2 performance scales with size only up to a point, but the primary bottleneck is likely query optimization, not storage. Option E is incorrect: Multi-AZ is for high availability and failover, not for enhancing read performance.

Full explanation →

540

MCQeasy

A developer notices that an S3 bucket policy allows public read access to all objects. The bucket contains sensitive data that should only be accessible by authorized IAM users. What is the BEST way to remediate this?

A.Enable default encryption on the bucket.

B.Modify the bucket policy to remove the public statement and use IAM policies for access.

C.Enable S3 Block Public Access at the account level.

D.Enable S3 Object Ownership and use ACLs.

AnswerB

The most direct and secure solution is to modify the S3 bucket policy to remove any statements that grant public access, typically identified by "Principal: "*". Concurrently, implement specific IAM policies attached to users, groups, or roles to grant precise, least-privilege access to authorized principals. This approach directly addresses the misconfiguration, ensures granular control, and aligns with AWS security best practices for managing access to S3 resources.

Why this answer

The bucket policy currently grants public read access, which overrides any IAM-based restrictions. By removing the public statement from the bucket policy and relying solely on IAM policies, access is controlled at the user level, ensuring only authorized IAM users can read objects. This aligns with the principle of least privilege and follows AWS best practices for securing S3 data.

Exam trap

The trap here is that candidates often confuse encryption with access control, thinking that enabling encryption (Option A) will prevent unauthorized access, when in fact encryption only protects data at rest and does not affect public read permissions.

How to eliminate wrong answers

Option A is wrong because enabling default encryption only encrypts data at rest; it does not restrict access, so public read access would still be allowed. Option C is wrong because S3 Block Public Access at the account level would prevent all public access, but it is a broad, account-wide setting that may inadvertently block legitimate public access for other buckets; the question asks for the best remediation for this specific bucket, not a blanket account-level change. Option D is wrong because S3 Object Ownership and ACLs are legacy access control mechanisms that are less secure and more complex to manage than IAM policies, and they do not directly address the public read access granted by the bucket policy.

Full explanation →

541

Multi-Selecteasy

A developer is using AWS KMS to encrypt data. Which TWO are valid operations that can be performed using KMS?

Select 2 answers

A.Store customer-managed keys on an HSM in your data center.

B.Generate data keys for envelope encryption.

C.Hash data using a keyed hash function.

D.Encrypt data using a customer master key.

E.Generate SSL/TLS certificates for a domain.

AnswersB, D

Envelope encryption is a core pattern supported by AWS KMS through the GenerateDataKey API, which returns a plaintext data key and a copy of that key encrypted under a CMK. You use the plaintext data key locally to encrypt your actual data (which can be of any size), then apply best practices by deleting the plaintext key and storing only the encrypted data key alongside the ciphertext. Later, to decrypt, you call Decrypt with the encrypted data key to retrieve the plaintext key. This is the recommended approach for encrypting large payloads because the KMS Encrypt API is limited to 4 KB per request, whereas envelope encryption has no practical size limit.

Why this answer

KMS can generate data keys for envelope encryption using the GenerateDataKey API, which returns a plaintext data key and an encrypted copy. Option D is correct because KMS can directly encrypt data (up to 1 KB) using a customer master key via the Encrypt API. Option A is incorrect because KMS does not store keys on an HSM in your data center; AWS manages the HSMs within its infrastructure.

Option C is incorrect because KMS does not provide a keyed hash function; hashing is not a KMS operation. Option E is incorrect because KMS does not generate SSL/TLS certificates; that is handled by AWS Certificate Manager (ACM).

Full explanation →

542

MCQhard

A developer notices that an IAM user has permissions to terminate EC2 instances, but the user should only be allowed to stop instances. The developer needs to update the policy to prevent termination while allowing stop. Which IAM policy statement should be added?

A.{"Effect":"Deny","Action":"ec2:TerminateInstances","Resource":"*"}

B.{"Effect":"Allow","Action":"ec2:TerminateInstances","Resource":"*"}

C.{"Effect":"Allow","Action":["ec2:StopInstances","ec2:TerminateInstances"],"Resource":"*"}

D.{"Effect":"Allow","Action":"ec2:RebootInstances","Resource":"*"}

AnswerA

An explicit Deny statement takes precedence over any Allow, so even if the user's other policies grant ec2:TerminateInstances, this line will effectively block the action. The wildcard resource scopes the denial to all EC2 instances in the account, meaning no running instance can be terminated by that user. This directly implements the developer's requirement to prevent termination.

Why this answer

A Deny statement explicitly blocks the specified action, overriding any Allow policies. Since the IAM user currently has permission to terminate EC2 instances (via an Allow policy), adding a Deny for ec2:TerminateInstances will prevent termination while still allowing the user to stop instances (if allowed by another policy). Option A provides this Deny.

Option B is an Allow that would not block termination. Option C allows both stop and terminate. Option D is unrelated.

Full explanation →

543

MCQeasy

A developer wants to store session state for a web application running on multiple EC2 instances. Which AWS service provides a fully managed, in-memory data store that is ideal for this use case?

A.Amazon ElastiCache for Redis

B.Amazon S3

C.Amazon DynamoDB

D.Amazon RDS for MySQL

AnswerA

Amazon ElastiCache for Redis is an excellent choice for storing web application session state due to its in-memory, high-performance nature. It provides extremely low-latency read and write operations, essential for a responsive user experience. As a fully managed service, it simplifies deployment and scaling, offering robust support for various data structures that efficiently manage session attributes and expiration.

Why this answer

Amazon ElastiCache for Redis is the correct choice because it provides a fully managed, in-memory data store that is ideal for storing session state across multiple EC2 instances. Redis supports atomic operations, TTL-based key expiration, and high-speed reads/writes, making it perfect for session management where low-latency access and automatic data eviction are critical. Unlike disk-based stores, ElastiCache for Redis keeps session data in memory, ensuring sub-millisecond response times and seamless scaling as the web application grows.

Exam trap

The trap here is that candidates often choose DynamoDB because it is fully managed and supports TTL, but they overlook the fact that the question specifically asks for an 'in-memory data store,' which DynamoDB is not—it uses SSD storage and has higher latency than an in-memory cache like Redis.

How to eliminate wrong answers

Option B is wrong because Amazon S3 is an object storage service designed for durable, long-term storage of static assets (e.g., images, backups), not for low-latency, in-memory session state; its read/write latency and lack of native TTL or atomic operations make it unsuitable for session management. Option C is wrong because Amazon DynamoDB is a fully managed NoSQL database that can store session data, but it is not an in-memory data store—it uses SSD-backed storage and has higher latency than an in-memory cache, and while it supports TTL, it is not optimized for the sub-millisecond access patterns required for session state in a high-traffic web app. Option D is wrong because Amazon RDS for MySQL is a relational database that stores data on disk, introducing significant latency for session reads/writes and requiring schema management; it is not designed for ephemeral, high-throughput session state and would create unnecessary overhead and performance bottlenecks.

Full explanation →

544

Multi-Selecthard

A developer is deploying a containerized application on Amazon ECS with Fargate. The application requires access to an Amazon RDS database. The developer needs to securely pass database credentials to the container. Which THREE methods can the developer use?

Select 3 answers

A.Store the credentials in AWS Systems Manager Parameter Store and reference the parameter in the task definition.

B.Store the credentials in AWS Secrets Manager and reference the secret in the task definition.

C.Use IAM roles for tasks and retrieve credentials from AWS Secrets Manager at runtime.

D.Hardcode the credentials in the container image.

E.Define environment variables in the task definition with the credentials.

AnswersA, B, C

Parameter Store can securely store and inject secrets.

Why this answer

AWS Systems Manager Parameter Store allows you to securely store database credentials as parameters and reference them directly in the ECS task definition using the 'secrets' field. This enables Fargate to inject the credentials as environment variables at container startup without exposing them in plaintext.

Exam trap

The trap here is that candidates often confuse 'referencing a secret in the task definition' (which is secure and done at launch time) with 'defining environment variables directly in the task definition' (which is insecure), and they may also overlook that IAM roles for tasks can be used to retrieve secrets at runtime, not just at launch.

Full explanation →

545

MCQeasy

A developer needs to deploy a containerized application on AWS. The application requires persistent storage that can be shared across multiple containers running on different EC2 instances. Which AWS service should the developer use?

A.Amazon S3

B.Amazon Elastic Block Store (EBS)

C.Amazon RDS

D.Amazon Elastic File System (EFS)

AnswerD

Amazon Elastic File System (EFS) is a fully managed, scalable, and highly available network file system designed for use with AWS cloud services and on-premises resources. EFS provides a POSIX-compliant file system interface, allowing multiple EC2 instances, containers, or serverless functions to concurrently access and share the same data. This makes it an ideal solution for containerized applications that require persistent, shared storage across a fleet of instances.

Why this answer

Amazon EFS provides a fully managed, scalable, and elastic NFS file system that can be mounted concurrently on multiple EC2 instances across different Availability Zones. This makes it the ideal choice for shared persistent storage when containers running on separate EC2 instances need to access the same data simultaneously.

Exam trap

The trap here is that candidates often confuse EBS with EFS, assuming EBS can be shared across instances, but EBS volumes are single-instance attachments by default, while EFS is purpose-built for concurrent multi-instance access.

How to eliminate wrong answers

Option A is wrong because Amazon S3 is an object storage service accessed via HTTP/HTTPS APIs, not a file system that can be mounted as a POSIX-compliant shared volume across EC2 instances. Option B is wrong because Amazon EBS volumes are block-level storage devices that can only be attached to a single EC2 instance at a time (unless using multi-attach EBS, which has strict limitations and is not designed for general-purpose shared file storage across many containers). Option C is wrong because Amazon RDS is a managed relational database service, not a file storage solution, and cannot be used as a shared file system for containerized applications.

Full explanation →

546

MCQmedium

A company uses AWS Elastic Beanstalk to deploy a web application. The environment is currently running a previous version. The developer uploads a new application version and deploys it to the environment. After the deployment, the environment health status turns 'Severe' and the new version is not accessible. The developer needs to quickly revert to the previous working version. What should the developer do?

A.Create a new environment with the previous version and swap CNAMEs.

B.Use the Elastic Beanstalk console to deploy the previous application version.

C.Roll back the environment configuration to a previous saved configuration.

D.Terminate the environment and launch a new one with the previous version.

AnswerB

Elastic Beanstalk maintains a history of all deployed application versions. When a new deployment introduces issues, the console or CLI allows direct selection and deployment of any previously uploaded and deployed application version. This process triggers an in-place update of the existing environment's instances, replacing the problematic code with the last known good version, thereby providing a quick and efficient rollback mechanism without requiring environment recreation.

Why this answer

Elastic Beanstalk allows you to deploy a previous application version directly from the console or CLI without creating a new environment. This action replaces the current application version in the existing environment, restoring the previously working code and resolving the health status. It is the fastest and most straightforward way to revert while preserving the environment's configuration and resources.

Exam trap

The trap here is that candidates confuse 'deploying a previous application version' (which directly fixes the code) with 'rolling back environment configuration' (which only affects settings), leading them to incorrectly choose Option C.

How to eliminate wrong answers

Option A is wrong because creating a new environment and swapping CNAMEs is an unnecessary, time-consuming process that introduces a new environment with its own resources and potential configuration drift, whereas a simple version rollback achieves the same result instantly. Option C is wrong because rolling back the environment configuration reverts settings like instance type or scaling rules, not the application version; the application code remains the broken version. Option D is wrong because terminating the environment and launching a new one with the previous version destroys all existing resources (e.g., RDS database if attached, logs, monitoring data) and requires reconfiguration, which is far more disruptive than a direct version deployment.

Full explanation →

547

MCQhard

A company is using AWS Lambda to process messages from an Amazon SQS queue. The Lambda function is configured with a reserved concurrency of 10. The SQS queue receives a burst of 1000 messages. The Lambda function processes each message in about 5 seconds. What is the most likely behavior of the system?

A.Lambda rejects the messages and sends them to the dead-letter queue.

B.Lambda automatically scales up to 1000 concurrent executions to process all messages quickly.

C.Lambda increases the reserved concurrency to accommodate the burst.

D.Lambda processes up to 10 messages concurrently, and the rest remain in the queue until processing capacity is available.

AnswerD

When a Lambda function has a reserved concurrency of 10, it means that at any given moment, a maximum of 10 instances of that function can be executing simultaneously. If there's a sudden influx of messages from the SQS queue, Lambda will invoke up to 10 functions to process them. Any additional messages beyond what these 10 concurrent invocations can handle will remain in the SQS queue, awaiting an available function instance to process them.

Why this answer

Lambda's reserved concurrency of 10 caps the maximum number of concurrent executions. When the SQS queue receives 1000 messages, Lambda polls the queue and invokes the function with up to 10 messages at a time (based on batch size, default 1). The remaining messages stay in the queue and are retried after the visibility timeout expires, as Lambda processes messages in batches limited by the reserved concurrency.

Exam trap

The trap here is that candidates assume Lambda automatically scales to handle any burst, but reserved concurrency explicitly limits scaling, and the exam tests understanding that this limit is enforced regardless of queue depth.

How to eliminate wrong answers

Option A is wrong because Lambda does not reject messages due to concurrency limits; messages remain in the queue and are retried, and a dead-letter queue is only used after the maximum retry count is exceeded. Option B is wrong because Lambda cannot scale beyond the reserved concurrency of 10, which is a hard limit set by the user, not an automatic scaling target. Option C is wrong because reserved concurrency is a static configuration that cannot be dynamically increased by Lambda in response to a burst; it must be changed manually or via an auto-scaling mechanism like Application Auto Scaling.

Full explanation →

548

Multi-Selecteasy

A developer needs to securely store database credentials and retrieve them programmatically from a Lambda function. Which AWS services can be used for this purpose? (Choose TWO.)

Select 2 answers

A.AWS Systems Manager Parameter Store (SecureString)

B.AWS Secrets Manager

C.AWS CloudFormation

D.AWS Identity and Access Management (IAM)

E.Amazon S3

AnswersA, B

AWS Systems Manager Parameter Store SecureString parameters store database credentials as encrypted values using AWS KMS, and they can be retrieved through the AWS API, CLI, or SDK by services like EC2, ECS, and Lambda. However, while Parameter Store can integrate with KMS and supports versioning, it does not natively automate credential rotation, so it is best when you need encrypted secrets without the additional lifecycle features of Secrets Manager.

Why this answer

Options A and B are correct. AWS Systems Manager Parameter Store (SecureString) and AWS Secrets Manager are both designed to securely store database credentials and other secrets, and allow programmatic retrieval from Lambda functions. AWS CloudFormation (option C) is for infrastructure as code, not for storing secrets.

AWS IAM (option D) is for managing permissions, not for storing secrets. Amazon S3 (option E) is for object storage and is not a secure secrets management service.

Full explanation →

549

MCQmedium

A developer is using AWS Elastic Beanstalk to deploy a web application. The application experiences high latency during peak hours. The developer wants to scale the application automatically based on CPU utilization. Which configuration should the developer use?

A.Configure an Auto Scaling step scaling policy based on MemoryReservation metric.

B.Use AWS CloudFront to cache responses and reduce load on the application.

C.Configure an Auto Scaling simple scaling policy based on Average CPU Utilization > 70% for scale-out and < 30% for scale-in.

D.Configure an Auto Scaling target tracking policy based on NetworkIn metric.

AnswerC

Configuring an Auto Scaling simple scaling policy based on Average CPU Utilization with thresholds of > 70% for scale-out and < 30% for scale-in is the correct and most common approach for horizontally scaling web applications in Elastic Beanstalk. High CPU utilization directly indicates that the existing instances are struggling to process requests, necessitating more compute capacity. Conversely, low CPU utilization suggests instances are underutilized, allowing for cost-efficient scale-in.

Why this answer

AWS Elastic Beanstalk integrates with Auto Scaling to automatically adjust the number of EC2 instances based on a simple scaling policy that uses the Average CPU Utilization metric. By setting a scale-out threshold at >70% and a scale-in threshold at <30%, the application can dynamically handle peak-hour traffic while reducing costs during low usage. This directly addresses the developer's requirement to scale based on CPU utilization.

Exam trap

The trap here is that candidates may confuse the metric used for scaling (CPU utilization) with other metrics like MemoryReservation or NetworkIn, or assume that caching solutions like CloudFront can replace the need for compute scaling, when the question explicitly requires scaling based on CPU utilization.

How to eliminate wrong answers

Option A is wrong because the MemoryReservation metric is specific to Amazon ECS and Fargate tasks, not to EC2 instances managed by Elastic Beanstalk, and step scaling policies are not the recommended approach for CPU-based scaling in this context. Option B is wrong because while CloudFront can reduce latency by caching responses at edge locations, it does not automatically scale the application's compute capacity based on CPU utilization; it only offloads requests for cached content. Option D is wrong because a target tracking policy based on NetworkIn metric would scale based on network traffic rather than CPU utilization, which does not meet the developer's explicit requirement to scale based on CPU utilization.

Full explanation →

550

MCQmedium

A company uses AWS KMS to encrypt data at rest in S3. The security team requires that all objects uploaded to a specific S3 bucket must be encrypted with a specific KMS key (key ID: xyz). The developer needs to enforce this by denying any PutObject request that does not use the correct key. Which bucket policy condition should be used?

A.s3:x-amz-server-side-encryption-aws-kms-key-id

B.kms:EncryptionContext

C.s3:EncryptionAlgorithm

D.kms:GrantOperations

AnswerA

This condition key, `s3:x-amz-server-side-encryption-aws-kms-key-id`, is precisely designed for S3 bucket policies to enforce the use of a *specific* AWS KMS customer master key (CMK) when objects are uploaded with server-side encryption using KMS (SSE-KMS). By including this condition, an S3 bucket policy can mandate that all incoming objects encrypted with SSE-KMS must utilize a predefined KMS key ARN, preventing uploads encrypted with unauthorized or default KMS keys. This ensures strict compliance with data residency or security requirements by linking data to a specific cryptographic key.

Why this answer

The `s3:x-amz-server-side-encryption-aws-kms-key-id` condition key allows you to enforce that a specific KMS key ID (e.g., `xyz`) is used for server-side encryption with AWS KMS (SSE-KMS). By including this condition in a bucket policy with a `Deny` effect, any `PutObject` request that does not specify the required key ID will be denied, meeting the security team's requirement.

Exam trap

The trap here is confusing S3-specific condition keys (like `s3:x-amz-server-side-encryption-aws-kms-key-id`) with KMS condition keys (like `kms:EncryptionContext`), leading candidates to pick a KMS condition key that does not apply to S3 bucket policies.

How to eliminate wrong answers

Option B is wrong because `kms:EncryptionContext` is a condition key used to control access based on the encryption context in KMS API calls (e.g., `Encrypt`, `Decrypt`), not to enforce the KMS key ID used for S3 object encryption. Option C is wrong because `s3:EncryptionAlgorithm` is not a valid S3 condition key; S3 uses `s3:x-amz-server-side-encryption` to specify the encryption type (e.g., AES256 or aws:kms), not the algorithm. Option D is wrong because `kms:GrantOperations` is a condition key used to restrict the operations allowed in a KMS grant, not to enforce the KMS key ID in S3 PutObject requests.

Full explanation →

551

MCQeasy

A developer is deploying a new version of a Lambda function using an alias for blue/green deployment. Traffic is gradually shifted to the new version. During the shift, a high error rate is observed. What should the developer do to minimize impact?

A.Use the Lambda function's provisioned concurrency to pre-warm the new version.

B.Manually revert the alias to point back to the old version.

C.Configure the alias with a canary deployment and an error rate alarm for automatic rollback.

D.Delete the new version and redeploy after fixing the issue.

AnswerC

Configuring a Lambda alias with a canary deployment allows for gradual shifting of traffic to the new function version, starting with a small percentage. Integrating this with an Amazon CloudWatch error rate alarm enables automatic rollback: if the new version's error rate exceeds a predefined threshold during the canary phase, the alias automatically reverts all traffic to the stable old version. This strategy minimizes the impact of potential issues by detecting them early and automating recovery.

Why this answer

It automates the rollback process using AWS CodeDeploy's canary deployment with an Amazon CloudWatch alarm on the error rate. When the alarm triggers, CodeDeploy automatically shifts traffic back to the previous version, minimizing impact without manual intervention. This is the recommended approach for safe blue/green deployments with Lambda aliases.

Exam trap

The trap here is that candidates may think manual reversion (Option B) is the simplest fix, but the exam emphasizes automated rollback strategies (like canary deployments with alarms) as the best practice for minimizing impact during blue/green deployments.

How to eliminate wrong answers

Option A is wrong because provisioned concurrency pre-warms execution environments to reduce cold starts, but it does not address a high error rate during traffic shifting; errors are typically caused by code defects, not cold starts. Option B is wrong because manually reverting the alias is a valid fallback but is slower and error-prone compared to an automated rollback; the question asks to minimize impact, and manual reversion introduces delay and potential for human error. Option D is wrong because deleting the new version and redeploying after fixing the issue is a reactive approach that does not minimize impact during the shift; it requires manual intervention and does not provide automatic recovery.

Full explanation →

552

MCQmedium

A developer is managing an application running on Amazon EC2 instances behind an Application Load Balancer. Users report that the application becomes unresponsive after several hours, and restarting the instance temporarily fixes the issue. The developer suspects a memory leak but cannot add custom instrumentation. Which AWS service can collect memory utilization metrics and help identify the memory leak with minimal configuration?

A.Use Amazon CloudWatch Logs agent to capture application logs.

B.Use the EC2 instance metadata service to query memory usage.

C.Install the CloudWatch agent on the EC2 instances to collect memory metrics and emit them to CloudWatch.

D.Use AWS X-Ray to trace memory allocation.

AnswerC

The unified CloudWatch agent is the correct and recommended solution for collecting detailed operating system-level metrics, including memory utilization, from EC2 instances. This agent can be configured to gather various custom metrics, such as used memory percentage, free memory, and swap usage, directly from the instance's operating system. These collected metrics are then reliably published to CloudWatch, enabling comprehensive monitoring, alarming, and dashboarding capabilities.

Why this answer

The CloudWatch agent can collect custom metrics, including memory utilization, from EC2 instances and publish them to Amazon CloudWatch. This allows the developer to monitor memory usage over time and identify a memory leak without modifying the application code. The default EC2 metrics do not include memory utilization, so the CloudWatch agent is the minimal-configuration solution for this requirement.

Exam trap

The trap here is that candidates assume EC2 automatically provides memory metrics in CloudWatch, but in reality, only CPU, network, and disk metrics are available by default; memory requires the CloudWatch agent.

How to eliminate wrong answers

Option A is wrong because the CloudWatch Logs agent captures application logs, not memory utilization metrics; logs could indirectly indicate issues but do not provide direct memory metrics needed to identify a leak. Option B is wrong because the EC2 instance metadata service provides information about the instance itself (e.g., instance ID, AMI ID) but does not expose memory utilization data; it is not a monitoring service for OS-level metrics. Option D is wrong because AWS X-Ray traces requests and identifies performance bottlenecks in distributed applications, not memory allocation or utilization; it is designed for tracing, not OS-level resource monitoring.

Full explanation →

553

MCQmedium

A developer is troubleshooting a DynamoDB table that is experiencing high write throttling (ProvisionedThroughputExceededException) on certain days. The table has provisioned write capacity of 1000 WCU. The table has a partition key of 'user_id' which is a UUID. The table is accessed by multiple services. CloudWatch metrics show that the WriteThrottleEvents are spiking during specific hours, and the ConsumedWriteCapacityUnits often reaches 1000. What is the most likely cause of the throttling?

A.The partition key is not distributed evenly, causing a hot partition.

B.The provisioned write capacity is insufficient to handle the traffic spikes.

C.The table does not have DynamoDB Accelerator (DAX) enabled.

D.The table is configured with eventual consistency, which throttles writes.

AnswerB

This is the correct answer. DynamoDB tables operate on a provisioned throughput model, where Write Capacity Units (WCUs) must be sufficient to handle the incoming write traffic. When the rate of write requests, especially during traffic spikes, exceeds the allocated provisioned write capacity, DynamoDB will begin to throttle requests. This throttling mechanism protects the underlying infrastructure and ensures consistent performance for other requests within the provisioned limits, but it results in rejected write operations for the application.

Why this answer

The ConsumedWriteCapacityUnits consistently reaches the provisioned 1000 WCU during specific hours, and WriteThrottleEvents spike at those same times. This indicates that the provisioned capacity is insufficient to handle peak traffic, causing requests to be throttled. The partition key (UUID) is well-distributed, so a hot partition is unlikely.

Exam trap

The trap here is that candidates often assume throttling must be caused by a hot partition (Option A) when the partition key is not a UUID, but in this case the UUID ensures even distribution, so the real issue is simply insufficient capacity during traffic spikes.

How to eliminate wrong answers

Option A is wrong because the partition key is a UUID, which is inherently random and evenly distributes writes across partitions, making a hot partition improbable. Option C is wrong because DAX is an in-memory cache for reads, not writes, and does not affect write throttling or provisioned write capacity. Option D is wrong because eventual consistency applies only to reads, not writes; writes are always strongly consistent and throttling is based on write capacity, not consistency settings.

Full explanation →

554

MCQmedium

A development team is using AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with a 'HealthCheck' error. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). What is the MOST likely cause of this error?

A.The ALB target group health check is misconfigured or the application is not responding to health check requests.

B.The EC2 instances do not have the correct IAM instance profile attached.

C.The deployment configuration is set to 'AllAtOnce' which does not support health checks.

D.The deployment group is not configured with the ALB target group.

AnswerA

CodeDeploy integrates directly with an Application Load Balancer (ALB) to manage traffic during deployments and validate instance health. During a deployment, CodeDeploy monitors the health of instances in the target group using the ALB's configured health checks. If these health checks fail, either due to an incorrect configuration (e.g., wrong port, path, or expected response) or because the deployed application itself is not starting correctly or responding to the health check requests, CodeDeploy will detect this and halt the deployment, often initiating a rollback. This critical mechanism ensures that only healthy instances receive production traffic, preventing service disruptions.

Why this answer

The 'HealthCheck' error in AWS CodeDeploy indicates that the deployment failed because the target group health checks are not passing. This typically occurs when the ALB health check path or configuration does not match the application's expected response, or the application is not running correctly on the instances, causing the ALB to mark them as unhealthy. CodeDeploy monitors the ALB target group health status during deployment and will fail if instances do not become healthy within the configured timeout.

Exam trap

The trap here is that candidates often confuse a 'HealthCheck' error with a permissions or configuration issue, but the error specifically points to the ALB health check failing, not to IAM roles or deployment group setup.

How to eliminate wrong answers

Option B is wrong because an incorrect IAM instance profile would cause the CodeDeploy agent to fail to communicate with the service or to download the revision, resulting in a different error (e.g., 'InstanceAgent' or 'AccessDenied'), not a 'HealthCheck' error. Option C is wrong because the 'AllAtOnce' deployment configuration does support health checks; it simply deploys to all instances simultaneously, but CodeDeploy still validates health status against the ALB target group. Option D is wrong because if the deployment group were not configured with the ALB target group, CodeDeploy would not perform health checks at all, and the error would be about missing target group configuration, not a health check failure.

Full explanation →

555

MCQmedium

A developer is building a serverless application using AWS Lambda and Amazon API Gateway. The API requires that the same Lambda function handle different HTTP methods (GET, POST, DELETE) for the same resource. The developer wants to minimize code and configuration. Which integration type should the developer use?

A.Lambda proxy integration

B.Lambda custom integration

C.HTTP integration

D.Mock integration

AnswerA

Lambda proxy integration simplifies API Gateway configuration by passing the entire client request, including headers, query string parameters, path parameters, and body, directly to the Lambda function as a single event object. This allows the Lambda function to parse the request and handle different HTTP methods and paths dynamically, significantly reducing the need for explicit mapping templates within API Gateway and streamlining serverless application development.

Why this answer

Lambda proxy integration (option A) is correct because it automatically passes the entire HTTP request (method, headers, query parameters, path parameters) to the Lambda function as a single event object, allowing the same function to inspect the `httpMethod` field and branch logic for GET, POST, DELETE without any additional API Gateway mapping or transformation configuration. This minimizes both code (the function handles routing internally) and configuration (no need to define separate integration requests/responses per method).

Exam trap

The trap here is that candidates often confuse 'custom integration' (option B) with 'proxy integration' (option A), mistakenly thinking custom integration offers more flexibility when in fact it requires more configuration and does not automatically pass the full request context.

How to eliminate wrong answers

Option B (Lambda custom integration) is wrong because it requires you to explicitly define request/response mapping templates for each HTTP method, increasing configuration complexity and defeating the goal of minimizing code and configuration. Option C (HTTP integration) is wrong because it proxies requests to an HTTP endpoint, not to a Lambda function, so it cannot directly invoke the same Lambda for multiple methods without an intermediate HTTP service. Option D (Mock integration) is wrong because it returns a static response defined in API Gateway without invoking any backend, so it cannot handle dynamic business logic for different HTTP methods.

Full explanation →

556

MCQmedium

A developer is deploying an application on Amazon EC2 instances that need to securely retrieve secrets from AWS Secrets Manager. What is the MOST secure way to provide the necessary permissions without hardcoding credentials?

A.Store the secret in an environment variable.

B.Attach an IAM role to the EC2 instance with permission to access Secrets Manager.

C.Embed the secret in the application code.

D.Use a configuration file stored in S3 with bucket policy.

AnswerB

IAM roles provide temporary credentials securely; the application can use the AWS SDK to fetch secrets without hardcoding.

Why this answer

Attaching an IAM role to the EC2 instance is the most secure method because it leverages temporary security credentials obtained via the EC2 instance metadata service (IMDS). This eliminates the need to hardcode, embed, or store any long-term credentials on the instance, adhering to the AWS Well-Architected Framework's security pillar. The IAM role's policy grants the instance precise permissions to call Secrets Manager APIs like GetSecretValue, ensuring least privilege.

Exam trap

The trap here is that candidates may think environment variables or S3 configuration files are secure enough, but the exam emphasizes that any form of static credential storage (including environment variables) is insecure compared to IAM roles, which provide automatic, temporary, and rotated credentials.

How to eliminate wrong answers

Option A is wrong because storing the secret in an environment variable still exposes the secret in plaintext within the instance's process space and can be read by any user or process with access to the environment, violating security best practices. Option C is wrong because embedding the secret in application code hardcodes the credential, making it visible in source control, logs, or binary analysis, and prevents rotation without redeployment. Option D is wrong because using a configuration file stored in S3 with a bucket policy does not inherently provide secure access; the EC2 instance would still need credentials to retrieve the file, and the bucket policy alone cannot grant permissions to the instance without an IAM role or user, while also exposing the secret in transit and at rest if not encrypted.

Full explanation →

557

MCQeasy

A developer needs to store application logs from multiple EC2 instances in a centralized location for analysis. The logs should be retained for 90 days. Which AWS service should be used to collect and store the logs?

A.Amazon Kinesis Data Firehose

B.Amazon CloudWatch Logs

C.AWS CloudTrail

D.Amazon S3 with S3 Server Access Logs

AnswerB

Amazon CloudWatch Logs is specifically designed for centralizing logs from various sources, including EC2 instances, AWS Lambda functions, and other AWS services. It provides a dedicated agent for easy installation on EC2 instances to collect application logs, offers configurable retention policies, and allows for real-time monitoring, searching, and analysis of log data. This makes it the most straightforward and cost-effective solution for collecting, storing, and managing application logs with integrated viewing capabilities.

Why this answer

Amazon CloudWatch Logs is the correct service for collecting, monitoring, and storing application logs from EC2 instances in a centralized location. It integrates directly with the CloudWatch Logs agent (or unified CloudWatch agent) installed on EC2 instances to stream log data, and it supports configurable retention policies, including a 90-day retention period. This makes it the ideal choice for centralized log storage and analysis without requiring additional infrastructure.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (which logs API calls) with CloudWatch Logs (which collects application logs), leading them to select CloudTrail for application-level logging needs.

How to eliminate wrong answers

Option A is wrong because Amazon Kinesis Data Firehose is a real-time data streaming service designed to load data into destinations like S3, Redshift, or Elasticsearch, not a native log storage and retention service; it lacks built-in log retention policies and is not optimized for storing logs directly for 90 days. Option C is wrong because AWS CloudTrail records API activity and governance events across AWS services, not application-level logs from EC2 instances; it is focused on auditing, not application log collection. Option D is wrong because Amazon S3 with S3 Server Access Logs captures detailed records about requests made to an S3 bucket, not application logs from EC2 instances; it is a bucket-level logging feature, not a centralized log collection service for EC2.

Full explanation →

558

MCQmedium

A company is using Amazon API Gateway to expose a REST API. The API is integrated with an AWS Lambda function. Lately, the API is returning 502 Bad Gateway errors. What is the MOST likely cause?

A.The API Gateway request throttling limit has been exceeded.

B.The API Gateway API key is invalid.

C.The Lambda function is returning an unhandled exception.

D.The Lambda function's execution role does not allow API Gateway to invoke it.

AnswerC

API Gateway expects its integrated Lambda function to return a specific JSON response format, including status code, headers, and body, for successful processing and mapping. When a Lambda function encounters an unhandled exception, times out, or returns malformed output that does not conform to this expected structure, API Gateway cannot properly map this response to an HTTP response for the client. Consequently, API Gateway returns an HTTP 502 Bad Gateway error, indicating that it received an invalid response from the upstream Lambda service.

Why this answer

A 502 Bad Gateway error from API Gateway typically indicates that the backend integration (in this case, the Lambda function) returned an error response. When a Lambda function throws an unhandled exception, API Gateway receives a 200 OK with a function error payload, but it cannot parse the response into a valid HTTP response, resulting in a 502. This is distinct from throttling or permission issues, which produce different HTTP status codes.

Exam trap

The trap here is that candidates often confuse 502 errors with throttling (429) or permission issues (403/500), but the 502 specifically points to a malformed or error response from the backend integration.

How to eliminate wrong answers

Option A is wrong because exceeding API Gateway request throttling limits results in a 429 Too Many Requests error, not a 502 Bad Gateway. Option B is wrong because an invalid API key causes a 403 Forbidden error, not a 502. Option D is wrong because if the Lambda function's execution role does not allow API Gateway to invoke it, API Gateway would return a 500 Internal Server Error or a 403, not a 502.

Full explanation →

559

MCQhard

A developer is creating an AWS Lambda function that processes events from an Amazon S3 bucket. The function writes logs to Amazon CloudWatch Logs. The developer wants to ensure that the Lambda function has the minimum required permissions. Which IAM policy should be attached to the Lambda execution role?

A.A policy that includes 'logs:CreateLogStream', 'logs:PutLogEvents', and 's3:*' on the bucket.

B.A policy that includes 'logs:*' and 's3:*' on the bucket.

C.A policy that includes 'logs:PutLogEvents' and 's3:ListBucket' on the bucket.

D.A policy that includes 'logs:CreateLogGroup', 'logs:CreateLogStream', 'logs:PutLogEvents', and 's3:GetObject' on the specific bucket.

AnswerD

This policy correctly adheres to the principle of least privilege by granting only the necessary permissions for a Lambda function to process an S3 object and log its execution. 'logs:CreateLogGroup' allows the function to create its dedicated log group, 'logs:CreateLogStream' enables the creation of log streams within that group, and 'logs:PutLogEvents' permits writing runtime logs to CloudWatch. 's3:GetObject' is the precise permission required to retrieve the S3 object's content, ensuring the function can perform its core task securely.

Why this answer

It grants the minimum required permissions for the Lambda function to read objects from the specific S3 bucket (s3:GetObject) and to write logs to CloudWatch Logs (logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents). The s3:GetObject action is necessary to process events from S3, and the three logs actions are the minimum needed for the Lambda runtime to create a log group, create a log stream, and write log events. This policy follows the principle of least privilege by scoping permissions to the specific bucket and avoiding wildcards.

Exam trap

The trap here is that candidates often forget that 'logs:CreateLogGroup' is required for the first invocation of a Lambda function, and they mistakenly choose a policy with only 'logs:PutLogEvents' or overly broad S3 permissions like 's3:*'.

How to eliminate wrong answers

Option A is wrong because it includes 's3:*' on the bucket, which grants all S3 actions (e.g., delete, put) far beyond the required 's3:GetObject', violating least privilege. Option B is wrong because it includes 'logs:*' (all CloudWatch Logs actions) and 's3:*' on the bucket, both overly permissive and not minimal. Option C is wrong because it omits 'logs:CreateLogGroup' and 'logs:CreateLogStream', which are required for the Lambda runtime to initialize logging, and includes 's3:ListBucket' instead of the necessary 's3:GetObject' for reading objects.

Full explanation →

560

Multi-Selecteasy

A developer is using AWS CodeBuild to run unit tests as part of a CI/CD pipeline. The developer wants to store the test results for later analysis. Which TWO AWS services can the developer use to store and view the test reports?

Select 2 answers

A.AWS CodeBuild test reports

B.AWS X-Ray

C.Amazon Athena

D.Amazon S3

E.Amazon CloudWatch Logs

AnswersA, D

AWS CodeBuild's native test reporting feature ingests test result files (such as JUnit XML or NUnit XML) declared in the buildspec's `reports` section, groups them into a test report group, and produces visual pass/fail metrics, trends, and failure summaries in the CodeBuild console. This is the intended, fully managed mechanism for analyzing unit test outcomes directly within the CI/CD pipeline without needing separate services.

Why this answer

AWS CodeBuild test reports is a built-in feature that allows you to view test results directly in the CodeBuild console, enabling analysis of test reports. Option D: Amazon S3 can be used to store raw test result files (e.g., XML reports) for later retrieval and analysis. Option B: AWS X-Ray is for distributed tracing, not for storing test reports.

Option C: Amazon Athena is a query service for data in S3, not a storage or viewing service for test reports. Option E: Amazon CloudWatch Logs is for log data, not structured test reports.

Full explanation →

561

MCQmedium

A developer notices that an AWS Lambda function, configured to access an Amazon RDS database in the same VPC, is timing out. The function has a 30-second timeout. CloudWatch Logs show that the function starts execution but never reaches the database. The VPC configuration includes private subnets without a NAT gateway. The RDS database is in the same VPC. What is the most likely cause of the timeout?

A.The Lambda function does not have internet access because it is in a VPC without a public IP.

B.The security group of the RDS database does not allow inbound traffic from the Lambda function's security group.

C.The Amazon RDS database is not publicly accessible and the Lambda function cannot resolve the database endpoint.

D.The VPC does not have a VPC endpoint for Amazon RDS, and the Lambda function cannot access the database through the NAT gateway.

AnswerB

For a Lambda function to successfully connect to an Amazon RDS database, the RDS instance's security group must explicitly permit inbound traffic on the database port (e.g., 3306 for MySQL, 5432 for PostgreSQL). A common best practice is to configure the RDS security group to allow inbound connections from the *security group associated with the Lambda function's ENIs*. If this rule is missing or incorrectly configured, the connection will be blocked, making this a highly probable cause of connectivity issues.

Why this answer

The Lambda function is timing out when trying to connect to the RDS database, which is in the same VPC. The most likely cause is that the RDS database's security group does not have an inbound rule allowing traffic from the Lambda function's security group on the database port (e.g., 3306 for MySQL, 5432 for PostgreSQL). Without this rule, the TCP connection attempt is silently dropped or rejected, causing the Lambda function to wait until its 30-second timeout expires.

Exam trap

The trap here is that candidates often assume the Lambda function needs internet access or a NAT gateway to communicate with an RDS database in the same VPC, overlooking the fact that security group rules are the primary control for inbound traffic within a VPC.

How to eliminate wrong answers

Option A is wrong because the Lambda function does not need internet access to reach an RDS database in the same VPC; private subnet communication within a VPC does not require a public IP or NAT gateway. Option C is wrong because the RDS database being publicly accessible is irrelevant when both resources are in the same VPC; DNS resolution of the database endpoint works via the VPC's internal DNS, and the Lambda function can resolve it without public access. Option D is wrong because a VPC endpoint for Amazon RDS is used for accessing RDS API operations (e.g., CreateDBInstance), not for database client connections (e.g., MySQL/PostgreSQL protocol), and the scenario explicitly states there is no NAT gateway, but the Lambda function does not need one to communicate within the VPC.

Full explanation →

562

MCQhard

A web application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). During rolling updates of the Auto Scaling group, users intermittently receive HTTP 502 (Bad Gateway) errors. The developer checks the ALB access logs and notices that requests are being routed to instances that are in the 'Draining' state. The ALB has connection draining enabled with a timeout of 30 seconds. The Auto Scaling group terminates instances after they are taken out of service. What is the most likely cause of the 502 errors?

A.The connection draining timeout is too short, causing the ALB to terminate connections before in-flight requests finish.

B.The health check interval is set too long, causing the ALB to consider unhealthy instances as healthy.

C.Cross-zone load balancing is disabled, so the ALB is routing requests to instances that are already draining.

D.The Auto Scaling group's minimum size is too small, causing the ALB to have no healthy targets.

AnswerA

When an EC2 instance is deregistered from an Application Load Balancer (ALB) target group, connection draining (also known as deregistration delay) begins. During this period, the ALB stops sending new requests to the instance but attempts to allow existing in-flight requests to complete. If the configured deregistration delay timeout is shorter than the time required for active requests to finish processing, the ALB will forcibly close those connections, leading to 502 Bad Gateway errors for the client, as the backend server did not return a proper response.

Why this answer

The 502 errors occur because the ALB's connection draining timeout of 30 seconds is too short to allow all in-flight requests to complete before the Auto Scaling group terminates the instances. When an instance enters the 'Draining' state, the ALB stops sending new requests but waits up to the draining timeout for existing connections to finish. If the timeout expires before requests complete, the ALB forcibly closes connections, resulting in HTTP 502 (Bad Gateway) errors for clients whose requests were still in progress.

Exam trap

The trap here is that candidates often confuse connection draining timeout with health check interval, assuming that a long health check interval causes the ALB to route to unhealthy instances, when in fact the 502 errors are caused by the ALB forcibly terminating connections before in-flight requests complete due to an insufficient draining timeout.

How to eliminate wrong answers

Option B is wrong because a long health check interval would cause the ALB to consider unhealthy instances as healthy for longer, but the issue here is that requests are being routed to instances already in the 'Draining' state, not that unhealthy instances are mistakenly considered healthy. Option C is wrong because cross-zone load balancing affects how traffic is distributed across Availability Zones, not the routing of requests to draining instances; the ALB routes to draining instances only when connection draining is active, regardless of cross-zone settings. Option D is wrong because a small minimum size would cause a lack of healthy targets, leading to 503 errors, not 502 errors; the 502 errors here are specifically tied to connection termination during draining, not insufficient capacity.

Full explanation →

563

Multi-Selecteasy

A developer is using Amazon RDS for MySQL and notices that the database performance has degraded. The developer suspects that slow queries are the cause. Which THREE actions should the developer take to identify and address the slow queries?

Select 3 answers

A.Enable the slow query log in RDS and review the logs.

B.Increase the DB instance size to improve performance.

C.Enable Performance Insights to analyze database performance.

D.Use the RDS console to review metrics for high CPU or IOPS usage.

E.Create a read replica to offload read traffic.

AnswersA, C, D

The slow query log records every SQL statement that takes longer than the `long_query_time` threshold to execute, capturing the exact query text, execution time, lock time, and rows examined. Enabling it via the RDS parameter group (`slow_query_log=1`) is the most direct way to pinpoint which specific statements are causing the observed slowdown, allowing targeted optimization such as adding indexes or rewriting the query. This makes it the definitive first step for diagnosing slow queries at the statement level rather than relying on inferred metrics.

Why this answer

Options A, C, and D are correct actions to identify and address slow queries in Amazon RDS for MySQL. Option A: Enabling the slow query log captures queries that exceed a specified execution time, allowing the developer to review and optimize them. Option C: Performance Insights provides a dashboard that visualizes database load, wait events, and top SQL queries, helping to pinpoint bottlenecks.

Option D: Reviewing metrics for high CPU or IOPS usage can indicate whether hardware resources are exhausted due to inefficient queries, guiding further investigation. Option B is incorrect because increasing the DB instance size is a reactive scaling measure that may temporarily alleviate performance issues but does not help identify the root cause of slow queries. Option E is incorrect because creating a read replica offloads read traffic and improves read scalability, but it does not directly assist in diagnosing or addressing slow query performance on the primary instance.

Full explanation →

564

MCQeasy

A developer is deploying a new version of a Lambda function using the AWS CLI. Which command should the developer use to update the function code?

A.aws lambda update-function-code

B.aws lambda update-function-configuration

C.aws lambda invoke

D.aws lambda create-function

AnswerA

aws lambda update-function-code is the correct command because it uploads a new deployment package (ZIP file or container image) to the Lambda service, replacing the code currently associated with the function. This command updates the function's code while preserving its configuration, and it operates on the $LATEST version unless you specify a different qualifying qualifier, making it the proper way to deploy a new code version.

Why this answer

The `update-function-code` command updates the code of a Lambda function. Option B (`update-function-configuration`) updates configuration settings only, not the code. Option C (`invoke`) is for invoking the function, and option D (`create-function`) is for creating a new function, not updating an existing one.

Full explanation →

565

MCQmedium

A developer is building a REST API using Amazon API Gateway that will serve static content from an Amazon S3 bucket. The API should cache responses for frequently accessed objects to reduce latency. Which API Gateway feature should the developer enable?

A.API Gateway caching with TTL set per method.

B.Amazon CloudFront as a custom domain.

C.Lambda@Edge for caching.

D.S3 Transfer Acceleration.

AnswerA

API Gateway offers built-in caching capabilities that can be enabled per stage or per method. This feature stores responses from your backend integrations, reducing the number of requests sent to your backend and significantly improving API response times for repeat requests. You can configure a Time To Live (TTL) for cached responses, allowing precise control over how long data remains in the cache before being refreshed, which is crucial for managing data freshness and reducing backend load.

Why this answer

API Gateway caching allows you to cache responses from your backend (e.g., an S3 bucket) for a specified Time-to-Live (TTL) per method, reducing the number of calls to the backend and lowering latency for frequently accessed objects. This feature is natively integrated with API Gateway and requires no additional services or complex configurations, making it the most direct solution for caching static content served through a REST API.

Exam trap

The trap here is that candidates often confuse API Gateway caching with CloudFront, assuming that a CDN is required for caching, when in fact API Gateway has its own built-in caching feature that is simpler to enable for REST APIs serving static content.

How to eliminate wrong answers

Option B is wrong because Amazon CloudFront as a custom domain is a content delivery network (CDN) that can cache content at edge locations, but it is not an API Gateway feature; it is a separate service that would be placed in front of API Gateway, not enabled within API Gateway itself. Option C is wrong because Lambda@Edge is used for customizing CloudFront behavior (e.g., modifying requests/responses) and is not a caching mechanism; it runs code at edge locations but does not provide built-in response caching like API Gateway caching. Option D is wrong because S3 Transfer Acceleration is designed to speed up uploads to S3 over long distances using AWS edge locations, but it does not cache responses or reduce latency for GET requests served through API Gateway.

Full explanation →

566

MCQeasy

A developer runs a script that uses the AWS CLI to copy a large number of files from an on-premises server to an S3 bucket. The copy operation fails partway through with a 'RequestTimeout' error. What is the MOST efficient way to resume the copy and ensure all files are transferred?

A.Delete the S3 bucket and restart the copy operation.

B.Use the aws s3 sync command to synchronize the source directory with the S3 bucket.

C.Use the cp command with the --recursive flag to copy the remaining files.

D.Increase the --cli-read-timeout value in the AWS CLI configuration and retry the original command.

AnswerB

The aws s3 sync command is the most appropriate and efficient solution for resuming an interrupted file transfer to S3. It intelligently compares the source directory with the S3 bucket, identifying only files that are new, have changed content (based on size and modification time), or are missing from the destination. This ensures that only the necessary data is transferred, minimizing bandwidth usage and significantly reducing the time required to complete the operation.

Why this answer

The `aws s3 sync` command is the most efficient way to resume the copy because it automatically compares the source directory with the destination S3 bucket and transfers only the files that are missing or have been modified. This avoids re-uploading already transferred files, directly addressing the partial failure without manual intervention or unnecessary overhead.

Exam trap

The trap here is that candidates often confuse `cp --recursive` with `sync`, assuming both can resume a copy, but only `sync` performs a differential comparison to avoid re-uploading already transferred files.

How to eliminate wrong answers

Option A is wrong because deleting the S3 bucket and restarting the entire copy operation is extremely inefficient and unnecessary; it would re-upload all files, including those already successfully transferred. Option C is wrong because the `cp --recursive` command does not perform any comparison or state tracking; it would blindly copy all files from the source again, potentially re-uploading already transferred files and wasting time and bandwidth. Option D is wrong because increasing the `--cli-read-timeout` only extends the time the CLI waits for a response from the S3 service; it does not address the root cause of the partial failure (e.g., network interruptions or throttling) and would not resume the copy from where it left off, nor does it skip already transferred files.

Full explanation →

567

Multi-Selectmedium

A company wants to encrypt data at rest in Amazon S3 using server-side encryption. Which options are managed by AWS KMS? (Choose TWO.)

Select 2 answers

A.SSE-S3

B.SSE-KMS

C.Envelope encryption with KMS

D.SSE-C

E.Client-side encryption

AnswersB, C

SSE-KMS uses AWS KMS for key management.

Why this answer

SSE-KMS (option B) is a server-side encryption option where AWS KMS manages the customer master key (CMK) used to encrypt S3 objects. Envelope encryption with KMS (option C) is the underlying mechanism used by SSE-KMS, where a data key is generated by KMS to encrypt the object, and that data key is then encrypted by the CMK. Both options involve AWS KMS managing the encryption keys, making them the correct choices for the question.

Exam trap

The trap here is that candidates often confuse SSE-S3 (which is server-side encryption but not KMS-managed) with SSE-KMS, or they think envelope encryption is a separate client-side concept rather than the core mechanism of SSE-KMS.

Full explanation →

568

MCQmedium

A developer is using AWS Elastic Beanstalk to deploy a web application. The application requires a relational database. The developer wants to ensure that the database is not accidentally deleted when the Elastic Beanstalk environment is terminated. Which approach should the developer take?

A.Create the database as part of the Elastic Beanstalk environment by adding an RDS database configuration in the .ebextensions.

B.Create the RDS instance outside of Elastic Beanstalk and configure the application to connect to it using environment variables.

C.Use an Amazon DynamoDB table instead of a relational database.

D.Configure a retention policy on the RDS instance within the Elastic Beanstalk environment.

AnswerB

The database is independent of the environment lifecycle, so it will not be deleted when the environment is terminated.

Why this answer

Creating the RDS instance outside of Elastic Beanstalk decouples the database lifecycle from the environment lifecycle. When the Elastic Beanstalk environment is terminated, the external RDS instance remains intact and is not deleted. The application can connect to it using environment variables configured in the Elastic Beanstalk environment, ensuring persistence of data.

Exam trap

The trap here is that candidates may assume that adding a retention policy (Option D) is possible within Elastic Beanstalk, but Elastic Beanstalk does not expose a retention policy for RDS instances created as part of the environment; the database is always deleted with the environment unless it is created externally.

How to eliminate wrong answers

Option A is wrong because adding an RDS database configuration in .ebextensions creates the database as part of the Elastic Beanstalk environment, which means it will be deleted when the environment is terminated. Option C is wrong because DynamoDB is a NoSQL database, not a relational database, and the question explicitly requires a relational database. Option D is wrong because Elastic Beanstalk does not support configuring a retention policy on an RDS instance created within the environment; the database is tied to the environment's lifecycle and will be deleted upon termination.

Full explanation →

569

MCQmedium

A company wants to encrypt data in transit between an Application Load Balancer and its EC2 instances. The instances run a custom web server. Which configuration should the developer implement?

A.Configure the ALB listener with a TLS certificate and set the target group protocol to HTTPS. Install the server certificate on the EC2 instances.

B.Use AWS Certificate Manager to issue a certificate for the EC2 instances and configure the web server to use it.

C.Configure the ALB listener with a TLS certificate and set the target group protocol to HTTP.

D.Enable client certificate authentication on the ALB.

AnswerA

Configuring the ALB listener with a TLS certificate ensures traffic from the client to the ALB is encrypted. By setting the target group protocol to HTTPS, the ALB then re-encrypts this traffic before forwarding it to the backend EC2 instances. The EC2 instances must have their own server certificates installed and configured on their web servers to successfully complete the TLS handshake, thereby providing comprehensive end-to-end encryption for data in transit.

Why this answer

To encrypt data in transit between an Application Load Balancer (ALB) and EC2 instances, the ALB listener must be configured with a TLS certificate for client-to-ALB encryption, and the target group protocol must be set to HTTPS to enable encryption between the ALB and the instances. The EC2 instances must have a server certificate installed (e.g., from ACM or self-signed) to terminate the TLS connection, ensuring end-to-end encryption. This setup allows the ALB to re-encrypt traffic after decrypting it from the client, using HTTPS for the backend connection.

Exam trap

The trap here is that candidates often assume setting the ALB listener to HTTPS alone encrypts the entire path, forgetting that the target group protocol must also be HTTPS to encrypt the ALB-to-instance traffic, or they mistakenly think ACM certificates can be directly installed on EC2 instances.

How to eliminate wrong answers

Option B is wrong because AWS Certificate Manager (ACM) cannot issue certificates directly to EC2 instances; ACM certificates are designed for use with AWS services like ALB, CloudFront, or API Gateway, and cannot be exported for installation on custom web servers. Option C is wrong because setting the target group protocol to HTTP sends unencrypted traffic between the ALB and EC2 instances, failing to encrypt data in transit as required. Option D is wrong because client certificate authentication on the ALB is used for mutual TLS (mTLS) to verify client identity, not for encrypting data in transit between the ALB and backend instances.

Full explanation →

570

Multi-Selectmedium

Which TWO actions can help protect an S3 bucket from data leaks? (Choose two.)

Select 2 answers

A.Enable versioning.

B.Enable default encryption.

C.Enable MFA Delete.

D.Block public access at the bucket level.

E.Configure cross-region replication.

AnswersB, D

Enabling default encryption for an S3 bucket ensures that all newly written objects are encrypted at rest, either with SSE-S3 (AES-256) or SSE-KMS, so the raw data is stored as ciphertext. This protects against data leaks where an attacker gains access to the underlying storage media or backups, because they cannot interpret the encrypted bytes without the decryption keys. Note that default encryption is not a replacement for access control; it is a confidentiality layer that complements IAM policies and Block Public Access, and it can be enforced at the bucket policy level to reject unencrypted writes.

Why this answer

Options B and D are correct. Enabling default encryption (B) ensures that all objects uploaded to the bucket are encrypted at rest, protecting data from unauthorized access if the bucket is misconfigured or accessed improperly. Blocking public access at the bucket level (D) prevents accidental public exposure of data.

Option A (versioning) helps recover from accidental deletions or overwrites but does not prevent data leaks. Option C (MFA Delete) adds an extra authentication step for deleting objects or changing versioning, which protects against unauthorized deletions, not leaks. Option E (cross-region replication) provides data redundancy and disaster recovery, but does not prevent data leaks.

Full explanation →

571

Multi-Selectmedium

A developer is debugging an application that uses Amazon SQS. The application occasionally processes the same message twice. Which TWO configurations can help prevent duplicate processing?

Select 2 answers

A.Increase the visibility timeout to ensure messages are deleted before becoming visible again.

B.Configure a dead-letter queue to capture duplicates.

C.Increase the delivery delay to defer message processing.

D.Enable long polling to reduce empty responses.

E.Use a FIFO queue with content-based deduplication.

AnswersA, E

A message in SQS is hidden from other consumers the moment it is received, but only for the duration of the visibility timeout. If your processing time exceeds this window, the message becomes visible again and can be picked up by another consumer, causing the same message to be processed twice. Increasing the visibility timeout gives the original consumer enough time to finish processing and call DeleteMessage, so the message is removed before it can ever be redelivered.

Why this answer

Increasing the visibility timeout gives the consumer more time to process and delete the message before it becomes visible again, reducing the chance of duplicate processing from another consumer. Option E is correct: using a FIFO queue with content-based deduplication ensures exactly-once processing by deduplicating messages with the same deduplication ID or based on message content within a 5-minute deduplication interval. Option B is incorrect: a dead-letter queue is used to capture messages that fail processing, not to prevent duplicates.

Option C is incorrect: increasing the delivery delay only delays the first delivery of a message, it does not prevent duplicate processing. Option D is incorrect: enabling long polling reduces empty responses and improves efficiency but does not prevent duplicates.

Full explanation →

572

MCQeasy

A developer is building a serverless application using AWS Lambda that needs to connect to an Amazon RDS MySQL database. The function will be deployed in a VPC. Which resource should the developer use to ensure secure and efficient database connections?

A.NAT Gateway

B.RDS Proxy

C.VPC Endpoint

D.AWS PrivateLink

AnswerB

RDS Proxy is specifically designed to manage and pool database connections for applications like AWS Lambda, which often create many short-lived connections. It sits between your Lambda function and the RDS database, maintaining a pool of established connections to the database. This significantly reduces the overhead of establishing new connections, improves scalability, and enhances security by integrating with AWS Secrets Manager for credential management and IAM for authentication.

Why this answer

RDS Proxy is the correct choice because it manages a pool of database connections, allowing Lambda functions to reuse them efficiently and avoid exhausting MySQL connection limits under high concurrency. It also enforces IAM authentication and securely stores credentials in AWS Secrets Manager, eliminating the need to hardcode database passwords in the function code.

Exam trap

The trap here is that candidates often confuse VPC Endpoints or PrivateLink with database connectivity, not realizing that RDS Proxy is the only service designed specifically to solve connection management and security for Lambda functions accessing RDS in a VPC.

How to eliminate wrong answers

Option A is wrong because a NAT Gateway provides outbound internet access for private subnets but does not manage or secure database connections; it would not help with connection pooling or credential management. Option C is wrong because a VPC Endpoint (Gateway or Interface) enables private connectivity to AWS services like S3 or DynamoDB, not to RDS databases; it does not handle connection pooling or authentication for MySQL. Option D is wrong because AWS PrivateLink is used to expose services privately across VPCs or accounts via Network Load Balancers and interface endpoints, but it does not provide the connection pooling, IAM integration, or failover capabilities that RDS Proxy offers for Lambda-to-RDS connections.

Full explanation →

573

Multi-Selectmedium

A company is deploying a critical application using AWS CloudFormation. The stack creation fails due to a resource creation failure. The developer needs to troubleshoot the issue. Which TWO actions should the developer take to identify the root cause? (Choose TWO.)

Select 2 answers

A.View the stack events in the CloudFormation console.

B.Check the stack outputs.

C.Delete the stack and recreate it with the same parameters.

D.Review the stack template for logical errors.

E.Check AWS CloudTrail logs for the stack creation attempt.

AnswersA, D

Viewing stack events in the CloudFormation console is the direct diagnostic path. During stack creation, every resource activity is logged as an event with a status (CREATE_IN_PROGRESS, CREATE_FAILED, etc.) and a 'status reason' field. That status reason for the first failed resource contains the precise underlying error returned by the AWS service (for example, an EC2 error or an IAM permission problem), making it the authoritative source for troubleshooting a failed stack.

Why this answer

Options A and D are correct. A: Viewing stack events (Events tab) shows error messages for each resource, which can indicate which resource failed and why. D: Reviewing the stack template for logical errors can help identify issues like missing dependencies or incorrect parameter values.

Option B is wrong because stack outputs are only available after successful creation; during a failure, outputs are not generated. Option C is wrong because deleting and recreating the stack with the same parameters will likely result in the same failure and also removes the stack's logs and events, losing troubleshooting information. Option E is wrong because CloudTrail logs API calls made to AWS, but CloudFormation-specific errors during resource creation are not detailed in CloudTrail; stack events provide more relevant information.

Full explanation →

574

MCQhard

A company runs a containerized application on Amazon ECS Fargate. The application writes logs to stdout. The operations team wants to centralize log monitoring and set up alarms for error patterns. What should a developer do to meet these requirements with minimal operational overhead?

A.Use Amazon Kinesis Data Firehose to stream logs to Amazon S3 and then to CloudWatch Logs.

B.Modify the application code to use the AWS SDK for CloudWatch Logs to put log events.

C.Install the CloudWatch agent in the container and configure it to send logs.

D.Configure the ECS task definition to use the awslogs log driver and set the log group.

AnswerD

Configuring the ECS task definition to utilize the `awslogs` log driver is the recommended and most efficient method for sending container logs from Fargate tasks to Amazon CloudWatch Logs. This native integration automatically captures `stdout` and `stderr` streams from your containers and delivers them to a specified CloudWatch Logs log group. It simplifies log management, centralizes monitoring, and requires no application code changes or agent deployments within the container.

Why this answer

The awslogs log driver is the native, zero-configuration way to send container stdout/stderr to Amazon CloudWatch Logs from ECS Fargate. By specifying the awslogs log driver and a log group in the task definition, logs are automatically forwarded without any additional agents, code changes, or infrastructure, meeting the requirement for minimal operational overhead.

Exam trap

The trap here is that candidates often overthink the solution and choose Option C (installing the CloudWatch agent) because they are familiar with it from EC2, forgetting that Fargate does not support host-level agents and that the awslogs driver is the built-in, agentless alternative.

How to eliminate wrong answers

Option A is wrong because Amazon Kinesis Data Firehose streams logs to S3, but then sending them to CloudWatch Logs requires an additional Lambda or subscription filter, adding unnecessary complexity and cost; the goal is minimal overhead, not a multi-hop pipeline. Option B is wrong because modifying application code to use the AWS SDK for CloudWatch Logs tightly couples the application to AWS APIs, increases development effort, and violates the principle of keeping logging infrastructure separate from application logic. Option C is wrong because installing the CloudWatch agent inside a Fargate container is not supported—Fargate does not allow running sidecar agents that require host-level access; the awslogs driver handles this at the container runtime level without any agent.

Full explanation →

575

MCQmedium

A company uses AWS CodePipeline with CodeBuild to test and deploy a web application. The pipeline has been failing at the deploy stage with an error: 'Access Denied'. CloudTrail shows the CodePipeline service role is making the call. What is the MOST likely cause?

A.The CodeBuild project does not have internet access.

B.The CodePipeline service role lacks permissions for the deploy action.

C.The deploy provider (e.g., ECS, S3) is not in the same AWS region.

D.The source code repository does not have the correct branch.

AnswerB

An 'Access Denied' error during the deploy stage is a classic indication that the AWS CodePipeline service role lacks the necessary IAM permissions to perform the deployment actions on the target AWS resource. For instance, if deploying to an S3 bucket, the role needs `s3:PutObject` and `s3:GetObject` permissions for the artifact. Without these explicit `Allow` statements in its policy, the service principal is unauthorized to interact with the target service, resulting in the reported access denial.

Why this answer

The error 'Access Denied' in the deploy stage, with CloudTrail showing the CodePipeline service role making the call, indicates that the IAM role assumed by CodePipeline does not have the necessary permissions to perform the deploy action against the target provider (e.g., ECS, S3, Elastic Beanstalk). CodePipeline uses its service role to invoke the deploy action, and if that role lacks the required `codedeploy:*`, `s3:PutObject`, or `ecs:UpdateService` permissions, the API call will be denied.

Exam trap

The trap here is that candidates confuse the CodeBuild service role with the CodePipeline service role, assuming the build role is responsible for deployment, when in fact CodePipeline uses its own role for the deploy action.

How to eliminate wrong answers

Option A is wrong because CodeBuild not having internet access would cause build failures (e.g., cannot download dependencies), not a deploy-stage 'Access Denied' error, and CloudTrail shows the CodePipeline service role, not CodeBuild, is making the call. Option C is wrong because deploy providers can be in different regions (cross-region actions are supported with appropriate IAM and resource policies), and the error is 'Access Denied', not a region mismatch. Option D is wrong because an incorrect source branch would cause the pipeline to fetch the wrong code or fail at the source stage, not produce an 'Access Denied' error at the deploy stage.

Full explanation →

576

MCQmedium

A developer is using AWS CodeBuild to build a Java application. The buildspec.yml file currently runs unit tests. The developer wants to generate a code coverage report and publish it to the CodeBuild console for analysis. Which CodeBuild feature should be used?

A.Test reports

B.Build artifacts

C.Amazon CloudWatch Logs

D.Amazon S3 access logs

AnswerA

AWS CodeBuild's "Test reports" feature is specifically designed to ingest and display structured test results and code coverage metrics directly within the CodeBuild console. By configuring the `reports` section in the `buildspec.yml` to point to test output files (e.g., JUnit XML, JaCoCo XML), CodeBuild processes these files to generate visual reports, including pass/fail rates, test duration, and code coverage percentages, providing immediate feedback on application quality.

Why this answer

AWS CodeBuild's test reports feature allows developers to create reports from test result files, including code coverage reports, and publish them to the CodeBuild console for analysis. This feature supports various report formats such as JaCoCo, Cobertura, and SimpleCov, enabling the developer to visualize coverage metrics directly in the console without external tools.

Exam trap

The trap here is that candidates confuse build artifacts (which store compiled binaries) with test reports (which store structured test and coverage data), or assume CloudWatch Logs can visualize coverage metrics when it only provides raw log text.

How to eliminate wrong answers

Option B is wrong because build artifacts are used to store output files (e.g., JARs, WARs) in Amazon S3 or CodeBuild, not for generating or publishing test or coverage reports. Option C is wrong because Amazon CloudWatch Logs captures build logs and output from CodeBuild runs, but it does not parse or display structured code coverage reports. Option D is wrong because Amazon S3 access logs track requests made to an S3 bucket, not CodeBuild test results or coverage data.

Full explanation →

577

MCQhard

A company uses AWS KMS customer master keys (CMKs) to encrypt sensitive data in Amazon S3. A compliance requirement mandates that the backing keys for the CMKs be automatically rotated every year. The developer must implement this with minimal operational overhead. Which solution meets the requirement?

A.Enable automatic key rotation for the CMK in AWS KMS.

B.Create a new CMK every year and update the S3 bucket policy to use the new key.

C.Use an AWS managed key (aws/s3) which automatically rotates annually.

D.Use SSE-S3 encryption with automatically rotated keys instead of KMS.

AnswerA

Enabling automatic key rotation for a CMK in AWS KMS ensures that the underlying cryptographic material (backing key) used for encryption is replaced annually. This process is transparent to applications, as the CMK's Amazon Resource Name (ARN) and Key ID remain unchanged, allowing existing encrypted data to still be decrypted by the original backing key. This fully automates the compliance requirement for annual key rotation without operational disruption.

Why this answer

AWS KMS supports automatic key rotation for customer managed CMKs. When enabled, KMS automatically rotates the backing key annually (approximately every 365 days) with no additional operational overhead. This satisfies the compliance requirement for yearly rotation without manual intervention.

Exam trap

The trap here is that candidates may confuse AWS managed keys (which rotate automatically but not on a customer-defined schedule) with customer managed CMKs, or assume that manual key rotation is required when automatic rotation is available.

How to eliminate wrong answers

Option B is wrong because manually creating a new CMK each year and updating the S3 bucket policy introduces significant operational overhead and violates the 'minimal operational overhead' requirement. Option C is wrong because AWS managed keys (aws/s3) are automatically rotated, but the rotation schedule is managed by AWS and is not guaranteed to be exactly every year; additionally, the question specifies using customer master keys (CMKs), not AWS managed keys. Option D is wrong because SSE-S3 uses server-side encryption with Amazon S3-managed keys, not AWS KMS CMKs, and the rotation schedule is managed by S3, not the customer, so it does not meet the requirement of using KMS CMKs with annual rotation.

Full explanation →

578

MCQmedium

A company is building a serverless application using AWS Lambda. The application processes messages from an Amazon SQS queue. The Lambda function is idempotent and handles duplicate messages correctly. The company needs to ensure that messages are processed in the order they were sent. Which solution should the company use?

A.Use Amazon SNS to fan out messages to Lambda.

B.Use Amazon Kinesis Data Streams as the event source for Lambda.

C.Configure the Lambda function to poll an SQS standard queue with a batch size of 10.

D.Configure the Lambda function to poll an SQS FIFO queue with a batch size of 1.

AnswerD

Amazon SQS FIFO (First-In, First-Out) queues are specifically engineered to guarantee strict message ordering and exactly-once processing. By configuring the Lambda function to poll a FIFO queue with a batch size of 1, each message is retrieved and processed individually and sequentially. This combination ensures that the processing order by the Lambda function precisely matches the order in which messages were originally sent to the queue, reliably meeting both ordering and exactly-once requirements.

Why this answer

Amazon SQS FIFO queues guarantee first-in, first-out delivery and exactly-once processing, which ensures messages are processed in the order they were sent. By configuring the Lambda function to poll the FIFO queue with a batch size of 1, each message is processed individually, preserving strict ordering without concurrency issues. The Lambda function's idempotency further ensures that any duplicate messages are handled safely, but the FIFO queue's inherent ordering is the key mechanism for maintaining sequence.

Exam trap

The trap here is that candidates often assume a standard SQS queue with a small batch size can maintain order, but standard queues only provide best-effort ordering and can still reorder messages due to retries or distributed processing.

How to eliminate wrong answers

Option A is wrong because Amazon SNS fans out messages to multiple subscribers asynchronously and does not guarantee any ordering; messages can arrive at Lambda in a different order than they were published. Option B is wrong because Amazon Kinesis Data Streams provides ordering within a shard but does not guarantee global ordering across shards, and it is designed for real-time streaming analytics, not for simple message queue processing with strict FIFO semantics. Option C is wrong because an SQS standard queue does not preserve message order; it uses best-effort ordering and can deliver messages out of sequence, even with a batch size of 10, making it unsuitable for ordered processing.

Full explanation →

579

MCQhard

A developer is deploying a serverless application that includes an AWS Lambda function with a dependency on a native library (e.g., a compiled C library). The developer uses AWS SAM. The Lambda function runs correctly in the local development environment but fails with an 'Unable to import module' error when deployed. What is the most likely cause?

A.The Lambda function's IAM role does not have permission to access the library.

B.The Lambda function's handler configuration is incorrect.

C.The native library is compiled for a different operating system than Lambda (Amazon Linux).

D.The Lambda function's timeout is too short.

AnswerC

AWS Lambda execution environments are based on Amazon Linux, requiring any native libraries (e.g., C/C++ compiled into .so files) to be compiled specifically for this operating system and its architecture (x86_64 or arm64). If a library is compiled on a different OS, such as macOS or Windows, or even a different Linux distribution, its binary format and system dependencies will be incompatible. This incompatibility leads to an ImportError when the Lambda runtime attempts to load the shared object, as it cannot resolve the necessary symbols or link against the correct system libraries.

Why this answer

AWS Lambda runs on Amazon Linux, which uses a different kernel and C runtime than typical local development environments (e.g., macOS or Windows). Native libraries compiled for a local OS will not be compatible with Lambda's execution environment, causing the 'Unable to import module' error. The developer must compile the native library on Amazon Linux or use a Lambda-compatible container to ensure binary compatibility.

Exam trap

The trap here is that candidates often confuse IAM permissions with filesystem access, or assume the error is a code-level issue (handler or timeout) rather than recognizing the OS-level binary incompatibility unique to Lambda's Amazon Linux environment.

How to eliminate wrong answers

Option A is wrong because IAM roles control permissions to AWS services and resources, not the ability to import or execute local native libraries within the Lambda runtime. Option B is wrong because the handler configuration (e.g., 'index.handler') is unrelated to native library import failures; a misconfigured handler would produce a 'Handler not found' error, not an import error. Option D is wrong because a timeout error occurs during function execution, not during the initialization/import phase; the 'Unable to import module' error happens before the handler runs.

Full explanation →

580

MCQmedium

A developer is building a serverless application using AWS Lambda functions that process events from Amazon SQS. The developer notices that some messages are being processed multiple times. What is the MOST likely cause of this issue?

A.The Lambda function's reserved concurrency is set too high.

B.The SQS visibility timeout is too short for the Lambda function's execution time.

C.The SQS queue has a dead-letter queue configured.

D.The Lambda function's batch size is set to more than 1.

AnswerB

When an SQS message is received by a Lambda function, it becomes temporarily invisible to other consumers for the duration of the visibility timeout. If the Lambda function's processing time exceeds this timeout, the message will reappear in the queue, becoming available for another Lambda invocation to pick up and process again. This scenario directly leads to duplicate message processing, as the original invocation might still be working on the message while a new one begins.

Why this answer

When an SQS message is processed by a Lambda function, the message becomes invisible to other consumers for the duration of the visibility timeout. If the Lambda function takes longer to process the message than the visibility timeout, SQS makes the message visible again and can deliver it to another consumer (or the same Lambda function in a new invocation), causing duplicate processing. This is the most likely cause of messages being processed multiple times.

Exam trap

The trap here is that candidates may confuse the visibility timeout with the Lambda function timeout or think that increasing concurrency or batch size causes duplicates, when in fact the visibility timeout directly controls the window for duplicate processing.

How to eliminate wrong answers

Option A is wrong because reserved concurrency limits the number of concurrent Lambda executions but does not cause duplicate message processing; it may actually throttle invocations. Option C is wrong because a dead-letter queue is used to capture messages that fail processing after a maximum number of retries, not to cause duplicate processing. Option D is wrong because setting the batch size to more than 1 allows Lambda to process multiple messages in a single invocation, which reduces the chance of duplicates by processing them together, not causing duplicates.

Full explanation →

581

MCQhard

Messages in an SQS queue are processed successfully but later reappear and are processed again. What is the most likely configuration issue?

A.The queue uses long polling

B.The queue has a dead-letter queue

C.The messages are encrypted with SSE-SQS

D.The visibility timeout is shorter than the processing time or messages are not deleted after processing

AnswerD

If the visibility timeout is shorter than the actual time required to process a message, the message will become visible again to other consumers before the initial consumer finishes and deletes it, leading to duplicate processing. Alternatively, if a consumer successfully processes a message but fails to explicitly call the `DeleteMessage` API, the message will remain in the queue and become visible again once its timeout expires, resulting in reprocessing. Both scenarios directly explain why messages might be processed successfully but still reappear.

Why this answer

When a message is processed but not deleted from the SQS queue, or when the visibility timeout expires before processing completes, the message becomes visible again in the queue and can be consumed by another worker. This causes duplicate processing. The correct fix is to ensure the visibility timeout is set longer than the expected processing time and that the message is explicitly deleted after successful processing.

Exam trap

The trap here is that candidates may confuse message reappearance with dead-letter queue behavior, but dead-letter queues only trigger after a configurable number of receive attempts, not after a single successful processing cycle.

How to eliminate wrong answers

Option A is wrong because long polling reduces empty responses and cost by waiting for messages, but does not cause messages to reappear after processing. Option B is wrong because a dead-letter queue captures messages that have failed processing multiple times, not cause reprocessing of successfully handled messages. Option C is wrong because SSE-SQS encrypts messages at rest, which has no effect on message visibility or deletion behavior.

Full explanation →

582

Multi-Selecteasy

Which TWO actions can help reduce Lambda cold start times? (Choose two.)

Select 2 answers

A.Increase the deployment package size.

B.Increase the memory allocated to the function.

C.Use Provisioned Concurrency.

D.Place the function in a VPC.

E.Reduce the function timeout.

AnswersB, C

Lambda allocates CPU proportionally to the amount of memory configured, so more memory means more CPU power available during initialization. This speeds up tasks like loading the runtime, unpacking code, and running static initializers, thereby shortening the cold start duration. It is a practical tuning knob, though it increases cost per invocation.

Why this answer

Increasing memory also increases CPU, which speeds up initialization. Option C is correct because using Provisioned Concurrency keeps environments warm. Option A is incorrect because larger deployment packages increase cold start.

Option D is incorrect because VPC adds network overhead, increasing cold start. Option E is incorrect because reducing the function timeout does not affect cold start time; timeout limits execution duration, not initialization.

Full explanation →

583

MCQmedium

A developer has an AWS Lambda function that processes messages from an Amazon SQS queue. The function is configured with a batch size of 10, reserved concurrency of 5, and a timeout of 5 minutes. The SQS queue has a large backlog, and CloudWatch metrics show high throttling (Throttles) for the Lambda function. The function is idempotent and can process up to 100 messages in a single invocation. What is the MOST effective way to increase throughput without increasing the reserved concurrency?

A.Increase the batch size to 100.

B.Increase the reserved concurrency to 10.

C.Reduce the batch size to 1.

D.Enable the SQS queue to use long polling.

AnswerA

Increasing the batch size for an SQS event source mapping allows each AWS Lambda invocation to process a larger number of messages simultaneously. This significantly reduces the total number of Lambda invocations required to process a given volume of messages, thereby lowering the demand for concurrent executions. By processing more work per invocation, the function is less likely to hit its concurrency limit and experience throttling, effectively optimizing resource utilization without increasing reserved concurrency.

Why this answer

Increasing the batch size to 100 allows each Lambda invocation to process up to 100 messages from the SQS queue instead of the current 10. Since the function is idempotent and can handle 100 messages per invocation, this change maximizes the number of messages processed per invocation without altering the reserved concurrency of 5. With a batch size of 100, each of the 5 concurrent invocations can process up to 100 messages, yielding a potential throughput of 500 messages per invocation cycle, which directly reduces the backlog and throttling by consuming messages faster.

Exam trap

The trap here is that candidates may think increasing reserved concurrency is the only way to improve throughput, but the question explicitly forbids that, and they overlook that increasing the batch size can achieve the same goal by processing more messages per invocation without adding more concurrent executions.

How to eliminate wrong answers

Option B is wrong because increasing reserved concurrency to 10 would increase throughput but directly violates the constraint of not increasing reserved concurrency, and it would also increase the risk of throttling other functions sharing the account concurrency limit. Option C is wrong because reducing the batch size to 1 would drastically decrease throughput, as each invocation would process only one message, requiring more invocations to handle the same backlog and potentially increasing throttling due to more concurrent executions. Option D is wrong because enabling long polling for the SQS queue reduces the number of empty responses and improves efficiency in message retrieval, but it does not increase the number of messages processed per invocation or reduce throttling caused by the Lambda function's concurrency limit.

Full explanation →

584

MCQeasy

A developer is creating a new DynamoDB table to store order data. The orders have a unique order ID and are retrieved by order ID. Occasionally, the developer needs to query orders by customer ID. Which design approach would minimize costs and provide the fastest queries?

A.Use the order ID as the partition key and create a global secondary index on customer ID

B.Use the customer ID as the partition key and order ID as the sort key

C.Use the order ID as the partition key and scan the table for customer ID queries

D.Use the customer ID as the partition key and create a local secondary index on order ID

AnswerA

This design effectively supports two distinct access patterns: retrieving a specific order by its unique order ID using a highly efficient GetItem operation, and querying all orders associated with a particular customer ID. By establishing a Global Secondary Index (GSI) with customer ID as its partition key, DynamoDB can efficiently retrieve all items matching that customer, optimizing performance and minimizing read capacity unit consumption for both primary and secondary query types.

Why this answer

Using the order ID as the partition key ensures the most efficient primary key access for the primary query pattern (retrieving by order ID). Creating a Global Secondary Index (GSI) on customer ID allows efficient querying by customer ID without scanning the base table, and GSIs have separate read/write capacity from the base table, so you only pay for the index when it is used. This design minimizes costs by avoiding unnecessary scans and provides the fastest queries for both access patterns.

Exam trap

The trap here is that candidates often choose Option B (customer ID as partition key) thinking it naturally supports both access patterns, but they overlook the hot partition problem and the fact that retrieving a single order by order ID would require a scan or a query with a known customer ID, which is not always available.

How to eliminate wrong answers

Option B is wrong because using customer ID as the partition key would cause all orders for the same customer to be stored in the same partition, leading to hot partitions and potential throttling, and it does not provide efficient retrieval by order ID (which would require a scan or a query with a known customer ID). Option C is wrong because scanning the entire table to find orders by customer ID is extremely inefficient and costly, as it reads every item in the table and incurs read capacity for all items, even those not matching the query. Option D is wrong because a Local Secondary Index (LSI) requires the same partition key as the base table (customer ID), which would still cause hot partitions for high-volume customers, and LSIs share the base table's read/write capacity, so they do not provide the same cost flexibility as a GSI.

Full explanation →

585

Multi-Selectmedium

A developer is deploying a new microservice on AWS Elastic Beanstalk. The service uses an RDS database. The developer wants to ensure that database credentials are not stored in the application's source code. Which TWO methods should the developer use to securely provide credentials to the application?

Select 2 answers

A.Use AWS Secrets Manager to store and retrieve the credentials at runtime.

B.Store the credentials in a configuration file within the application source code.

C.Use Elastic Beanstalk environment properties to set the credentials.

D.Store the credentials in an encrypted file on an EC2 instance.

E.Store the credentials in an S3 bucket with a public read policy.

AnswersA, C

AWS Secrets Manager is the recommended service for storing and retrieving credentials at runtime. It encrypts secrets at rest with AWS KMS keys, integrates with IAM for fine-grained access control, and supports automatic rotation to reduce the risk of compromised credentials. The application can fetch the secret on startup or on demand using the AWS SDK, eliminating hardcoded values from the codebase and ensuring that the secret is not visible in configuration files or logs.

Why this answer

Options A and C are correct. AWS Secrets Manager allows you to store and automatically rotate database credentials, and retrieve them securely at runtime via API calls, avoiding hardcoding. Elastic Beanstalk environment properties let you set environment variables that the application can read, and these properties can be configured to reference secrets from Secrets Manager (e.g., using the `aws-secrets-manager` namespace).

Option B is incorrect because storing credentials in source code exposes them in version control and is insecure. Option D is incorrect because storing credentials in an encrypted file on an EC2 instance still requires managing the encryption key and is not a recommended practice for Elastic Beanstalk. Option E is incorrect because an S3 bucket with a public read policy makes the credentials publicly accessible, violating security best practices.

Full explanation →

586

MCQhard

A developer is migrating a monolithic application to a microservices architecture on AWS. The application uses a relational database. The developer wants to use Amazon RDS for the database and needs to ensure that each microservice can only access its own set of tables. Which approach should the developer take?

A.Create a single RDS instance with a separate database per microservice.

B.Use RDS with IAM database authentication and create database users with limited privileges for each microservice.

C.Use RDS in a VPC and restrict network access per microservice using security groups.

D.Use Amazon RDS Proxy to control access.

AnswerB

AWS IAM database authentication integrates directly with IAM, allowing microservices to authenticate using IAM roles or users, eliminating the need for hardcoded database credentials. This method enables the creation of highly granular database users with specific permissions (e.g., SELECT on tableA, INSERT on tableB), ensuring each microservice can only access the precise tables and operations it requires. This robust, fine-grained access control is essential for securing a microservices architecture.

Why this answer

IAM database authentication allows the developer to create database users with granular, table-level privileges using standard SQL GRANT statements, ensuring each microservice can only access its own set of tables. By combining IAM roles with database user credentials, the developer can enforce least-privilege access without sharing a single database user across services. This approach directly addresses the requirement for per-microservice table isolation while leveraging RDS's native authentication and authorization capabilities.

Exam trap

The trap here is that candidates often confuse network-level isolation (security groups) with database-level authorization, assuming that restricting network access per microservice is sufficient to enforce table-level separation, when in fact security groups cannot differentiate between tables within the same database instance.

How to eliminate wrong answers

Option A is wrong because creating a separate database per microservice on a single RDS instance does not prevent a microservice from connecting to another microservice's database if it has the same database user credentials or network access; it only provides logical separation, not access control. Option C is wrong because security groups control network-layer access to the RDS instance as a whole, not to individual tables or databases within it; once a microservice can connect to the RDS endpoint, it can access any table unless further database-level permissions are enforced. Option D is wrong because Amazon RDS Proxy manages connection pooling and provides some IAM authentication support, but it does not enforce table-level access control; it still relies on the underlying database user permissions for authorization.

Full explanation →

587

MCQeasy

A development team uses AWS Elastic Beanstalk to deploy a web application. They want to perform a blue/green deployment to minimize downtime. What should they do to implement this?

A.Create an Auto Scaling group and manually replace instances.

B.Update the existing environment with the new version and set the deployment policy to 'Rolling'.

C.Use AWS CodeDeploy to perform a blue/green deployment on the EC2 instances.

D.Create a new environment, deploy the new version, and then swap the environment URLs.

AnswerD

This is the standard blue/green deployment in Elastic Beanstalk.

Why this answer

Blue/green deployment in Elastic Beanstalk is achieved by creating a separate environment (the green environment) with the new application version, then swapping the CNAME records (URLs) of the two environments. This instantly routes traffic from the old (blue) environment to the new (green) environment with zero downtime, and allows quick rollback by swapping back.

Exam trap

The trap here is that candidates confuse the built-in Elastic Beanstalk blue/green deployment (environment swap) with the deployment policies (e.g., Rolling, Immutable) that operate within a single environment, or they incorrectly assume CodeDeploy is the only way to perform blue/green deployments.

How to eliminate wrong answers

Option A is wrong because manually replacing instances in an Auto Scaling group is not a blue/green deployment; it is a manual, error-prone process that does not provide instant traffic switching or easy rollback. Option B is wrong because updating the existing environment with a 'Rolling' deployment policy updates instances in batches within the same environment, which does not create a separate, isolated environment for the new version and still risks partial downtime. Option C is wrong because AWS CodeDeploy is a separate service that can perform blue/green deployments on EC2 instances, but the question specifically asks about using AWS Elastic Beanstalk, which has its own built-in blue/green deployment mechanism via environment URL swaps.

Full explanation →

588

MCQmedium

A developer is troubleshooting an AWS CloudFormation stack that failed to create. The error message says 'The following resource(s) failed to create: [MyEC2Instance]'. What is the first step the developer should take?

A.Update the stack with a new template.

B.Delete the stack and try again.

C.Review the CloudFormation template for syntax errors.

D.View the stack events in the CloudFormation console to see the specific error for the resource.

AnswerD

The CloudFormation console's "Events" tab provides a chronological log of every action taken by the stack, including resource creation attempts, status changes, and, critically, any errors encountered. When a resource fails to create, CloudFormation logs a specific CREATE_FAILED event for that resource, often including the underlying AWS service error message (e.g., "User is not authorized to perform this operation," "The specified S3 bucket already exists"). This detailed information is essential for diagnosing the exact cause of the failure.

Why this answer

When a CloudFormation stack fails to create, the error message only indicates which resource failed, not why. The first troubleshooting step is to view the stack events in the CloudFormation console, which provides detailed error messages for each resource, such as an API call failure, insufficient permissions, or a resource limit exceeded. This allows the developer to diagnose the root cause before making any changes.

Exam trap

The trap here is that candidates often jump to fixing the template or retrying the stack, overlooking that the specific error details are available in the stack events, which is the fastest path to identifying the actual cause.

How to eliminate wrong answers

Option A is wrong because updating the stack with a new template without understanding the failure reason could introduce additional errors or mask the underlying issue. Option B is wrong because deleting the stack and retrying without investigation wastes time and may repeat the same failure if the root cause (e.g., a missing parameter or IAM role) is not addressed. Option C is wrong because syntax errors in the template would typically be caught during validation before stack creation, and the error message specifically indicates a resource creation failure, not a template syntax issue.

Full explanation →

589

MCQhard

A developer wants a Lambda function to process SQS messages in batches but avoid losing the whole batch when only one record fails. Which feature should be enabled?

A.Partial batch response for SQS event source mapping

B.Reserved concurrency of one

C.Maximum message size increase

D.SQS short polling

AnswerA

Partial batch response for SQS event source mapping directly addresses the challenge of handling failures within a batch of messages processed by a Lambda function. When enabled, the Lambda function can return a list of message IDs that failed processing, allowing SQS to only return those specific messages to the queue for retry. This prevents successful messages within the same batch from being reprocessed, significantly improving efficiency, reducing costs, and simplifying error handling logic.

Why this answer

Partial batch response for SQS event source mapping allows the Lambda function to report which messages in a batch failed processing. When enabled, Lambda retries only the failed messages instead of the entire batch, preventing successful messages from being reprocessed or lost. This is achieved by returning a `batchItemFailures` array in the function's response, which tells Lambda which message IDs to retry.

Exam trap

The trap here is that candidates may confuse partial batch response with SQS dead-letter queues or retry policies, but the key differentiator is that partial batch response is a Lambda event source mapping feature that specifically allows per-message failure handling within a batch.

How to eliminate wrong answers

Option B is wrong because reserved concurrency of one limits the Lambda function to a single concurrent execution, which does not affect how individual messages within a batch are handled; it only throttles overall throughput. Option C is wrong because maximum message size increase is a queue-level setting in SQS that controls the maximum payload size (up to 256 KB for standard queues), not a mechanism for handling partial batch failures. Option D is wrong because SQS short polling returns immediately with available messages but does not provide any per-message failure handling within a batch; it only affects message retrieval latency.

Full explanation →

590

MCQeasy

A developer is deploying a web application on AWS Elastic Beanstalk. The application needs to run on multiple instances behind a load balancer. Which deployment policy will cause the LEAST downtime?

A.All at once

B.Rolling

C.Rolling with additional batch

D.Immutable

AnswerC

Zero downtime.

Why this answer

Rolling with additional batch (C) is the correct deployment policy for minimizing downtime because it first launches a full new batch of instances in addition to the existing ones, then shifts traffic to the new instances before terminating the old ones. This ensures that the full capacity remains available throughout the deployment, unlike other policies that temporarily reduce capacity or require a full replacement.

Exam trap

The trap is that candidates often assume immutable deployments cause the least downtime. Immutable deployments provide zero downtime by launching a new set of instances and swapping the CNAME atomically, but they require creating a full new environment and use more resources. Rolling with additional batch also provides zero downtime by adding extra capacity before removing old instances, ensuring full capacity is maintained throughout the deployment.

The key distinction is that rolling with additional batch avoids downtime without requiring a full new environment, while all-at-once and rolling deployments can temporarily reduce capacity or cause interruption.

How to eliminate wrong answers

Option A (All at once) is wrong because it replaces all instances simultaneously, causing complete downtime during the deployment window. Option B (Rolling) is wrong because it updates instances in batches, temporarily reducing capacity by the batch size during each update cycle, which can cause partial downtime if traffic exceeds remaining capacity. Option D (Immutable) is wrong because although it creates a new Auto Scaling group and swaps traffic, the old instances are terminated only after the new ones are healthy, but the initial launch of the new group takes time and the swap can cause a brief traffic interruption if not managed with DNS or health checks.

Full explanation →

591

MCQhard

A company runs a containerized application on Amazon ECS with Fargate launch type. The application needs to access an Amazon RDS MySQL database using credentials stored in AWS Secrets Manager. The ECS task role has the following IAM policy: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["secretsmanager:GetSecretValue"],"Resource":"arn:aws:secretsmanager:us-east-1:123456789012:secret:prod-db-*"}]}. The application fails to retrieve the secret with an AccessDeniedException. What is the most likely cause?

A.The task execution role does not have permission to retrieve the secret.

B.The secret's resource-based policy denies access to the task role.

C.The task is in a private subnet without a VPC endpoint to Secrets Manager.

D.The secret name does not match the pattern in the policy.

AnswerB

AWS Secrets Manager supports resource-based policies, which are attached directly to the secret itself and specify which principals (like an ECS Task Role) are allowed or denied access. Even if the ECS Task Role has an identity-based policy that explicitly grants permission to retrieve secrets, an explicit Deny statement in the secret's resource-based policy will always override any Allow statements, effectively blocking access for the task role. This provides a powerful mechanism for fine-grained access control at the resource level.

Why this answer

The IAM policy on the ECS task role allows access to secrets matching the pattern `prod-db-*`. However, if the secret has a resource-based policy that explicitly denies access to the task role, that denial overrides the IAM allow, causing an AccessDeniedException. AWS Secrets Manager evaluates both identity-based policies (task role) and resource-based policies, and an explicit deny in either results in denial.

Exam trap

The trap here is that candidates confuse the task execution role with the task role, or assume network connectivity issues (VPC endpoints) are the cause when the error is clearly an IAM permissions denial.

How to eliminate wrong answers

Option A is wrong because the task execution role is used to pull container images and write logs, not to retrieve secrets; the task role (which has the policy shown) is used for application-level API calls like GetSecretValue. Option C is wrong because while a VPC endpoint can improve network connectivity, it is not required for Fargate tasks to reach Secrets Manager over the public internet or via NAT gateway; the error is an AccessDeniedException, not a network timeout. Option D is wrong because the secret name matches the pattern `prod-db-*` in the policy; the error is an access denial, not a resource mismatch.

Full explanation →

592

MCQhard

A developer is investigating why an AWS Lambda function is not writing logs to CloudWatch Logs. The function has been invoked multiple times, but the log group shows 0 stored bytes. What is the most likely cause?

A.The CloudWatch Logs log group does not exist.

B.The Lambda execution role lacks permissions to write to CloudWatch Logs.

C.The Lambda function is failing before any logging code is executed.

D.The Lambda function is configured to use a different log group name.

AnswerB

For an AWS Lambda function to successfully send its runtime logs and any application-specific output (e.g., from `console.log`) to CloudWatch Logs, its associated IAM execution role must possess specific permissions. Crucially, these include `logs:CreateLogStream` to create a new log stream within the log group and `logs:PutLogEvents` to send log data to that stream. Without these explicit permissions, the function will execute, but its logging attempts will silently fail, resulting in no log entries appearing in CloudWatch.

Why this answer

The most likely cause is that the Lambda execution role lacks the necessary IAM permissions to write logs to CloudWatch Logs. Without permissions such as `logs:CreateLogGroup`, `logs:CreateLogStream`, and `logs:PutLogEvents`, the Lambda function cannot create the log group or stream, nor can it write log events, resulting in 0 stored bytes despite successful invocations.

Exam trap

The trap here is that candidates assume a missing log group (Option A) is the root cause, when in fact the log group is automatically created if the IAM permissions are correct, making the permission issue the more fundamental problem.

How to eliminate wrong answers

Option A is wrong because the log group is automatically created by the Lambda service on the first invocation if the execution role has the required permissions; its absence is a symptom, not the root cause. Option C is wrong because if the function were failing before any logging code, the Lambda runtime itself would still attempt to write execution logs (e.g., START, END, REPORT messages) to CloudWatch, which would produce stored bytes. Option D is wrong because the log group name is predetermined by the Lambda service (e.g., /aws/lambda/<function-name>) and cannot be changed by the developer; a different log group name would not prevent logs from being written to the default group.

Full explanation →

593

MCQeasy

A developer is using AWS Lambda to process messages from an Amazon SQS queue. The function needs to access an Amazon DynamoDB table. What is the MOST secure way to grant the Lambda function access to DynamoDB?

A.Use the Lambda function's execution role to grant full administrative access to DynamoDB.

B.Store the AWS access key and secret access key as environment variables in the Lambda function.

C.Assign an IAM role to the Lambda function with a policy that grants the required DynamoDB permissions.

D.Create an IAM user with DynamoDB access and use its credentials in the Lambda function.

AnswerC

Assigning an IAM role to the Lambda function with a precisely scoped policy is the secure and recommended method for granting AWS service permissions. This approach leverages temporary credentials automatically managed by AWS, eliminating the need to store static access keys. The IAM policy can be crafted to adhere strictly to the principle of least privilege, allowing the function only the specific DynamoDB actions (e.g., dynamodb:PutItem, dynamodb:GetItem) on designated resources it requires to perform its task.

Why this answer

AWS Lambda uses an IAM execution role to securely obtain temporary credentials via the AWS Security Token Service (STS). By attaching a policy that grants only the required DynamoDB actions (e.g., GetItem, PutItem) on specific tables, you follow the principle of least privilege. This avoids hardcoding long-term credentials and eliminates the risk of credential exposure.

Exam trap

The trap here is that candidates may think storing credentials as environment variables is acceptable for simplicity, but the exam emphasizes that IAM roles with least-privilege policies are the most secure and AWS-recommended approach for granting permissions to AWS services like Lambda.

How to eliminate wrong answers

Option A is wrong because granting full administrative access (e.g., dynamodb:* on all resources) violates least privilege and could allow unintended actions like deleting tables. Option B is wrong because storing AWS access keys and secret access keys as environment variables exposes long-term credentials in plaintext, increasing the risk of leakage through logs or function output. Option D is wrong because creating an IAM user and embedding its credentials in the function requires managing long-term keys, which is less secure than using an execution role that automatically rotates temporary credentials.

Full explanation →

594

MCQmedium

A developer is using Amazon SQS to decouple microservices. The consumer service processes messages from the queue. To reduce processing time, the developer wants to receive multiple messages in a single API call. What is the maximum number of messages that can be received at once?

A.5

B.100

C.20

D.10

AnswerD

This is the correct maximum value for the `MaxNumberOfMessages` parameter when calling the SQS `ReceiveMessage` API. Amazon SQS allows consumers to retrieve up to 10 messages in a single batch, which helps reduce the number of API calls, minimize network overhead, and improve overall processing efficiency for microservices. Requesting 10 messages optimizes throughput while adhering to the service's defined limits.

Why this answer

Amazon SQS allows a consumer to retrieve up to 10 messages in a single ReceiveMessage API call. This is the hard limit enforced by the SQS service, regardless of the queue type (standard or FIFO). Using this maximum batch size can reduce the number of API calls and improve throughput, but each message must still be processed individually and deleted after processing.

Exam trap

The trap here is confusing the SQS ReceiveMessage batch limit (10) with the SQS SendMessageBatch limit (10) or the Lambda event source mapping batch size (up to 10,000), leading candidates to pick 5, 20, or 100.

How to eliminate wrong answers

Option A is wrong because 5 is the maximum number of messages that can be sent in a single SendMessageBatch API call, not received. Option B is wrong because 100 is the maximum number of messages that can be sent or received in a single batch for Amazon SNS or Kinesis, but SQS limits ReceiveMessage to 10. Option C is wrong because 20 is the maximum batch size for AWS Lambda event source mappings when polling an SQS queue, not the limit for a single ReceiveMessage API call.

Full explanation →

595

Multi-Selecthard

A developer is designing a microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. Which TWO options can the developer use for service discovery?

Select 2 answers

A.AWS Cloud Map

B.AWS Global Accelerator

C.Amazon ECS Service Connect

D.Amazon Route 53 private hosted zones

E.Application Load Balancer internal

AnswersA, C

AWS Cloud Map is a fully managed service discovery solution that lets you register application resources—such as ECS tasks, EKS pods, and on-premises instances—with logical service names and automatically discover their current locations via DNS queries or HTTP API calls. It updates the registry as instances scale up/down or become unhealthy, providing dynamic, real-time endpoint resolution. For a microservices architecture, Cloud Map is the correct choice because it gives you a custom namespace (e.g., 'backend.internal') and allows services to find each other without hard-coded IPs, while also supporting health checks to filter out unhealthy instances.

Why this answer

AWS Cloud Map provides DNS-based service discovery for microservices. Option C is correct because Amazon ECS Service Connect is a native ECS feature that simplifies service discovery and connectivity within ECS tasks. Option B is incorrect because AWS Global Accelerator improves global traffic routing, not service discovery.

Option D is incorrect because Amazon Route 53 private hosted zones are used for custom domain names within a VPC, not for dynamic service discovery in ECS. Option E is incorrect because an internal Application Load Balancer is used for load balancing, not service discovery.

Full explanation →

596

MCQhard

A company is designing a multi-account strategy using AWS Organizations. They want to enable cross-account access for developers using IAM roles. Each developer has an IAM user in the 'developers' account. The 'production' account has an IAM role 'AdminRole' that can be assumed by the 'developers' account. Which trust policy should be attached to 'AdminRole'?

A.{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"},"Action":"sts:AssumeRole"}]} where 123456789012 is the developers account ID.

B.{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"ec2.amazonaws.com"},"Action":"sts:AssumeRole"}]}

C.{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/*"},"Action":"sts:AssumeRole"}]}

D.{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:role/AdminRole"},"Action":"sts:AssumeRole"}]}

AnswerA

The root user of the account is used to allow all IAM users/roles in that account to assume the role.

Why this answer

The trust policy on the 'AdminRole' in the production account must allow the entire 'developers' account (using its root ARN) to assume the role. When an IAM user in the developers account calls sts:AssumeRole, AWS evaluates the trust policy; specifying the root ARN of the developers account (arn:aws:iam::123456789012:root) delegates trust to the entire account, and the individual user's permissions are then controlled by an IAM policy attached to the user or a group that grants sts:AssumeRole for this role.

Exam trap

The trap here is that candidates often confuse the trust policy's Principal with the resource being accessed, mistakenly specifying the role's own ARN (Option D) or limiting to specific users (Option C), instead of using the root ARN of the trusted account to allow any authorized entity in that account to assume the role.

How to eliminate wrong answers

Option B is wrong because it specifies a Service principal (ec2.amazonaws.com), which is used for AWS services like EC2 to assume a role, not for cross-account IAM users. Option C is wrong because it restricts the principal to IAM users with a wildcard (arn:aws:iam::123456789012:user/*), which would not allow IAM roles or the root account to assume the role, and also does not cover cases where the developer might be using an IAM role in the developers account. Option D is wrong because it specifies the ARN of the AdminRole itself as the principal, which would create a self-referential trust policy that does not grant access to any external account; the principal must be the trusted account's root or specific IAM entities.

Full explanation →

597

MCQmedium

A company has a Lambda function that processes records from an SQS queue. The function is failing intermittently with timeout errors. The processing time per record varies, but the SQS queue has a visibility timeout of 30 seconds. The Lambda function has a timeout of 1 minute. What is the MOST likely cause of the timeout errors?

A.The Lambda function's reserved concurrency is set too low.

B.The SQS queue has too many messages causing Lambda to throttle.

C.The SQS visibility timeout is shorter than the Lambda function timeout.

D.The SQS queue's default visibility timeout of 30 seconds is too long.

AnswerC

If the SQS visibility timeout is configured to be shorter than the Lambda function's execution timeout, a message being processed by Lambda can become visible again in the queue before the function successfully completes its work. This scenario can lead to other Lambda instances, or even the same one, picking up and attempting to process the identical message again. Such duplicate processing can cause resource contention, unexpected behavior, and ultimately result in the original or subsequent Lambda invocations timing out as they struggle to complete the task or handle redundant operations.

Why this answer

When the SQS visibility timeout (30 seconds) is shorter than the Lambda function timeout (1 minute), the message becomes visible again in the queue before the function finishes processing it. This causes the same message to be picked up by another consumer (or the same Lambda invocation) while the original invocation is still running, leading to duplicate processing and eventual timeout errors as the function repeatedly attempts to process the same record.

Exam trap

The trap here is that candidates often confuse timeout errors with throttling or concurrency issues, but the specific interplay between SQS visibility timeout and Lambda function timeout is a classic DVA-C02 pitfall that tests understanding of asynchronous message processing lifecycle.

How to eliminate wrong answers

Option A is wrong because reserved concurrency limits the maximum number of concurrent Lambda executions, but timeout errors are not caused by concurrency limits—they occur when the function execution exceeds its configured timeout. Option B is wrong because Lambda throttling occurs when the number of concurrent invocations exceeds the account or function concurrency limit, not from too many messages in the queue; throttling results in invocation failures (e.g., 429 errors), not timeout errors within the function. Option D is wrong because a 30-second visibility timeout is not too long; in fact, it is too short relative to the Lambda timeout, causing premature message reappearance—a longer visibility timeout would help prevent the issue.

Full explanation →

598

MCQhard

A company uses AWS Lambda to process sensitive data. The Lambda function needs to access an RDS database with a password stored in AWS Secrets Manager. The function currently retrieves the secret using the AWS SDK. What is the best practice to secure this setup?

A.Configure the Lambda function to use IAM database authentication for RDS.

B.Store the password as a Lambda environment variable encrypted with KMS.

C.Use the AWS CLI within the Lambda function to fetch the secret each time.

D.Rotate the secret daily using Secrets Manager and cache it in Lambda.

AnswerA

Configuring the Lambda function to use IAM database authentication for RDS is the most secure and recommended approach. This method allows the Lambda function to connect using its execution role, generating short-lived, temporary authentication tokens instead of relying on static usernames and passwords. It eliminates the need to store or manage long-term database credentials, significantly enhancing security by leveraging AWS IAM's robust permission model and automatic credential rotation.

Why this answer

IAM database authentication eliminates the need to store or retrieve a password entirely. The Lambda function assumes an IAM role that generates a temporary authentication token (valid for 15 minutes) using the AWS SDK, which is then used to connect to RDS via TLS. This approach follows the principle of least privilege and removes the risk of static credentials being exposed or misused.

Exam trap

The trap here is that candidates assume Secrets Manager is always the best practice for secrets, but the question specifically asks for the best practice to secure the setup, and IAM authentication removes the secret entirely, which is more secure than any secret management approach.

How to eliminate wrong answers

Option B is wrong because storing the password as a Lambda environment variable, even if encrypted with KMS, still introduces a static secret that could be exposed through logs, error messages, or function configuration views. Option C is wrong because using the AWS CLI within a Lambda function is inefficient (adds cold-start latency and dependency on the CLI binary) and still requires the function to handle the secret in memory, whereas the SDK is the recommended method. Option D is wrong because daily rotation and caching in Lambda does not address the fundamental risk of a static password; the secret still exists and could be compromised, whereas IAM authentication removes the password entirely.

Full explanation →

599

MCQmedium

A company stores sensitive documents in an Amazon S3 bucket. The security team requires that all objects uploaded must be encrypted at rest using a specific customer-managed AWS KMS key (key-id: 1234-5678). The developer must enforce this by denying any PutObject request that does not use the correct key. Which S3 bucket policy condition should be used?

A.s3:x-amz-server-side-encryption with value 'aws:kms'

B.s3:x-amz-server-side-encryption-aws-kms-key-id with value 'arn:aws:kms:us-east-1:123456789012:key/1234-5678'

C.s3:x-amz-acl with value 'bucket-owner-full-control'

D.aws:SourceArn with value the bucket ARN

AnswerB

The `s3:x-amz-server-side-encryption-aws-kms-key-id` condition directly enforces the use of a specific AWS KMS key by comparing its ARN against the value provided in the S3 PUT object request header. This precise condition ensures that only objects encrypted with the designated customer-managed key (CMK) are successfully uploaded to the bucket. It provides the granular control necessary to meet strict compliance requirements for sensitive data, ensuring data at rest is secured with an auditable, pre-approved key.

Why this answer

The condition key `s3:x-amz-server-side-encryption-aws-kms-key-id` allows you to enforce that a specific customer-managed AWS KMS key (identified by its full ARN) is used for server-side encryption. By denying PutObject requests that do not match this key ID, the security team ensures all uploaded objects are encrypted at rest with the required KMS key.

Exam trap

The trap here is that candidates often confuse `s3:x-amz-server-side-encryption` (which only checks if SSE-KMS is enabled) with `s3:x-amz-server-side-encryption-aws-kms-key-id` (which checks the specific key ID), leading them to pick Option A, which does not enforce the required customer-managed key.

How to eliminate wrong answers

Option A is wrong because `s3:x-amz-server-side-encryption` with value `aws:kms` only enforces that SSE-KMS is used, but does not restrict which KMS key is used; any KMS key (including default AWS-managed keys) would satisfy the condition. Option C is wrong because `s3:x-amz-acl` with value `bucket-owner-full-control` controls access permissions via ACLs, not encryption requirements, and is irrelevant to enforcing encryption key usage. Option D is wrong because `aws:SourceArn` is used to restrict requests based on the source ARN (e.g., to prevent cross-service confused deputy attacks), not to enforce encryption key selection.

Full explanation →

600

Multi-Selecteasy

Which TWO of the following are best practices for securing AWS account root user?

Select 2 answers

A.Delete the root user access keys.

B.Use the root user for daily administrative tasks.

C.Set a password policy that locks the root user after 10 failed attempts.

D.Share the root user password with senior developers for emergencies.

E.Enable multi-factor authentication (MFA) for the root user.

AnswersA, E

Root user access keys are permanent long-term credentials with unrestricted privileges across the account, including billing and even account closure. They cannot be constrained by IAM policies or permission boundaries, so if they are compromised, the attacker gains full control without any possibility of mitigating the scope. AWS best practice is to never create root access keys, and if they already exist, delete them immediately and rely on password plus MFA for the rare root sign-in.

Why this answer

Deleting root user access keys prevents unauthorized use via programmatic access. Option E is correct: Enabling MFA adds an extra layer of security. Option B is incorrect because the root user should not be used for daily tasks; use IAM users instead.

Option C is incorrect because AWS does not automatically lock the root user after failed attempts. Option D is incorrect because sharing the root user password is a security risk.

Full explanation →

AWS Certified Developer Associate DVA-C02 (DVA-C02) — Questions 526–600