CCNA Development with AWS Services Questions — Page 2 of 4

MCQhard

A developer is building a multi-region application using Amazon DynamoDB global tables. The application needs to read data from a replica table in a different region shortly after a write in the primary region. The developer notices that reads sometimes return stale data. Which of the following explains this behavior?

A.Global tables use asynchronous replication, introducing unavoidable replication lag.

B.The developer must use DynamoDB Streams to capture changes and replicate them separately.

C.The developer must enable strong consistency reads on the replica table.

D.The global table must be configured with write forwarding.

AnswerA

DynamoDB Global Tables are built upon an asynchronous, multi-master replication model, which inherently leads to eventual consistency across regions. This design means there will always be an unavoidable, albeit typically brief, replication lag between regions. Data written to one region is propagated to other replica regions with a small delay, ensuring high availability and low latency writes globally but not immediate read consistency across regions.

Why this answer

Amazon DynamoDB global tables use asynchronous replication to propagate writes from one region to all other replica tables. This means that after a write in the primary region, there is an inherent replication lag (typically sub-second but can be higher under load or network issues) before the change is visible in other regions. The developer observes stale reads because the read is hitting a replica that has not yet received the update, which is expected behavior for eventually consistent reads on global tables.

Exam trap

The trap here is that candidates often assume DynamoDB global tables provide immediate consistency across regions (like synchronous replication) or that they can simply switch to strong consistency reads on replicas, but the exam tests the understanding that global tables are eventually consistent and that strong consistency is not available on replica tables.

How to eliminate wrong answers

Option B is wrong because DynamoDB Streams are used to capture item-level changes for custom processing (e.g., triggering Lambda functions), but they are not required for replication in global tables—global tables handle replication internally using the DynamoDB replication protocol. Option C is wrong because strong consistency reads are not supported on replica tables in a global table setup; only eventually consistent reads are available on replicas, so enabling strong consistency reads is not an option. Option D is wrong because write forwarding is a feature that allows a write request to a replica to be forwarded to the primary region for execution, but it does not affect the read consistency or replication lag when reading from a replica after a write in the primary region.

Practice this question →

MCQmedium

A developer is deploying a web application using AWS Elastic Beanstalk. The application uses a MySQL database. During deployment, the developer needs to apply database schema migrations. Which approach should the developer use to run database migrations as part of the Elastic Beanstalk deployment?

A.Use an .ebextensions configuration file to run a migration script during deployment.

B.Configure an RDS event subscription to trigger a Lambda function that runs migrations.

C.Run the migration script as a scheduled task using CloudWatch Events.

D.Use AWS CodeDeploy's AppSpec file to run the migration script.

AnswerA

Using an .ebextensions configuration file is the correct approach because Elastic Beanstalk processes these files during deployment, allowing developers to execute custom commands on the EC2 instances. Specifically, `container_commands` or `commands` within these YAML files can run database migration scripts at a specific point in the application deployment lifecycle. This ensures the database schema is updated in sync with the new application code before it starts serving traffic.

Why this answer

Elastic Beanstalk supports .ebextensions configuration files that can execute custom commands or scripts during deployment. By placing a migration script (e.g., a shell script that runs `mysql` commands or a framework migration tool) in the `.ebextensions` directory and using the `commands` or `container_commands` key, the developer can ensure the migration runs automatically after the application is deployed but before the new environment serves traffic. This approach integrates the migration into the deployment lifecycle without external dependencies.

Exam trap

The trap here is that candidates often confuse the deployment lifecycle hooks of different AWS services (e.g., CodeDeploy's AppSpec vs. Elastic Beanstalk's .ebextensions) and assume any migration script can be plugged into any deployment tool, ignoring that Elastic Beanstalk has its own proprietary configuration mechanism.

How to eliminate wrong answers

Option B is wrong because RDS event subscriptions notify about database events (e.g., failover, backup completion) but do not trigger Lambda functions directly; while you could use EventBridge to route RDS events to Lambda, this approach is asynchronous and unrelated to the deployment lifecycle, so it cannot guarantee migrations run exactly during an Elastic Beanstalk deployment. Option C is wrong because running migrations as a scheduled task using CloudWatch Events would execute at fixed times, not in sync with the deployment process, leading to potential schema mismatches or race conditions. Option D is wrong because AWS CodeDeploy's AppSpec file is used for deployments managed by CodeDeploy, not Elastic Beanstalk; Elastic Beanstalk has its own deployment mechanism and does not read or execute AppSpec files.

Practice this question →

MCQmedium

A developer needs an S3 upload workflow where clients upload large files directly to S3 without exposing AWS credentials through the browser. What should the backend generate?

A.Pre-signed URLs with appropriate expiration and object restrictions

B.Long-lived IAM access keys for each client

C.A public-read bucket policy

D.An S3 Inventory report

AnswerA

Pre-signed URLs grant temporary, time-limited access to specific S3 objects or prefixes without requiring AWS credentials directly from the client. They are generated by an AWS credential holder and can be configured with specific permissions (e.g., PutObject), an expiration time, and even conditions on the upload like content type or size. This approach securely delegates upload capability to unauthenticated clients for a defined period, aligning perfectly with the requirement for client uploads without exposing long-term credentials.

Why this answer

Pre-signed URLs allow the backend to generate time-limited, permission-restricted URLs that clients can use to upload objects directly to S3 without exposing AWS credentials. The backend signs the URL with IAM credentials, and the client uses the URL to perform the PUT operation, ensuring secure, credential-free uploads.

Exam trap

The trap here is that candidates may confuse pre-signed URLs with public bucket policies or long-lived keys, thinking that any form of direct access requires exposing credentials, when in fact pre-signed URLs provide temporary, scoped access without credential leakage.

How to eliminate wrong answers

Option B is wrong because long-lived IAM access keys would expose permanent credentials in the browser, violating the requirement to avoid credential exposure and creating a severe security risk. Option C is wrong because a public-read bucket policy allows anyone to read objects but does not provide a secure, controlled upload mechanism; it would also expose the bucket to unauthorized writes if not carefully restricted. Option D is wrong because an S3 Inventory report is a listing of objects for auditing or lifecycle management, not a mechanism for uploading files.

Practice this question →

MCQeasy

A developer is using Amazon DynamoDB to store session data for a web application. The application experiences read-heavy traffic and the developer wants to reduce latency. Which feature should be used to improve read performance?

A.DynamoDB Global Tables

B.DynamoDB Streams

C.DynamoDB Accelerator (DAX)

D.DynamoDB Time to Live (TTL)

AnswerC

DynamoDB Accelerator (DAX) is a fully managed, highly available, in-memory cache specifically designed for DynamoDB. It provides microsecond response times for read-heavy workloads by caching frequently accessed data, significantly reducing the load on the underlying DynamoDB table. DAX is API-compatible with DynamoDB, allowing developers to integrate it with minimal application code changes to achieve substantial read performance improvements.

Why this answer

DynamoDB Accelerator (DAX) is a fully managed, in-memory cache that delivers up to 10x read performance improvement by reducing response times from milliseconds to microseconds. For read-heavy workloads like session data, DAX offloads read traffic from the DynamoDB table, reducing latency and providing a seamless caching layer without application code changes.

Exam trap

The trap here is that candidates confuse DynamoDB Global Tables (which reduce latency for cross-region reads) with a single-region read cache, but Global Tables do not improve read performance within the same region — DAX is the correct service for that purpose.

How to eliminate wrong answers

Option A is wrong because DynamoDB Global Tables provide multi-region replication for disaster recovery and low-latency writes across regions, but they do not improve read performance within a single region. Option B is wrong because DynamoDB Streams capture item-level changes for event-driven processing or replication, but they do not cache data or reduce read latency. Option D is wrong because DynamoDB Time to Live (TTL) automatically expires old session data to manage storage costs, but it has no impact on read performance or latency.

Practice this question →

MCQmedium

A developer has an AWS Lambda function that processes messages from an Amazon SQS standard queue. The function is idempotent and currently has a batch size of 10. The developer wants to increase throughput and increases the batch size to 100. After the change, CloudWatch metrics show a significant increase in throttles and the queue backlog is growing. The function's reserved concurrency is set to 10. What is the most effective action to resolve the throttling and improve throughput?

A.Increase the reserved concurrency of the Lambda function

B.Increase the memory allocation of the Lambda function

C.Switch the SQS queue to a FIFO queue

D.Decrease the batch size back to 10

AnswerA

Increasing reserved concurrency directly allocates a dedicated maximum number of simultaneous executions for this specific Lambda function. This prevents the function from being throttled by the account's unreserved concurrency limit or other functions consuming available capacity. By ensuring more invocations can run in parallel, the function can effectively process larger SQS batch sizes without messages backing up, significantly improving overall message consumption rate and throughput.

Why this answer

Increasing the reserved concurrency from 10 to a higher value directly addresses the root cause of throttling. With a batch size of 100, each invocation processes more messages, but the function's reserved concurrency of 10 limits the maximum number of concurrent executions to 10. This means the Lambda service can only invoke the function 10 times at once, regardless of how many messages are in the queue.

By raising reserved concurrency, you allow more concurrent invocations to handle the larger batches, reducing throttling and improving throughput.

Exam trap

The trap here is that candidates often assume throttling is due to function performance (memory or CPU) and choose to increase memory, when in fact the issue is a concurrency limit that prevents the function from scaling to handle the larger batch size.

How to eliminate wrong answers

Option B is wrong because increasing memory allocation improves CPU and network performance per invocation but does not increase the number of concurrent executions allowed, so it cannot resolve throttling caused by hitting the reserved concurrency limit. Option C is wrong because switching to a FIFO queue would reduce throughput due to its strict message ordering and limited concurrency (FIFO queues support a maximum of 300 transactions per second with batching), which is counterproductive when trying to increase throughput. Option D is wrong because decreasing the batch size back to 10 would reduce the number of messages processed per invocation, lowering throughput and failing to address the underlying concurrency bottleneck.

Practice this question →

MCQmedium

A developer is creating a REST API using Amazon API Gateway with Lambda proxy integration. The API needs to accept and return binary data such as images or PDF files. The developer has configured the API to use the Lambda proxy integration. What additional configuration is required to support binary data?

A.Set the Content-Type header to application/octet-stream in the Lambda response.

B.In API Gateway, add the binary media types to the API settings, e.g., image/png, application/pdf.

C.Use an API Gateway custom domain with an SSL certificate.

D.Enable API caching with binary support.

AnswerB

This is the correct and essential step for API Gateway to properly handle binary data from a Lambda integration. By explicitly listing media types like `image/png` or `application/pdf` in the API Gateway's binary media types settings, you instruct API Gateway to treat incoming and outgoing payloads of these types as raw binary data. This ensures that API Gateway correctly base64-encodes binary responses from Lambda before sending them to the client and decodes binary requests before passing them to Lambda, preventing data corruption.

Why this answer

With Lambda proxy integration, API Gateway passes the client request as-is to Lambda and returns the Lambda response as-is to the client. To handle binary data, you must explicitly declare the binary media types (e.g., image/png, application/pdf) in the API Gateway REST API settings. This tells API Gateway to base64-encode the binary payload before sending it to Lambda and to decode the base64-encoded response from Lambda back to binary for the client.

Without this configuration, API Gateway treats all payloads as text and will corrupt binary data.

Exam trap

The trap here is that candidates assume Lambda proxy integration automatically handles binary data because it passes everything through, but in reality, API Gateway requires explicit binary media type configuration to avoid corrupting binary payloads during base64 encoding/decoding.

How to eliminate wrong answers

Option A is wrong because setting the Content-Type header to application/octet-stream in the Lambda response alone does not enable API Gateway to handle binary data; API Gateway must be explicitly configured with the binary media types in the API settings, and the Lambda response must also include the correct isBase64Encoded flag set to true. Option C is wrong because using a custom domain with an SSL certificate is related to HTTPS endpoint configuration and custom domain names, not to enabling binary data support in API Gateway. Option D is wrong because API caching is a performance optimization feature that caches responses; it does not provide or enable binary data handling, and there is no 'binary support' toggle in API caching.

Practice this question →

MCQeasy

A developer is using Amazon API Gateway to create a REST API. The API must support CORS (Cross-Origin Resource Sharing) to allow requests from a web application hosted on a different domain. What must the developer do to enable CORS?

A.Use Amazon CloudFront to proxy the API and add CORS headers.

B.Enable CORS in the API Gateway settings and configure the required headers.

C.Nothing; API Gateway automatically handles CORS.

D.Add CORS headers in the Lambda function code.

AnswerB

API Gateway provides a dedicated feature to enable Cross-Origin Resource Sharing (CORS) directly within its console or via infrastructure as code. This involves configuring the `OPTIONS` method for resources, specifying allowed origins, methods, and headers, and ensuring the necessary `Access-Control-Allow-*` headers are automatically included in responses. This native capability simplifies CORS management, allowing the API Gateway to handle preflight requests and inject the required headers without custom backend logic.

Why this answer

Enabling CORS in API Gateway requires explicit configuration: you must enable CORS on the API Gateway resource, which automatically generates an OPTIONS method and adds the necessary CORS headers (Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers) to responses. This is done through the API Gateway console or API configuration, not by the backend Lambda function or CloudFront.

Exam trap

The trap here is that candidates assume API Gateway automatically handles CORS (Option C) or that adding headers only in the Lambda function is sufficient (Option D), forgetting that the browser's preflight OPTIONS request must be handled by API Gateway itself.

How to eliminate wrong answers

Option A is wrong because Amazon CloudFront does not automatically add CORS headers for API Gateway; it can only forward or modify headers if configured, but the CORS headers must originate from the API Gateway or backend. Option C is wrong because API Gateway does not automatically handle CORS; it requires explicit enabling and configuration of CORS headers and the OPTIONS preflight response. Option D is wrong because while you can add CORS headers in the Lambda function code, this only works for non-preflight requests; API Gateway must still handle the OPTIONS preflight request and return the appropriate CORS headers, which is why enabling CORS in API Gateway is the recommended approach.

Practice this question →

MCQmedium

A developer is using AWS Elastic Beanstalk to deploy a web application. The application writes logs to the local file system. The developer wants to ensure that logs are automatically rotated and retained for 30 days. What should the developer do?

A.Modify the application code to write logs directly to an S3 bucket with lifecycle policies.

B.Add a cron job to the EC2 instances that compresses and deletes old logs.

C.Configure the Elastic Beanstalk environment to enable log rotation and set retention period to 30 days.

D.Install the CloudWatch Logs agent on the EC2 instances and configure it to stream logs to CloudWatch Logs with a 30-day retention.

AnswerC

Elastic Beanstalk provides built-in environment properties to manage log rotation and retention directly, making it the most appropriate and integrated solution for this requirement. Developers can configure settings like `LogRotationPeriod` and `LogRotationSizeThreshold` through the Elastic Beanstalk console, CLI, or configuration files. This ensures local log files are automatically rotated and old logs are removed, preventing disk space issues without requiring custom code or manual scripts.

Why this answer

Elastic Beanstalk provides a built-in configuration for log rotation and retention directly in the environment settings. By enabling log rotation and setting the retention period to 30 days, the developer can automatically manage logs without modifying application code or adding external agents. This leverages the Elastic Beanstalk health agent, which handles log rotation on the EC2 instances and stores rotated logs in Amazon S3 with lifecycle policies to enforce the retention period.

Exam trap

The trap here is that candidates often overcomplicate the solution by choosing CloudWatch Logs (Option D) because it is a common logging service, but the question specifically asks for automatic rotation and retention on the local file system, which Elastic Beanstalk's built-in feature handles directly without additional services.

How to eliminate wrong answers

Option A is wrong because writing logs directly to S3 from application code bypasses the local file system requirement and introduces unnecessary complexity, such as managing S3 permissions and handling network latency, while Elastic Beanstalk already provides a simpler built-in log rotation mechanism. Option B is wrong because adding a cron job to EC2 instances is a manual, non-scalable approach that does not integrate with Elastic Beanstalk's managed environment; it also lacks centralized retention control and can be lost during instance replacements. Option D is wrong because while CloudWatch Logs agent can stream logs with a 30-day retention, this requires additional setup and costs, and it does not perform local log rotation on the file system; Elastic Beanstalk's native log rotation is more straightforward for this specific requirement.

Practice this question →

MCQeasy

A developer wants to store application configuration data that can be accessed by multiple microservices. The data is sensitive and should be encrypted at rest. Which AWS service should be used to meet these requirements?

A.Amazon S3

B.AWS Identity and Access Management (IAM)

C.Amazon DynamoDB

D.AWS Systems Manager Parameter Store

AnswerD

AWS Systems Manager Parameter Store is a highly scalable, secure, and easy-to-use service for storing and managing configuration data and secrets. It supports hierarchical organization, versioning, and secure string types, allowing sensitive data like database credentials or API keys to be encrypted at rest using AWS KMS. Applications can securely retrieve parameters at runtime, making it the ideal solution for centralized application configuration management.

Why this answer

AWS Systems Manager Parameter Store provides a secure, hierarchical store for configuration data and secrets. It supports encryption at rest using AWS KMS, integrates with AWS IAM for fine-grained access control, and is designed for use by multiple microservices via the AWS SDK or CLI. This makes it the ideal choice for storing sensitive application configuration that must be encrypted at rest and accessed by distributed services.

Exam trap

The trap here is that candidates often choose Amazon S3 because they think of storing configuration files (e.g., JSON or YAML) in buckets, but they overlook that Parameter Store is purpose-built for secure, encrypted configuration management with native IAM integration and no need to manage file access or encryption manually.

How to eliminate wrong answers

Option A is wrong because Amazon S3 is an object storage service, not a configuration store; while it supports encryption at rest, it lacks native hierarchical parameter management, versioning of configuration values, and seamless integration with AWS SDKs for parameter retrieval without custom code. Option B is wrong because AWS Identity and Access Management (IAM) is an access management service for controlling permissions, not a data store; it cannot store application configuration data or secrets. Option C is wrong because Amazon DynamoDB is a NoSQL database designed for high-performance, scalable data storage, but it does not provide built-in encryption at rest by default (requires additional configuration with AWS KMS), and it lacks native parameter store features like tiered pricing, automatic rotation, or simple key-value retrieval without provisioning read/write capacity units.

Practice this question →

Multi-Selectmedium

A company is using Amazon RDS for MySQL with Multi-AZ deployment. The application writes to the database using the primary endpoint. The company wants to improve read performance and offload read traffic from the primary instance. Which TWO actions should the company take? (Choose TWO.)

Select 2 answers

A.Create an Amazon RDS read replica in the same region.

B.Add another primary instance and configure replication.

C.Modify the application to use the read replica endpoint for SELECT queries.

D.Use the Multi-AZ secondary instance endpoint for read queries.

E.Enable Amazon RDS Proxy to distribute read queries across instances.

AnswersA, C

Creating an Amazon RDS read replica in the same region provides an asynchronously replicated copy of the primary database instance. This replica is specifically designed to handle read-only queries, such as SELECT statements, thereby offloading the read workload from the primary instance. By distributing read traffic, the primary instance's CPU, I/O, and connection utilization are significantly reduced, allowing it to dedicate resources to write operations and maintain optimal performance for critical transactions.

Why this answer

Amazon RDS read replicas are designed to offload read traffic from the primary DB instance. A read replica is an asynchronous copy of the primary that can serve SELECT queries, improving read performance without impacting write operations on the primary. Option C is correct because the application must explicitly use the read replica's endpoint for read queries; the replica does not automatically balance traffic.

Together, creating a read replica and modifying the application to direct SELECT queries to its endpoint achieves the goal of improving read performance and offloading the primary.

Exam trap

The trap here is confusing Multi-AZ standby instances with read replicas—candidates often think the standby can serve reads, but it is a passive replica that only becomes active during failover and has no accessible endpoint for read queries.

Practice this question →

MCQeasy

A developer needs to store session state data for a web application running on multiple EC2 instances. The data must be highly available and durable. Which AWS service should be used?

A.Amazon ElastiCache

B.Amazon S3

C.Amazon EBS

D.Amazon CloudFront

AnswerA

Amazon ElastiCache provides managed in-memory data stores, such as Redis or Memcached, which offer extremely low-latency access and high throughput. This makes it an ideal choice for storing frequently accessed, transient session state data for web applications. By centralizing session state in ElastiCache, application servers can remain stateless, allowing for seamless horizontal scaling and high availability across multiple instances without losing user sessions.

Why this answer

Amazon ElastiCache is the correct choice because it provides a managed, in-memory caching service that is ideal for storing session state data with high availability and durability. By using ElastiCache for Redis or Memcached, session data is stored outside of individual EC2 instances, ensuring that if an instance fails, the session state is preserved and can be accessed by other instances in the application tier. ElastiCache supports replication and automatic failover, meeting the requirements for high availability and durability.

Exam trap

The trap here is that candidates often confuse Amazon ElastiCache with Amazon DynamoDB or Amazon S3 for session storage, but the question specifically requires a highly available and durable in-memory solution, and ElastiCache is the only option that provides low-latency, shared session state across multiple EC2 instances with built-in replication and failover.

How to eliminate wrong answers

Option B (Amazon S3) is wrong because S3 is an object storage service designed for large-scale data storage and retrieval, not for low-latency session state access; its eventual consistency model and higher latency make it unsuitable for real-time session management. Option C (Amazon EBS) is wrong because EBS provides block-level storage volumes attached to a single EC2 instance, so session data stored on an EBS volume is not shared across multiple instances and becomes unavailable if the instance fails, violating the high availability requirement. Option D (Amazon CloudFront) is wrong because CloudFront is a content delivery network (CDN) that caches static and dynamic content at edge locations; it does not provide a storage mechanism for session state data and is not designed for transactional, stateful data persistence.

Practice this question →

MCQeasy

A developer is creating an API with Amazon API Gateway that needs to accept binary data (e.g., images) and store them directly in an S3 bucket. The developer wants to minimize backend complexity. Which integration type should be used?

A.AWS service integration with S3

B.Lambda proxy integration

C.HTTP integration

D.Mock integration

AnswerA

AWS service integration enables API Gateway to directly invoke actions on other AWS services, such as S3, without requiring an intermediate compute layer like Lambda. For storing objects, this integration type allows API Gateway to map incoming request bodies directly to S3 PUT object operations. This approach significantly minimizes backend complexity and latency by leveraging S3's native capabilities for object storage, making it the most efficient solution for directly accepting and storing data.

Why this answer

AWS service integration with S3 allows API Gateway to directly proxy binary data (e.g., images) to an S3 bucket without invoking a Lambda function or other backend. This minimizes backend complexity because the API Gateway handles the request transformation and passes the payload directly to S3 via the PutObject API action, eliminating the need for custom code.

Exam trap

The trap here is that candidates often default to Lambda proxy integration for any data processing task, overlooking that direct AWS service integration can handle binary uploads to S3 without any compute layer, which is the simplest and most cost-effective approach.

How to eliminate wrong answers

Option B (Lambda proxy integration) is wrong because it introduces unnecessary backend complexity by requiring a Lambda function to receive the binary data and then upload it to S3, adding compute cost and latency. Option C (HTTP integration) is wrong because it would require a separate HTTP endpoint (e.g., on EC2 or on-premises) to receive the data and then forward it to S3, defeating the goal of minimizing backend complexity. Option D (Mock integration) is wrong because it only returns static responses from API Gateway without actually storing any data in S3, so it cannot fulfill the requirement of persisting binary data.

Practice this question →

MCQmedium

A developer is using AWS SAM to deploy a serverless application. The template includes a Lambda function that connects to an RDS MySQL database. The function works correctly in the developer's account but fails with a timeout when deployed to a production account. What is the MOST likely cause?

A.The Lambda function timeout is set too low for the database query.

B.The Lambda function is not attached to the same VPC as the RDS instance.

C.The SAM template does not support RDS as an event source.

D.The Lambda function uses a runtime that is not compatible with the MySQL client.

AnswerB

For a Lambda function to securely and privately access an Amazon RDS instance, it must be configured to operate within the same Virtual Private Cloud (VPC) as the database. RDS instances are typically deployed into private subnets without public internet access, requiring the Lambda function to be placed within that VPC to establish a private network connection. If the Lambda is not attached to the correct VPC, it will be unable to resolve the private IP address or reach the RDS endpoint, leading to connection failures.

Why this answer

The most likely cause is that the Lambda function is not attached to the same VPC as the RDS instance. Lambda functions run in a VPC by default only if explicitly configured; without VPC attachment, the function cannot reach the RDS database's private IP address, leading to a connection timeout. The developer's account may have had the RDS instance publicly accessible or the Lambda function was inadvertently in the same VPC, but the production account likely uses a private RDS instance in a VPC that the Lambda function is not connected to.

Exam trap

The trap here is that candidates often assume a Lambda function can always reach an RDS database by default, overlooking the critical VPC configuration requirement for private resources.

How to eliminate wrong answers

Option A is wrong because a low Lambda function timeout would cause a timeout error, but the symptom is a connection timeout (the function fails to connect at all), not a query execution timeout; the core issue is network connectivity, not the timeout value. Option C is wrong because SAM templates do not need to define RDS as an event source; Lambda connects to RDS via the database client library in the function code, not through an event source mapping. Option D is wrong because the Lambda function works correctly in the developer's account, proving the runtime is compatible with the MySQL client; the failure is environment-specific, not runtime-related.

Practice this question →

MCQeasy

A developer needs to store temporary session data for a web application running on Amazon EC2 behind an Application Load Balancer. The data must be accessible across multiple EC2 instances. Which AWS service should the developer use?

A.Amazon ElastiCache

B.Amazon EBS

C.Amazon DynamoDB

D.Amazon S3

AnswerA

Amazon ElastiCache, offering managed Redis or Memcached, is the optimal choice for storing temporary session data. Its in-memory nature provides sub-millisecond latency and high throughput, crucial for frequently accessed session information. By externalizing session state from individual web servers, ElastiCache enables horizontal scaling of application instances and ensures session continuity even if an instance fails, preventing the need for sticky sessions.

Why this answer

Amazon ElastiCache is the correct choice because it provides a managed, in-memory caching service (e.g., Redis or Memcached) that can store temporary session data with sub-millisecond latency. Since the data must be accessible across multiple EC2 instances behind an Application Load Balancer, ElastiCache offers a centralized, highly available data store that all instances can read from and write to, ensuring session persistence regardless of which instance handles a request.

Exam trap

The trap here is that candidates often confuse 'temporary session data' with 'persistent user data' and choose DynamoDB for its scalability, overlooking that ElastiCache is purpose-built for low-latency, ephemeral storage with automatic eviction policies.

How to eliminate wrong answers

Option B (Amazon EBS) is wrong because EBS volumes are block-level storage attached to a single EC2 instance in a specific Availability Zone; they cannot be shared across multiple instances for concurrent read/write access. Option C (Amazon DynamoDB) is wrong because while it is a fully managed NoSQL database that can store session data, it is a persistent, disk-based database with higher latency than an in-memory cache, and it is overkill for temporary session data that does not require durability. Option D (Amazon S3) is wrong because S3 is an object storage service designed for high-durability, long-term storage with eventual consistency (unless using S3 Select or versioning), and its higher latency and lack of native sub-millisecond access make it unsuitable for real-time session data that must be read and written on every request.

Practice this question →

MCQmedium

A developer is building a chat application using WebSockets. The application runs on multiple EC2 instances and needs to broadcast messages to all connected clients. Which AWS service can handle the WebSocket connections and route messages?

A.Amazon SQS with long polling

B.Application Load Balancer with WebSocket support

C.Amazon CloudFront with WebSocket support

D.Amazon API Gateway WebSocket API

AnswerD

Amazon API Gateway WebSocket API is purpose-built for managing persistent, bidirectional communication channels required by real-time applications like chat. It natively handles WebSocket connection management, including connection establishment and termination, and provides robust mechanisms to send messages to specific clients or broadcast messages to all connected clients, often integrating with backend services like AWS Lambda for message processing.

Why this answer

Amazon API Gateway WebSocket API is the correct choice because it natively manages WebSocket connections, maintains persistent bidirectional communication, and can broadcast messages to all connected clients using callback URLs. It handles connection lifecycle (connect, disconnect, default) and integrates with AWS Lambda or other backends to route messages efficiently.

Exam trap

The trap here is that candidates confuse Application Load Balancer's WebSocket support (which only proxies connections to a single target) with the need for a managed service that can broadcast to multiple clients, leading them to choose ALB over API Gateway.

How to eliminate wrong answers

Option A is wrong because Amazon SQS is a message queue service that uses polling (long or short) and does not support WebSocket connections or real-time bidirectional communication. Option B is wrong because Application Load Balancer supports WebSocket connections but only for routing traffic to backend targets; it cannot broadcast messages to all connected clients or manage the WebSocket protocol's pub/sub patterns. Option C is wrong because Amazon CloudFront does not natively support WebSocket connections; it is a CDN optimized for HTTP/HTTPS and cannot maintain persistent WebSocket state or route messages.

Practice this question →

MCQhard

A Lambda function connects to an RDS database and causes too many database connections during traffic spikes. Which service should be introduced?

A.AWS Glue Data Catalog

B.Amazon RDS Proxy

C.Amazon Route 53 Resolver

D.AWS WAF

AnswerB

Amazon RDS Proxy is a fully managed, highly available database proxy that significantly improves application resilience and scalability for RDS databases. It establishes and maintains a pool of database connections, reusing them efficiently for new application connections from services like Lambda. This reduces the overhead of establishing new connections, prevents Lambda's concurrent invocations from overwhelming the RDS database with too many open connections, and handles credential management securely.

Why this answer

Amazon RDS Proxy sits between your Lambda function and the RDS database, managing a pool of established database connections. During traffic spikes, Lambda can rapidly scale up concurrent executions, each potentially opening a new database connection, which can exhaust the database's maximum connections. RDS Proxy reuses connections from the pool, reducing the number of open connections and preventing database overload, while also improving connection handling efficiency for serverless applications.

Exam trap

The trap here is that candidates might confuse AWS WAF (a web firewall) or Route 53 (DNS) with database connection management, or incorrectly think that Glue Data Catalog can somehow cache or pool database connections, when in fact only RDS Proxy directly addresses the connection scaling issue for Lambda and RDS.

How to eliminate wrong answers

Option A is wrong because AWS Glue Data Catalog is a metadata repository for data assets in AWS Glue and Athena, not a connection pooling or proxy service for RDS databases. Option C is wrong because Amazon Route 53 Resolver is a DNS service for resolving domain names within VPCs, and it does not manage database connections or connection pooling. Option D is wrong because AWS WAF is a web application firewall that protects against common web exploits like SQL injection and cross-site scripting, but it does not handle database connection management or pooling.

Practice this question →

MCQhard

Refer to the exhibit. A developer runs the AWS CLI command to invoke a Lambda function. The command succeeds, but the function returns an error. The developer wants to see the error message and logs from the function execution. What should the developer add to the command?

A.--client-context string

B.--qualifier alias

C.--invocation-type Event

D.--log-type Tail

AnswerD

The --log-type Tail parameter is specifically designed to retrieve the last 4 KB of log data generated by a synchronous Lambda function invocation. When used with RequestResponse invocation type, this option includes the base64-encoded log output in the LogResult field of the CLI response. This provides immediate access to recent execution logs directly within the terminal, which is invaluable for debugging and quick verification of function behavior.

Why this answer

The `--log-type Tail` parameter instructs the AWS CLI to retrieve the last 4 KB of log data from the function's execution and base64-encode it in the response. This allows the developer to see the error message and logs directly without needing to query CloudWatch Logs separately. The command must also use `--invocation-type RequestResponse` (the default) to get a synchronous response containing the logs.

Exam trap

The trap here is that candidates often confuse `--invocation-type Event` (async) with the ability to retrieve logs, not realizing that only synchronous invocations (`RequestResponse`) return execution results and logs via `--log-type Tail`.

How to eliminate wrong answers

Option A is wrong because `--client-context string` passes arbitrary JSON data to the Lambda function as part of the invocation request, but it does not retrieve or display any logs or error messages from the execution. Option B is wrong because `--qualifier alias` specifies a version or alias of the function to invoke, which controls which code runs but does not affect log retrieval. Option C is wrong because `--invocation-type Event` triggers an asynchronous invocation, which returns a 202 response immediately without any function output or logs, making it impossible to see error messages in the response.

Practice this question →

MCQmedium

A Lambda function must share reusable validation code across several functions without packaging the same library into every deployment artifact. What should be used?

A.Lambda layer

B.API Gateway usage plan

C.S3 multipart upload

D.CloudWatch metric filter

AnswerA

A Lambda layer is a ZIP archive containing supplementary code or data, such as libraries, custom runtimes, or common utility functions. By packaging reusable validation logic into a layer, multiple Lambda functions can reference it, significantly reducing deployment package sizes and promoting code consistency. This mechanism directly addresses the need to share common code across various serverless functions efficiently.

Why this answer

Lambda layers allow you to centrally manage reusable code (e.g., validation libraries) and share it across multiple Lambda functions without packaging it into each deployment artifact. When you attach a layer to a function, the layer's content is extracted into the /opt directory, making it available at runtime. This avoids duplication and simplifies updates, as you only need to update the layer version rather than every function's deployment package.

Exam trap

The trap here is that candidates may confuse Lambda layers with other AWS services that handle 'sharing' (like API Gateway usage plans for sharing API access) or 'packaging' (like S3 multipart upload for large files), but only Lambda layers are designed to share code and dependencies across functions without repackaging.

How to eliminate wrong answers

Option B is wrong because API Gateway usage plans are used to throttle and quota API requests, not to share code across Lambda functions. Option C is wrong because S3 multipart upload is a mechanism for uploading large objects in parts, not for distributing reusable code to Lambda functions. Option D is wrong because CloudWatch metric filters are used to extract metric data from log streams, not to share or package code for Lambda.

Practice this question →

MCQeasy

A developer is writing a Lambda function that processes images uploaded to an S3 bucket. The function needs to extract metadata from the image. Which S3 feature can be used to automatically trigger the Lambda function?

A.S3 Events

B.S3 Inventory

C.S3 Transfer Acceleration

D.S3 Batch Operations

AnswerA

S3 Event Notifications are the correct mechanism for triggering real-time actions in response to object changes within an S3 bucket. When an image is uploaded, S3 can publish an event to a configured destination, such as an AWS Lambda function. This allows for immediate, automated processing like image resizing, watermarking, or metadata extraction as soon as the object creation event occurs.

Why this answer

Amazon S3 Events can be configured to send a notification when an object is created (e.g., via PutObject) in an S3 bucket. This event can directly invoke an AWS Lambda function, making it the correct service to automatically trigger the function upon image upload. The developer simply needs to set up an S3 event notification with the Lambda function as the destination.

Exam trap

The trap here is that candidates may confuse S3 Batch Operations (which can invoke Lambda functions for batch processing) with real-time event triggers, but Batch Operations require a manual job initiation and do not automatically fire on each upload.

How to eliminate wrong answers

Option B (S3 Inventory) is wrong because it is used to generate a list of objects and their metadata for auditing or compliance, not to trigger real-time event-driven actions. Option C (S3 Transfer Acceleration) is wrong because it only speeds up uploads over long distances using edge locations, it has no mechanism to invoke Lambda functions. Option D (S3 Batch Operations) is wrong because it performs bulk actions (like copying or tagging) on existing objects via a job, not real-time event triggering upon object creation.

Practice this question →

MCQeasy

A developer is designing a microservices architecture where each service runs in its own Amazon ECS container. Services need to communicate with each other. The developer wants to simplify service discovery and load balancing. Which AWS service should the developer use?

A.AWS Cloud Map

B.Elastic Load Balancing

C.Amazon ECS service discovery

D.Amazon Route 53

AnswerA

AWS Cloud Map provides a robust service discovery solution by registering dynamically changing microservices with custom names, allowing other services to discover them via API calls or DNS queries. It integrates seamlessly with Amazon ECS, enabling tasks to register and deregister automatically as they scale or become unhealthy. This dynamic registration is crucial for ephemeral microservices, ensuring services can find each other reliably without hardcoding network locations.

Why this answer

AWS Cloud Map is the correct choice because it provides a fully managed service discovery solution that allows microservices to dynamically discover each other using DNS or HTTP API calls. It integrates natively with Amazon ECS, enabling services to register themselves and resolve other services by logical names, which simplifies service discovery and load balancing across containers.

Exam trap

The trap here is that candidates often confuse the ECS service discovery feature (which is just a configuration option) with a standalone AWS service, leading them to pick option C instead of recognizing that AWS Cloud Map is the underlying service that actually provides the discovery mechanism.

How to eliminate wrong answers

Option B is wrong because Elastic Load Balancing (ELB) is a load balancer that distributes traffic to targets, but it does not provide service discovery; it requires manual configuration of target groups and does not automatically register/deregister ECS services as they scale. Option C is wrong because Amazon ECS service discovery is not a standalone AWS service; it is a feature that leverages AWS Cloud Map under the hood, so the correct service to use is Cloud Map itself. Option D is wrong because Amazon Route 53 is a DNS service primarily for domain name resolution and routing internet traffic, not designed for dynamic service discovery of ephemeral containers in ECS; it lacks native integration with ECS task registration and health checks for service discovery.

Practice this question →

MCQeasy

A developer is building a serverless REST API using Amazon API Gateway and AWS Lambda. The API should return JSON responses to client requests. The developer is using the Lambda proxy integration. What is the simplest way to return a JSON response from the Lambda function?

A.Return a string from the Lambda handler.

B.Return a dictionary containing 'statusCode', 'headers', and 'body' with 'body' as a JSON string.

C.Use API Gateway integration response and mapping templates to transform the Lambda output.

D.Return a JSON object from Lambda and set a Content-Type header in the API Gateway method response.

AnswerB

This format precisely adheres to the API Gateway Lambda proxy integration contract, where the Lambda function is solely responsible for constructing the entire HTTP response. By returning a dictionary containing `statusCode`, `headers` (as a dictionary of key-value pairs), and a `body` field (which itself must be a string, often a JSON string), the Lambda function provides all necessary information for API Gateway to directly pass through to the client. This ensures the client receives a properly formatted HTTP response with the correct status, custom headers, and a valid JSON payload.

Why this answer

With Lambda proxy integration, API Gateway passes the entire request to the Lambda function and expects the function to return a specific response format. The simplest way to return a JSON response is to return a dictionary (or object) containing 'statusCode', 'headers', and 'body', where 'body' is a JSON string. This format is required by API Gateway to correctly interpret the Lambda output and forward it to the client.

Exam trap

The trap here is that candidates often think returning a JSON object directly from Lambda is sufficient, but they overlook the requirement that the body must be a JSON string and the response must include the exact 'statusCode', 'headers', and 'body' keys for API Gateway proxy integration to work correctly.

How to eliminate wrong answers

Option A is wrong because returning a plain string from the Lambda handler will cause API Gateway to fail or return an unexpected response, as it expects a properly formatted response object. Option C is wrong because using API Gateway integration response and mapping templates adds unnecessary complexity; with proxy integration, the Lambda function itself is responsible for formatting the response, and mapping templates are not used. Option D is wrong because simply returning a JSON object from Lambda without the required 'statusCode', 'headers', and 'body' structure will not be parsed correctly by API Gateway, and setting a Content-Type header in the method response does not address the required Lambda response format.

Practice this question →

MCQhard

A developer is building a real-time chat application using WebSocket APIs in Amazon API Gateway. The backend is an AWS Lambda function that stores connection IDs in an Amazon DynamoDB table. After a few days, the application stops working for new users. The developer checks CloudWatch Logs and sees that the Lambda function is returning 'AccessDeniedException' when calling DynamoDB. What is the MOST likely cause?

A.The Lambda function code was updated but the IAM role was not reattached.

B.The Lambda function uses an outdated AWS SDK version.

C.The API Gateway route was updated without redeploying the API.

D.The DynamoDB table was recreated and the Lambda function's IAM role still references the old table ARN.

AnswerD

When a DynamoDB table is recreated, it is assigned a completely new Amazon Resource Name (ARN), even if it has the same name. IAM policies grant permissions to specific resources, often identified by their ARN. If the Lambda function's IAM role policy explicitly referenced the old table's ARN, recreating the table invalidates that specific resource permission. Consequently, the Lambda function attempting to access the newly created table (with its new ARN) would correctly receive an AccessDeniedException because its IAM role lacks permission for that specific new resource.

Why this answer

The most likely cause is that the DynamoDB table was recreated, which changes its ARN. The Lambda function's IAM role still references the old table ARN, so when the function attempts to perform DynamoDB operations (e.g., PutItem for storing connection IDs), the request is denied because the role no longer has permissions on the new table. This is a common issue when infrastructure is rebuilt without updating IAM policies.

Exam trap

The trap here is that candidates may confuse 'AccessDeniedException' with a network or API configuration issue (like an outdated SDK or missing redeployment), rather than recognizing it as a classic IAM permissions problem tied to resource ARN changes.

How to eliminate wrong answers

Option A is wrong because IAM roles are attached to Lambda functions at the function level, not to the code; updating code does not detach the role. Option B is wrong because an outdated SDK version would cause errors like 'UnknownOperationException' or 'UnsupportedMediaType', not 'AccessDeniedException', which is an IAM permissions error. Option C is wrong because API Gateway route updates without redeployment would cause 404 or 503 errors at the API level, not an 'AccessDeniedException' from Lambda when calling DynamoDB.

Practice this question →

MCQmedium

A developer is using AWS CodePipeline to deploy a web application to an Auto Scaling group. The pipeline includes a deploy action that uses CodeDeploy. The deployment fails with the error: 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' Which of the following is the MOST likely cause?

A.The CodeDeploy agent is not sending logs to CloudWatch.

B.The deployment configuration has a minimum healthy instances setting that is too restrictive.

C.The application's lifecycle hooks are failing during the ApplicationStop event.

D.The instances were launched from an AMI that does not have the CodeDeploy agent installed.

AnswerB

CodeDeploy deployment configurations, such as `CodeDeployDefault.OneAtATime` or custom settings, include a `minimum healthy instances` threshold. If this setting is too restrictive, for example, requiring 100% of instances to remain healthy during a rolling update, the deployment will fail when even a single instance is taken offline for the update. The deployment cannot proceed if the number of healthy instances drops below the specified minimum, leading to a "too few healthy instances" error.

Why this answer

The error message indicates that the deployment failed because too many instances were unhealthy or failed. The most likely cause is that the deployment configuration's minimum healthy hosts setting is too restrictive, meaning it requires a higher percentage of healthy instances during deployment than the environment can sustain, causing CodeDeploy to stop the deployment when the threshold is breached.

Exam trap

The trap here is that candidates often confuse individual instance failures (e.g., missing agent, hook errors) with the deployment group-level threshold error, leading them to pick options that explain why a single instance failed rather than why the entire deployment was aborted.

How to eliminate wrong answers

Option A is wrong because the CodeDeploy agent not sending logs to CloudWatch would cause a lack of monitoring data, but it would not directly cause the deployment to fail with the given error; the deployment would proceed but logs would be missing. Option C is wrong because lifecycle hooks failing during the ApplicationStop event would cause individual instance failures, but the error message specifically points to a global deployment failure due to too few healthy instances, which is a deployment configuration issue, not a hook failure. Option D is wrong because if instances were launched from an AMI without the CodeDeploy agent, the agent would not run and the deployment would fail on each instance individually, but the error message about 'too few healthy instances' is a deployment group-level threshold issue, not a missing agent problem.

Practice this question →

MCQhard

A developer is building a REST API using API Gateway and Lambda. The API must support multiple HTTP methods and use a custom domain name with an SSL certificate. The developer wants to enable caching for the /products GET endpoint to reduce latency. Which step is essential to enable caching for this specific endpoint?

A.Set the TTL (time-to-live) for the /products GET method to a non-zero value.

B.Enable caching on the /products GET method and specify cache key parameters.

C.Flush the API cache to start fresh.

D.Enable caching on the API stage and set the 'Cache Status' to 'AVAILABLE'.

AnswerB

To implement caching for a specific API Gateway method like /products GET, caching must first be enabled at the API stage level. Subsequently, individual methods can be configured to utilize this cache. This involves explicitly enabling caching for the /products GET method and defining cache key parameters, which dictate how requests are uniquely identified for caching purposes, often including query string parameters, headers, or path parameters. This ensures relevant responses are stored and retrieved efficiently.

Why this answer

Enabling caching on a specific method (e.g., /products GET) in API Gateway allows you to configure cache key parameters, which control how the cache key is generated based on request parameters. This is essential for per-endpoint caching, as it ensures that only responses for the /products GET endpoint are cached, reducing latency for that specific method without affecting other endpoints.

Exam trap

The trap here is that candidates often confuse enabling caching at the stage level (which caches all methods) with enabling it on a specific method, and they overlook the requirement to specify cache key parameters for per-endpoint control.

How to eliminate wrong answers

Option A is wrong because setting a non-zero TTL on the /products GET method is not a step to enable caching; TTL is configured after caching is enabled and controls how long cached responses are retained, not the enabling itself. Option C is wrong because flushing the API cache clears existing cached data but does not enable caching; it is a maintenance action, not an enabling step. Option D is wrong because enabling caching on the API stage caches all methods in the stage by default, not specifically the /products GET endpoint, and the 'Cache Status' to 'AVAILABLE' is a status indicator, not an action to enable per-method caching.

Practice this question →

100

MCQhard

A developer is designing a serverless application that processes large files uploaded to Amazon S3. Each file can be up to 5 GB. The processing involves extracting metadata and generating thumbnails. The developer wants to minimize processing time and cost. Which approach should the developer take?

A.Use S3 Object Lambda to process the object as it is being retrieved.

B.Use an S3 event notification to invoke a Lambda function that copies the object to an EC2 instance for processing.

C.Use AWS Fargate to run a container that polls S3 for new objects and processes them.

D.Use an S3 event notification to invoke a Lambda function that downloads the file, processes it, and uploads results.

AnswerD

Correct. S3 event notifications invoke a Lambda function directly when a new object is created. This allows processing the file in a serverless manner, minimizing cost and complexity. The Lambda function can efficiently handle the file by streaming and processing within its limits.

Why this answer

S3 event notifications can trigger a Lambda function immediately after an object is uploaded. The Lambda function can download the file from S3, extract metadata and generate thumbnails, then store the results. This approach is serverless and cost-effective, as you pay only for compute time.

While Lambda has execution time and memory limits, processing a 5 GB file for metadata and thumbnails can be optimized to fit within these limits, making it the most appropriate choice among the options.

Exam trap

Candidates often choose S3 Object Lambda for any processing, but it only acts on data retrieval. For upload-triggered processing, S3 event notification with Lambda is the standard serverless pattern.

How to eliminate wrong answers

Option B is wrong because copying the object to an EC2 instance introduces significant latency and cost from provisioning and managing a virtual machine, plus the overhead of data transfer and instance startup, which is not optimal for a serverless, event-driven architecture. Option C is wrong because AWS Fargate requires polling S3 for new objects, which is inefficient compared to event-driven notifications, and running a container adds complexity and cost for a task that can be handled by a lightweight Lambda function. Option D is wrong because invoking a Lambda function to download a 5 GB file exceeds the Lambda function's maximum execution time (15 minutes) and memory (10 GB), and the entire file must be downloaded before processing begins, increasing latency and cost.

Practice this question →

101

MCQmedium

A company is using Amazon CloudFront to distribute static content from an S3 bucket. The content is updated frequently, but users see stale content. The developer wants to ensure that new content is served as soon as possible after an update. Which action should be taken?

A.Enable 'Origin Shield' to reduce the number of requests to S3.

B.Set the 'Minimum TTL' to 0 and 'Default TTL' to 0.

C.Set the 'Object Caching' to 0 in the CloudFront distribution.

D.Create a CloudFront invalidation for the updated files.

AnswerD

Creating a CloudFront invalidation request specifically targets and removes specified objects from all CloudFront edge caches globally. Upon successful invalidation, the next request for those objects at any edge location will result in CloudFront fetching the latest version directly from the origin. This is the most direct and effective method to ensure users immediately receive updated content after changes have been deployed to the origin, overriding any existing TTL settings.

Why this answer

CloudFront caches content at edge locations based on TTL settings. When content is updated in the S3 origin, existing cached copies remain stale until they expire or are explicitly invalidated. Creating a CloudFront invalidation for the updated files immediately removes the cached objects from all edge locations, forcing CloudFront to fetch the latest version from S3 on the next request.

This ensures new content is served as soon as possible after an update.

Exam trap

The trap here is that candidates confuse TTL configuration (which controls how long new objects are cached) with invalidation (which removes already-cached objects), leading them to pick options that only affect future caching behavior without addressing the stale content already served.

How to eliminate wrong answers

Option A is wrong because enabling Origin Shield reduces the number of requests to the S3 origin by consolidating them at a regional cache layer, but it does not force CloudFront to serve fresh content; it can actually increase staleness by adding another caching layer. Option B is wrong because setting Minimum TTL and Default TTL to 0 tells CloudFront to respect the Cache-Control max-age=0 header from the origin, but if the S3 object does not have that header (or has a higher max-age), CloudFront will still cache the content for the origin's specified duration; TTL settings alone do not purge already-cached content. Option C is wrong because 'Object Caching' is not a configurable numeric field in CloudFront; the correct setting is 'Minimum TTL', 'Maximum TTL', and 'Default TTL' under the 'Cache Based on Selected Request Headers' behavior, and setting these to 0 does not invalidate existing cached objects.

Practice this question →

102

Multi-Selectmedium

A DynamoDB query must support lookup by email address as well as by user ID. Which two changes may be required?

Select 2 answers

A.Create a secondary index with email as a key

B.Scan the full table for every login

C.Choose projection attributes needed by the query

D.Disable partition keys

AnswersA, C

This is the primary mechanism in DynamoDB to efficiently query data using an attribute other than the table's primary key. By defining a Global Secondary Index (GSI) with email as its partition key, DynamoDB builds a separate, sparse table that allows direct, high-performance lookups based on email addresses. This approach avoids costly full table scans and ensures predictable, low-latency access for user authentication or profile retrieval.

Why this answer

A Global Secondary Index (GSI) or Local Secondary Index (LSI) on the email attribute allows DynamoDB to efficiently query by email address without scanning the entire table. Since the primary key is user ID, querying by email requires an index that uses email as the partition key or sort key. Option C is correct because specifying projection attributes limits the data returned from the index or table, reducing read capacity consumption and improving performance.

Exam trap

The trap here is that candidates may think a Scan is acceptable for low-volume logins, but the exam emphasizes that any production authentication system must use an index to avoid full table scans and meet latency requirements.

Practice this question →

103

MCQmedium

A company is developing a serverless application using AWS Lambda and API Gateway. The application needs to process user uploads to Amazon S3. The Lambda function must be invoked asynchronously after an object is uploaded to an S3 bucket. Which configuration should the developer use to invoke the Lambda function?

A.Configure the S3 bucket to send events to Lambda by adding a Lambda trigger in the S3 bucket properties.

B.Configure the S3 bucket to send events to an Amazon SQS queue and have Lambda poll the queue.

C.Configure the S3 bucket to send events to Amazon CloudWatch Events and have CloudWatch invoke Lambda.

D.Configure the S3 bucket to send events to an Amazon API Gateway endpoint that triggers the Lambda function.

AnswerA

This is the most direct and efficient method. Amazon S3 natively supports event notifications, allowing you to configure a bucket to send events, such as s3:ObjectCreated:*, directly to an AWS Lambda function. When an object is uploaded, S3 asynchronously invokes the specified Lambda function, passing the event details as payload, which simplifies the architecture and minimizes latency. This setup requires granting S3 permissions to invoke the Lambda function.

Why this answer

S3 can directly invoke Lambda asynchronously via a bucket notification configuration. When an object is uploaded, S3 publishes an event to the Lambda service, which then executes the function without requiring any intermediary services. This is the simplest and most direct way to trigger a Lambda function from an S3 event.

Exam trap

The trap here is that candidates may overcomplicate the solution by introducing unnecessary intermediary services (like SQS or API Gateway) when the direct S3-to-Lambda trigger is the simplest and most appropriate asynchronous invocation method.

How to eliminate wrong answers

Option B is wrong because while S3 can send events to SQS and Lambda can poll the queue, this introduces unnecessary complexity and latency; the requirement is for asynchronous invocation, which S3-to-Lambda direct trigger already provides without an intermediary. Option C is wrong because S3 cannot send events directly to CloudWatch Events; S3 events can be sent to EventBridge (formerly CloudWatch Events) only via S3 Event Notifications configured for EventBridge, and even then, EventBridge would invoke Lambda, but this is not the standard or simplest configuration. Option D is wrong because routing S3 events through API Gateway adds an unnecessary HTTP layer and introduces potential latency and cost; API Gateway is designed for RESTful API endpoints, not for direct S3 event processing.

Practice this question →

104

MCQeasy

A developer is creating an AWS Lambda function to process events from an Amazon SQS queue. The function must process each message exactly once and in order. Which SQS queue type should the developer use?

A.Standard queue.

B.FIFO queue.

C.Dead-letter queue.

D.Delay queue.

AnswerB

Amazon SQS FIFO (First-In-First-Out) queues are designed to guarantee message ordering and exactly-once processing. They ensure that messages are processed in the exact order they are sent and prevent duplicates from being delivered to the consumer, thanks to message deduplication IDs and message group IDs. This makes FIFO queues ideal for applications where the sequence of operations and the prevention of duplicate processing are critical for data integrity.

Why this answer

FIFO queue. FIFO (First-In-First-Out) queues guarantee exactly-once processing and preserve the order of messages, which is required by the use case. Standard queues offer at-least-once delivery and do not guarantee order, making them unsuitable for this requirement.

Exam trap

The trap here is that candidates often confuse the 'exactly-once' and 'in-order' requirements with Standard queues, assuming they can achieve this with idempotent processing, but Standard queues explicitly do not guarantee order and can deliver duplicates.

How to eliminate wrong answers

Option A is wrong because Standard queues provide at-least-once delivery, meaning a message can be delivered more than once, and they do not guarantee message order. Option C is wrong because a Dead-letter queue is not a primary queue type; it is a secondary queue used to store messages that failed processing, not to process events in order with exactly-once semantics. Option D is wrong because a Delay queue is a feature of both Standard and FIFO queues that introduces a message delivery delay, but it does not provide exactly-once processing or ordering guarantees.

Practice this question →

105

MCQhard

A development team is building a real-time chat application using Amazon API Gateway WebSocket APIs and AWS Lambda. The application needs to maintain a connection to each user and broadcast messages to all connected clients. Which approach should the developer use to scale the application efficiently?

A.Store connection IDs in Amazon DynamoDB and use the API Gateway Management API to send messages to all connections.

B.Use Amazon ElastiCache to cache connection IDs and have Lambda send messages using the Redis pub/sub feature.

C.Use Amazon SNS to publish messages to all connected clients via the WebSocket API.

D.Use Amazon SQS to queue messages and have Lambda poll the queue to send messages to all connections.

AnswerA

This is the correct and standard architectural pattern for serverless WebSocket applications on AWS. When a client connects, API Gateway invokes an onConnect Lambda function which stores the unique connectionId in a DynamoDB table. To send a message to all connected clients, a backend service (e.g., another Lambda function) retrieves all active connectionId's from DynamoDB and then iteratively calls the API Gateway Management API's postToConnection action for each ID, pushing the message directly to the client.

Why this answer

DynamoDB provides a scalable, serverless key-value store to persist WebSocket connection IDs, and the API Gateway Management API allows Lambda to send messages directly to any connected client via its connection ID. This combination efficiently handles the broadcast requirement without managing infrastructure, as Lambda can iterate over stored connection IDs and call the Management API for each message.

Exam trap

The trap here is that candidates may confuse the pub/sub or queuing services (SNS, SQS, ElastiCache) as direct communication channels to WebSocket clients, overlooking that API Gateway requires the Management API for server-to-client messaging and that DynamoDB is the simplest way to store and retrieve connection IDs at scale.

How to eliminate wrong answers

Option B is wrong because ElastiCache with Redis pub/sub is designed for decoupled messaging between services, not for directly sending messages to WebSocket clients via API Gateway; it would require additional custom logic to map Redis channels to connection IDs and invoke the Management API. Option C is wrong because Amazon SNS is a pub/sub notification service that pushes messages to endpoints like HTTP/S, email, or Lambda, but it cannot directly send messages to WebSocket connections managed by API Gateway. Option D is wrong because Amazon SQS is a message queue that decouples producers and consumers, but it does not provide a mechanism to send messages to WebSocket clients; Lambda would still need to poll the queue and use the Management API, adding latency and complexity without benefit for real-time broadcasting.

Practice this question →

106

MCQmedium

A company runs a batch processing job on Amazon ECS using Fargate. The job processes files from an S3 bucket and writes results to another S3 bucket. The job runs once per day and takes about 30 minutes. The company wants to reduce costs by stopping the ECS service when not in use. Which solution should the developer implement?

A.Use an AWS Lambda function to run the job and configure a scheduled event in Amazon EventBridge.

B.Use AWS Batch with a Fargate launch type and schedule the job with Amazon EventBridge.

C.Use Amazon ECS Service Auto Scaling to scale the service down to zero tasks when not in use.

D.Use an Amazon EC2 Auto Scaling group to launch an instance, run the job, and then terminate.

AnswerB

AWS Batch is specifically designed for running batch computing workloads, efficiently managing job queues, compute environments, and job execution. Utilizing the Fargate launch type eliminates the need to provision and manage EC2 instances, providing a serverless experience where resources are automatically provisioned and scaled down to zero when jobs are not running. Scheduling the job with Amazon EventBridge ensures reliable, time-based invocation of the batch process, making this a robust, serverless, and cost-effective solution for a 30-minute batch job.

Why this answer

AWS Batch with a Fargate launch type is the ideal solution because it is purpose-built for batch processing jobs that run to completion. By scheduling the job with Amazon EventBridge, you can trigger the job once per day, and AWS Batch automatically provisions the Fargate compute environment only when the job runs, then scales down to zero after completion—eliminating costs during idle periods. This approach directly addresses the requirement to reduce costs by stopping the ECS service when not in use, without manual intervention.

Exam trap

The trap here is that candidates often confuse ECS Service Auto Scaling with AWS Batch's job-based scaling; while ECS can scale to zero tasks, it does not automatically manage job completion and termination, leading to residual costs and complexity, whereas AWS Batch is designed for exactly this use case.

How to eliminate wrong answers

Option A is wrong because while a Lambda function could process files from S3, it has a maximum execution timeout of 15 minutes, which is insufficient for a job that takes about 30 minutes, and it cannot directly write results to another S3 bucket in the same manner as a batch job. Option C is wrong because Amazon ECS Service Auto Scaling can scale the desired count to zero, but it does not automatically stop the service after the job completes; the service remains defined and incurs costs for the Fargate infrastructure even at zero tasks (e.g., load balancer or network costs), and it lacks native job scheduling and lifecycle management for batch workloads. Option D is wrong because using an EC2 Auto Scaling group to launch an instance for a 30-minute job is inefficient; it requires managing the instance lifecycle, patching, and termination, and incurs costs for the running instance and associated resources, whereas Fargate with AWS Batch provides a serverless, cost-effective alternative that scales to zero automatically.

Practice this question →

107

MCQeasy

A developer is deploying a containerized application on Amazon ECS using Fargate. The application needs to store sensitive configuration data, including database passwords, that must be rotated regularly. Which service should the developer use to manage these secrets securely?

A.Amazon S3 with server-side encryption

B.AWS Secrets Manager

C.Amazon DynamoDB with server-side encryption

D.AWS Systems Manager Parameter Store

AnswerB

Secrets Manager provides automatic secret rotation and fine-grained access control.

Why this answer

AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, retrieving, and automatically rotating sensitive configuration data such as database passwords. It integrates natively with Amazon ECS (via the `secrets` container definition parameter) and supports automatic rotation using AWS Lambda, which meets the requirement for regular rotation without custom code.

Exam trap

The trap here is that candidates often confuse AWS Systems Manager Parameter Store (which can store secrets but lacks native rotation) with AWS Secrets Manager, overlooking the explicit requirement for 'regular rotation' in the question.

How to eliminate wrong answers

Option A is wrong because Amazon S3 with server-side encryption provides static encryption at rest but lacks native secret rotation capabilities and does not integrate directly with ECS task definitions for injecting secrets as environment variables. Option C is wrong because Amazon DynamoDB with server-side encryption is a NoSQL database service designed for high-performance data storage, not for managing secrets with built-in rotation or fine-grained access control for secret lifecycle management. Option D is wrong because AWS Systems Manager Parameter Store can store secrets (using SecureString parameters) but does not support automatic rotation of secrets; it requires custom automation to rotate values, whereas the question explicitly requires regular rotation.

Practice this question →

108

MCQmedium

A company has a DynamoDB table that stores order data. The table has a partition key of OrderID and a sort key of OrderDate. The company frequently queries orders by CustomerID, which is not a key attribute. The queries are slow and consume a lot of read capacity. Which design change would MOST improve query performance?

A.Increase the provisioned read capacity for the table.

B.Create a Global Secondary Index (GSI) with CustomerID as the partition key.

C.Change the table's primary key to use CustomerID as the partition key.

D.Use a FilterExpression on the CustomerID attribute in a Scan operation.

AnswerB

Creating a Global Secondary Index (GSI) with `CustomerID` as its partition key is the most effective solution for efficiently querying items based on `CustomerID`. A GSI stores a copy of a subset of the base table's attributes, indexed by its own primary key (in this case, `CustomerID`). This allows `Query` operations to directly access items matching a specific `CustomerID` without scanning the entire base table, significantly improving performance and reducing cost for targeted lookups.

Why this answer

Creating a Global Secondary Index (GSI) with CustomerID as the partition key allows DynamoDB to efficiently query orders by CustomerID using the index's key structure, avoiding full table scans. This directly addresses the slow performance and high read capacity consumption by enabling targeted lookups instead of scanning all items and filtering.

Exam trap

The trap here is that candidates often think increasing provisioned capacity (Option A) or using FilterExpression (Option D) will fix performance, but they fail to recognize that these do not change the underlying inefficient data access pattern of scanning all items.

How to eliminate wrong answers

Option A is wrong because increasing provisioned read capacity only adds more throughput capacity but does not change the underlying query pattern; the query still performs a full Scan or inefficient query, so it would still be slow and consume more capacity units. Option C is wrong because changing the table's primary key to CustomerID would break existing access patterns that rely on OrderID as the partition key, and it would not support queries by OrderID without a separate index. Option D is wrong because using a FilterExpression on a Scan operation still reads every item in the table, consuming the same amount of read capacity and providing no performance improvement; FilterExpressions only reduce the data returned, not the data read.

Practice this question →

109

MCQeasy

A developer wants to upload a large file (5 GB) to an Amazon S3 bucket using the AWS SDK. Which approach is MOST efficient and resilient?

A.Generate a presigned URL and use a third-party tool to upload.

B.Invoke an AWS Lambda function to upload the file.

C.Use the Multipart Upload API to upload the file in parts.

D.Use the PutObject API call with the entire file.

AnswerC

The Amazon S3 Multipart Upload API is the recommended and most efficient method for uploading large objects, specifically designed for files up to 5 TB. It allows a 5 GB file to be broken into smaller, independently uploaded parts, significantly improving throughput and resilience. This approach enables parallel uploads, easy resumption of failed parts, and enhanced fault tolerance against network issues, making it ideal for this scenario.

Why this answer

The Multipart Upload API is specifically designed for large objects (over 100 MB, recommended for 5 GB). It allows uploading a file in parallel parts, which improves throughput and resilience by enabling retries of individual failed parts without restarting the entire upload. This approach also supports pausing and resuming uploads, making it the most efficient and resilient method for a 5 GB file.

Exam trap

The trap here is that candidates may assume the PutObject API (Option D) is sufficient for large files because it supports up to 5 GB, but they overlook the lack of parallel uploads and partial failure recovery, which the Multipart Upload API provides and is explicitly recommended by AWS for files over 100 MB.

How to eliminate wrong answers

Option A is wrong because generating a presigned URL delegates the upload to a third-party tool, which introduces external dependencies and does not inherently provide the parallel upload or retry capabilities of the Multipart Upload API, reducing resilience and control. Option B is wrong because invoking an AWS Lambda function to upload the file is inefficient; Lambda has a maximum execution timeout of 15 minutes and a deployment package size limit of 250 MB (unzipped), making it unsuitable for handling a 5 GB upload directly, and it adds unnecessary complexity and latency. Option D is wrong because the PutObject API call has a maximum object size limit of 5 GB in a single PUT operation, but it does not support parallel uploads or partial retries; if the upload fails, the entire file must be re-uploaded, making it less resilient and efficient for large files compared to Multipart Upload.

Practice this question →

110

MCQeasy

A developer has an Amazon S3 bucket containing private user documents. The application must generate a time-limited URL for users to download their own documents without requiring the users to have AWS credentials. Which solution should the developer use?

A.Use CloudFront signed URLs with an origin access identity (OAI) to restrict access to the S3 bucket.

B.Create a pre-signed URL for each object using the AWS SDK with an appropriate expiration time.

C.Set a bucket policy that allows public read access for the specific users based on their IP addresses.

D.Provide the users with IAM user credentials that have read access to the bucket.

AnswerB

Creating a pre-signed URL for each object using the AWS SDK is the most secure and efficient method for granting temporary access to private S3 objects. This URL, generated with the developer's AWS credentials and a specified expiration time, allows any recipient to perform a specific action (e.g., GET) on the object directly from S3 without needing their own AWS credentials. It provides granular, time-limited access, perfectly aligning with the need for secure access to private user documents.

Why this answer

Pre-signed URLs allow temporary, time-limited access to private S3 objects without requiring the user to have AWS credentials. The developer generates the URL server-side using the AWS SDK, embedding an expiration time, and the user can download the object directly via HTTP GET. This meets the requirement of granting ephemeral access to specific documents for unauthenticated users.

Exam trap

The trap here is that candidates often confuse pre-signed URLs with CloudFront signed URLs, thinking the CDN is required for time-limited access, but pre-signed URLs work directly with S3 and are simpler for single-object, time-limited downloads without needing CloudFront.

How to eliminate wrong answers

Option A is wrong because CloudFront signed URLs with OAI are used to control access at the CDN edge, but they still require the developer to manage CloudFront distributions and signing keys; the question asks for a simpler, direct S3 solution without requiring users to have AWS credentials. Option C is wrong because setting a bucket policy for public read access based on IP addresses would expose the bucket to all users from those IPs, violating the requirement for per-user, per-document private access and not providing time-limited URLs. Option D is wrong because providing IAM user credentials to end users is a security anti-pattern; it would require distributing long-term credentials, violating the principle of least privilege and the requirement that users not have AWS credentials.

Practice this question →

111

MCQmedium

A developer is building a serverless application using AWS Lambda to process events from Amazon S3. The Lambda function needs to persist data to an Amazon RDS MySQL database. Which of the following is the MOST secure way to pass database credentials to the Lambda function?

A.Store the credentials in an S3 bucket with server-side encryption and read them in the Lambda function.

B.Use IAM database authentication for MySQL and assign an IAM role to the Lambda function.

C.Hardcode the credentials as environment variables in the Lambda function configuration.

D.Store the credentials in AWS Secrets Manager and retrieve them in the Lambda function code.

AnswerD

Secrets Manager provides secure storage and automatic rotation.

Why this answer

AWS Secrets Manager provides a secure, auditable, and automated way to store and retrieve database credentials. The Lambda function can assume an IAM role with permissions to access the secret, and retrieve the credentials at runtime using the AWS SDK, avoiding hardcoding or insecure storage. This approach also supports automatic rotation of credentials, enhancing security.

Exam trap

The trap here is that candidates may believe IAM database authentication (Option B) is not supported for RDS MySQL, but it is actually supported for MySQL 5.7 and 8.0. However, the question asks for the 'MOST secure' method. While IAM database authentication is secure, AWS Secrets Manager provides additional benefits such as automatic credential rotation, fine-grained access control, and audit logging, making it the most secure and recommended approach for managing database credentials in a serverless application.

How to eliminate wrong answers

Option A is wrong because storing credentials in an S3 bucket, even with server-side encryption, introduces additional complexity and risk: the Lambda function must manage decryption, and S3 access policies must be carefully configured, but more critically, this approach does not provide native secret rotation or fine-grained audit logging like Secrets Manager. Option B is wrong because IAM database authentication for MySQL is not supported by Amazon RDS MySQL; it is only supported for Amazon RDS Aurora MySQL and Amazon RDS PostgreSQL. Option C is wrong because hardcoding credentials as environment variables exposes them in plaintext in the Lambda function configuration, which can be viewed by anyone with access to the Lambda console or API, and they are not automatically rotated.

Practice this question →

112

MCQmedium

A developer is building a serverless application using AWS Step Functions. The workflow must execute hundreds of thousands of short-lived tasks per day, each taking less than 30 seconds. The tasks need to run in parallel, and a small number of duplicate executions are acceptable. Which type of Step Functions workflow should the developer choose?

A.Standard Workflow

B.Express Workflow

C.AWS Lambda function with synchronous invocation

D.Amazon Simple Workflow Service (SWF)

AnswerB

Express Workflows are optimized for high-volume, short-duration executions (under 5 minutes) with at-least-once delivery. They can handle hundreds of thousands of executions per second at a lower cost, making them suitable for this use case.

Why this answer

Express Workflows are designed for high-volume, short-duration (under 5 minutes) event-processing workloads, executing hundreds of thousands of state transitions per second with at-least-once semantics. Since the tasks are short-lived (under 30 seconds), run in parallel, and tolerate a small number of duplicate executions, Express Workflow is the correct choice because it offers lower cost and higher throughput than Standard Workflow, which guarantees exactly-once execution and is better suited for long-running, auditable workflows.

Exam trap

The trap here is that candidates often assume Standard Workflow is always the default choice for Step Functions, overlooking the specific requirements for high throughput, short duration, and tolerance for duplicates that make Express Workflow the correct answer.

How to eliminate wrong answers

Option A is wrong because Standard Workflow is designed for long-running, durable workflows with exactly-once execution and a maximum execution duration of one year, making it over-provisioned and more expensive for high-volume, short-lived tasks where duplicate executions are acceptable. Option C is wrong because AWS Lambda synchronous invocation is not a Step Functions workflow type; it is a compute invocation pattern that lacks the orchestration, state management, and parallel execution capabilities provided by Step Functions. Option D is wrong because Amazon Simple Workflow Service (SWF) is a legacy service for long-running, human-in-the-loop workflows, not optimized for high-throughput, short-lived automated tasks, and it requires managing workers and deciders, adding operational overhead.

Practice this question →

113

MCQeasy

A developer needs to analyze real-time streaming data from thousands of devices. The data consists of JSON messages that must be processed and stored in Amazon S3. Which AWS service should the developer use to ingest and buffer the streaming data?

A.Amazon S3

B.AWS Lambda

C.Amazon Simple Queue Service (SQS)

D.Amazon Kinesis Data Streams

AnswerD

Amazon Kinesis Data Streams is a fully managed, scalable service specifically engineered for real-time ingestion, processing, and analysis of large streams of data records. It provides the necessary throughput and low latency to capture continuous data from various sources, making it ideal for real-time analytics, log processing, and live dashboards. Multiple applications can concurrently consume data from a stream, enabling diverse real-time use cases.

Why this answer

Amazon Kinesis Data Streams is designed for real-time ingestion and buffering of large-scale streaming data, such as JSON messages from thousands of devices. It can capture and store data in shards for up to 365 days, allowing downstream consumers (e.g., Lambda, Kinesis Data Analytics) to process the data before storing it in Amazon S3. This makes it the correct choice for ingesting and buffering the streaming data before persistent storage.

Exam trap

The trap here is that candidates often confuse Amazon SQS with Kinesis Data Streams, but SQS is a pull-based queue for decoupling microservices, not a streaming data platform with shard-based parallelism and long-term retention, which is required for ingesting high-throughput real-time data from thousands of devices.

How to eliminate wrong answers

Option A is wrong because Amazon S3 is an object storage service, not a streaming ingestion or buffer service; it cannot ingest real-time streaming data directly without an intermediary like Kinesis or API Gateway. Option B is wrong because AWS Lambda is a serverless compute service that can process streaming data but is not designed to ingest or buffer data; it runs on demand and has a maximum execution timeout of 15 minutes, making it unsuitable as a primary ingestion buffer. Option C is wrong because Amazon SQS is a message queue service for decoupling applications, but it is not optimized for real-time streaming from thousands of devices; it lacks shard-level parallelism, has a maximum message size of 256 KB, and does not support ordered replay or long-term buffering like Kinesis Data Streams.

Practice this question →

114

MCQmedium

A REST API requires request validation before invoking Lambda to reduce unnecessary function executions for malformed payloads. Where should validation be configured?

A.Inside the Lambda timeout setting

B.In the IAM execution role

C.In the S3 bucket policy

D.In API Gateway request models and validators

AnswerD

API Gateway provides built-in request validation capabilities through the use of request models and validators. Developers can define JSON Schema models for the request body, headers, and query parameters. When enabled for a specific API method, API Gateway automatically validates incoming requests against these defined models *before* invoking the backend integration, such as a Lambda function, returning a 400 Bad Request error for invalid payloads.

Why this answer

API Gateway provides built-in request validation using models (JSON Schema) and validators. By configuring validation at the API Gateway layer, malformed payloads are rejected before they reach the Lambda function, reducing unnecessary invocations and associated costs. This is the correct approach because API Gateway acts as the entry point for REST APIs and can enforce payload structure without invoking the backend.

Exam trap

The trap here is that candidates may confuse Lambda's execution role or timeout settings with request validation, not realizing that API Gateway is the correct layer to filter malformed payloads before they trigger Lambda.

How to eliminate wrong answers

Option A is wrong because the Lambda timeout setting controls how long a function can run, not whether it is invoked; it cannot prevent invocation for malformed payloads. Option B is wrong because the IAM execution role defines permissions for the Lambda function to access other AWS services, not request validation. Option C is wrong because S3 bucket policies control access to S3 objects, not API request validation; they are unrelated to REST API payload checking.

Practice this question →

115

MCQmedium

A developer is using Amazon S3 to host a static website. The website uses JavaScript to fetch data from an API Gateway endpoint. Users report that the website loads but API calls fail with HTTP 403 errors. The developer checks the S3 bucket policy and finds it allows public read access. What is the most likely cause?

A.The S3 bucket policy blocks access from the API Gateway domain.

B.The S3 bucket is not configured for static website hosting.

C.The API Gateway API key is not included in the JavaScript code.

D.The S3 bucket does not have CORS configuration to allow cross-origin requests from the API Gateway domain.

AnswerC

When an API Gateway method is configured to require an API key, every incoming request must include a valid `x-api-key` header. If the JavaScript code making the API call omits this essential header, or provides an incorrect or expired key, API Gateway will reject the request with a `403 Forbidden` status code. This indicates that the request reached API Gateway but was denied due to a lack of proper authentication credentials.

Why this answer

The website loads from S3, but the API calls to API Gateway fail with 403. This is often due to missing API key. If the API Gateway endpoint requires an API key and the JavaScript code does not include it in the request headers, API Gateway returns a 403 Forbidden error.

Option C is correct because the most likely cause is that the API key is not included in the JavaScript code, leading to the 403 response.

Exam trap

Candidates often confuse CORS issues with API key requirements. While CORS can cause errors, a 403 Forbidden error from API Gateway often indicates that an API key is required but not provided. The trap is to assume it is a CORS problem without checking the API key requirement.

How to eliminate wrong answers

Option A is wrong because the S3 bucket policy controls access to S3 objects, not outbound API calls from JavaScript; the 403 error originates from the browser's CORS enforcement, not from S3 blocking the API Gateway domain. Option B is wrong because the website loads successfully, confirming static website hosting is already enabled; the issue is with cross-origin API calls, not S3 hosting configuration. Option C is wrong because API keys are optional for API Gateway and, if required, would cause a 403 from API Gateway itself (e.g., 'Missing Authentication Token'), not a browser-level CORS 403; the error is due to missing CORS headers, not missing API keys.

Practice this question →

116

MCQmedium

A company is using Amazon S3 to store sensitive documents. The security team requires that all data be encrypted at rest using AWS KMS with a Customer Managed Key (CMK). The developer enabled default encryption on the S3 bucket with the CMK. However, some PUT requests are failing with 'Access Denied'. What is the MOST likely cause?

A.The S3 bucket's object ownership is set to BucketOwnerPreferred.

B.The KMS key policy does not grant the IAM user/role permissions to use the key.

C.The KMS key is in a different AWS Region than the S3 bucket.

D.The S3 bucket policy denies PutObject without encryption.

AnswerB

When an IAM user or role attempts to upload an object to S3 using server-side encryption with AWS KMS (SSE-KMS), S3 makes a request to AWS KMS on behalf of the uploader to generate a data key. This operation specifically requires the IAM principal to have `kms:GenerateDataKey` permissions on the specified AWS KMS key. If the KMS key policy does not explicitly allow or implicitly denies this action for the calling principal, the `PutObject` request will fail with an `Access Denied` error because S3 cannot obtain the necessary encryption key from KMS.

Why this answer

When default encryption is enabled on an S3 bucket with a KMS CMK, the S3 service uses the CMK to encrypt objects at rest. However, the IAM user or role making the PUT request must have explicit permissions to use that CMK, typically via the kms:GenerateDataKey and kms:Decrypt actions in the KMS key policy. If the key policy does not grant these permissions to the principal, the request fails with an 'Access Denied' error, even though the bucket policy and IAM permissions are otherwise correct.

Exam trap

The trap here is that candidates often assume enabling default encryption on the bucket is sufficient, overlooking that the IAM principal must also be explicitly authorized to use the KMS key via the key policy or IAM policy.

How to eliminate wrong answers

Option A is wrong because S3 bucket object ownership (BucketOwnerPreferred) controls whether objects uploaded by other AWS accounts are owned by the bucket owner, not encryption permissions; it does not cause 'Access Denied' on PUT requests when using a CMK. Option C is wrong because KMS keys are regional resources, and S3 buckets can only use KMS keys from the same region as the bucket; if the key were in a different region, the bucket configuration would fail at setup, not cause intermittent PUT failures. Option D is wrong because a bucket policy denying PutObject without encryption would cause failures for unencrypted requests, but the developer has already enabled default encryption with the CMK, so requests are encrypted; the error is due to KMS key permissions, not encryption enforcement.

Practice this question →

117

Multi-Selecteasy

A developer is troubleshooting an AWS Lambda function that is timing out. The function is configured with a 3-second timeout. Which of the following could cause the function to timeout? (Choose THREE.)

Select 3 answers

A.The function's reserved concurrency is set to 0.

B.The function has a dead-letter queue configured.

C.The function is configured to access a VPC without a NAT gateway.

D.The function experiences a cold start.

E.The function's deployment package is larger than 50 MB.

AnswersC, D, E

When a Lambda function is configured to access a VPC but lacks a NAT gateway, outbound internet traffic fails. If the function makes external calls (e.g., to DynamoDB or external APIs), these requests will hang until the function times out.

Why this answer

Lambda timeouts occur when the function execution exceeds the configured timeout. Option A is incorrect because setting reserved concurrency to 0 causes immediate throttling (TooManyRequestsException), not a timeout. Option B is incorrect because a dead-letter queue is for asynchronous invocation failures, not timeouts.

Option C is correct: if the function is in a VPC without a NAT gateway, it cannot access external networks, leading to network timeouts. Option D is correct: cold starts can delay execution due to initialization, potentially exceeding the timeout. Option E is correct: a deployment package larger than 50 MB can increase cold start time significantly, causing the function to timeout.

Exam trap

Candidates may mistakenly think reserved concurrency of 0 causes a timeout, but it actually causes immediate throttling. The real trap is that cold starts and large deployment packages can both contribute to timeouts, especially when the timeout is short.

Practice this question →

118

MCQeasy

A developer wants to invoke an AWS Lambda function every hour to perform a maintenance task. Which AWS service should be used to schedule the invocation?

A.Amazon Simple Queue Service (SQS)

B.AWS Step Functions

C.Amazon CloudWatch Events (EventBridge)

D.Amazon Simple Notification Service (SNS)

AnswerC

Amazon CloudWatch Events, now largely integrated into Amazon EventBridge, is the definitive AWS service for triggering Lambda functions on a schedule. It enables developers to create rules that define specific time-based patterns, such as cron expressions or fixed-rate intervals, to directly invoke target Lambda functions. This provides a robust, serverless, and highly scalable solution for automating periodic tasks and time-driven events within the AWS ecosystem.

Why this answer

Amazon CloudWatch Events (now part of Amazon EventBridge) is the correct service for scheduling periodic invocations of AWS Lambda functions. It allows you to create a rule with a cron or rate expression (e.g., `rate(1 hour)`) that triggers the Lambda function on a defined schedule. This is the native, serverless way to run code on a recurring timer without managing any infrastructure.

Exam trap

The trap here is that candidates often confuse 'scheduling' with 'messaging' and pick SQS or SNS, not realizing that only EventBridge (CloudWatch Events) provides native cron/rate-based triggers for Lambda.

How to eliminate wrong answers

Option A is wrong because Amazon SQS is a message queue service for decoupling application components; it does not have a built-in scheduler to invoke Lambda on a recurring schedule. Option B is wrong because AWS Step Functions is a workflow orchestration service that can invoke Lambda, but it is designed for stateful, multi-step processes, not for simple time-based scheduling (it lacks native cron/rate triggers). Option D is wrong because Amazon SNS is a pub/sub notification service; it can trigger Lambda from messages, but it cannot generate scheduled events on its own.

Practice this question →

119

MCQeasy

A developer is building a serverless application and wants to invoke an AWS Lambda function every hour to perform a cleanup task. Which AWS service should the developer use to schedule the invocation?

A.AWS Step Functions

B.Amazon SNS

C.Amazon SQS

D.Amazon EventBridge (CloudWatch Events)

AnswerD

Amazon EventBridge, which evolved from CloudWatch Events, is a serverless event bus service that makes it easy to connect applications together using data from your own applications, integrated SaaS applications, and AWS services. It excels at creating rules that match incoming events and route them to targets, including Lambda functions. Crucially, EventBridge supports cron-like expressions and fixed-rate schedules, making it the ideal service for invoking Lambda functions at specified times or recurring intervals.

Why this answer

Amazon EventBridge (formerly CloudWatch Events) is the correct service for scheduling AWS Lambda invocations on a recurring basis. It provides a cron or rate expression to trigger a Lambda function at a defined interval, such as every hour, without the need for managing any servers or additional infrastructure.

Exam trap

The trap here is that candidates often confuse Amazon EventBridge with Amazon CloudWatch Logs or assume Step Functions is needed for any time-based workflow, but Step Functions is for stateful orchestration, not simple scheduled invocations.

How to eliminate wrong answers

Option A is wrong because AWS Step Functions is a workflow orchestration service designed to coordinate multiple AWS services into state machines, not for scheduling standalone recurring events. Option B is wrong because Amazon SNS is a pub/sub messaging service for sending notifications or fan-out messages, not a scheduler for invoking Lambda on a time-based trigger. Option C is wrong because Amazon SQS is a message queue service for decoupling application components; it cannot initiate Lambda invocations based on a time schedule.

Practice this question →

120

MCQhard

A company is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed to deploy.' The CodeDeploy agent logs show that the BeforeInstall lifecycle event script returned a non-zero exit code. What is the MOST likely cause of this issue?

A.The application revision is missing from the S3 bucket.

B.The BeforeInstall script has a bug that causes it to exit with a non-zero status.

C.The IAM instance profile does not have permissions to call CodeDeploy APIs.

D.The CodeDeploy agent is not running on the instances.

AnswerB

CodeDeploy strictly interprets any non-zero exit status from a lifecycle event script, such as BeforeInstall, as a critical failure. This indicates that the script, intended to prepare the environment or install prerequisites, did not complete successfully. Consequently, the deployment on that specific instance is immediately halted, and the overall deployment is marked as failed, preventing further potentially problematic steps.

Why this answer

The error message explicitly states that the CodeDeploy agent logs show the BeforeInstall lifecycle event script returned a non-zero exit code. This directly indicates that the script itself failed during execution, which is the most likely cause of the deployment failure. The BeforeInstall script is a custom script run by the CodeDeploy agent on each instance, and a non-zero exit code signals an error condition that halts the deployment for that instance.

Exam trap

The trap here is that candidates often confuse a script failure (non-zero exit code) with infrastructure or permission issues, but the question explicitly provides the agent log detail pointing to the BeforeInstall script, making the script bug the direct and most likely cause.

How to eliminate wrong answers

Option A is wrong because if the application revision were missing from the S3 bucket, the error would occur earlier in the process (during the download phase) and the CodeDeploy agent logs would show a different error, such as 'Failed to download revision' or a 403/404 HTTP status code, not a non-zero exit code from the BeforeInstall script. Option C is wrong because insufficient IAM instance profile permissions to call CodeDeploy APIs would prevent the agent from registering with the service or pulling deployment instructions, resulting in errors like 'Unable to register instance' or 'AccessDeniedException', not a script exit code failure. Option D is wrong because if the CodeDeploy agent were not running, the instances would not appear in the deployment at all, and the error would be 'No instances found' or 'Instance not available', not a script execution failure with a non-zero exit code.

Practice this question →

121

MCQmedium

A developer is building a RESTful API using Amazon API Gateway and Lambda. The API should support CORS for a specific origin (https://example.com) and allow only GET and POST methods. Which configuration in the OPTIONS method response will satisfy these requirements?

A.Access-Control-Allow-Origin: https://example.com, Access-Control-Allow-Methods: GET,POST

B.Access-Control-Allow-Origin: *, Access-Control-Allow-Methods: GET,POST,OPTIONS

C.Access-Control-Allow-Origin: https://example.com, Access-Control-Allow-Methods: GET,POST,OPTIONS

D.Access-Control-Allow-Origin: https://example.com, Access-Control-Allow-Headers: Content-Type

AnswerA

This configuration correctly specifies `https://example.com` as the only permitted origin, adhering to the principle of least privilege for cross-origin requests. By listing `GET,POST` in `Access-Control-Allow-Methods`, the server explicitly informs the browser which actual HTTP methods are allowed for the resource, satisfying the preflight request's requirements without exposing unnecessary methods like `OPTIONS` itself.

Why this answer

The OPTIONS method response must include the `Access-Control-Allow-Origin` header set to the specific origin `https://example.com` to restrict CORS access, and the `Access-Control-Allow-Methods` header must list only the allowed HTTP methods (`GET,POST`). The OPTIONS method itself is a preflight request and does not need to be listed in the allowed methods; it is automatically handled by the browser. This configuration satisfies the requirement of supporting CORS for a single origin and only GET and POST methods.

Exam trap

The trap here is that candidates often mistakenly include `OPTIONS` in the `Access-Control-Allow-Methods` header, thinking it must be listed because the preflight request uses that method, but the correct behavior is to only list the actual HTTP methods (GET, POST) that the API supports for the main request.

How to eliminate wrong answers

Option B is wrong because it uses a wildcard origin (`*`), which does not satisfy the requirement for a specific origin (`https://example.com`), and it incorrectly includes `OPTIONS` in the allowed methods list, which is unnecessary and could cause confusion. Option C is wrong because it includes `OPTIONS` in the `Access-Control-Allow-Methods` header; the OPTIONS method is the preflight request itself and should not be listed as an allowed method in the response. Option D is wrong because it specifies `Access-Control-Allow-Headers` instead of `Access-Control-Allow-Methods`, and it omits the required `Access-Control-Allow-Methods` header entirely, so the browser would not know which HTTP methods are permitted.

Practice this question →

122

MCQeasy

A developer is creating a CI/CD pipeline for a serverless application using AWS CodePipeline. The application consists of an AWS Lambda function, an Amazon API Gateway REST API, and an Amazon DynamoDB table. Which action should the developer take to automate the deployment of the API Gateway updates?

A.Use AWS Lambda to update the API Gateway configuration.

B.Store the API Gateway Swagger file in Amazon S3 and trigger a deployment.

C.Use AWS CloudFormation to define and deploy the API Gateway.

D.Use AWS CodeBuild to compile and deploy the API Gateway configuration.

AnswerC

AWS CloudFormation is the recommended and most robust service for defining and deploying AWS resources, including API Gateway, as Infrastructure as Code (IaC). It allows developers to declaratively specify the entire API Gateway configuration in a template, enabling automated, repeatable, and version-controlled deployments with built-in rollback capabilities, which is crucial for maintaining consistency and reliability in CI/CD pipelines.

Why this answer

AWS CloudFormation provides infrastructure as code (IaC) capabilities that allow you to define the entire API Gateway configuration, including resources, methods, integrations, and deployment stages, in a template. When integrated with CodePipeline, CloudFormation can automatically create or update the API Gateway and trigger a deployment as part of the CI/CD pipeline, ensuring consistent and repeatable deployments without manual intervention.

Exam trap

The trap here is that candidates often assume CodeBuild or a custom Lambda function is needed for deployment, but the exam tests whether you recognize that CloudFormation is the native, fully managed IaC service that integrates seamlessly with CodePipeline for deploying API Gateway updates.

How to eliminate wrong answers

Option A is wrong because using a Lambda function to update API Gateway configuration directly via API calls is not a recommended or scalable CI/CD practice; it bypasses infrastructure as code, lacks versioning, and makes rollbacks and auditing difficult. Option B is wrong because simply storing a Swagger file in S3 does not automatically trigger a deployment; you would need additional automation (e.g., a Lambda function or CloudFormation) to import the Swagger definition and create a deployment, making this an incomplete solution. Option D is wrong because CodeBuild is designed to compile source code and run tests, not to deploy API Gateway configurations; it lacks the native capability to manage API Gateway resources and deployments, which is better handled by CloudFormation or the AWS CLI.

Practice this question →

123

MCQmedium

A developer is deploying a web application on AWS Elastic Beanstalk. The application requires a fixed IP address for outbound traffic to a third-party API. What is the MOST cost-effective solution?

A.Launch the environment in a VPC with a NAT Gateway in a public subnet.

B.Attach an Internet Gateway to the VPC.

C.Use a VPC endpoint for the third-party API.

D.Assign an Elastic IP to each EC2 instance.

AnswerA

This is the correct approach for instances in private subnets needing outbound internet access to third-party APIs while maintaining private IP addresses. A NAT Gateway, deployed in a public subnet, allows instances in private subnets to initiate outbound connections to the internet. All outbound traffic from these private instances will appear to originate from the NAT Gateway's Elastic IP address, providing a consistent and fixed public IP for the third-party API to whitelist, which is crucial for security policies.

Why this answer

A NAT Gateway in a public subnet provides a fixed public IP address for outbound traffic from private subnets, enabling the web application to communicate with the third-party API while remaining secure. Elastic Beanstalk environments are typically launched in private subnets, and the NAT Gateway is the most cost-effective managed service for this purpose compared to a NAT instance or assigning Elastic IPs to each EC2 instance.

Exam trap

The trap here is that candidates often confuse a NAT Gateway with an Internet Gateway, thinking the latter provides outbound IPs, or they incorrectly assume a VPC endpoint can be used for any external API, when it is limited to AWS services.

How to eliminate wrong answers

Option B is wrong because an Internet Gateway only allows inbound and outbound traffic to and from the internet for resources with public IPs; it does not provide a fixed outbound IP for instances in private subnets. Option C is wrong because a VPC endpoint is used for private connectivity to AWS services (e.g., S3, DynamoDB) via the AWS network, not for accessing third-party APIs over the internet. Option D is wrong because assigning an Elastic IP to each EC2 instance is not cost-effective (each Elastic IP incurs charges when not associated with a running instance) and does not scale well; it also exposes instances directly to the internet, increasing security risks.

Practice this question →

124

MCQeasy

A developer is writing an AWS Lambda function that processes messages from an Amazon SQS queue. The function should process each message at least once, but duplicates are acceptable. The function is triggered by a Lambda event source mapping. If the function returns an error, what happens to the message?

A.The message is sent to a dead-letter queue (DLQ).

B.The message is deleted from the queue to prevent duplicate processing.

C.Lambda automatically retries the function with a 1-minute delay.

D.The message remains in the queue and becomes visible after the visibility timeout expires.

AnswerD

When an AWS Lambda function fails to process a message from an SQS queue, the Lambda service does not delete the message. Instead, the message remains in the SQS queue, but it stays hidden from other consumers due to the in-flight visibility timeout that was initiated when Lambda received it. Upon the expiration of this visibility timeout, the message automatically becomes visible again in the queue, making it available for another Lambda invocation attempt or consumption by another service.

Why this answer

When a Lambda function invoked by an SQS event source mapping returns an error, the message is not deleted from the queue. Instead, it remains in the queue and becomes visible again after the visibility timeout expires. This allows the function to retry processing the message, ensuring at-least-once processing.

The default behavior is to retry based on the queue's redrive policy, not to immediately send the message to a DLQ or delete it.

Exam trap

The trap here is that candidates often assume Lambda automatically deletes failed messages or immediately sends them to a DLQ, but the actual behavior is that the message remains in the queue and becomes visible again after the visibility timeout expires, allowing for retries.

How to eliminate wrong answers

Option A is wrong because a message is only sent to a dead-letter queue (DLQ) after the maximum number of retries specified in the queue's redrive policy is exhausted, not on the first error. Option B is wrong because Lambda does not delete a message from the queue on error; deletion only occurs after successful processing to prevent duplicate processing. Option C is wrong because Lambda does not automatically retry with a fixed 1-minute delay; the retry timing is controlled by the SQS visibility timeout, which is configurable and not set to 1 minute by default.

Practice this question →

125

MCQhard

A developer is deploying a microservices architecture on Amazon ECS using Fargate launch type. The services need to communicate with each other. The developer wants to use service discovery so that services can find each other by name. Which AWS service should the developer use?

A.Amazon Route 53 private hosted zones

B.Amazon ECR

C.Application Load Balancer

D.AWS Cloud Map

AnswerD

AWS Cloud Map is the correct choice because it provides a fully managed service discovery solution that allows microservices to locate each other dynamically. It integrates natively with Amazon ECS, automatically registering and deregistering service instances as they scale up or down. This enables applications to discover service endpoints using either API calls or DNS queries, simplifying inter-service communication in a dynamic containerized environment.

Why this answer

AWS Cloud Map is the correct choice because it is a cloud resource discovery service that allows microservices to register their DNS names and health checks, enabling dynamic service discovery. With Amazon ECS and Fargate, services can use AWS Cloud Map namespaces (either API-based or DNS-based) to resolve each other by logical service names, which is essential for inter-service communication in a microservices architecture.

Exam trap

The trap here is that candidates often confuse Route 53 private hosted zones with AWS Cloud Map, not realizing that Cloud Map provides the dynamic registration and health check integration needed for ephemeral containers, whereas Route 53 alone requires manual record management.

How to eliminate wrong answers

Option A is wrong because Amazon Route 53 private hosted zones provide DNS resolution within a VPC but lack the dynamic service registration, health checking, and API-based discovery features that AWS Cloud Map offers for ephemeral Fargate tasks. Option B is wrong because Amazon ECR is a container image registry used for storing and retrieving Docker images, not for service discovery or DNS resolution. Option C is wrong because an Application Load Balancer distributes incoming traffic to targets but does not provide service discovery by name; it is a load balancing layer, not a naming or registration service.

Practice this question →

126

MCQhard

A service publishes order events to SNS. Several consumers need different filtered subsets of events without changing publisher code. What should the developer configure?

A.Separate AWS accounts for each consumer

B.Lambda code that discards unwanted events after invocation

C.SNS subscription filter policies

D.SQS long polling only

AnswerC

SNS subscription filter policies are the most direct and efficient solution for this requirement. These policies allow each subscriber to define specific rules based on message attributes or the message body. Only messages that fully match a subscriber's defined filter policy are delivered to that particular endpoint, ensuring consumers receive only the relevant "order events" they need. This prevents unnecessary message delivery and optimizes downstream processing by filtering at the source.

Why this answer

SNS subscription filter policies allow each consumer to define a JSON policy on their subscription that selectively delivers only messages matching specified attributes (e.g., event type, region). This enables multiple consumers to receive different filtered subsets of the same SNS topic without modifying the publisher's code, as the filtering happens server-side at the SNS service level.

Exam trap

The trap here is that candidates often confuse client-side filtering (Option B) with server-side filtering, or assume that SQS long polling (Option D) can filter messages, when in fact SNS subscription filter policies are the only native AWS mechanism for server-side message subsetting without publisher changes.

How to eliminate wrong answers

Option A is wrong because separate AWS accounts do not provide message filtering; they would require duplicating the SNS topic and publisher logic across accounts, adding complexity without solving the subset requirement. Option B is wrong because discarding unwanted events in Lambda after invocation wastes compute resources and incurs unnecessary costs, as the Lambda function is still triggered for every message, defeating the purpose of server-side filtering. Option D is wrong because SQS long polling only controls how often the consumer polls for messages, not which messages are delivered; it does not filter message content or attributes.

Practice this question →

127

MCQeasy

A developer is building a serverless REST API using Amazon API Gateway and AWS Lambda. The API will be consumed by a web application hosted on a different domain. The developer needs to enable Cross-Origin Resource Sharing (CORS) for all HTTP methods. What is the most efficient way to achieve this?

A.Enable CORS on the API Gateway resource using the 'Enable CORS' feature in the API Gateway console, which adds the OPTIONS method and appropriate headers.

B.In the Lambda function code, add the 'Access-Control-Allow-Origin' header to every response.

C.Configure Amazon CloudFront in front of API Gateway to handle CORS.

D.Set a bucket policy on the S3 bucket that hosts the web application to allow cross-origin requests.

AnswerA

Enabling CORS directly on the API Gateway resource is the correct and most efficient solution. API Gateway's built-in CORS feature automatically configures the necessary preflight OPTIONS method for the resource. It also injects the required Access-Control-Allow-Origin, Access-Control-Allow-Methods, and Access-Control-Allow-Headers into the method responses and integration responses, ensuring browsers can successfully make cross-origin requests to your API.

Why this answer

API Gateway's 'Enable CORS' feature automatically creates an OPTIONS method for the selected resource and configures the necessary response headers (e.g., Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers) to handle preflight requests. This is the most efficient approach as it centralizes CORS configuration at the API Gateway layer, eliminating the need for manual header management in Lambda or additional infrastructure.

Exam trap

The trap here is that candidates assume adding CORS headers only in the Lambda function code is sufficient, overlooking the mandatory preflight OPTIONS request that API Gateway must handle separately.

How to eliminate wrong answers

Option B is wrong because while adding headers in Lambda is necessary for the actual response, it does not handle the preflight OPTIONS request that browsers send before cross-origin requests; without a proper OPTIONS response, CORS will fail. Option C is wrong because CloudFront does not natively handle CORS preflight requests; it can pass through headers but still requires the origin (API Gateway) to be properly configured for CORS, making it an unnecessary extra layer. Option D is wrong because S3 bucket policies control access to S3 objects, not API Gateway endpoints; CORS for the API must be configured on the API Gateway resource itself, not on the web application's hosting bucket.

Practice this question →

128

MCQhard

A developer is building an application that uses Amazon DynamoDB as a data store. The application reads the same item frequently but writes rarely. The developer wants to reduce read costs. Which DynamoDB feature should the developer use?

A.DynamoDB Accelerator (DAX)

B.DynamoDB Global Tables

C.DynamoDB Auto Scaling

D.Time to Live (TTL)

AnswerA

DynamoDB Accelerator (DAX) is an in-memory cache designed to provide microsecond response times for read-heavy workloads, significantly reducing the number of read capacity units (RCUs) consumed from the underlying DynamoDB table. When an application reads data through DAX, if the item is in the cache, it's served directly, bypassing DynamoDB and incurring no RCU cost. This makes DAX highly effective for applications requiring low-latency access to frequently read data, directly lowering operational costs associated with read throughput.

Why this answer

DynamoDB Accelerator (DAX) is an in-memory cache that reduces read latency from single-digit milliseconds to microseconds. Since the application reads the same item frequently but writes rarely, DAX can serve repeated read requests from its cache, significantly reducing the number of read capacity units consumed against the DynamoDB table and thus lowering read costs.

Exam trap

The trap here is that candidates often confuse DAX with ElastiCache or assume that Auto Scaling reduces costs, but DAX is the only DynamoDB-native service that directly reduces read costs by caching frequently accessed items.

How to eliminate wrong answers

Option B is wrong because Global Tables provide multi-region replication for disaster recovery and low-latency writes, not read cost reduction. Option C is wrong because Auto Scaling adjusts provisioned throughput based on traffic patterns but does not reduce per-read costs; it only prevents throttling. Option D is wrong because Time to Live (TTL) automatically expires old items to reduce storage costs, not read costs.

Practice this question →

129

MCQhard

A company runs a containerized application on Amazon ECS using the Fargate launch type. The application needs to store temporary data that must persist across container restarts but does not need to be shared across multiple tasks. The data should be automatically deleted when the task stops. Which storage option should the developer use?

A.Attach an Amazon EBS volume to the task.

B.Use the ephemeral storage provided by Fargate.

C.Mount an Amazon EFS file system to the container.

D.Create a Docker volume using the 'tmpfs' driver.

AnswerB

Fargate tasks are provisioned with a certain amount of ephemeral storage, typically 20 GB by default, which is local to the task's underlying compute environment. This storage is designed for temporary data, such as application logs, caches, or scratch space, and persists for the entire lifecycle of the Fargate task. While it is deleted once the task stops, it remains available and consistent across restarts of individual containers within that same task, making it suitable for short-lived data that doesn't require long-term persistence.

Why this answer

Fargate provides ephemeral storage (up to 20 GB by default) that persists data across container restarts within the same task but is automatically deleted when the task stops. This matches the requirement for temporary data that does not need to be shared across tasks and is cleaned up upon task termination.

Exam trap

The trap here is that candidates confuse 'persist across container restarts' with 'persist across task stops,' leading them to choose Amazon EFS or EBS, which are designed for long-term persistence, while Fargate's ephemeral storage perfectly meets the temporary, task-scoped requirement.

How to eliminate wrong answers

Option A is wrong because Amazon EBS volumes cannot be directly attached to Fargate tasks; EBS volumes are only supported with EC2 launch type and require instance-level attachment, not task-level. Option C is wrong because Amazon EFS provides persistent, shared file storage that persists beyond the task lifecycle and is designed for multi-task sharing, which contradicts the requirement for data to be automatically deleted when the task stops. Option D is wrong because Docker volumes using the 'tmpfs' driver store data in memory, not on disk, and do not persist across container restarts; they are ephemeral and lost when the container stops.

Practice this question →

130

MCQhard

A developer is deploying a web application on Amazon EKS. The application needs to read configuration data from an Amazon S3 bucket at startup. The developer wants to ensure that the configuration is securely accessed without embedding AWS credentials in the application code. Which solution should the developer use?

A.Use IAM roles for service accounts (IRSA) to assign an IAM role to the pod.

B.Store the AWS credentials in AWS Secrets Manager and retrieve them at startup.

C.Assign an IAM instance profile to the EC2 instances running the EKS nodes.

D.Embed the AWS access key and secret key in a Kubernetes ConfigMap.

AnswerA

IAM roles for service accounts (IRSA) is the recommended and most secure method for granting AWS permissions to applications running in EKS pods. It leverages an OpenID Connect (OIDC) provider associated with the EKS cluster to allow Kubernetes service accounts to assume specific IAM roles. This mechanism provides fine-grained, pod-level permissions, ensuring that each pod receives only the necessary temporary AWS credentials, thereby adhering strictly to the principle of least privilege and enhancing overall security.

Why this answer

IAM roles for service accounts (IRSA) allows you to associate an IAM role with a Kubernetes service account, which the pod can assume to obtain temporary AWS credentials via the AWS STS endpoint. This eliminates the need to embed long-term credentials in the application code or environment variables, and the credentials are automatically rotated by the AWS SDK. The pod retrieves the configuration from S3 using the assumed role's permissions, ensuring secure access.

Exam trap

The trap here is that candidates may confuse IRSA with IAM instance profiles, thinking that assigning a role to the node is sufficient, but IRSA is the correct method for pod-level IAM permissions in EKS.

How to eliminate wrong answers

Option B is wrong because storing AWS credentials in AWS Secrets Manager still requires the application to retrieve them at startup, which introduces a credential management overhead and a potential attack surface if the retrieval itself is not secured; it does not eliminate the need to handle long-term credentials. Option C is wrong because assigning an IAM instance profile to the EC2 nodes grants permissions to all pods running on those nodes, violating the principle of least privilege and potentially allowing unintended access to the S3 bucket. Option D is wrong because embedding AWS access keys in a Kubernetes ConfigMap exposes the credentials in plaintext within the cluster, which is a severe security risk and violates AWS best practices.

Practice this question →

131

MCQmedium

A developer is using AWS CodePipeline to automate deployments. The pipeline has a manual approval action that requires a developer to approve before deploying to production. The developer wants to receive an email notification when an approval action is pending. Which AWS service should be used to send the notification?

A.Amazon Simple Email Service (SES)

B.AWS Lambda

C.Amazon Simple Notification Service (SNS)

D.Amazon CloudWatch Logs

AnswerC

Amazon Simple Notification Service (SNS) is a highly scalable, fully managed pub/sub messaging service that enables you to send messages to a large number of subscribers or endpoints. CodePipeline natively integrates with SNS, allowing developers to configure notifications for pipeline state changes, approval actions, or execution failures to an SNS topic. This topic can then reliably deliver these alerts via various protocols, including email, SMS, or to other AWS services, making it the direct and most efficient solution for email notifications.

Why this answer

Amazon Simple Notification Service (SNS) is the correct choice because it is a pub/sub messaging service designed to send notifications to subscribers via email, SMS, or other protocols. CodePipeline can publish events to an SNS topic when an approval action is pending, and the developer can subscribe an email endpoint to that topic to receive the notification directly.

Exam trap

The trap here is that candidates may confuse Amazon SES with SNS because both can send emails, but SES is a dedicated email-sending service requiring manual integration, whereas SNS is the native event notification service that directly integrates with CodePipeline's approval actions.

How to eliminate wrong answers

Option A is wrong because Amazon Simple Email Service (SES) is a platform for sending transactional and marketing emails, but it is not integrated with CodePipeline's event-driven notifications; SES requires explicit API calls or SMTP configuration and does not natively subscribe to CodePipeline events. Option B is wrong because AWS Lambda is a compute service that can process events, but it is not a notification delivery service; while Lambda could be used to send emails via SES, it adds unnecessary complexity and is not the direct service for sending email notifications from a CodePipeline approval action. Option D is wrong because Amazon CloudWatch Logs is a service for storing, monitoring, and accessing log files; it does not send notifications and is not designed for real-time alerting to email endpoints.

Practice this question →

132

Multi-Selecteasy

A developer is using AWS Step Functions to orchestrate a workflow. The developer wants to handle errors and retries for a task. Which TWO fields can be used in a state definition to configure error handling? (Choose TWO.)

Select 2 answers

A.Retry

B.Catch

C.FailureState

D.ErrorOutput

E.ErrorAction

AnswersA, B

In AWS Step Functions, the "Retry" field within a state definition allows a developer to specify a retry policy for transient errors. It defines which errors ("ErrorEquals"), how many times ("MaxAttempts"), and with what delay ("IntervalSeconds" and "BackoffRate") the state should be re-executed before failing. This mechanism is crucial for building resilient workflows that can automatically recover from temporary issues without manual intervention.

Why this answer

The `Retry` field in an AWS Step Functions state definition defines an array of retry policies, specifying which errors to retry, the maximum number of retry attempts, the interval between retries, and the backoff rate. Option B is correct because the `Catch` field defines an array of fallback states or state machine transitions that are executed when a specific error occurs after all retry attempts are exhausted, allowing the workflow to handle errors gracefully.

Exam trap

The trap here is that candidates often confuse the `Retry` and `Catch` fields with non-existent fields like `FailureState` or `ErrorAction`, or they mistakenly think `ErrorOutput` is used to capture error details, when in fact Step Functions uses `ResultPath` to include error information in the state output.

Practice this question →

133

MCQeasy

A developer is building a web application that requires user authentication. The application will run on Amazon EC2 instances behind an Application Load Balancer. The developer wants to offload authentication to a managed service that supports social login providers. Which AWS service should the developer use?

A.AWS Identity and Access Management (IAM)

B.Amazon Cognito

C.AWS Directory Service

D.AWS Single Sign-On

AnswerB

Amazon Cognito is the correct choice because it is specifically engineered to provide secure and scalable user directories for web and mobile applications. Cognito User Pools enable easy sign-up, sign-in, and access control for application users, supporting multi-factor authentication and integration with social identity providers like Google, Facebook, and Apple. It offloads the complexity of user management and authentication from your application backend.

Why this answer

Amazon Cognito is the correct choice because it is a fully managed identity service designed for web and mobile applications, providing user authentication, authorization, and support for social login providers (e.g., Google, Facebook, Amazon) via OAuth 2.0 and OpenID Connect. It offloads the entire authentication workflow from the EC2 instances and ALB, integrating seamlessly with the ALB's authentication action to validate tokens before traffic reaches the application.

Exam trap

The trap here is that candidates often confuse IAM's role-based access control with user authentication, overlooking that IAM cannot handle social login providers or external user identity federation for customer-facing apps.

How to eliminate wrong answers

Option A is wrong because AWS IAM is for managing AWS service access and permissions for users and roles, not for external user authentication with social login providers; it lacks built-in support for social identity federation. Option C is wrong because AWS Directory Service provides managed Microsoft Active Directory or LDAP-based directories for enterprise identity, which does not natively support social login providers like Google or Facebook. Option D is wrong because AWS Single Sign-On (now AWS IAM Identity Center) is designed for workforce identity and SSO across AWS accounts and business applications, not for customer-facing web app authentication with social logins.

Practice this question →

134

MCQmedium

A developer is using Amazon DynamoDB as the data store for a serverless application. The application experiences high read traffic, and the developer wants to reduce latency. The data is not frequently updated. Which DynamoDB feature should the developer use?

A.DynamoDB Auto Scaling

B.DynamoDB Global Tables

C.DynamoDB Accelerator (DAX)

D.DynamoDB Time to Live (TTL)

AnswerC

DynamoDB Accelerator (DAX) is a fully managed, highly available, in-memory cache specifically designed for DynamoDB. It provides microsecond response times for read-heavy workloads by caching items and query results, significantly reducing the load on the underlying DynamoDB table. DAX acts as a transparent proxy, allowing applications to continue using the DynamoDB API while benefiting from accelerated read performance.

Why this answer

DynamoDB Accelerator (DAX) is a fully managed, in-memory cache that reduces read latency for DynamoDB tables from single-digit milliseconds to microseconds. Since the data is not frequently updated, DAX can serve repeated read requests from its cache without hitting the underlying table, making it ideal for high-read, low-write workloads.

Exam trap

The trap here is that candidates may confuse DAX with Global Tables, thinking that replicating data across regions reduces latency, but the question specifies reducing latency within a single region, where DAX's in-memory caching is the correct solution.

How to eliminate wrong answers

Option A is wrong because DynamoDB Auto Scaling adjusts provisioned throughput capacity based on traffic patterns, which helps manage cost and performance but does not reduce read latency. Option B is wrong because DynamoDB Global Tables provide multi-region replication for disaster recovery and low-latency reads across regions, but they do not improve read latency within a single region. Option D is wrong because DynamoDB Time to Live (TTL) automatically deletes expired items to manage storage costs, and has no impact on read performance or latency.

Practice this question →

135

Multi-Selecthard

A Lambda function processes a batch of SQS messages. Which two configurations reduce duplicate or failed-message impact?

Select 2 answers

A.Set visibility timeout to zero

B.Use a visibility timeout longer than expected processing time

C.Disable the dead-letter queue

D.Configure a dead-letter queue and partial batch response where appropriate

AnswersB, D

Utilizing an SQS visibility timeout that is longer than the expected message processing time is a fundamental best practice for reliable asynchronous processing. This ensures that once a Lambda function receives a message, it has sufficient exclusive time to process it successfully and delete it from the queue before it becomes visible to other consumers. This prevents duplicate processing attempts and ensures that each message is handled at least once without unnecessary retries by other instances.

Why this answer

A visibility timeout longer than the expected processing time prevents other consumers from reprocessing a message while it is still being handled, reducing duplicates. Option D is correct because a dead-letter queue captures messages that repeatedly fail processing, allowing analysis and preventing them from blocking the queue, while partial batch response enables the function to return a list of failed message IDs so that only those messages become visible again, reducing reprocessing of successful ones.

Exam trap

The trap here is that candidates often think setting visibility timeout to zero or disabling the DLQ simplifies processing, but in reality, these actions increase duplicate or failed-message impact by removing mechanisms that control reprocessing and isolate problematic messages.

Practice this question →

136

MCQhard

A developer is using AWS CodeDeploy to deploy a new version of an application to an Auto Scaling group. The deployment fails because the new instances do not pass the health check. The developer wants to automatically roll back the deployment if the health check fails. Which CodeDeploy setting should be configured?

A.Set the deployment configuration to AllAtOnce to speed up the process.

B.Configure a lifecycle hook to terminate failing instances.

C.Use a blue/green deployment strategy instead of in-place.

D.Enable automatic rollback in the deployment group configuration.

AnswerD

Enabling automatic rollback within the CodeDeploy deployment group configuration is the most direct and effective solution for ensuring recovery from problematic deployments. This feature allows CodeDeploy to monitor the health of a new deployment using specified CloudWatch alarms or other health checks. Upon detecting a failure, it automatically reverts all instances in the deployment group to the last known good application revision, minimizing downtime and operational overhead by providing a self-healing mechanism.

Why this answer

AWS CodeDeploy provides a built-in automatic rollback feature that can be configured at the deployment group level. When enabled, if a deployment fails (e.g., due to health check failures), CodeDeploy automatically reverts to the last known successful deployment, ensuring minimal downtime and manual intervention.

Exam trap

The trap here is that candidates often confuse deployment strategies (like blue/green or in-place) with rollback mechanisms, not realizing that rollback is a separate configuration setting that must be explicitly enabled regardless of the deployment strategy.

How to eliminate wrong answers

Option A is wrong because changing the deployment configuration to AllAtOnce does not enable rollback; it only deploys to all instances simultaneously, which could increase the blast radius of a failed deployment. Option B is wrong because lifecycle hooks are used to perform custom actions (e.g., draining connections) during instance launch or termination, not to trigger automatic rollbacks of a deployment. Option C is wrong because while blue/green deployment can reduce risk, it does not inherently provide automatic rollback on health check failure; rollback must be explicitly enabled in the deployment group configuration.

Practice this question →

137

MCQeasy

A developer is designing a REST API using Amazon API Gateway that experiences high traffic with many repeated requests for the same data. The developer wants to reduce backend load and improve response times. Which feature should the developer enable on the API Gateway method?

A.Enable API Gateway caching

B.Implement caching in the Lambda function using a local cache

C.Use an Amazon ElastiCache Redis cluster and modify the Lambda function to check the cache first

D.Place an Amazon CloudFront distribution in front of API Gateway

AnswerA

Enabling API Gateway caching directly addresses the problem by storing responses from the backend integration (e.g., Lambda) for a configurable Time-To-Live (TTL). This significantly reduces the number of identical requests that reach the backend service, offloading the compute and database resources. It operates at the API Gateway layer, making it highly efficient for repeated requests to the same API method and improving overall API responsiveness.

Why this answer

API Gateway caching stores responses from backend endpoints for a configurable Time-to-Live (TTL). When a request for the same data arrives, API Gateway serves the cached response directly without invoking the backend, reducing load and improving latency. This is the most straightforward and managed solution for repeated requests at the API layer.

Exam trap

The trap here is that candidates may overcomplicate the solution by choosing a distributed cache like ElastiCache or a CDN like CloudFront, when the simplest and most cost-effective managed service (API Gateway caching) directly addresses the requirement at the API layer.

How to eliminate wrong answers

Option B is wrong because implementing a local cache inside a Lambda function is ephemeral and not shared across concurrent invocations, so it cannot reduce backend load for repeated requests from different clients. Option C is wrong because while ElastiCache Redis can cache data, it requires additional code in the Lambda function to check the cache first, adding complexity and latency compared to API Gateway's built-in caching. Option D is wrong because CloudFront caches content at the edge, but it does not reduce backend load for API Gateway itself unless combined with API Gateway caching; CloudFront alone still forwards cache misses to API Gateway, which then invokes the backend.

Practice this question →

138

Multi-Selectmedium

A developer is designing a highly available application using Amazon SQS and AWS Lambda. Which TWO strategies should the developer implement to ensure that messages are processed at least once? (Choose TWO.)

Select 2 answers

A.Configure a Dead Letter Queue (DLQ) to capture failed messages.

B.Enable long polling on the SQS queue.

C.Use a FIFO queue to ensure exactly-once processing.

D.Set the SQS queue's visibility timeout to be greater than the Lambda function's timeout.

E.Use the SQS DeleteMessage API inside the Lambda function only after successful processing.

AnswersD, E

Setting the SQS queue's visibility timeout to be greater than the Lambda function's timeout is crucial for at-least-once processing. If the Lambda function fails or times out before successfully processing and deleting a message, the message will automatically become visible again in the queue once the SQS visibility timeout expires. This ensures that another consumer or a subsequent invocation of the Lambda function can pick up and re-process the message, guaranteeing it is processed at least once.

Why this answer

Setting the SQS queue's visibility timeout to be greater than the Lambda function's timeout ensures that if the Lambda function fails or times out, the message becomes visible again in the queue after the visibility timeout expires, allowing another consumer to retry processing. This prevents messages from being lost due to processing failures, supporting at-least-once processing. Option E is correct because calling the SQS DeleteMessage API only after successful processing ensures that the message is not removed from the queue until it has been fully and correctly handled, so if processing fails, the message remains available for retry.

Exam trap

The trap here is that candidates often confuse the purpose of a Dead Letter Queue (DLQ) as a mechanism for ensuring at-least-once processing, when in fact it is for isolating messages that have exhausted retries, not for guaranteeing delivery.

Practice this question →

139

MCQeasy

A developer is building a serverless application using AWS Lambda. The function needs to access an S3 bucket to read a configuration file. What is the best way to provide the Lambda function with the bucket name?

A.Hardcode the bucket name in the Lambda function code.

B.Store the bucket name in an environment variable for the Lambda function.

C.Read the bucket name from a text file stored in the same bucket.

D.Use a KMS key to encrypt the bucket name and decrypt it in the function.

AnswerB

Storing the S3 bucket name in an environment variable is the recommended and most efficient method for passing configuration data to an AWS Lambda function. Environment variables are easily configured through the AWS Management Console, CLI, or Infrastructure as Code tools like CloudFormation or Terraform, allowing updates without modifying or redeploying the function's code. This promotes separation of configuration from code, enhances flexibility across different deployment environments, and improves operational agility.

Why this answer

AWS Lambda environment variables provide a secure, configurable, and decoupled way to pass the S3 bucket name to the function without hardcoding it in the code. This follows the principle of infrastructure as code and allows the same function code to be reused across different environments (e.g., dev, staging, prod) by simply changing the environment variable value. Environment variables are encrypted at rest by default using AWS KMS, ensuring the bucket name is not exposed in plaintext within the code repository.

Exam trap

The trap here is that candidates may overcomplicate the solution by choosing KMS encryption (Option D) or the circular dependency of reading from the same bucket (Option C), when the simplest and most secure approach—environment variables—is the correct answer for decoupling configuration from code.

How to eliminate wrong answers

Option A is wrong because hardcoding the bucket name in the Lambda function code violates the separation of configuration from code, making the function environment-specific and requiring code changes to point to a different bucket. Option C is wrong because reading the bucket name from a text file stored in the same bucket creates a circular dependency: the function needs the bucket name to access the bucket, but it must first read the file from the bucket to get the name, which is impossible without prior knowledge of the bucket. Option D is wrong because using a KMS key to encrypt the bucket name and decrypt it in the function adds unnecessary complexity and overhead; environment variables are already encrypted at rest by default, and the bucket name is not sensitive data that requires custom encryption—this approach does not solve the configuration problem.

Practice this question →

140

MCQmedium

A Lambda function needs temporary scratch space larger than the default while processing images. Which setting should be adjusted?

A.Reserved concurrency

B.Ephemeral storage size for /tmp

C.Function URL auth type

D.Dead-letter queue target

AnswerB

The ephemeral storage size for the "/tmp" directory directly controls the amount of local, temporary disk space available to a Lambda function during its execution. By increasing this configurable setting, a function can access more scratch space than the default 512 MB, which is essential for processing larger files or datasets locally. This directly fulfills the requirement for a larger temporary scratch space within the Lambda execution environment.

Why this answer

Lambda functions have a default /tmp storage of 512 MB, which is insufficient for large image processing tasks. Adjusting the ephemeral storage size (up to 10,240 MB) provides the necessary scratch space for temporary files, such as intermediate image buffers or resized outputs, without requiring external storage like EFS.

Exam trap

The trap here is that candidates confuse ephemeral storage with memory allocation or external storage services, assuming that increasing the function's memory or using S3 will solve the scratch space issue, when the /tmp directory is the only directly configurable scratch space within the Lambda execution environment.

How to eliminate wrong answers

Option A is wrong because reserved concurrency controls the maximum number of concurrent executions for a function, not storage capacity. Option C is wrong because the function URL auth type (e.g., AWS_IAM or NONE) determines authentication for HTTP invocations, not storage. Option D is wrong because a dead-letter queue target (e.g., SQS or SNS) is used for capturing failed asynchronous invocations, not for providing scratch space.

Practice this question →

141

MCQhard

A company runs a microservices architecture on Amazon ECS with Fargate. Each service exposes an HTTP API and needs to be accessible only from the company's internal network via a VPN. The services are deployed in private subnets. What is the MOST secure and scalable way to expose these services?

A.Create a VPC Endpoint service powered by PrivateLink and a Network Load Balancer in front of the services.

B.Place an Application Load Balancer in public subnets and point to the services' target groups.

C.Use a NAT Gateway to allow inbound traffic from the VPN to the services.

D.Use an Internet Gateway and route traffic from the VPN to the services.

AnswerA

A VPC Endpoint service, powered by AWS PrivateLink, enables secure, private connectivity from other VPCs or on-premises networks (via VPN/Direct Connect) to services hosted within your VPC. By placing a Network Load Balancer (NLB) in front of the ECS services, the PrivateLink endpoint can expose these services securely. This setup ensures traffic remains entirely within the AWS network and your private network, bypassing the public internet and maintaining strict security for internal-only access.

Why this answer

AWS PrivateLink with a VPC Endpoint service and a Network Load Balancer (NLB) allows you to expose services running in private subnets to other VPCs or on-premises networks via VPN without traversing the public internet. The NLB handles TCP traffic at Layer 4, and the VPC Endpoint service provides secure, scalable connectivity by creating elastic network interfaces in the consumer VPC, ensuring traffic stays within the AWS network. This approach is both secure (no public exposure) and scalable (NLB handles high throughput and availability).

Exam trap

The trap here is that candidates often confuse NAT Gateway (outbound only) with a solution for inbound traffic, or they assume an ALB in public subnets is acceptable because it can be restricted via security groups, but that still exposes the services to the internet at the network layer.

How to eliminate wrong answers

Option B is wrong because placing an Application Load Balancer in public subnets would expose the services to the internet, violating the requirement that services be accessible only from the internal network via VPN. Option C is wrong because a NAT Gateway is used for outbound traffic from private subnets to the internet, not for inbound traffic from a VPN; it cannot accept inbound connections initiated from outside the VPC. Option D is wrong because an Internet Gateway is designed for direct internet access, and routing VPN traffic through it would expose services to the public internet, defeating the purpose of private subnets and internal-only access.

Practice this question →

142

MCQmedium

A company is building a serverless application using AWS Lambda to process user uploads to Amazon S3. The Lambda function needs to access a DynamoDB table to store metadata. What is the MOST secure way to grant the Lambda function access to DynamoDB?

A.Store IAM user access keys in the Lambda function's environment variables.

B.Use a resource-based policy on the DynamoDB table to allow the Lambda function's ARN.

C.Create an IAM role with a policy that grants DynamoDB access and attach it to the Lambda function.

D.Hardcode the DynamoDB credentials in the Lambda function code.

AnswerC

Using an IAM role is the secure way to grant permissions to Lambda functions.

Why this answer

AWS Lambda uses an IAM role (execution role) to obtain temporary credentials via the AWS Security Token Service (STS). Attaching a policy that grants DynamoDB access to this role follows the principle of least privilege and avoids long-term credentials. This is the standard, secure pattern for granting Lambda functions access to other AWS services.

Exam trap

The trap here is that candidates confuse resource-based policies (which work for services like S3 and SQS) with the need for an execution role for Lambda, leading them to incorrectly select Option B, even though DynamoDB does not support resource-based policies for granting access to Lambda functions.

How to eliminate wrong answers

Option A is wrong because storing IAM user access keys in environment variables introduces long-term credentials that can be leaked, and it violates the AWS best practice of using temporary credentials via IAM roles. Option B is wrong because resource-based policies on DynamoDB tables cannot grant access to a Lambda function directly; DynamoDB does not support resource-based policies for Lambda invocation, and the Lambda function still needs an execution role to assume permissions. Option D is wrong because hardcoding credentials in code is insecure, makes rotation difficult, and violates the principle of never embedding secrets in application code.

Practice this question →

143

MCQeasy

A developer needs to send large files (up to 5 GB) from a web application to Amazon S3. The application runs on EC2 instances. Which approach is MOST efficient and reliable?

A.Save the file to EC2 instance store and then copy to S3.

B.Upload the file as a single S3 PutObject operation.

C.Use S3 multipart upload to upload the file in parts.

D.Use S3 Transfer Acceleration to upload the file.

AnswerC

S3 multipart upload is the recommended and most efficient method for uploading large objects, especially those exceeding 100 MB, and is required for objects larger than 5 GB. This method breaks the file into smaller, independent parts, which can be uploaded concurrently, significantly improving throughput and resilience. If a part fails, only that specific part needs to be re-uploaded, rather than the entire file, ensuring greater reliability and faster recovery from network issues.

Why this answer

S3 multipart upload is the most efficient and reliable approach for uploading large files (up to 5 GB) because it allows the file to be split into smaller parts that can be uploaded in parallel, improving throughput and resilience. If a part fails, only that part needs to be retried, not the entire file, and the upload can be paused and resumed. This is the recommended AWS method for objects larger than 100 MB and is required for objects over 5 GB.

Exam trap

The trap here is that candidates may think S3 Transfer Acceleration (Option D) is the best choice for large files because it speeds up transfers, but they overlook that multipart upload is the fundamental mechanism for reliability and efficiency with large objects, while Transfer Acceleration is an optional performance enhancement that can be used on top of multipart upload.

How to eliminate wrong answers

Option A is wrong because saving to EC2 instance store is ephemeral (data is lost on instance stop/termination) and adds an unnecessary intermediate step with no benefit for reliability or efficiency. Option B is wrong because a single PutObject operation for a 5 GB file is prone to network interruptions, requires the entire upload to restart on failure, and has a hard limit of 5 GB (the maximum object size in a single PUT is 5 GB, but multipart is still recommended for files over 100 MB). Option D is wrong because S3 Transfer Acceleration optimizes network path and speed for long-distance transfers but does not provide the reliability benefits of parallel uploads or retry granularity; it can be combined with multipart upload but is not the primary solution for reliability.

Practice this question →

144

MCQmedium

A developer is building a serverless application using AWS SAM. The application includes a Lambda function that needs read-only access to an S3 bucket. The developer wants to use SAM's built-in policy templates to grant this permission. Which policy template should be used in the SAM template?

A.S3ReadPolicy

B.S3CrudPolicy

C.S3FullAccessPolicy

D.S3StreamPolicy

AnswerA

The S3ReadPolicy template grants a Lambda function the necessary `s3:GetObject` permission to retrieve specific objects and `s3:ListBucket` to enumerate the contents of a designated S3 bucket. This adheres strictly to the principle of least privilege, ensuring the application can only perform read operations without any ability to modify or delete data. It is the most appropriate choice for scenarios requiring only data retrieval from S3.

Why this answer

The S3ReadPolicy template is the correct choice because it grants read-only access to an S3 bucket, which aligns with the requirement for the Lambda function. AWS SAM provides this built-in IAM policy template to simplify attaching least-privilege permissions, specifically allowing s3:GetObject, s3:ListBucket, and similar read operations.

Exam trap

The trap here is that candidates may confuse S3CrudPolicy with read-only access, but CRUD implies full data manipulation (create, read, update, delete), which is more permissive than the required read-only scope.

How to eliminate wrong answers

Option B (S3CrudPolicy) is wrong because it grants create, read, update, and delete permissions, which exceeds the required read-only access and violates the principle of least privilege. Option C (S3FullAccessPolicy) is wrong because it provides full administrative access to the S3 bucket, including delete and write operations, far beyond the read-only requirement. Option D (S3StreamPolicy) is wrong because it is not a valid SAM policy template; SAM does not include a template named S3StreamPolicy, and streaming permissions are typically associated with services like Kinesis or DynamoDB Streams, not S3.

Practice this question →

145

Multi-Selectmedium

A developer is troubleshooting a Lambda function that times out when processing large files from Amazon S3. The function is configured with a 3-minute timeout and 128 MB memory. Which TWO actions would MOST likely resolve the issue? (Choose TWO.)

Select 2 answers

A.Use S3 multipart upload for large files to improve throughput.

B.Increase the memory allocation for the Lambda function.

C.Change the S3 event notification to send messages to an Amazon SQS queue instead.

D.Update the Lambda function code to use a more efficient algorithm.

E.Increase the Lambda function timeout to 15 minutes.

AnswersB, E

In AWS Lambda, memory allocation is directly correlated with the CPU power and network bandwidth provisioned for the function's execution environment. For processing large files, increasing memory provides more RAM for data buffering and in-memory operations, while the increased CPU and network throughput accelerate data retrieval from S3 and subsequent computational tasks. This combined performance boost can significantly reduce the overall execution time, helping the function complete within its timeout.

Why this answer

Increasing the memory allocation for a Lambda function also increases CPU and network bandwidth, which can significantly speed up the processing of large files, helping the function complete within the timeout. Option E is correct because increasing the Lambda function timeout directly addresses the timeout issue, giving the function more time to complete processing large files. Option A is incorrect because S3 multipart upload is used for uploading large objects to S3, not for downloading/reading from S3; it does not improve data ingestion into a Lambda function.

Option C is incorrect because sending events to SQS does not affect the processing speed of a single large file; it only decouples the event source. Option D is too generic; while a more efficient algorithm could help, it is not a guaranteed or most likely fix compared to increasing memory or timeout.

Exam trap

The trap is that candidates may incorrectly assume S3 multipart upload speeds up reading from S3, when it is only for uploading. A common mistake is to overlook increasing timeout as a valid fix, but in the AWS Developer Associate exam, both memory increase and timeout increase are standard solutions for Lambda timeouts.

Practice this question →

146

MCQeasy

A developer is writing a Lambda function that processes records from a Kinesis stream. The function must handle duplicate records and ensure exactly-once processing. Which approach should the developer use?

A.Disable retries in the Lambda function to avoid processing duplicates.

B.Enable record ordering in the Kinesis stream.

C.Use a unique identifier for each record and store processed IDs in a DynamoDB table to skip duplicates.

D.Send the records to an SQS FIFO queue for deduplication.

AnswerC

This is the most effective and recommended approach for ensuring idempotent processing of Kinesis records by a Lambda function. By assigning a unique identifier (e.g., a UUID or a combination of source ID and timestamp) to each record and storing these IDs in a DynamoDB table upon successful processing, the Lambda function can check if a record has already been processed before executing its core logic. This prevents duplicate processing even with Kinesis's "at-least-once" delivery semantics and Lambda retries, ensuring data consistency.

Why this answer

Exactly-once processing in a Kinesis-triggered Lambda function requires idempotency. By using a unique identifier (e.g., Kinesis sequence number or a business key) and storing processed IDs in a DynamoDB table, the function can check for duplicates before processing each record. This pattern ensures that even if Kinesis delivers the same record multiple times (due to retries or shard rebalancing), the record is only processed once.

Exam trap

The trap here is that candidates confuse ordering with deduplication, assuming that enabling record ordering (Option B) prevents duplicates, when in fact ordering only ensures records are processed in sequence, not that each record is processed only once.

How to eliminate wrong answers

Option A is wrong because disabling retries does not prevent duplicates; Kinesis can still deliver the same record multiple times due to its at-least-once delivery guarantee, and disabling retries would cause data loss on transient failures. Option B is wrong because record ordering (enabled by default in Kinesis streams) controls the sequence of records within a shard but does not eliminate duplicate records; duplicates can still occur from producer retries or consumer rebalancing. Option D is wrong because sending records to an SQS FIFO queue does not deduplicate records already delivered by Kinesis; the deduplication ID in SQS FIFO only prevents duplicates within the queue itself, and the Lambda function would still need to handle duplicates from the Kinesis source.

Practice this question →

147

MCQeasy

A developer creates an AWS CloudFormation stack with the template snippet shown. The stack creation fails with the error: "Bucket with name my-unique-bucket-12345 already exists." What is the MOST likely cause?

A.The developer does not have permission to create S3 buckets.

B.The bucket name is already taken by another AWS account.

C.The CloudFormation template has a syntax error.

D.The bucket name was used by another stack in the same account.

AnswerB

S3 bucket names are globally unique across all AWS accounts and regions. This means that if another AWS account has already registered the desired bucket name, any attempt to create a new bucket with that exact name, even in a different account or region, will result in a `BucketAlreadyExists` error. This fundamental constraint ensures a unique namespace for all S3 resources worldwide.

Why this answer

The error message 'Bucket with name my-unique-bucket-12345 already exists' indicates that the bucket name is globally unique across all AWS accounts. Since the bucket name is already taken, the most likely cause is that another AWS account has already created a bucket with that exact name. S3 bucket names are unique across all of AWS, not just within a single account or region.

Exam trap

The trap here is that candidates may assume bucket names only need to be unique within their own account or region, but AWS S3 enforces global uniqueness across all accounts and regions, making Option D a plausible but incorrect choice.

How to eliminate wrong answers

Option A is wrong because if the developer lacked permissions to create S3 buckets, the error would be an authorization failure (e.g., 'Access Denied'), not a 'bucket already exists' error. Option C is wrong because a syntax error in the CloudFormation template would produce a validation error (e.g., 'Template format error') before any resource creation attempt. Option D is wrong because if the bucket name was used by another stack in the same account, the error would still be 'already exists', but the question asks for the MOST likely cause; since bucket names are globally unique, the name being taken by any account (including another account) is the primary reason, and the error message does not specify it was from the same account.

Practice this question →

148

MCQmedium

A developer is deploying a Node.js application on AWS Elastic Beanstalk. The application uses environment variables for database credentials. The developer wants to ensure that the credentials are encrypted at rest and rotated automatically. Which solution meets these requirements with minimal effort?

A.Store the credentials in AWS Secrets Manager and retrieve them in the application code. Configure automatic rotation.

B.Hardcode the credentials in the application code and use environment variables for different environments.

C.Store the credentials in AWS Systems Manager Parameter Store as SecureString parameters and reference them in the application code.

D.Use Elastic Beanstalk environment properties to set the credentials as plaintext environment variables.

AnswerA

AWS Secrets Manager is the most secure and recommended service for storing sensitive credentials. It encrypts secrets at rest and in transit using AWS Key Management Service (KMS), and critically, it supports automatic rotation of credentials for various database types and other services. This significantly reduces the risk of long-lived, compromised credentials and simplifies credential lifecycle management, aligning with security best practices for a Node.js application on Elastic Beanstalk.

Why this answer

AWS Secrets Manager is the correct choice because it provides built-in automatic rotation of secrets (including database credentials) with minimal configuration, and it encrypts secrets at rest using AWS KMS. The developer can retrieve the credentials at runtime via the AWS SDK, avoiding hardcoding or plaintext exposure. Elastic Beanstalk environment properties do not offer encryption at rest or rotation, and while Parameter Store SecureString parameters encrypt at rest, they lack native automatic rotation without additional custom logic.

Exam trap

The trap here is that candidates often confuse AWS Systems Manager Parameter Store SecureString parameters with Secrets Manager, overlooking that Parameter Store lacks native automatic rotation, which is explicitly required by the question.

How to eliminate wrong answers

Option B is wrong because hardcoding credentials in application code violates security best practices, does not encrypt credentials at rest, and requires manual rotation. Option C is wrong because AWS Systems Manager Parameter Store SecureString parameters encrypt at rest but do not support automatic rotation natively; rotation would require a custom AWS Lambda function or manual intervention. Option D is wrong because Elastic Beanstalk environment properties store credentials as plaintext environment variables, which are not encrypted at rest and cannot be rotated automatically.

Practice this question →

149

MCQmedium

A company is using AWS Lambda with a 1 GB memory configuration. The function processes large CSV files from S3 and occasionally times out after 15 seconds. The function currently uses synchronous invocation. What is the MOST cost-effective solution to handle larger files without losing data?

A.Increase the Lambda timeout to 15 minutes and keep memory at 1 GB.

B.Switch to asynchronous Lambda invocation to allow up to 15 minutes of processing.

C.Increase the Lambda memory to 3 GB to improve processing speed.

D.Use AWS Step Functions to orchestrate the processing in smaller chunks.

AnswerA

Increasing the Lambda timeout to its maximum of 15 minutes directly addresses the problem if the function simply requires more execution time to complete its task. This is often the most cost-effective solution for tasks that are not CPU-bound but rather time-consuming due to sequential operations or external dependencies, as it avoids increasing compute resources unnecessarily. Keeping memory at 1 GB ensures that billing remains efficient by only paying for the additional execution duration, not for unused processing power.

Why this answer

Increasing the Lambda timeout from 15 seconds to 15 minutes directly addresses the timeout issue without incurring additional costs. Keeping memory at 1 GB avoids the higher per-GB-second cost of larger memory configurations, making it the most cost-effective solution. Lambda charges based on memory allocation and execution duration, so extending the timeout alone does not increase the cost per invocation if the function runs for the same duration.

Exam trap

The trap here is that candidates assume asynchronous invocation has a longer timeout than synchronous, but both share the same 15-minute maximum; the real differentiator is that asynchronous invocation allows retries and queueing, not extended execution time.

How to eliminate wrong answers

Option B is wrong because switching to asynchronous invocation does not change the maximum execution duration; Lambda's synchronous and asynchronous invocations both have a maximum timeout of 15 minutes (900 seconds), so the function would still time out after 15 seconds unless the timeout is increased. Option C is wrong because increasing memory to 3 GB would increase processing speed but also triples the cost per GB-second, making it less cost-effective than simply extending the timeout at 1 GB. Option D is wrong because using AWS Step Functions to orchestrate processing in smaller chunks adds complexity and cost (per state transition) without addressing the root cause—the function's timeout limit—and may still require increasing the Lambda timeout for each chunk.

Practice this question →

150

MCQeasy

A developer is writing a script to programmatically create an Amazon EC2 instance. The script will run on an EC2 instance that already has an IAM role attached. Which AWS SDK method should the developer use to securely obtain temporary credentials for the script?

A.Retrieve the temporary credentials from the instance metadata endpoint (http://169.254.169.254/latest/meta-data/iam/security-credentials/).

B.Store the access key ID and secret access key in the script.

C.Use AWS Secrets Manager to store and retrieve the credentials.

D.Use the AWS SDK's default credential provider chain.

AnswerA

Instance metadata provides temporary credentials from the IAM role automatically.

Why this answer

The instance metadata endpoint at http://169.254.169.254/latest/meta-data/iam/security-credentials/ provides temporary, automatically rotated credentials for the IAM role attached to the EC2 instance. The AWS SDK's default credential provider chain automatically checks this endpoint, but explicitly retrieving from the metadata service is a valid and secure method when you need direct access to the credentials, such as for use with non-AWS tools or custom signing logic.

Exam trap

The trap here is that candidates confuse the AWS SDK's automatic credential resolution (the default credential provider chain) with an explicit method to retrieve credentials, leading them to choose option D even though the question asks for the method the developer should use in the script, which is directly querying the instance metadata endpoint.

How to eliminate wrong answers

Option B is wrong because hardcoding access keys in a script violates AWS security best practices and creates a long-term credential exposure risk; the keys could be compromised if the script is shared, logged, or stored in version control. Option C is wrong because AWS Secrets Manager is designed for storing and retrieving secrets like database passwords or API keys, not for obtaining temporary credentials for an EC2 instance that already has an IAM role; it adds unnecessary complexity and cost when the instance metadata service provides credentials automatically. Option D is wrong because while the AWS SDK's default credential provider chain does automatically retrieve credentials from the instance metadata service, the question asks which method the developer should use to 'securely obtain temporary credentials' — the chain is an automatic process, not a method the developer explicitly calls to retrieve credentials in a script; the developer would need to use the metadata endpoint directly or rely on the SDK's automatic resolution, but the chain itself is not a method to call.

Practice this question →