CCNA Development with AWS Services Questions

Option B is correct because Amazon EFS provides shared file storage for multiple EC2 instances. Option A is wrong because EBS volumes can only be attached to one instance. Option C is wrong because S3 is object storage.

Option D is wrong because DynamoDB is a NoSQL database.

Option C is correct because AWS Cloud Map provides service discovery, AWS AppConfig manages application configuration, and AWS Secrets Manager securely stores secrets. Option A uses Systems Manager Parameter Store for configuration, but AppConfig is more feature-rich for config management. Option B uses Service Discovery (AWS Cloud Map) but EC2 Image Builder is for creating AMIs, not config.

Option D uses ECS Service Discovery (part of Cloud Map) but Config is for resource compliance, not configuration management.

Correct: D. CloudFormation stack updates can automatically roll back on failure if the stack's RollbackConfiguration is set. CodePipeline does not automatically roll back; it stops on failure.

Option A is wrong because CodePipeline does not have a built-in rollback action. Option B is wrong because CodeDeploy is for EC2/ECS, not CloudFormation. Option C is wrong because the stack policy does not control rollback behavior.

Option D is correct because using Fn::GetAtt to retrieve the ARN of the DLQ resource within the same template avoids hardcoding. Option A is wrong because Fn::ImportValue is for cross-stack references, not needed here. Option B is wrong because Ref returns the queue URL, not the ARN.

Option C is wrong because Fn::Sub is a string substitution function, but you still need to reference the resource attribute correctly.

Option A is correct. RDS Proxy manages connection pooling and reduces the number of open connections to the database, thus preventing connection exhaustion without code changes. Option B is wrong because increasing the max_connections setting only postpones the problem and may cause resource contention.

Option C is wrong because Multi-AZ is for high availability, not connection management. Option D is wrong because switching to Aurora with Auto Scaling does not address the connection leak issue and requires migration effort.

Option C is correct because API Gateway supports custom authorizers that can validate OAuth tokens. Option A is wrong because IAM auth is for AWS credentials. Option B is wrong because Cognito User Pools can be used but the question specifies external provider.

Option D is wrong because Lambda authorizer is the custom authorizer type.

A, C, and E are correct. Using environment variables for configuration (A) avoids hardcoding secrets. Encrypting environment variables with KMS (C) protects them at rest.

Using a VPC (E) isolates the function. Option B (IAM roles) is already required for permissions, not an additional action. Option D (CloudTrail) is for auditing, not direct security of the function.

Options A, C, and E are correct. Lambda scales by creating new instances up to the reserved concurrency limit. Provisioned concurrency keeps instances warm.

The burst concurrency limit applies per region. Option B is wrong because reserved concurrency limits max concurrency, not guarantees. Option D is wrong because provisioned concurrency does not reduce cold starts for unreserved instances.

Option C is correct because S3 Glacier Instant Retrieval is for long-lived, rarely accessed data that requires millisecond retrieval, but with a retrieval cost. Option A is wrong because S3 Standard is for frequently accessed data. Option B is wrong because S3 Intelligent-Tiering is for unknown or changing access patterns.

Option D is wrong because S3 One Zone-IA is for infrequent access but less durable.

Correct: D. The Deny statement explicitly denies all s3 actions on the secret/ prefix. Even though the Allow statement allows PutObject on the bucket, the explicit Deny overrides it.

Option A is wrong because Deny takes precedence. Option B is wrong because it's denied. Option C is wrong because the Deny is not conditional.

The correct answer is B. AWS AppConfig is designed to manage application configuration data and supports feature flags and dynamic configuration. Option A is wrong because Systems Manager Parameter Store is also suitable but AppConfig is more specialized for this use case.

However, according to best practices, AppConfig is the recommended service for application configuration. Option C is wrong because DynamoDB is a database, not a configuration store. Option D is wrong because S3 is object storage with higher latency.

Option D is correct because 'aws deploy get-deployment-instance' provides detailed information about a specific instance deployment. Option A is wrong because 'list-deployment-instances' only lists IDs. Option B is wrong because 'get-deployment' gives overall deployment info.

Option C is wrong because 'list-deployments' lists deployments.

Option C is correct because increasing the Lambda timeout is the simplest and most cost-effective way to handle longer processing times. Option A is wrong because Step Functions add cost and complexity. Option B is wrong because Lambda functions cannot run longer than 15 minutes.

Option D is wrong because provisioned concurrency is for reducing cold starts, not for extending timeout.

Option B is correct because ElastiCache for Redis provides an in-memory data store that is ideal for session management, offering low latency and high throughput. Option A is wrong because S3 is for object storage, not low-latency session storage. Option C is wrong because RDS is a relational database, which is slower for session data.

Option D is wrong because DynamoDB is a NoSQL database but is not as fast as in-memory caching for session state.

Option B is correct because enabling caching for the authorizer allows API Gateway to reuse the policy for subsequent requests within the TTL. Option A is wrong because increasing Lambda memory may reduce latency but not as effectively as caching. Option C is wrong because using a custom authorizer with a simple response does not address latency.

Option D is wrong because reducing the TTL would increase calls to the authorizer, increasing latency.

Option D is correct because Lambda concurrent execution limits can cause throttling, leading to 503 errors. Increasing the limit provides more capacity. Option A is wrong because Lambda timeout errors cause 504, not 503.

Option B is wrong because API Gateway throttling (default 10,000 rps) is usually not the cause at low rates. Option C is wrong because memory increase helps performance but not concurrency limits.

Option A, B, and D are correct. The AWS SDK automatically retries with exponential backoff (A). The developer can also implement custom retry logic (B).

DLQ helps capture failed events (D). Option C (reserved capacity) does not implement retry. Option E (SQS) is not needed for this scenario.

Options A, B, and D are correct. The bucket policy must grant access to the other account's user or role. The user in the other account must have permissions via IAM.

The IAM role in the source account can be used for cross-account access. Option C is wrong because ACLs are legacy and not recommended. Option E is wrong because VPC endpoint is for network connectivity, not cross-account access.

Option C is correct because increasing the Lambda memory allocation also increases allocated CPU, which directly helps CPU-bound functions. Option A is wrong because increasing batch size does not help CPU-bound tasks. Option B is wrong because Provisioned Concurrency does not reduce execution time.

Option D is wrong because changing to a different runtime may not address the CPU limitation.

Option B is correct because the artifacts section in buildspec.yml uses the 'files' key (not 'file') to specify which files are build artifacts. Option A is wrong because 'file' is not a valid key. Option C is wrong because 'path' is not a key in the artifacts section; it's a property of the 'files' list.

Option D is wrong because 'base-directory' is misspelled and the structure is incorrect.

Option C is correct because the best practice is to attach an IAM role to the Lambda function with the required permissions. This avoids hardcoding credentials. Option A is incorrect because storing credentials in environment variables is not secure.

Option B is incorrect because Lambda does not use access keys in IAM users; it uses roles. Option D is incorrect because the Lambda function should have least privilege, not full admin access.

Option C is correct because Fn::ImportValue imports exported outputs from another stack. Option A is wrong because Fn::GetAtt only works within the same stack. Option B is wrong because Fn::Ref returns a single value.

Option D is wrong because nested stacks are more complex.

Options A and B are correct. Option A: API Gateway must return CORS headers. Option B: The Lambda function must handle the OPTIONS method.

Option C is wrong because CORS is not disabled by default; it must be explicitly enabled. Option D is wrong because the Lambda function does not need to return CORS headers; API Gateway adds them. Option E is wrong because custom domain is not related to CORS.

Options A, B, and D are correct. Option A: The Lambda function needs the execute-api:ManageConnections permission to post to connections. Option B: The callback URL is used to send messages to clients.

Option D: The connection ID is obtained from the event object. Option C is wrong because the WebSocket URL is not needed for posting; the callback URL is derived from the API endpoint. Option E is wrong because DynamoDB is not required for sending messages; it's optional for persistence.

Option C is correct because the Lambda function needs kms:Decrypt permission for the specific KMS key used for S3 SSE-KMS encryption. Option A is wrong because s3:GetObject without kms:Decrypt would fail if the object is encrypted with SSE-KMS. Option B is wrong because kms:GenerateDataKey is used for client-side encryption, not decryption.

Option D is wrong because kms:Encrypt is for encryption, not decryption.

A StatusCode 200 indicates that Lambda accepted the invocation and ran the function without a runtime error. However, the function might have a logical error, incorrect business logic, or might be returning unexpected data. The developer should check the function's logs in CloudWatch Logs to see the actual output and any debug messages.

The payload format might also be incorrect, but the invocation succeeded technically. The function's memory or timeout settings might cause issues but would typically result in an error. The IAM role might be insufficient but would show an error in logs.

Options B and C are correct. Amazon SQS provides message queuing for decoupling. Amazon SNS enables pub/sub messaging.

Option A is wrong because ELB is for load balancing traffic to a single service. Option D is wrong because CloudWatch is for monitoring. Option E is wrong because Route 53 is DNS.

CodeBuild can be configured with a buildspec file that defines phases, including a 'post_build' phase for running tests. If the tests fail, CodeBuild returns a non-zero exit code, causing the build to fail. CodePipeline will then stop and not proceed to the deploy stage.

The developer can also use a 'test' action in CodePipeline with a test provider like CodeBuild. The other options either don't stop the pipeline or are not automated.

Option A is correct because filter expressions are applied after the scan retrieves the items, so all 10,000 items were scanned but none matched the filter. Option B is wrong because the scan returns up to 1 MB of data, not a fixed number of items, and the filter is applied after. Option C is wrong because the filter expression is syntactically correct.

Option D is wrong because the filter expression is applied after scanning, not before.

Option D is correct because Elastic Beanstalk can pass environment properties securely by storing them in the EB environment configuration, and they can be retrieved at runtime. Option A is wrong because hardcoding in environment variables in the EB console is not secure; they can be seen in the console. Option B is wrong because storing credentials in S3 and downloading them adds complexity and potential exposure.

Option C is wrong because Secrets Manager is a good practice, but Elastic Beanstalk can inject secrets as environment properties without custom code.

Option D is correct because AWS Secrets Manager provides automatic rotation, encryption at rest, and integration with ECS for secure retrieval. Option A (Parameter Store with KMS) does not support automatic rotation. Option B (Secrets Manager with Lambda rotation) is essentially correct but the Lambda function is needed for custom rotation; however, Secrets Manager can manage rotation automatically with built-in rotation for AWS services.

Option C (EC2 Systems Manager) is not for secrets management.

FunctionError: Unhandled means the function threw an exception. Option C is correct. Option A is wrong because StatusCode 200 indicates invocation succeeded but function failed.

Option B is wrong because function did execute. Option D is wrong because response is not an error from CLI.

Option A is correct because using a Lambda authorizer caches the policy and reduces latency for subsequent requests. Option B is wrong because request validation only checks format, not token validity. Option C is wrong because it adds a separate validation step in the integration.

Option D is wrong because VPC Link is for private integrations, not token validation.

Option B is correct because the policy grants only the necessary S3 actions (PutObject) on the specific bucket. Option A is wrong because it grants all S3 actions. Option C is wrong because it grants s3:* which is too broad.

Option D is wrong because it grants read-only access, not write.

Option B is correct because a resource policy on API Gateway can restrict access to a VPC. Option E is correct because a VPC endpoint for API Gateway allows API Gateway to receive traffic from the VPC privately. Option A is wrong because Lambda VPC configuration is for the function's access to VPC resources, not for API Gateway.

Option C is wrong because a VPC endpoint for Lambda is not needed for API Gateway access. Option D is wrong because an API key is for authentication, not network restriction.

Option B is correct because ElastiCache (Memcached or Redis) is a managed in-memory cache suitable for session state. Option A is wrong because S3 is not designed for low-latency session storage. Option C is wrong because DynamoDB can be used but is not as fast for session state.

Option D is wrong because RDS adds latency and cost for session data.

Option C is correct because caching the secret outside the handler reduces latency and cost. Option A is wrong because it does not cache. Option B is wrong because environment variables are not secure for secrets.

Option D is wrong because SSM Parameter Store is not the best practice for secrets; Secrets Manager is preferred.

Option A is correct because adding an RDS Proxy reduces connection management overhead and can improve latency. Option B is wrong because scaling EC2 instances does not help database performance. Option C is wrong because ElastiCache requires application changes.

Option D is wrong because increasing instance size helps but may be costly and not address connection pooling.

Options B and D are correct. Adding a random prefix to the partition key distributes writes across partitions. Using DynamoDB Accelerator (DAX) reduces read load.

Option A is wrong because increasing read capacity does not solve hot partition issue. Option C is wrong because global secondary indexes do not reduce throttling on the base table. Option E is wrong because disabling auto scaling may worsen throttling.

Options A, B, and D are correct. Option A sets up a log group. Option B configures the IAM role for API Gateway to write logs.

Option D enables access logging. Option C is not required because Lambda function logs are separate. Option E is not required because Lambda execution role is for Lambda, not API Gateway logging.

Option B is correct because initializing the DynamoDB client outside the handler allows it to be reused across invocations, improving performance. Option A is incorrect because creating a new client for each invocation adds overhead. Option C is incorrect because using a global variable for the table name is fine, but the client should be initialized outside.

Option D is incorrect because using a static variable in Java achieves the same effect as initializing outside the handler.

S3 Glacier Deep Archive is the lowest cost for long-term archival with retrieval times of 12 hours. S3 Standard is expensive for long retention. S3 Intelligent-Tiering automatically moves to lower cost tiers, but still incurs monitoring fees.

S3 One Zone-Infrequent Access is not highly available across AZs.

B and D are correct. The Lambda function needs an event source mapping (B) and the execution role needs permissions to poll the queue (D). Option A is wrong because SQS does not need a resource-based policy for the same account.

Option C is wrong because DLQ is optional. Option E is wrong because VPC is not required.

Options A, B, and D are correct. CloudWatch Logs shows error details; IAM permissions are often the cause; network connectivity is required for Lambda to reach the database. Option C is wrong because KMS key rotation is not related.

Option E is wrong because VPC flow logs show network traffic but not Lambda errors.

Option D is correct because S3 Event Notifications can trigger Lambda asynchronously and support retry. Option A is wrong because API Gateway is for synchronous requests. Option B is wrong because Step Functions is an orchestrator, not a trigger.

Option C is wrong because SQS requires a Lambda function to poll; S3 does not directly send to SQS.

Option D is correct because ElastiCache provides a managed, external cache for session state that persists independently of EC2 instances. Option A is wrong because instance store is ephemeral. Option B is wrong because EBS is tied to the instance and is lost on termination if not configured for persistence.

Option C is wrong because S3 is not optimized for low-latency session storage.

Option D is correct because on-demand capacity handles spikes automatically and is cost-effective for unpredictable traffic. Option A is wrong because provisioned capacity requires manual scaling and may throttle during spikes. Option B is wrong because reserved capacity is for predictable workloads.

Option C is wrong because auto scaling adds latency and cost during scaling.

Option D is correct because enabling auto scaling adjusts capacity based on traffic. Option A is wrong because indexes don't affect throttling. Option B is wrong because decreasing capacity would worsen throttling.

Option C is wrong because increasing read capacity only partially helps.

Option C is correct because S3 Bucket Policies can deny uploads without encryption headers. Option D is correct because S3 default encryption can be configured to automatically encrypt objects. Option A is wrong because client-side encryption is different from server-side.

Option B is wrong because S3 does not support SQS policies for encryption. Option E is wrong because IAM policies can control permissions but not enforce encryption on uploads.

Option C is correct because setting the DeletionPolicy attribute to Delete ensures the bucket is deleted when the stack is deleted. Option A is wrong because the default is to retain the bucket. Option B is wrong because DependsOn does not affect deletion.

Option D is wrong because the bucket name is not related to deletion behavior.

Option C is correct because implementing a retry mechanism with exponential backoff is the recommended approach to handle throttling errors from DynamoDB. Option A is wrong because increasing Lambda memory does not affect DynamoDB throughput. Option B is wrong because decreasing batch size may reduce the number of writes per invocation, but does not handle throttling directly; exponential backoff is more effective.

Option D is wrong because changing the Kinesis stream's shard count does not affect DynamoDB throughput.

Correct: A. The Lambda execution role only has the AWSLambdaBasicExecutionRole policy, which grants permissions to write logs to CloudWatch. However, the Lambda function needs permission to poll and delete messages from SQS.

The missing policy is AWSLambdaSQSQueueExecutionRole or a custom policy with sqs:ReceiveMessage, sqs:DeleteMessage, sqs:GetQueueAttributes. Option B is wrong because the SQS event source mapping is correctly defined. Option C is wrong because the function code is valid.

Option D is wrong because the batch size of 10 is valid.

Option D is correct because configuring a dead-letter queue (DLQ) for the SQS queue allows messages that exceed the maximum retries to be stored for later analysis, while the Lambda function's retry behavior handles transient failures. Option A is wrong because increasing the Lambda timeout may help but does not provide automatic retries. Option B is wrong because SQS does not have a built-in retry mechanism; Lambda retries are separate.

Option C is wrong because DLQ on Lambda captures only events that Lambda cannot process, but the best practice is to use SQS DLQ.

Option A is correct. Elastic Beanstalk can provision an RDS database as part of the environment using the AWS::ElasticBeanstalk::Environment resource with a linked RDS instance. Option B is wrong because manually creating an RDS instance outside of Elastic Beanstalk does not integrate with environment management.

Option C is wrong because DynamoDB is NoSQL, not relational. Option D is wrong because adding a database to the application code as a file-based database like SQLite is not suitable for production and does not scale.

Options B and D are correct. Option B: Lambda functions must be configured with a VPC subnet to be placed in the VPC. Option D: A security group must be attached to the Lambda function to control traffic.

Option A is incorrect because an internet gateway is not needed for private VPC access. Option C is incorrect because a NAT gateway is for outbound internet access, not for accessing RDS within the VPC. Option E is incorrect because an IAM role is for permissions, not network connectivity.