CCNA Development with AWS Services Questions — Page 4 of 4

226

MCQeasy

A developer is building a serverless application that needs to process messages from an Amazon SQS queue and store the results in an Amazon DynamoDB table. Which AWS service should the developer use to orchestrate the processing logic without managing servers?

A.Amazon Elastic Container Service (ECS) with Fargate

B.Amazon EC2 instances with a custom application

C.AWS Lambda

D.AWS Step Functions

AnswerC

AWS Lambda is the ideal serverless compute service for processing messages in an event-driven architecture. It automatically executes code in response to triggers, such as messages arriving in an SQS queue, without requiring any server provisioning or management. Lambda scales seamlessly with demand, offers a cost-effective pay-per-execution model, and integrates natively with other AWS services, making it perfectly suited for building highly scalable and resilient message processing components.

Why this answer

AWS Lambda is the correct choice because it is a serverless compute service that can be triggered by SQS messages via event source mappings, process each message, and write results to DynamoDB without provisioning or managing any servers. The developer simply uploads the processing code, and Lambda handles scaling, concurrency, and execution, making it ideal for this event-driven, serverless workflow.

Exam trap

The trap here is that candidates often confuse AWS Step Functions as a serverless orchestrator for simple tasks, but Step Functions is designed for coordinating multi-step workflows and state machines, not for directly processing individual SQS messages, which is a core Lambda use case.

How to eliminate wrong answers

Option A is wrong because Amazon ECS with Fargate, while serverless in terms of infrastructure management, still requires defining a container image, task definitions, and cluster configuration, which adds unnecessary overhead for a simple message-processing task that can be handled by a single function. Option B is wrong because Amazon EC2 instances require manual server provisioning, patching, scaling, and management, which violates the 'without managing servers' requirement of the question. Option D is wrong because AWS Step Functions is a state machine orchestration service designed to coordinate multiple AWS services and handle complex workflows, not to directly process individual SQS messages; using it here would introduce unnecessary complexity and cost compared to a direct Lambda trigger.

Practice this question →

227

Multi-Selecteasy

A developer is using Amazon DynamoDB for a gaming leaderboard. The table has a sort key of 'score' (Number). The developer wants to retrieve the top 10 players. Which TWO operations can achieve this? (Choose TWO.)

Select 2 answers

A.TransactGetItems

B.Scan and sort results client-side, then take first 10

C.BatchGetItem

D.GetItem

E.Query with ScanIndexForward set to false and Limit set to 10

AnswersB, E

A Scan operation reads every single item in the entire DynamoDB table or a secondary index, which can then be sorted client-side by the score attribute in descending order, with the first 10 items taken. While this method technically yields the correct top 10 results, it is highly inefficient and expensive for large tables. It consumes significant read capacity units (RCUs) and network bandwidth by transferring all data, making it impractical for a production leaderboard.

Why this answer

Scanning all items and sorting them client-side by score descending gives the global top 10, regardless of partition keys. Option E is correct if the table is designed with a single partition key (e.g., a constant value like 'Leaderboard'), because a Query with ScanIndexForward=false and Limit=10 then retrieves the top 10 items from that partition efficiently. Options A, C, and D are incorrect because they cannot return the top 10 items sorted globally.

Exam trap

The pitfall is that candidates assume Query with ScanIndexForward=false and Limit=10 works globally across all partitions, but it only applies within a single partition key. However, if the table uses a constant partition key (common for leaderboards), it becomes a valid solution. Always consider the table design when evaluating Query vs.

Scan.

Practice this question →

228

MCQhard

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer. The application needs to authenticate users via an external OpenID Connect (OIDC) identity provider. The company wants to offload authentication to the load balancer and use IAM roles to access AWS resources. Which solution should the developer implement?

A.Configure the ALB target group to authenticate using the OIDC identity provider.

B.Use AWS Lambda@Edge to authenticate users at the edge.

C.Configure the ALB to use the OIDC identity provider for user authentication. Use the identity token to assume an IAM role via web identity federation.

D.Use Amazon Cognito user pools as the OIDC provider and integrate with ALB.

AnswerC

Application Load Balancers natively support authentication with OpenID Connect (OIDC) identity providers by configuring an `authenticate-oidc` action on a listener rule. After successful authentication, the ALB forwards the ID token to the backend application. The application can then use this OIDC identity token to securely assume an AWS IAM role via web identity federation, granting temporary, fine-grained permissions to access AWS resources without embedding long-lived credentials.

Why this answer

The Application Load Balancer (ALB) can directly authenticate users against an external OpenID Connect (OIDC) identity provider using its native OIDC authentication action. After successful authentication, the ALB passes the ID token to the backend application, which can then use the AWS Security Token Service (STS) AssumeRoleWithWebIdentity API to exchange the token for temporary AWS credentials, allowing the application to access AWS resources via an IAM role without managing long-term keys.

Exam trap

The trap here is that candidates confuse target group configuration with listener rule authentication actions, or assume that Cognito is required for any OIDC integration with ALB, when in fact ALB natively supports external OIDC providers directly.

How to eliminate wrong answers

Option A is wrong because ALB target groups do not handle authentication; authentication is configured at the listener rule level, not on the target group. Option B is wrong because Lambda@Edge is designed for content delivery and request/response manipulation at CloudFront edge locations, not for offloading OIDC authentication directly to an ALB or for assuming IAM roles via web identity federation. Option D is wrong because while Amazon Cognito can act as an OIDC provider and integrate with ALB, the question specifies an external OIDC provider, and using Cognito would introduce an unnecessary intermediary; the ALB supports direct integration with any OIDC-compliant identity provider without requiring Cognito.

Practice this question →

229

MCQmedium

A developer is building a RESTful API using Amazon API Gateway and AWS Lambda. The API needs to support custom domain names with SSL/TLS certificates. The developer has created the custom domain name in API Gateway and uploaded the certificate to AWS Certificate Manager (ACM) in the same region. However, when accessing the custom domain, users get an SSL error. What is the most likely cause?

A.The certificate was not issued by a trusted certificate authority.

B.The custom domain name's DNS record does not point to API Gateway's regional domain name.

C.The API Gateway API is not deployed to a stage that is mapped to the custom domain name.

D.The certificate is in the wrong region relative to the API Gateway regional endpoint.

AnswerB

For a custom domain to function with API Gateway, its DNS record (typically a CNAME or an ALIAS record in Route 53) must correctly resolve to the API Gateway's regional endpoint domain name. If the DNS record is misconfigured or missing, client requests will not reach the API Gateway endpoint associated with the custom domain. Consequently, the server presenting the certificate (which would be the API Gateway) cannot be found at the requested custom domain, leading to an SSL handshake failure as the client cannot establish a secure connection with the intended server.

Why this answer

The most likely cause is that the custom domain name's DNS record does not point to API Gateway's regional domain name. When using a custom domain name with API Gateway, you must create a DNS record (typically a CNAME or A record using Route 53 alias) that maps your custom domain to the API Gateway-generated regional domain name (e.g., d-xxxxx.execute-api.region.amazonaws.com). Without this correct DNS mapping, the SSL/TLS handshake fails because the certificate presented by API Gateway does not match the domain name the client is connecting to, resulting in an SSL error.

Exam trap

The trap here is that candidates often confuse SSL errors with API configuration issues like missing stage mappings or incorrect certificate authorities, but SSL errors occur at the transport layer due to DNS misconfiguration or certificate domain mismatch, not at the application layer.

How to eliminate wrong answers

Option A is wrong because AWS Certificate Manager (ACM) only issues certificates that are trusted by major browsers and operating systems; if ACM issued the certificate, it is automatically from a trusted CA, so this is not the cause. Option C is wrong because while the API must be deployed to a stage and the stage must be mapped to the custom domain name for the API to respond, an SSL error occurs at the TLS handshake level before any API routing happens; a missing stage mapping would cause a 404 or 403 error, not an SSL error. Option D is wrong because the developer created the custom domain name in API Gateway and uploaded the certificate to ACM in the same region, so the region mismatch is not the issue; the certificate must be in the same region as the API Gateway regional endpoint, which it is.

Practice this question →

230

MCQhard

A DynamoDB table uses partition key customerId. One enterprise customer generates most traffic and is throttled while the table has unused capacity elsewhere. What design change best addresses the hot partition?

A.Enable point-in-time recovery

B.Reduce item size by removing attributes

C.Use strongly consistent reads only

D.Add write sharding or redesign the partition key to distribute that customer's workload

AnswerD

A hot partition occurs when a single partition key value receives disproportionately high read or write traffic, leading to throttling. To mitigate this, one can implement write sharding by appending a random or calculated suffix to the `customerid` (e.g., `customerid-001`, `customerid-002`), effectively distributing that single customer's operations across multiple logical partitions. Alternatively, redesigning the partition key entirely to include a more granular attribute alongside `customerid` can achieve similar workload distribution.

Why this answer

The hot partition is caused by a single customerId receiving a disproportionate amount of traffic, exceeding the 3000 RCU or 1000 WCU per partition limit. By adding write sharding (e.g., appending a random suffix to the partition key) or redesigning the partition key to include a more granular attribute, you distribute that customer's writes across multiple partitions, eliminating the bottleneck and utilizing the table's unused capacity.

Exam trap

The trap here is that candidates mistakenly believe reducing item size or changing read consistency can resolve a hot partition, when only redistributing the partition key's workload addresses the underlying throughput imbalance.

How to eliminate wrong answers

Option A is wrong because point-in-time recovery (PITR) enables continuous backups and restores to any point within the last 35 days; it does not affect request distribution or throttling. Option B is wrong because reducing item size can lower consumed capacity per operation but does not change how requests are distributed across partitions; the hot partition remains throttled if the same customerId still receives high traffic. Option C is wrong because strongly consistent reads consume twice the RCU of eventually consistent reads and do not alter partition key distribution; they would actually increase throttling risk on the hot partition.

Practice this question →

231

Multi-Selectmedium

A developer is deploying an application using AWS Elastic Beanstalk. The application requires a relational database. Which THREE components are created by Elastic Beanstalk when you add a database to your environment?

Select 3 answers

A.A DB subnet group

B.An Amazon RDS DB instance

C.An AWS CloudFormation stack

D.An Amazon DynamoDB table

E.A security group for the database

AnswersA, B, E

Correct. Elastic Beanstalk creates a DB subnet group to define which subnets the RDS instance can be placed in.

Why this answer

When you add a database to an Elastic Beanstalk environment, Elastic Beanstalk automatically creates a DB subnet group, an Amazon RDS DB instance, and a security group for the database. The CloudFormation stack is already created as part of the environment's infrastructure, not specifically when adding the database. DynamoDB is not used for relational databases.

Exam trap

The trap is that candidates often think only the RDS instance and security group are created, but Elastic Beanstalk also creates a DB subnet group. Many also incorrectly believe a CloudFormation stack is created at that point, but it already exists.

Practice this question →

232

MCQeasy

A developer needs to store application configuration data, such as database connection strings and API keys, for a microservices application running on Amazon ECS. The configuration must be encrypted at rest and easily auditable. Which AWS service should the developer use?

A.AWS Secrets Manager.

B.Amazon S3 with server-side encryption.

C.AWS Systems Manager Parameter Store.

D.Amazon DynamoDB with encryption at rest.

AnswerC

AWS Systems Manager Parameter Store is purpose-built for securely storing and managing application configuration data, including both plain-text and encrypted parameters. It offers hierarchical organization, automatic versioning of parameter changes, and seamless integration with AWS Key Management Service (KMS) for encryption. Its ability to retrieve parameters by name and integration with AWS CloudTrail for auditing all access and modifications makes it the ideal, cost-effective, and operationally simple choice for this use case.

Why this answer

AWS Systems Manager Parameter Store is the correct choice because it is designed to store application configuration data like database connection strings and API keys, integrates natively with Amazon ECS for secure parameter retrieval, and supports encryption at rest using AWS KMS. It also provides built-in auditing through AWS CloudTrail, which logs all API calls to the Parameter Store, meeting the auditability requirement.

Exam trap

The trap here is that candidates often confuse AWS Secrets Manager with Systems Manager Parameter Store, but Secrets Manager is specifically for secrets requiring automatic rotation, while Parameter Store is the appropriate choice for general configuration data that needs encryption and auditing without rotation.

How to eliminate wrong answers

Option A is wrong because AWS Secrets Manager is optimized for managing secrets with automatic rotation, which is overkill for general configuration data and incurs additional cost per secret; the question does not require rotation. Option B is wrong because Amazon S3 with server-side encryption can store configuration data but lacks native integration with ECS for secure, low-latency parameter retrieval and does not provide the same level of auditability via CloudTrail for individual parameter access without additional configuration. Option D is wrong because Amazon DynamoDB with encryption at rest is a NoSQL database designed for high-scale application data, not for storing simple configuration parameters, and it requires custom code to manage access control and auditing, adding unnecessary complexity.

Practice this question →

233

Multi-Selectmedium

A developer is building a serverless application using AWS Lambda functions that need to access an Amazon RDS database. Which of the following are best practices for managing database credentials? (Choose TWO.)

Select 2 answers

A.Use AWS Systems Manager Parameter Store to store encrypted credentials.

B.Use AWS Secrets Manager to store and rotate credentials.

C.Store the credentials as Lambda environment variables.

D.Hardcode the credentials in the Lambda function code.

E.Store the credentials in a file in the Lambda deployment package.

AnswersA, B

Parameter Store can store encrypted parameters securely.

Why this answer

AWS Systems Manager Parameter Store is a best practice for managing database credentials because it provides secure, encrypted storage for configuration data and secrets. By using Parameter Store with AWS KMS encryption, developers can store credentials separately from code and retrieve them at runtime via the AWS SDK, ensuring that sensitive information is not exposed in the function code or deployment artifacts.

Exam trap

The trap here is that candidates often assume storing credentials as encrypted environment variables (Option C) is sufficient, but the exam requires understanding that environment variables are not a secure secret management service and lack features like rotation and fine-grained access control that Parameter Store or Secrets Manager provide.

Practice this question →

234

MCQhard

A company runs a data processing pipeline using AWS Step Functions. The pipeline starts with a task that reads a CSV file from Amazon S3 and then fans out to multiple parallel Lambda functions for data transformation. The final step aggregates the results and writes to an Amazon DynamoDB table. Recently, the pipeline has been failing intermittently with 'StateMachineExecutionLimitExceeded' errors. The development team has already increased the execution history limit to the maximum. The pipeline runs about 500 executions per day. Meanwhile, the operations team reports that some executions are timing out after 5 minutes, even though each Lambda function completes within 30 seconds. The Step Function definition uses a Map state with a max concurrency of 20. The developer needs to fix both issues. Which combination of actions should the developer take? (Choose the BEST option.)

A.Reduce the max concurrency of the Map state and increase the task execution timeout in the Step Function definition.

B.Split the pipeline into multiple smaller Step Functions and chain them together.

C.Increase the max concurrency of the Map state and add a retry policy.

D.Set a Lambda reserved concurrency for the transformation functions to 100.

AnswerB

Splitting the pipeline into multiple smaller Step Functions and chaining them together distributes executions across different state machines, each with its own concurrency limit, preventing the limit error. Additionally, each smaller state machine can have its own timeout settings, allowing the pipeline to complete within the 5-minute limit. This combination addresses both issues correctly.

Why this answer

StateMachineExecutionLimitExceeded indicates that the number of concurrent executions for this state machine exceeds its limit. Since the execution history limit is already maximized, the only way to reduce concurrency is to distribute executions across multiple state machines. Splitting the pipeline into smaller Step Functions and chaining them together reduces the number of concurrent executions per state machine, resolving the limit error.

The timeout issue is mitigated because each smaller state machine can have its own timeout, preventing the overall pipeline from exceeding 5 minutes. Option B is the only combination that addresses both problems.

Practice this question →

235

MCQhard

A developer is deploying a microservices architecture on Amazon ECS with Fargate. Each service needs to store sensitive configuration data such as database passwords. The developer wants to avoid hardcoding secrets in the application code. Which approach should the developer use?

A.Store the secrets in an Amazon S3 bucket and use a pre-signed URL to download them at startup.

B.Define the secrets as environment variables in the ECS task definition.

C.Encrypt the secrets using AWS KMS and store the encrypted blob in a configuration file within the Docker image.

D.Store the secrets in AWS Systems Manager Parameter Store or AWS Secrets Manager and reference them in the ECS task definition using the 'secrets' parameter.

AnswerD

This is the most secure and recommended approach for managing secrets in ECS. AWS Systems Manager Parameter Store (especially `SecureString` parameters) and AWS Secrets Manager are purpose-built services for securely storing and managing sensitive data. By referencing these services in the ECS task definition's `secrets` parameter, ECS automatically retrieves and injects the secrets into the container's environment at runtime, leveraging the task's IAM role for secure, granular access. This ensures secrets are never hardcoded, are not visible in task definitions or logs, and can be rotated independently of application deployments.

Why this answer

AWS Systems Manager Parameter Store and AWS Secrets Manager are purpose-built services for securely storing and managing sensitive configuration data. By referencing secrets via the `secrets` parameter in the ECS task definition, the secrets are injected into the container at runtime without being exposed in the application code, task definition plaintext, or Docker image. This approach integrates natively with ECS Fargate and supports automatic rotation of secrets.

Exam trap

The trap here is that candidates often choose Option B (environment variables in the task definition) because it seems simple and works in development, but they overlook that the task definition is stored in plaintext and accessible via the ECS API, making it insecure for production secrets.

How to eliminate wrong answers

Option A is wrong because storing secrets in an S3 bucket with a pre-signed URL introduces a long-lived URL that can be intercepted or leaked, and it does not provide native secret rotation or fine-grained access control compared to AWS Secrets Manager. Option B is wrong because defining secrets as environment variables in the ECS task definition stores them in plaintext within the task definition, which can be viewed by anyone with access to the ECS API or console, violating security best practices. Option C is wrong because encrypting secrets with KMS and storing the encrypted blob in a Docker image embeds the encrypted data in the image, making it difficult to rotate secrets without rebuilding the image, and the decryption key must be managed separately, increasing complexity and risk.

Practice this question →

236

MCQeasy

A developer is writing code to upload an object to an Amazon S3 bucket. The object is 200 MB in size. Which AWS SDK method should the developer use to perform this upload?

A.Enable S3 Transfer Acceleration and use the PutObject API.

B.Use the PutObject API operation.

C.Use the multipart upload API.

D.Use a pre-signed URL and upload using HTTP PUT.

AnswerC

The S3 multipart upload API is the recommended and most robust method for uploading large objects to Amazon S3, particularly those exceeding 100 MB, and is mandatory for objects larger than 5 GB. This API breaks the object into smaller, manageable parts, which can be uploaded independently, in parallel, and even out of order. This approach significantly enhances upload speed, provides resilience against network failures (only failed parts need re-uploading), and allows for pausing and resuming uploads.

Why this answer

Objects larger than 100 MB should be uploaded using the multipart upload API to improve throughput and provide resilience against network failures. The multipart upload API allows the 200 MB object to be split into parts, uploaded in parallel, and then assembled, which is more efficient and reliable than a single PutObject operation for objects over 5 GB or for large objects in general.

Exam trap

The trap here is that candidates assume the PutObject API is sufficient for any object under 5 GB, but the AWS SDK best practice and the exam emphasize using multipart upload for objects over 100 MB to ensure reliability and performance.

How to eliminate wrong answers

Option A is wrong because S3 Transfer Acceleration is a feature that speeds up uploads over long distances using edge locations, but it does not replace the need for multipart upload for large objects; the PutObject API still has a 5 GB limit and is not recommended for objects over 100 MB. Option B is wrong because the PutObject API operation is designed for objects up to 5 GB, but for a 200 MB object, using a single PutObject call is less reliable and efficient than multipart upload due to potential network interruptions and lack of parallel uploads. Option D is wrong because a pre-signed URL grants temporary access for an HTTP PUT upload, but it still uses the PutObject API under the hood, which is not optimal for a 200 MB object; multipart upload is the recommended approach for objects over 100 MB.

Practice this question →

237

MCQmedium

A developer is using Amazon API Gateway with a Lambda authorizer to control access to an API. The authorizer function needs to decode a JWT token from the request header and return an IAM policy. Which type of Lambda authorizer should be used?

A.TOKEN authorizer with the token passed in the Authorization header.

B.REQUEST authorizer with the token in a custom header.

C.Use Amazon Cognito User Pools as the authorizer.

D.Use a resource policy to allow or deny access based on the JWT token.

AnswerA

A TOKEN authorizer is specifically designed to receive a single authorization token, typically a JWT, from a designated header like `Authorization`. It passes this token directly to a Lambda function which then decodes and validates it, returning an IAM policy that grants or denies access to API resources. This streamlined approach is ideal for scenarios focused solely on token-based authentication, simplifying the Lambda's input processing by providing just the raw token string.

Why this answer

A TOKEN authorizer is designed to receive a JWT or OAuth token in the Authorization header and pass it directly to the Lambda function for validation. The Lambda function then decodes the token and returns an IAM policy document to allow or deny the API request. This is the correct choice because the question explicitly states the token is in the request header and needs to be decoded, which matches the TOKEN authorizer's behavior of forwarding the raw token value.

Exam trap

The trap here is that candidates confuse the TOKEN authorizer (which passes only the token) with the REQUEST authorizer (which passes the full request), assuming that decoding a JWT requires access to other request parameters, when in fact the token alone is sufficient for validation.

How to eliminate wrong answers

Option B is wrong because a REQUEST authorizer passes the entire request context (headers, query parameters, path parameters) to the Lambda function, which is unnecessary overhead when only the JWT token from a header is needed; it also requires more complex parsing logic. Option C is wrong because Amazon Cognito User Pools are a managed identity service that handles JWT verification natively, not a Lambda authorizer; using them would bypass the requirement for a custom Lambda function to decode the token. Option D is wrong because resource policies control access based on IP addresses, VPCs, or AWS accounts, not on the contents of a JWT token; they cannot decode or validate token claims.

Practice this question →

238

MCQeasy

A developer wants to store application logs in Amazon S3 with automatic transition to Glacier after 30 days and deletion after 365 days. Which S3 feature should be used?

A.S3 Lifecycle configuration

B.S3 Object Lock

C.S3 Replication

D.S3 Event Notifications

AnswerA

S3 Lifecycle configuration is the correct choice because it allows developers to define rules for automatically transitioning objects between different S3 storage classes (e.g., S3 Standard to S3 Standard-IA, Glacier, or Glacier Deep Archive) based on their age or access patterns. This is ideal for application logs, which typically become less frequently accessed over time but still require retention, enabling significant cost savings by moving them to progressively colder storage tiers. Furthermore, lifecycle policies can also be configured to automatically expire and permanently delete objects after a specified period, ensuring compliance and managing storage footprint efficiently.

Why this answer

S3 Lifecycle configuration is the correct feature because it allows you to define rules that automatically transition objects to colder storage classes like Glacier after a specified number of days (30) and permanently delete them after a longer period (365). This directly matches the requirement for time-based storage tiering and deletion without manual intervention.

Exam trap

The trap here is that candidates confuse S3 Lifecycle policies with S3 Event Notifications, thinking event-driven triggers can handle time-based transitions, but Lifecycle policies are the only native S3 feature that automates storage class transitions and deletions based on object age.

How to eliminate wrong answers

Option B is wrong because S3 Object Lock is designed to prevent objects from being deleted or overwritten for a fixed retention period, not to automate storage class transitions or scheduled deletions. Option C is wrong because S3 Replication asynchronously copies objects to another bucket for redundancy or compliance, but it does not manage lifecycle transitions or deletion schedules. Option D is wrong because S3 Event Notifications trigger actions (e.g., Lambda, SQS) on object events like PUT or DELETE, but they cannot enforce time-based transitions to Glacier or automatic deletion after a set number of days.

Practice this question →

239

MCQeasy

A developer is creating an AWS Lambda function that needs to access files from an Amazon EFS file system. The Lambda function must be configured to access the VPC. Which of the following is required to allow the Lambda function to mount the EFS file system?

A.The Lambda function must have the AWSLambdaVPCAccessExecutionRole managed policy attached.

B.The Lambda function must be in the same Availability Zone as the EFS mount target.

C.The Lambda function must have the AmazonElasticFileSystemClientReadWriteAccess managed policy attached.

D.The Lambda function must have the efs:MountFileSystem permission in its execution role.

AnswerA

The AWSLambdaVPCAccessExecutionRole managed policy is essential because it grants the necessary IAM permissions for Lambda to create, describe, and delete Elastic Network Interfaces (ENIs) within the specified VPC subnets. When a Lambda function is configured to access resources in a VPC, AWS Lambda provisions these ENIs to establish network connectivity, allowing the function to communicate with private resources like EFS file systems. Without these permissions, Lambda cannot integrate into the VPC and therefore cannot reach EFS.

Why this answer

The AWSLambdaVPCAccessExecutionRole managed policy provides the necessary permissions for Lambda to manage elastic network interfaces (ENIs) in a VPC, which is required for Lambda to connect to an EFS file system via mount targets. Without this policy, the Lambda function cannot create or manage the ENI needed to route traffic to the EFS mount target within the VPC.

Exam trap

The trap here is that candidates confuse the VPC networking permissions required for Lambda to mount EFS (AWSLambdaVPCAccessExecutionRole) with EFS-specific API permissions (AmazonElasticFileSystemClientReadWriteAccess) or a nonexistent efs:MountFileSystem action, leading them to select the wrong policy or permission.

How to eliminate wrong answers

Option B is wrong because Lambda can access EFS mount targets in any Availability Zone within the same VPC; it does not need to be in the same AZ as the mount target, as Lambda uses ENIs in the VPC subnets to reach the mount target across AZs. Option C is wrong because the AmazonElasticFileSystemClientReadWriteAccess policy grants permissions to EFS API operations (e.g., CreateFileSystem, DescribeMountTargets) but does not include the specific efs:MountFileSystem permission or the VPC networking permissions required for Lambda to mount the file system. Option D is wrong because the efs:MountFileSystem permission is not a valid IAM action; EFS mounting is controlled by network connectivity (VPC configuration) and the execution role must include permissions for EC2 ENI management (ec2:CreateNetworkInterface, etc.), not a direct EFS mount action.

Practice this question →

240

MCQeasy

A company stores sensitive user data in an S3 bucket. The security team requires that all data be encrypted at rest using a customer-managed KMS key. The bucket already has default encryption configured with SSE-S3. What is the MINIMUM change needed to meet the requirement?

A.Change the default encryption of the bucket to SSE-KMS with the desired KMS key.

B.Add an object-level encryption setting to each object after upload.

C.Enable S3 Bucket Keys on the bucket.

D.Attach a bucket policy that denies uploads without the required KMS key.

AnswerA

Changing the S3 bucket's default encryption to SSE-KMS with a specified AWS KMS key ensures that all new objects uploaded to the bucket are automatically encrypted at rest using that customer-managed key. This eliminates the need for individual uploaders to specify encryption headers, significantly reducing the risk of unencrypted data and simplifying compliance requirements for sensitive user data. It's the most robust and operationally efficient method to enforce encryption for all objects.

Why this answer

The current bucket has default encryption set to SSE-S3, which uses AWS-managed keys, not customer-managed KMS keys. Changing the default encryption to SSE-KMS with the desired customer-managed KMS key ensures that all new objects uploaded to the bucket are automatically encrypted at rest using that key, meeting the security team's requirement without additional per-object configuration.

Exam trap

The trap here is that candidates often confuse enforcing encryption via bucket policies (which only denies non-compliant uploads) with actually setting the encryption method via default encryption, which automatically applies the required encryption to all objects.

How to eliminate wrong answers

Option B is wrong because adding object-level encryption settings after upload does not enforce encryption at rest for all objects; it requires manual intervention and does not change the default encryption behavior for future uploads. Option C is wrong because enabling S3 Bucket Keys reduces the number of KMS API calls for SSE-KMS but does not change the encryption type from SSE-S3 to SSE-KMS; it is an optimization feature, not a method to enforce customer-managed KMS encryption. Option D is wrong because a bucket policy that denies uploads without the required KMS key can enforce encryption requirements but does not change the default encryption configuration; it would still allow objects encrypted with SSE-S3 if the policy is not correctly crafted, and it does not automatically encrypt objects—it only denies unencrypted uploads, which is not the same as ensuring all data is encrypted at rest with the specified KMS key.

Practice this question →

241

MCQhard

A company is using Amazon API Gateway to expose a set of RESTful APIs. Each API call is processed by an AWS Lambda function. The company wants to enforce throttling limits to prevent abuse. Specifically, the company wants to allow 100 requests per second per API key. What is the SIMPLEST way to achieve this?

A.Use AWS WAF to block requests after 100 per second.

B.Set a reserved concurrency on the Lambda function to 100.

C.Configure a CloudWatch alarm to disable the API key after exceeding the limit.

D.Create a usage plan in API Gateway with a rate limit of 100 requests per second per API key.

AnswerD

API Gateway usage plans are specifically designed to control access to API stages and methods by defining throttling and quota limits for individual API keys. By associating an API key with a usage plan, you can enforce precise rate limits, such as 100 requests per second, and burst limits on a per-consumer basis. This provides real-time, fine-grained control over API consumption, ensuring fair usage and protecting backend resources.

Why this answer

API Gateway usage plans are specifically designed to enforce throttling limits per API key. By creating a usage plan with a rate limit of 100 requests per second and associating it with the desired API keys, you can directly control request rates at the API Gateway layer without additional services or custom logic. This is the simplest and most native approach for per-API-key throttling.

Exam trap

The trap here is that candidates may confuse reserved concurrency (which limits Lambda execution concurrency) with API-level rate limiting, or assume that a reactive solution like CloudWatch alarms can enforce proactive throttling, when in fact API Gateway usage plans provide the simplest and most direct mechanism for per-API-key rate control.

How to eliminate wrong answers

Option A is wrong because AWS WAF is a web application firewall that filters traffic based on rules (e.g., IP sets, SQL injection), but it does not natively support per-API-key rate limiting; implementing such a limit would require custom logic and is not the simplest solution. Option B is wrong because reserved concurrency on a Lambda function limits the number of concurrent executions, not the request rate per second per API key; it also applies globally to the function, not per API key, and does not prevent abuse at the API Gateway level. Option C is wrong because a CloudWatch alarm can only trigger actions (e.g., disable an API key) after the limit is exceeded, but it cannot enforce a hard throttle in real time; the alarm would react after the fact, allowing bursts beyond 100 requests per second before any action is taken.

Practice this question →

242

MCQmedium

A company wants to build a RESTful API that handles file uploads. The API needs to support multipart/form-data content type. The developer is using Amazon API Gateway and AWS Lambda. Which approach should the developer use to handle file uploads efficiently?

A.Configure API Gateway to pass the entire request body to Lambda, and process the file within the Lambda function.

B.Create a Lambda function that accepts the file and uploads it to S3 using the AWS SDK.

C.Use API Gateway to generate a presigned S3 URL, and have the client upload directly to S3. The Lambda function can then process the file asynchronously.

D.Use an EC2 instance to host a custom web server that accepts file uploads and writes to S3.

AnswerC

This is the recommended serverless pattern for large file uploads. API Gateway can authenticate the request and then generate a temporary, time-limited presigned URL for S3. The client then uses this URL to upload the file directly to S3, bypassing API Gateway and Lambda payload limits entirely. S3 can then asynchronously trigger a Lambda function (e.g., via S3 event notifications) to process the uploaded file, ensuring scalability and efficiency.

Why this answer

It offloads the file upload to Amazon S3 directly via a presigned URL, which avoids the 10 MB payload limit and 29-second timeout of API Gateway and Lambda for large files. The client uploads the file to S3, and a separate Lambda function processes the file asynchronously, making the solution efficient and scalable for multipart/form-data uploads.

Exam trap

The trap here is that candidates assume Lambda can handle file uploads directly via API Gateway, overlooking the 10 MB payload limit and 29-second timeout, and fail to recognize the presigned URL pattern as the efficient serverless solution for large multipart/form-data uploads.

How to eliminate wrong answers

Option A is wrong because API Gateway has a 10 MB payload limit and a 29-second integration timeout, making it unsuitable for large file uploads; passing the entire request body to Lambda also forces the function to handle raw multipart parsing, which is inefficient and error-prone. Option B is wrong because it still requires the client to send the file through API Gateway and Lambda, hitting the same size and timeout constraints; the Lambda function would need to receive the entire file payload before uploading to S3, defeating the purpose of direct upload. Option D is wrong because it introduces unnecessary infrastructure management (EC2) and does not leverage serverless benefits; it also does not address the requirement to use API Gateway and Lambda, and a custom web server on EC2 adds operational overhead without improving efficiency.

Practice this question →

243

MCQmedium

A developer is building a microservices application composed of multiple AWS Lambda functions and an Amazon API Gateway. The developer needs to trace requests as they travel through different services to identify performance bottlenecks. Which AWS service should the developer integrate?

A.AWS CloudTrail

B.Amazon CloudWatch Logs

C.AWS X-Ray

D.Amazon Inspector

AnswerC

AWS X-Ray is purpose-built for distributed tracing, providing an end-to-end view of requests as they travel through your microservices application. It collects data about requests, generates a service map visualizing application components and their interconnections, and allows developers to identify performance bottlenecks, errors, and latency issues within individual services or across the entire request path. X-Ray's ability to trace requests across multiple services makes it invaluable for debugging and optimizing complex distributed systems.

Why this answer

AWS X-Ray is the correct service because it provides end-to-end tracing of requests as they travel through distributed applications, including AWS Lambda functions and API Gateway. It generates a service map that shows the flow of requests, latency breakdowns, and identifies performance bottlenecks across microservices. X-Ray integrates directly with Lambda and API Gateway via the X-Ray SDK and tracing headers, enabling trace propagation without code changes.

Exam trap

The trap here is that candidates confuse CloudWatch Logs (which shows logs) with distributed tracing (which correlates requests across services), leading them to pick CloudWatch Logs instead of X-Ray for end-to-end performance analysis.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail records API calls for auditing and governance, not for tracing individual request paths or performance bottlenecks across microservices. Option B is wrong because Amazon CloudWatch Logs aggregates log data but does not provide distributed tracing or service maps to correlate requests across multiple Lambda functions and API Gateway. Option D is wrong because Amazon Inspector is a vulnerability management service that scans for software vulnerabilities and network exposure, not for tracing application requests or performance analysis.

Practice this question →

244

MCQmedium

A company uses Amazon API Gateway to expose a REST API. The API uses a Lambda authorizer to validate JWT tokens. Recently, the API has been returning 401 Unauthorized errors for valid tokens. The developer notices that the tokens are signed with a new key but the authorizer still uses the old key. What is the MOST efficient way to update the authorizer with the new key?

A.Modify the Lambda authorizer to fetch the public key from a well-known URL at runtime.

B.Update the API Gateway stage deployment to redeploy the API.

C.Delete and recreate the API Gateway authorizer with the new key.

D.Update the Lambda authorizer's environment variable with the new key and publish a new version.

AnswerA

Modifying the Lambda authorizer to fetch the public key from a well-known URL at runtime is the most robust solution. This approach leverages standard identity provider practices where public keys (often in JWKS format) are exposed at a predictable endpoint (e.g., `/.well-known/jwks.json`). The Lambda function can programmatically retrieve and cache these keys, ensuring it always uses the latest valid key for JWT signature verification without requiring any redeployment of the Lambda function or API Gateway when the key rotates. This significantly reduces operational overhead and enhances security by enabling seamless key rotation.

Why this answer

Fetching the public key from a well-known URL (e.g., the JWKS endpoint) at runtime allows the Lambda authorizer to automatically use the latest signing key without manual intervention. This approach decouples key rotation from the authorizer code, ensuring that valid tokens signed with the new key are accepted immediately. It is the most efficient method as it avoids redeployments, environment variable updates, or recreating the authorizer.

Exam trap

The trap here is that candidates assume updating environment variables or redeploying the API is sufficient, but they overlook that the authorizer must dynamically resolve the signing key to handle automatic key rotation without manual steps.

How to eliminate wrong answers

Option B is wrong because redeploying the API Gateway stage does not update the signing key used by the Lambda authorizer; it only deploys the current API configuration. Option C is wrong because deleting and recreating the authorizer is unnecessary and inefficient; the authorizer can be updated programmatically or by modifying its logic. Option D is wrong because updating an environment variable and publishing a new Lambda version still requires manual key rotation and does not address the root cause of dynamic key changes; the authorizer would still need to be updated each time the key changes.

Practice this question →

245

Multi-Selectmedium

A company is using AWS Elastic Beanstalk to deploy a web application. The application uses an Amazon RDS MySQL database. The development team wants to ensure that database credentials are not exposed in the application code. Which THREE actions should the team take to securely manage and retrieve database credentials? (Choose three.)

Select 3 answers

A.Store the credentials in an S3 bucket with a bucket policy that restricts access to the application.

B.Configure Elastic Beanstalk to pass the secret ARN to the application as an environment property.

C.Modify the application code to retrieve the credentials from Secrets Manager at startup.

D.Hardcode the credentials in the application code and use environment variables to override them.

E.Store the database credentials in AWS Secrets Manager.

AnswersB, C, E

Passing the secret ARN as an environment property in Elastic Beanstalk is a secure pattern because the actual credential value is never embedded in code or environment configuration. The application retrieves the secret from AWS Secrets Manager at runtime using the ARN, while the Elastic Beanstalk instance profile supplies the necessary IAM permissions. This keeps the secret itself hidden and ensures the application always uses the current value, even if the secret is rotated.

Why this answer

To securely manage database credentials in Elastic Beanstalk, the team should store credentials in AWS Secrets Manager (option E). Then, configure Elastic Beanstalk to pass the secret ARN as an environment property (option B) so the application can retrieve the secret at startup (option C). This avoids hardcoding credentials in code or environment variables.

Option A (S3 bucket) is less secure and not best practice; Option D (hardcoding) is insecure and should never be done.

Practice this question →

246

MCQmedium

A company runs a Node.js application on AWS Elastic Beanstalk. The application experiences high latency during peak hours. The developer suspects that the environment's EC2 instances are under-provisioned. Which configuration change would MOST effectively address the latency issue with minimal cost increase?

A.Place the environment behind an Application Load Balancer.

B.Enable Auto Scaling and configure scaling triggers based on CPU utilization.

C.Change the instance type to a larger size in the environment configuration.

D.Decrease the minimum number of instances in the Auto Scaling group.

AnswerB

Enabling Auto Scaling and configuring scaling triggers based on CPU utilization is the most effective and elastic solution for handling variable loads in a Node.js application. When the average CPU utilization across the Auto Scaling group exceeds a predefined threshold, new EC2 instances are automatically launched to distribute the workload, improving responsiveness and preventing performance degradation. Conversely, instances are terminated during periods of low utilization, optimizing operational costs.

Why this answer

Enabling Auto Scaling with CPU utilization triggers dynamically adds EC2 instances during peak hours, distributing the load and reducing latency without over-provisioning during off-peak times. This matches the symptom of under-provisioned instances and minimizes cost by scaling only when needed, unlike static solutions that waste resources.

Exam trap

The trap here is that candidates often confuse adding a load balancer (Option A) with solving capacity issues, but a load balancer only distributes traffic and does not increase compute resources, so latency remains if instances are saturated.

How to eliminate wrong answers

Option A is wrong because placing the environment behind an Application Load Balancer (ALB) alone does not address under-provisioned instances; an ALB distributes traffic but does not add compute capacity, so latency persists if instances are overloaded. Option C is wrong because changing to a larger instance type increases cost for all hours, including low-traffic periods, and does not dynamically adapt to peak demand, making it less cost-effective than Auto Scaling. Option D is wrong because decreasing the minimum number of instances reduces the baseline capacity, worsening latency during both peak and normal loads, as fewer instances handle the same traffic.

Practice this question →

247

MCQmedium

A developer is using Amazon API Gateway to expose a REST API. The API needs to validate request parameters and payload before invoking the backend Lambda function. What is the MOST efficient way to perform this validation?

A.Use API Gateway request validation with a model schema.

B.Validate the request in the Lambda function and return errors if validation fails.

C.Use Amazon CloudFront to validate the request at the edge.

D.Use API Gateway request parameters to enforce required headers.

AnswerA

API Gateway's request validation leverages JSON Schema Draft 4 models to define the expected structure and data types for request bodies, headers, and query parameters. By configuring a validator for a method, API Gateway automatically inspects incoming requests against the defined schema. This pre-processing rejects malformed requests before they reach the backend, significantly reducing unnecessary Lambda invocations, saving costs, and improving API responsiveness.

Why this answer

API Gateway's built-in request validation allows you to define a JSON Schema model that automatically validates request parameters, headers, and payload before the request reaches the backend Lambda function. This offloads validation from the Lambda function, reducing compute time and cost, and provides immediate 400 error responses without invoking the backend. It is the most efficient approach because it minimizes latency and Lambda invocations for invalid requests.

Exam trap

The trap here is that candidates often assume validation must happen in the Lambda function (Option B) because they think backend logic is required, but API Gateway's built-in request validation is more efficient and is the recommended approach for schema-based validation before invocation.

How to eliminate wrong answers

Option B is wrong because validating in the Lambda function incurs unnecessary compute cost and latency, as the function must be invoked even for invalid requests, and it does not leverage API Gateway's native validation capabilities. Option C is wrong because Amazon CloudFront is a content delivery network (CDN) that caches and distributes content at the edge; it does not perform request validation against a schema or model, and its primary purpose is not to validate API requests. Option D is wrong because using API Gateway request parameters to enforce required headers only validates the presence of headers, not the payload body or complex parameter constraints, and it lacks the schema-based validation needed for payload structure.

Practice this question →

248

MCQeasy

A developer is building a serverless application using AWS Lambda. The application needs to process messages from an Amazon SQS queue and store results in an Amazon DynamoDB table. Which AWS service should the developer use to trigger the Lambda function when new messages arrive in the SQS queue?

A.Set up an Amazon EventBridge rule to capture SQS events and invoke Lambda.

B.Use Amazon SNS to subscribe to the SQS queue and trigger Lambda.

C.Use AWS Step Functions to poll the SQS queue and invoke Lambda.

D.Configure an SQS event source mapping on the Lambda function.

AnswerD

Configuring an SQS event source mapping on a Lambda function is the correct and most efficient approach. This mechanism enables Lambda to automatically poll the specified SQS queue, retrieve batches of messages, and then synchronously invoke the Lambda function with these messages as the event payload. Lambda manages the polling infrastructure, scaling, and ensures messages are processed, deleted upon successful execution, or returned to the queue if the function fails.

Why this answer

AWS Lambda supports native SQS event source mappings, which allow Lambda to poll an SQS queue and invoke the function automatically when new messages arrive. This integration handles the polling, batch retrieval, and deletion of messages from the queue, making it the simplest and most efficient way to process SQS messages with Lambda.

Exam trap

The trap here is that candidates may confuse the direction of SNS-SQS integration, thinking SNS can subscribe to SQS to trigger Lambda, when in fact SNS publishes to SQS and Lambda must be triggered via an event source mapping or SNS topic subscription directly.

How to eliminate wrong answers

Option A is wrong because Amazon EventBridge rules cannot directly capture SQS events; SQS does not emit events to EventBridge for queue messages. Option B is wrong because Amazon SNS cannot subscribe to an SQS queue; SNS publishes messages to SQS subscriptions, not the reverse, and SNS cannot trigger Lambda from SQS messages. Option C is wrong because AWS Step Functions can poll SQS using a service integration, but it is not designed to trigger Lambda directly from new messages; it would require a custom polling loop or callback pattern, adding unnecessary complexity compared to the native SQS event source mapping.

Practice this question →

249

MCQhard

A developer is building a serverless application using AWS Lambda and Amazon API Gateway REST API. The API Gateway is configured to use a Lambda proxy integration. The developer wants to return a custom error message with a specific HTTP status code (e.g., 404) when a resource is not found. How should the developer implement this?

A.Return a JSON object with 'status_code' and 'message' keys.

B.Throw an exception with a message that includes the HTTP status code.

C.Return a JSON object with 'errorMessage' and 'errorType' keys.

D.Return a JSON object with keys 'statusCode', 'headers', and 'body' where 'statusCode' is 404 and 'body' contains the error message.

AnswerD

For API Gateway Lambda proxy integration, the Lambda function must return a JSON object with the exact structure `{ 'statusCode': <number>, 'headers': <object>, 'body': <string> }`. This specific format allows the Lambda function to fully control the HTTP response returned to the client, including the status code (e.g., 404 Not Found), custom headers, and the response body containing the error message. Adhering to this contract ensures API Gateway correctly maps the Lambda's output to the desired HTTP response.

Why this answer

With Lambda proxy integration in API Gateway, the Lambda function must return a response in the exact format that API Gateway expects: a JSON object with 'statusCode' (integer), 'headers' (object), and 'body' (string). This allows the developer to set a custom HTTP status code like 404 and include a custom error message in the body. API Gateway will then map this response directly to the HTTP response sent to the client.

Exam trap

The trap here is that candidates often confuse the Lambda proxy integration response format with the standard Lambda error response format (errorMessage/errorType) or assume that simply throwing an exception will propagate the status code, but AWS requires a specific structured success response to control the HTTP status code.

How to eliminate wrong answers

Option A is wrong because returning a JSON object with 'status_code' and 'message' keys does not match the required response format for Lambda proxy integration; API Gateway will not interpret these keys and will likely return a 502 Malformed Lambda Response. Option B is wrong because throwing an exception in Lambda causes the function to fail, and API Gateway will return a 502 Internal Server Error, not the custom status code or message. Option C is wrong because 'errorMessage' and 'errorType' are part of the standard error response format for Lambda invocations (used in non-proxy integrations or direct invocations), but with proxy integration, the Lambda must return a properly formatted success response, not an error object.

Practice this question →

250

MCQhard

A company runs a stateful web application on EC2 instances behind an Application Load Balancer. The application uses WebSockets for real-time communication. The company wants to use AWS CodeDeploy to deploy updates with minimal downtime. Which deployment configuration should the developer use?

A.Canary deployment.

B.In-place deployment.

C.Blue/green deployment.

D.Immutable deployment.

AnswerC

Blue/green deployment involves creating an entirely new, identical environment (the "green" environment) running the new version of the application alongside the existing "blue" environment. Traffic remains directed to the stable "blue" environment while the "green" environment is thoroughly tested. Once verified, traffic is seamlessly shifted from "blue" to "green" at the load balancer level. This approach ensures zero downtime and preserves existing user sessions on the "blue" environment until the switch is complete, making it ideal for stateful applications.

Why this answer

Blue/green deployment is correct because it allows the company to deploy a new version of the application on a separate set of EC2 instances (green environment) while the current version continues to serve traffic on the original set (blue environment). Once the green environment is fully tested and healthy, the Application Load Balancer can instantly switch traffic to it, minimizing downtime. This approach is ideal for stateful WebSocket applications because it avoids terminating active connections during the deployment, as the blue environment remains operational until the switch is complete.

Exam trap

The trap here is that candidates often confuse 'immutable deployment' with a valid CodeDeploy option, but AWS CodeDeploy only supports blue/green and in-place deployments, while immutable deployments are a concept from Elastic Beanstalk or EC2 Auto Scaling with launch template versioning.

How to eliminate wrong answers

Option A is wrong because a canary deployment gradually shifts a small percentage of traffic to the new version, which can cause issues with stateful WebSocket connections that require session persistence and may not handle partial traffic shifts gracefully. Option B is wrong because an in-place deployment updates the existing EC2 instances one at a time, which terminates active WebSocket connections and disrupts real-time communication, leading to downtime. Option D is wrong because immutable deployment is not a standard AWS CodeDeploy deployment configuration; AWS CodeDeploy supports blue/green and in-place deployments, but immutable deployments are typically associated with AWS Elastic Beanstalk or EC2 Auto Scaling with launch templates, not CodeDeploy.

Practice this question →

251

MCQeasy

A company uses AWS Elastic Beanstalk to deploy a web application. The application stores user-uploaded images in an S3 bucket. The developer needs to ensure that the application can read and write to the S3 bucket. What should the developer do?

A.Use Amazon CloudFront to proxy requests to the S3 bucket.

B.Hardcode the AWS access keys in the application code.

C.Apply an S3 bucket policy that allows access from the Elastic Beanstalk environment's security group.

D.Configure the Elastic Beanstalk environment to use an IAM instance profile that grants S3 access.

AnswerD

Configuring the Elastic Beanstalk environment to use an IAM instance profile that grants S3 access is the recommended and most secure method. An IAM instance profile attaches an IAM role to the underlying EC2 instances, allowing the application to obtain temporary, automatically rotated credentials from the instance metadata service. This enables the application to make authenticated AWS API calls to S3 without storing any long-term credentials directly within the application code or configuration.

Why this answer

Elastic Beanstalk environments run on EC2 instances, and the recommended way to grant AWS permissions to those instances is by attaching an IAM instance profile. This profile includes an IAM role with a policy that allows the required S3 read and write actions, enabling the application to securely access the S3 bucket without embedding credentials in the code.

Exam trap

The trap here is that candidates may confuse network-level controls (security groups) with identity-based controls (IAM roles) and incorrectly assume that an S3 bucket policy can reference a security group, when in fact S3 bucket policies support only principal, source IP, VPC, or source VPC endpoint conditions, not security group IDs.

How to eliminate wrong answers

Option A is wrong because Amazon CloudFront is a content delivery network (CDN) that can cache and serve content from S3, but it does not grant the application itself the ability to read/write to the bucket; it only proxies requests from clients. Option B is wrong because hardcoding AWS access keys in application code violates security best practices, as keys can be exposed in version control or logs, and Elastic Beanstalk provides a more secure mechanism via instance profiles. Option C is wrong because S3 bucket policies can restrict access by source IP or VPC, but they cannot reference EC2 security groups directly; security groups are a network-level construct, not an identity-based one, and S3 does not evaluate security group IDs in bucket policies.

Practice this question →

252

Multi-Selectmedium

A developer is implementing S3 multipart upload for large files. Which two actions are required to complete the upload?

Select 2 answers

A.Enable S3 static website hosting

B.Upload all parts and keep their ETags/part numbers

C.Disable bucket encryption

D.Call CompleteMultipartUpload with the uploaded part list

AnswersB, D

After initiating a multipart upload, the core process involves uploading each individual part of the large file using the `UploadPart` API operation. For every successful part upload, Amazon S3 returns a unique ETag (entity tag) and the corresponding part number. It is critical to store these ETags and part numbers, as they are mandatory parameters for the subsequent `CompleteMultipartUpload` request, which reassembles the parts into the final object.

Why this answer

During an S3 multipart upload, each part must be uploaded individually, and the response includes an ETag (a hash of the part) and a part number. These must be recorded and provided in the final request to assemble the object. Option D is correct because the CompleteMultipartUpload API call is required to signal S3 to combine all uploaded parts into the final object, using the list of ETags and part numbers.

Exam trap

The trap here is that candidates may think uploading all parts is sufficient without calling CompleteMultipartUpload, or they may confuse the multipart upload process with other S3 features like static hosting or encryption settings.

Practice this question →

253

MCQeasy

A developer is building an application that needs to send email notifications to users. Which AWS service is designed for sending transactional emails?

A.AWS Lambda

B.Amazon Simple Email Service (SES)

C.Amazon Simple Notification Service (SNS)

D.Amazon Simple Queue Service (SQS)

AnswerB

Amazon Simple Email Service (SES) is a highly scalable, cost-effective, and flexible cloud-based email sending service designed for developers to send marketing, notification, and transactional emails from any application. It handles the underlying email infrastructure, including SMTP, deliverability, and reputation management, allowing applications to programmatically send emails via API, SDKs, or SMTP interface. This makes SES the ideal choice for applications requiring direct email sending capabilities.

Why this answer

Amazon Simple Email Service (SES) is specifically designed for sending transactional emails, such as order confirmations, password resets, and marketing communications. It provides a reliable, scalable SMTP interface or API to send high-deliverability emails, with features like dedicated IP addresses and feedback loops. This makes it the correct choice for an application that needs to send email notifications directly to users.

Exam trap

The trap here is that candidates often confuse Amazon SNS with SES because both can send notifications, but SNS is limited to push notifications (SMS, mobile push, HTTP) and cannot send rich transactional emails, while SES is the dedicated email service.

How to eliminate wrong answers

Option A is wrong because AWS Lambda is a serverless compute service for running code in response to events, not a service for sending emails; it could be used to trigger email sending via SES, but it is not the email delivery service itself. Option C is wrong because Amazon Simple Notification Service (SNS) is a pub/sub messaging service designed for sending push notifications to endpoints like SMS, mobile apps, or HTTP/HTTPS, not for sending transactional emails with rich content or attachments. Option D is wrong because Amazon Simple Queue Service (SQS) is a fully managed message queuing service for decoupling application components, and it has no capability to send emails; it can only hold messages for processing by other services.

Practice this question →

254

Multi-Selecthard

A company is using AWS CodePipeline to automate its deployment pipeline. The pipeline has a source stage that pulls code from Amazon S3, a build stage using AWS CodeBuild, and a deploy stage using AWS CodeDeploy. The developer wants to add a manual approval step before deployment to production. Which of the following are correct steps to implement this? (Choose THREE.)

Select 3 answers

A.Add a second pipeline for the approval step.

B.Configure the approval action to use an SNS topic for notifications.

C.Use AWS CodeBuild to run a script that waits for manual approval.

D.Create an IAM role that allows the pipeline to publish to the SNS topic.

E.Add an approval action to the pipeline before the deploy stage.

AnswersB, D, E

When a manual approval action is configured in AWS CodePipeline, it can be integrated with Amazon SNS to send notifications to designated approvers. Upon reaching the approval stage, CodePipeline publishes a message to the specified SNS topic, which can then trigger email subscriptions or other endpoints to alert approvers. This ensures timely communication and allows approvers to access the approval console link directly from the notification, facilitating a prompt decision.

Why this answer

AWS CodePipeline approval actions can be configured to send notifications via Amazon SNS when the action requires manual approval. This allows approvers to be alerted that an approval is pending, enabling timely review and progression of the pipeline.

Exam trap

The trap here is that candidates may think a separate pipeline or a custom script is needed for manual approval, but AWS CodePipeline provides a built-in approval action that integrates directly with SNS and IAM, making those external workarounds incorrect.

Practice this question →

255

MCQmedium

A developer is deploying an application on Amazon ECS using the Fargate launch type. The application needs to communicate with a DynamoDB table. The developer creates a VPC with private subnets and configures the ECS service to use those subnets. However, the tasks cannot reach DynamoDB. What is the MOST likely cause?

A.The task IAM role does not have permissions to access DynamoDB.

B.The security group of the tasks does not allow outbound traffic to DynamoDB.

C.The VPC does not have a VPC endpoint for DynamoDB, and there is no NAT gateway.

D.The task definition does not have a network mode that supports DynamoDB.

AnswerC

When an ECS task runs in a private subnet, it lacks a direct route to the internet, which is necessary to reach public AWS service endpoints like DynamoDB. Without a NAT Gateway to provide outbound internet access or a VPC endpoint for DynamoDB (a Gateway Endpoint for DynamoDB specifically), the task has no network path to communicate with the DynamoDB service. This configuration prevents any successful API calls from the private subnet.

Why this answer

ECS tasks using the Fargate launch type in private subnets cannot reach public AWS services like DynamoDB unless the VPC has either a NAT gateway (to route traffic through an internet gateway) or a VPC endpoint for DynamoDB. Without one of these, the private subnets have no route to the DynamoDB API endpoints, causing connectivity failures. The IAM role and security group are configured correctly, but the network path is missing.

Exam trap

The trap here is that candidates often assume IAM permissions (Option A) are the sole cause of access failures, overlooking the network-layer requirement that private subnets need a route to public AWS services via a NAT gateway or VPC endpoint.

How to eliminate wrong answers

Option A is wrong because the task IAM role controls permissions to DynamoDB actions (e.g., GetItem, PutItem), but if the tasks cannot reach the DynamoDB endpoint at the network level, permissions are irrelevant—the request never arrives. Option B is wrong because security groups are stateful; outbound traffic is allowed by default unless explicitly denied, and DynamoDB does not require a specific outbound rule for HTTPS (port 443) since the default outbound rule allows all traffic. Option D is wrong because the network mode (e.g., awsvpc, bridge, host) does not affect the ability to reach DynamoDB; Fargate requires the awsvpc mode, which assigns an elastic network interface to each task, but this does not block outbound traffic to DynamoDB.

Practice this question →

256

MCQeasy

A developer has written an AWS Lambda function that processes messages from an Amazon SQS queue. The function is configured with a reserved concurrency of 5. The SQS queue has 10,000 messages waiting to be processed. What will happen when the Lambda function is invoked?

A.Lambda will automatically increase reserved concurrency to handle the load.

B.Lambda will reject the invocation because reserved concurrency is too low.

C.Lambda will scale up to 20 concurrent executions to process all messages quickly.

D.Lambda will process messages with a maximum of 5 concurrent executions, each processing a batch of messages.

AnswerD

This statement accurately describes the behavior of a Lambda function configured with reserved concurrency. The function will scale up to, but not exceed, the specified limit of 5 concurrent executions. Each of these concurrent executions will then process a batch of messages from the event source, ensuring that the processing adheres strictly to the defined concurrency constraint.

Why this answer

AWS Lambda integrates with Amazon SQS to poll the queue and invoke the function with batches of messages. The reserved concurrency of 5 caps the maximum number of concurrent executions, so Lambda will process messages with up to 5 concurrent invocations, each receiving a batch of up to 10 messages (default batch size). The remaining messages remain in the queue until they are processed or the visibility timeout expires.

Exam trap

The trap here is that candidates assume Lambda will automatically scale to handle the queue depth, but reserved concurrency is a hard limit that prevents scaling beyond the configured value, leading to throttling rather than rejection or automatic scaling.

How to eliminate wrong answers

Option A is wrong because reserved concurrency is a hard limit that Lambda cannot automatically increase; it must be manually adjusted or removed. Option B is wrong because Lambda does not reject invocations due to low reserved concurrency; it simply throttles the function, and unprocessed messages remain in the SQS queue. Option C is wrong because Lambda cannot scale beyond the reserved concurrency of 5, regardless of the number of messages in the queue.

Practice this question →

257

MCQmedium

A developer is building a REST API using Amazon API Gateway and wants to transform the request data before sending it to the backend Lambda function. The transformation includes mapping query string parameters to a JSON body. Which API Gateway feature should be used?

A.Velocity Template Language (VTL) mapping templates

B.Lambda authorizer

C.Request validator

D.CORS configuration

AnswerA

Velocity Template Language (VTL) mapping templates are a core feature within API Gateway's integration request and response stages. They enable the transformation of incoming client request payloads and outgoing backend responses into formats compatible with the integration. This includes converting query string parameters, path parameters, or headers into a structured JSON body, or vice-versa, making them essential for adapting data formats between client and backend services.

Why this answer

API Gateway uses Velocity Template Language (VTL) mapping templates to transform incoming request data, such as mapping query string parameters into a JSON body before passing it to the backend Lambda function. This feature allows you to define a template that extracts values from the request's query string parameters (e.g., `$input.params('paramName')`) and constructs a new JSON payload, enabling seamless integration with Lambda without modifying the client request.

Exam trap

The trap here is that candidates often confuse request validation (Option C) with data transformation, assuming that validating the request structure also implies the ability to reshape the data, but validation only checks for presence and format, not mapping or transformation.

How to eliminate wrong answers

Option B is wrong because a Lambda authorizer is used for custom authentication and authorization of API requests, not for transforming request data or mapping parameters to a JSON body. Option C is wrong because a request validator only validates that the request adheres to the API's defined schema (e.g., required parameters, types), but it does not perform any data transformation or mapping. Option D is wrong because CORS configuration manages cross-origin resource sharing headers (e.g., Access-Control-Allow-Origin) to allow browser-based clients from different domains, and it has no role in transforming request payloads or mapping query string parameters.

Practice this question →

258

Multi-Selecthard

A developer is building a real-time chat application using WebSocket APIs in API Gateway and Lambda. The application must handle thousands of concurrent connections. Which TWO actions should the developer take to ensure the application scales properly?

Select 2 answers

A.Use CloudFront to distribute the WebSocket endpoints.

B.Place the Lambda function in a VPC to improve security.

C.Enable API Gateway caching to reduce Lambda invocations.

D.Set the Lambda function's reserved concurrency to a high enough value.

E.Use a DynamoDB table to store connection IDs and handle connection state.

AnswersD, E

For a real-time chat application, sudden bursts of user activity can lead to a large volume of concurrent Lambda invocations. Setting a high enough reserved concurrency guarantees that a specified number of execution environments are always available exclusively for this specific Lambda function, preventing it from being throttled by the account's unreserved concurrency pool. This ensures the function can consistently process messages and maintain responsiveness even during peak load, which is critical for delivering a smooth and reliable real-time chat experience.

Why this answer

Setting reserved concurrency ensures the Lambda function has enough allocated capacity to handle the high volume of concurrent WebSocket connections without being throttled by the account-level concurrency limit. Without reserved concurrency, the function could experience throttling errors (HTTP 429) during traffic spikes, causing dropped connections and poor user experience.

Exam trap

A common pitfall is assuming CloudFront can help scale WebSocket APIs for concurrent connections. While CloudFront does support WebSocket connections, it does not address the backend Lambda scaling or state management required for thousands of connections. The correct scaling actions are setting reserved concurrency for the Lambda function and storing connection IDs in DynamoDB for state management.

Similarly, enabling API Gateway caching or placing Lambda in a VPC do not solve the concurrency scaling issue.

Practice this question →

259

MCQeasy

A developer wants to deploy a containerized application to Amazon ECS using Fargate. The application requires persistent storage that can be shared across multiple containers in the same task. Which storage option should the developer use?

A.Amazon EC2 instance store

B.Amazon EFS file system

C.Amazon S3 bucket

D.Amazon EBS volume

AnswerB

Amazon EFS (Elastic File System) provides scalable, elastic, shared file storage that can be accessed concurrently by multiple AWS Fargate tasks. It offers persistent storage, ensuring data remains available even if containers are stopped, replaced, or scaled. This makes EFS an excellent choice for containerized applications requiring shared state, persistent data, or a common file system across different application instances running on Fargate.

Why this answer

Amazon EFS provides a shared, persistent, and scalable file system that can be mounted by multiple containers within the same ECS task using Fargate. EFS supports the Network File System (NFS) protocol, allowing concurrent read/write access from all containers in the task, which meets the requirement for shared persistent storage. Unlike ephemeral or block storage options, EFS is designed for multi-attach scenarios and persists independently of the container lifecycle.

Exam trap

The trap here is that candidates often confuse Amazon EBS with a shared storage solution, but EBS volumes cannot be attached to multiple Fargate containers or tasks simultaneously, making EFS the only correct choice for shared persistent storage in this context.

How to eliminate wrong answers

Option A is wrong because Amazon EC2 instance store provides ephemeral block storage that is tied to the lifecycle of an EC2 instance, not a Fargate task, and cannot be shared across multiple containers. Option C is wrong because Amazon S3 is an object storage service accessed via HTTP/HTTPS APIs, not a file system mountable via NFS, and does not provide the POSIX-compliant shared file system required for concurrent container access. Option D is wrong because Amazon EBS volumes are block-level storage that can only be attached to a single EC2 instance at a time (unless using multi-attach EBS, which is not supported with Fargate), and cannot be shared across multiple containers in the same Fargate task.

Practice this question →

260

MCQmedium

A developer is using AWS Elastic Beanstalk to deploy a web application. The application needs to store session state. Which configuration is MOST cost-effective and scalable?

A.Use S3 to store session state

B.Use an ElastiCache Memcached cluster

C.Use an RDS database to store session state

D.Store session state in the local file system of each EC2 instance

AnswerB

An ElastiCache Memcached cluster provides a highly scalable, in-memory key-value store perfectly suited for transient session state. Its distributed nature allows multiple EC2 instances in an Elastic Beanstalk environment to access shared session data with very low latency. This ensures user sessions persist even if requests are routed to different instances by a load balancer, enhancing application scalability and user experience.

Why this answer

ElastiCache Memcached is the most cost-effective and scalable solution for storing session state because it is an in-memory cache designed for low-latency access, which is ideal for session data that must be frequently read and written. It scales horizontally by adding nodes, and its distributed nature ensures that session data persists across EC2 instance replacements, unlike local storage. This avoids the higher cost and overhead of RDS or the latency and eventual consistency issues of S3 for session management.

Exam trap

The trap here is that candidates often choose local file system storage (D) because it seems simplest and free, overlooking that it fails in auto-scaling environments where instances are ephemeral and session data is not shared.

How to eliminate wrong answers

Option A is wrong because S3 is an object store with higher latency and eventual consistency, making it unsuitable for session state that requires fast, consistent reads and writes; it also incurs per-request costs that can become expensive under high traffic. Option C is wrong because RDS is a relational database with higher cost and operational overhead (e.g., provisioning, scaling, backups) compared to an in-memory cache, and it is overkill for simple key-value session data. Option D is wrong because storing session state in the local file system of each EC2 instance breaks when instances are replaced or scaled out, as session data is not shared across instances, leading to data loss and poor scalability.

Practice this question →

261

Multi-Selecthard

A Lambda function processes messages from an SQS standard queue and writes results to DynamoDB. Duplicate writes occasionally occur after retries. Which two changes best make the processing idempotent?

Select 2 answers

A.Use a deterministic idempotency key stored with a conditional write in DynamoDB

B.Increase the Lambda timeout to 15 minutes

C.Treat the SQS message ID or business transaction ID as a processed-record key

D.Disable SQS visibility timeout

AnswersA, C

SQS Standard queues provide at-least-once delivery, meaning messages can be delivered multiple times. Implementing idempotency is crucial to prevent duplicate processing side effects. By generating a deterministic key (e.g., from the SQS message ID or a business transaction ID) and storing it in DynamoDB with a conditional write (e.g., using `attribute_not_exists`), the Lambda function ensures that the operation only proceeds if the key hasn't been recorded before, making the operation safe for retries and preventing unintended state changes.

Why this answer

Using a deterministic idempotency key (e.g., a business transaction ID) combined with a conditional write in DynamoDB ensures that if the same message is processed more than once, the second write attempt will fail because the item already exists. This prevents duplicate records even when Lambda retries after a failure or timeout, making the processing idempotent at the database level.

Exam trap

The trap here is that candidates often confuse idempotency with simply increasing timeouts or disabling visibility timeouts, not realizing that idempotency requires a deterministic key and a conditional check at the storage layer.

Practice this question →

262

MCQeasy

A developer wants to store session state for a web application that runs on multiple EC2 instances behind an Application Load Balancer. Which AWS service should the developer use to store the session state in a centralized, highly available location?

A.Amazon RDS

B.Amazon S3

C.Amazon ElastiCache

D.AWS Lambda

AnswerC

Amazon ElastiCache is a fully managed in-memory caching service, offering high-performance, low-latency data retrieval using Redis or Memcached engines. It is specifically designed for use cases like session state management, where rapid access to frequently changing, ephemeral key-value data is critical. Its in-memory nature significantly reduces I/O latency compared to disk-based solutions, ensuring a responsive user experience and easily scaling to handle high request volumes.

Why this answer

Amazon ElastiCache is the correct choice because it provides a managed, in-memory caching service that supports Redis or Memcached, which are ideal for storing session state in a centralized, highly available manner. Session data requires low-latency reads and writes, and ElastiCache offers sub-millisecond performance, replication across multiple Availability Zones, and automatic failover, making it suitable for stateless web applications behind an Application Load Balancer.

Exam trap

The trap here is that candidates mistakenly choose Amazon RDS for session storage due to its familiarity with databases, overlooking that session state is transient and requires low-latency access, which ElastiCache's in-memory architecture provides far more efficiently.

How to eliminate wrong answers

Option A is wrong because Amazon RDS is a relational database service designed for persistent, structured data with ACID compliance, not for transient session state; its higher latency and connection overhead make it suboptimal for frequent session reads/writes. Option B is wrong because Amazon S3 is an object storage service with eventual consistency for read-after-write in some cases, and its higher latency (typically tens of milliseconds) and lack of native session expiration mechanisms make it unsuitable for real-time session state management. Option D is wrong because AWS Lambda is a serverless compute service for running code in response to events, not a data store; it cannot natively persist session state across invocations without an external storage layer like ElastiCache or DynamoDB.

Practice this question →

263

MCQeasy

A company is using AWS CloudFormation to deploy infrastructure. The developer wants to update a stack and needs to know what changes will be made before executing the update. Which AWS CLI command should the developer use?

A.aws cloudformation deploy

B.aws cloudformation create-change-set

C.aws cloudformation validate-template

D.aws cloudformation update-stack

AnswerB

Correct. The aws cloudformation create-change-set command creates a change set, which is a summary of proposed changes to a CloudFormation stack. This allows the developer to review what resources will be added, modified, or deleted before executing the update, without making any actual changes.

Why this answer

The `aws cloudformation create-change-set` command creates a change set, which is a summary of proposed changes to a CloudFormation stack. This allows the developer to review what resources will be added, modified, or deleted before executing the update, without making any actual changes. The change set can then be executed with `aws cloudformation execute-change-set` to apply the changes.

Exam trap

The trap here is that candidates often confuse `aws cloudformation update-stack` with a preview command, but it directly applies changes, whereas `create-change-set` is the correct command for reviewing changes before execution.

How to eliminate wrong answers

Option A is wrong because `aws cloudformation deploy` is used to deploy a stack or update an existing stack directly, but it does not provide a preview of changes before execution; it applies changes immediately. Option C is wrong because `aws cloudformation validate-template` only checks the syntax and structure of a CloudFormation template, not the impact of changes on an existing stack. Option D is wrong because `aws cloudformation update-stack` directly updates the stack without offering a preview of the changes, making it unsuitable for reviewing changes beforehand.

Practice this question →

264

MCQeasy

A developer is building a serverless API using Amazon API Gateway and AWS Lambda. The API accepts JSON payloads in the request body. The developer wants to ensure that incoming requests have a valid structure before being passed to the Lambda function to reduce unnecessary invocations. Which API Gateway feature should the developer use?

A.Request validation using models and request validators

B.Usage plans with API keys

C.WAF (AWS WAF) integration

D.Custom authorizer (Lambda authorizer)

AnswerA

API Gateway's request validation feature directly addresses the need to validate the structure and data types of incoming request payloads. By defining a Model, which is essentially a JSON schema, and associating it with a Method's request body, API Gateway automatically checks the request against this schema. Invalid requests, such as those with missing required fields or incorrect data types, are rejected with a 400 Bad Request error *before* the request reaches the backend integration, significantly reducing unnecessary Lambda invocations and operational costs.

Why this answer

API Gateway's request validation feature allows you to define a JSON Schema model for the request body and attach a request validator to the method. This validates the payload structure before the request reaches the Lambda function, preventing invalid payloads from triggering unnecessary invocations and reducing costs.

Exam trap

The trap here is that candidates confuse request validation (payload structure checking) with authorization (who can call the API) or security filtering (WAF), leading them to pick a wrong option like custom authorizer or WAF integration.

How to eliminate wrong answers

Option B is wrong because usage plans with API keys control rate limiting and quota management for API consumers, not payload structure validation. Option C is wrong because AWS WAF integration protects against web exploits like SQL injection or cross-site scripting at the HTTP layer, not JSON schema validation. Option D is wrong because a custom authorizer (Lambda authorizer) authenticates and authorizes the caller (e.g., via OAuth or JWT), but does not validate the request body's structure or content.

Practice this question →

265

MCQhard

A developer is optimizing an S3 bucket for static website hosting. The site has a main page (index.html) and an error page (error.html). Users report seeing a generic 403 error instead of the error page when accessing a missing object. What is the likely cause?

A.The bucket policy denies access to the error.html object.

B.The Error document field in the static website hosting configuration is not set to error.html.

C.The index.html is missing from the bucket.

D.The error.html object has incorrect permissions.

AnswerB

This is the correct answer because the 'Error document' field within the S3 static website hosting configuration explicitly tells S3 which HTML file to serve when a 4xx error occurs. Without this field being correctly set to `error.html`, S3 will not know to redirect error requests to your custom page, even if `error.html` exists and has appropriate permissions. This configuration acts as the crucial routing instruction for custom error handling, ensuring a branded user experience during errors.

Why this answer

When static website hosting is enabled on an S3 bucket, the Error Document field specifies the object served when a 403 or 404 error occurs. If this field is not set to error.html, S3 returns its generic 403 error response instead of the custom error page. The correct answer is B because the Error document configuration is missing or incorrect.

Exam trap

The trap here is that candidates often confuse a permission issue (like a bucket policy or object ACL) with a configuration issue, assuming a 403 error always means 'access denied' rather than a missing Error Document setting.

How to eliminate wrong answers

Option A is wrong because a bucket policy denying access to error.html would cause a 403 error for that specific object, but the scenario describes a generic 403 error when accessing a missing object, not a permission issue on the error page itself. Option C is wrong because if index.html were missing, users would get a 403 or 404 error on the root, but the question specifically states the error occurs when accessing a missing object, not the main page. Option D is wrong because incorrect permissions on error.html would prevent it from being served, but the generic 403 error when accessing a missing object is controlled by the Error Document configuration, not the object's permissions.

Practice this question →

266

MCQeasy

A developer wants to store application configuration securely and retrieve it programmatically from EC2 instances. The configuration includes database passwords and API keys. Which AWS service should be used?

A.EC2 user data

B.Amazon S3 with server-side encryption

C.AWS CloudFormation template parameters

D.AWS Systems Manager Parameter Store with SecureString

AnswerD

AWS Systems Manager Parameter Store, specifically when utilizing the SecureString data type, provides a highly secure and scalable solution for storing sensitive application configuration and secrets. SecureString encrypts parameter values using AWS Key Management Service (KMS) customer master keys, ensuring data is protected at rest and in transit. It offers fine-grained IAM access control, versioning, and seamless integration with EC2 instances and other AWS services for secure runtime retrieval without hardcoding credentials.

Why this answer

AWS Systems Manager Parameter Store with SecureString is the correct choice because it is purpose-built for securely storing sensitive configuration data like database passwords and API keys. It integrates with AWS KMS for encryption at rest, supports versioning, and allows EC2 instances to retrieve values via the AWS CLI or SDK using IAM roles, eliminating the need to hardcode secrets.

Exam trap

The trap here is that candidates confuse EC2 user data (which is easy to use but insecure) with a proper secrets management service, overlooking that Parameter Store provides encryption, access control, and audit logging essential for production security.

How to eliminate wrong answers

Option A is wrong because EC2 user data is unencrypted plaintext accessible via the instance metadata service (IMDS) and is intended for startup scripts, not secure storage of secrets. Option B is wrong because while Amazon S3 with server-side encryption protects data at rest, it lacks native integration for programmatic retrieval from EC2 with IAM roles and does not support automatic rotation or versioning of secrets. Option C is wrong because AWS CloudFormation template parameters are used for passing values during stack creation and are not designed for runtime secret retrieval; they can expose secrets in plaintext in the console or logs if not handled carefully.

Practice this question →

267

MCQmedium

A developer is building a serverless application that uses Amazon S3 event notifications to trigger an AWS Lambda function for thumbnail generation. The developer wants to ensure that duplicate S3 events do not cause the same image to be processed multiple times. Which approach should the developer implement to ensure idempotent processing?

A.Store the object key and event ID in a DynamoDB table and check for duplicates before processing

B.Set the Lambda function's concurrency to 1 to prevent concurrent executions

C.Use an Amazon SQS FIFO queue as the event destination

D.Enable S3 event notification filtering based on object size

AnswerA

Amazon S3 event notifications operate on an "at least once" delivery model, meaning duplicate events can occur. By storing a unique identifier, such as a combination of the S3 object key and the event's `eventTime` or a generated `eventId`, in a DynamoDB table, the Lambda function can implement idempotency. Before processing, the function attempts a conditional write to DynamoDB; if the item already exists, it signifies a duplicate event that has been processed or is currently being handled, preventing redundant work and ensuring each object is processed exactly once.

Why this answer

Storing the S3 object key and event ID in a DynamoDB table with a TTL attribute allows the Lambda function to perform a conditional write (or check for an existing item) before processing. This ensures that even if duplicate S3 events are delivered (e.g., due to S3's at-least-once delivery guarantee), the same image is only processed once, achieving idempotency.

Exam trap

The trap here is that candidates often assume S3 event notifications are exactly-once, but the exam tests that they are at-least-once, requiring explicit idempotency handling via an external store like DynamoDB.

How to eliminate wrong answers

Option B is wrong because setting concurrency to 1 only prevents concurrent executions but does not prevent duplicate events from being processed sequentially; the same image could still be processed multiple times if duplicate events arrive one after another. Option C is wrong because SQS FIFO queues provide exactly-once processing within the queue, but S3 event notifications cannot directly send to a FIFO queue (S3 only supports standard SQS queues as event destinations), and even if you manually route through a FIFO queue, the deduplication ID would need to be based on the event ID, which is not automatically handled. Option D is wrong because filtering based on object size only reduces the number of events triggered (e.g., for small or large objects) but does not address duplicate events for the same object; duplicates can still occur regardless of size.

Practice this question →

268

MCQeasy

A developer is using AWS SAM to define a serverless application. The application includes an AWS Lambda function that needs to access an Amazon DynamoDB table. The developer wants to grant the Lambda function the minimum required permissions to read and write items in the table. Which resource should the developer use to define the IAM permissions?

A.AWS::DynamoDB::Table

B.AWS::IAM::Role

C.AWS::Serverless::Function Policies property

D.AWS::Lambda::Permission

AnswerC

The Policies property within an AWS::Serverless::Function resource in a SAM template is the designated and most efficient way to attach IAM permissions to the Lambda function's execution role. This property allows developers to specify predefined SAM policy templates (e.g., DynamoDBReadPolicy) or define custom inline IAM policy statements, granting the function the necessary permissions to interact with other AWS services like DynamoDB. It directly modifies the function's execution role to allow specific actions.

Why this answer

The AWS::Serverless::Function resource's Policies property allows you to attach IAM policies directly to the Lambda function's execution role in a declarative manner. By specifying a policy statement with dynamodb:GetItem, dynamodb:PutItem, etc., and the ARN of the DynamoDB table, you grant the minimum required permissions for read and write access without manually creating an IAM role. SAM automatically creates and associates the IAM role with the function, simplifying permission management.

Exam trap

The trap here is that candidates confuse AWS::Lambda::Permission (which controls who can invoke the Lambda) with the IAM permissions needed for the Lambda to access other services, leading them to select Option D instead of the correct Policies property.

How to eliminate wrong answers

Option A is wrong because AWS::DynamoDB::Table defines the DynamoDB table resource itself, not IAM permissions; it cannot grant access to Lambda functions. Option B is wrong because AWS::IAM::Role is a generic CloudFormation resource that requires you to manually define the role, trust policy, and attach policies, which is more verbose and error-prone than using SAM's Policies property. Option D is wrong because AWS::Lambda::Permission is used to grant other AWS services or accounts permission to invoke the Lambda function, not to grant the Lambda function permissions to access other resources like DynamoDB.

Practice this question →