CCNA Development with AWS Services Questions

Option C is correct because AWS Systems Manager Parameter Store can store configuration data securely, with encryption using KMS, and provides audit trails via CloudTrail. Option A is incorrect because S3 is not designed for parameter storage and would require additional setup for encryption and access control. Option B is incorrect because DynamoDB is a database, not a configuration store; it would require more overhead.

Option D is incorrect because Secrets Manager is more expensive and is specifically for secrets, not general application configuration.

Option D is correct because each shard's records have a sequence number, and a single consumer can process them in order. Option A is wrong because multiple consumers in a group can process different shards but ordering within a shard is maintained only if one consumer handles that shard. Option B is wrong because DynamoDB streams are for DynamoDB tables, not Kinesis.

Option C is wrong because Lambda consumes records in batches, but ordering is preserved within a shard as long as there's only one concurrent invocation per shard. However, the best practice is to have one consumer per shard.

API Gateway Lambda authorizer can call the OAuth provider to validate tokens. Cognito User Pools can be configured as an OAuth 2.0 provider and integrated with API Gateway. Custom Lambda function can validate tokens directly.

API Gateway resource policy is for IP whitelisting, not authentication. IAM authorization is for AWS credentials.

Options B and D are correct because they involve secure storage and rotation of credentials. Option A is wrong because storing credentials in Lambda environment variables is not secure if the variables are visible in the console. Option C is wrong because hardcoding is never a best practice.

Option E is wrong because storing in source code is insecure.

Option A is correct because reducing max concurrency and increasing task timeout addresses both state machine execution limits and timeouts. Option B is wrong because increasing map concurrency would worsen throttling. Option C is wrong because splitting into multiple state machines does not address task timeouts.

Option D is wrong because Lambda reserved concurrency does not prevent state machine throttling.

Option A is correct because AWS Systems Manager Parameter Store or AWS Secrets Manager can securely store secrets and be referenced in ECS task definitions. Option B is wrong because environment variables in the task definition are visible in plaintext. Option C is wrong because S3 is not designed for secrets.

Option D is wrong because it increases attack surface.

The correct answer is B. The policy allows s3:PutObject but does not include kms:Encrypt, which is required for uploading objects with SSE-KMS. Option A is wrong because the policy allows s3:PutObject.

Option C is wrong because the KMS key is specified. Option D is wrong because the user may not have KMS permissions, but the missing action is kms:Encrypt.

Option A is correct because the Deny statement explicitly denies s3:* actions on the confidential prefix when the source IP is not in 10.0.0.0/8. Since the user's IP (192.168.1.100) is not in that range, the Deny applies. Even though the Allow statement grants s3:PutObject, the explicit Deny overrides.

Option B is wrong because the Deny applies. Option C is wrong because the Deny is explicit. Option D is wrong because the IP condition is checked.

Option C is correct because the multipart upload API is designed for objects over 100 MB. Option A is wrong because PutObject is for objects up to 5 GB, but recommended for smaller objects. Option B is wrong because pre-signed URLs are for granting temporary access, not uploading large objects efficiently.

Option D is wrong because S3 Transfer Acceleration speeds up uploads over long distances but does not change the API method needed.

Option D is correct because X-Ray tracing must be enabled on downstream resources to record segments. Option A is wrong because sampling rate affects number of traces, not completeness. Option B is wrong because X-Ray SDK is needed on Lambda.

Option C is wrong because X-Ray daemon is needed for EC2, but Lambda uses the X-Ray SDK.

Option C is correct because the Lambda execution role must allow logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents for CloudWatch, and dynamodb:PutItem for DynamoDB. Option A is wrong because it includes unnecessary DynamoDB read permissions. Option B is wrong because it includes dynamodb:* which is too broad.

Option D is wrong because it lacks DynamoDB write permission.

Option A is correct because enabling caching in API Gateway will cache responses for a specified TTL. Option C is correct because Lambda can return cache-control headers to instruct API Gateway to cache the response. Option B is wrong because CloudFront caches content at the edge, but API Gateway caching is separate and more direct.

Option D is wrong because DynamoDB Accelerator is for database caching, not API responses. Option E is wrong because ElastiCache is not integrated with API Gateway for response caching.

Option B is correct because adding 'npm cache verify' before 'npm install' can fix integrity errors by clearing the cache. Option A is wrong because disabling integrity checks reduces security. Option C is wrong because 'npm install --prefer-offline' uses cache and may still have integrity issues.

Option D is wrong because using a separate CodeBuild project does not solve the integrity problem.

SSE-S3 is Amazon-managed keys, not customer-managed. To use customer-managed KMS keys, you must change the default encryption to SSE-KMS. S3 Bucket Keys reduce KMS costs but are not required.

Object-level encryption settings are not needed if default encryption is set. Policy change is not sufficient.

Option B is correct because API Gateway provides built-in usage plans with the ability to set rate limits per API key. Option A is wrong because Lambda reserved concurrency limits the overall concurrency, not per-key throttling. Option C is wrong because WAF is for web application firewall, not per-key throttling.

Option D is wrong because CloudWatch alarms only alert, they don't throttle.

Option A is correct because the Lambda authorizer can retrieve the public key from an external URL (e.g., JWKS endpoint) at runtime, avoiding hardcoded keys. Option B is wrong because recreating the authorizer would cause downtime. Option C is wrong because deploying a new stage does not update the authorizer logic.

Option D is wrong because manually updating environment variables requires a function update and is less flexible than fetching keys dynamically.

Option B is correct because the artifact must be passed explicitly between stages via the OutputArtifacts and InputArtifacts configuration. Option A is wrong because S3 bucket policy is not typically the issue for cross-account same account. Option C is wrong because CodeBuild permissions are separate.

Option D is wrong because CodeDeploy permissions are for deployment, not artifact access.

Option A is correct because AWS Secrets Manager can store and automatically rotate database credentials. Option C is correct because Elastic Beanstalk can pass environment properties (e.g., secrets) to the application. Option D is correct because the application can query Secrets Manager at runtime to get the current credentials.

Option B is incorrect because hardcoding credentials in environment variables is insecure. Option E is incorrect because storing credentials in S3 with a bucket policy is less secure and not best practice.

Option D is correct because enabling Auto Scaling and adjusting scaling triggers allows the environment to add instances during peak hours and remove them during low traffic, balancing performance and cost. Option A is wrong because increasing instance size may be more expensive and less elastic. Option B is wrong because reducing the number of instances would worsen latency.

Option C is wrong because using a load balancer alone does not change instance provisioning.

Option B is correct because API Gateway can validate requests using a model schema, reducing Lambda invocations. Option A is wrong because validation in Lambda still incurs cost and latency. Option C is wrong because request parameters alone don't validate payload.

Option D is wrong because CloudFront is a CDN, not for API validation.

Options A and C are correct. Enabling caching requires enabling cache in the API Gateway stage settings and also configuring cache key parameters (usually by enabling caching on the method request). Option B is for API keys, not caching.

Option D is for edge-optimized endpoints, not caching. Option E is not directly related to enabling caching; it is about custom domain.

Amazon SQS can directly invoke AWS Lambda via event source mappings. Option A is correct because Lambda can poll SQS and process messages. Option B is incorrect because SNS is a pub/sub service, not for SQS.

Option C is incorrect because EventBridge is for event buses, not direct SQS triggers. Option D is incorrect because Step Functions orchestrate workflows, not direct triggers.

Option A is correct because manual approval gates allow review. Option B is correct because S3 versioning enables rollback. Option D is correct because CloudFormation change sets allow preview.

Option C is wrong because AWS KMS is not needed. Option E is wrong because cross-account access is not mentioned.

IAM roles for tasks can be used to authenticate to other AWS services via SDK. Service Connect can handle service discovery and encryption. App Mesh provides mTLS for authentication between services.

Security groups control network access, not authentication. API Gateway is for external APIs.

Option D is correct when the Lambda function is a custom integration (not proxy), the Lambda function must return the CORS headers in the response. For proxy integrations, API Gateway automatically handles CORS headers. If the developer enabled CORS on API Gateway but the Lambda is a custom integration, the headers from API Gateway may not be passed through; the Lambda must return them.

Option A is the correct answer: the Lambda function must return the CORS headers because the API Gateway CORS configuration only applies to the mock response, not the Lambda response.

Option D is correct because the ECS Service Auto Scaling requires a custom metric to be published to CloudWatch, and it may take a few minutes for the metric to appear. Option A is wrong because Fargate tasks do not have a maximum task limit by default; the limit is per region and can be increased. Option B is wrong because the SQS ApproximateNumberOfMessagesVisible metric is available as a standard CloudWatch metric.

Option C is wrong because the payments service polls the queue; the scaling policy should work regardless of polling frequency.

Option B is correct because with proxy integration, Lambda must return a response in the specific format: statusCode, headers, and body. Option A is wrong because throwing an exception results in a 502 Bad Gateway. Option C is wrong because the format does not include 'errorMessage' as a top-level key.

Option D is wrong because the correct format uses 'statusCode', not 'status_code'.

Option A is correct because the AMI must be shared with the target account, and the EBS snapshots must be shared as well. Option B (copy to target account) is not necessary. Option C (public) is not required.

Option D (encryption key) is only needed if the snapshots are encrypted.

Option A is correct because a blue/green deployment allows the company to create a new set of instances (green) and switch traffic after testing, minimizing downtime. Option B is incorrect because in-place deployment would update instances one by one, but stateful applications may lose session data. Option C is incorrect because immutable deployments are not supported by CodeDeploy for EC2; they are used with Elastic Beanstalk.

Option D is incorrect because canary deployments are for Lambda, not EC2.

Option A is correct because Elastic Beanstalk can automatically create and configure an instance profile with the necessary S3 permissions if you specify the bucket policy. Option B is wrong because S3 bucket policies are for bucket-level access, not directly for EC2 instances. Option C is wrong because access keys are insecure.

Option D is wrong because CloudFront is for content delivery, not for granting S3 access.

Option C is correct because AWS Systems Manager Parameter Store (or Secrets Manager) is designed for secure storage of secrets and can be accessed via IAM roles. Option A is wrong because environment variables can be exposed. Option B is wrong because S3 is not designed for secrets and requires encryption management.

Option D is wrong because Lambda is a compute service, not a secret store.

Option B is correct because Amazon SES is for sending emails. Option A is wrong because SNS is for push notifications. Option C is wrong because SQS is for message queuing.

Option D is wrong because Lambda is compute.

Option B is correct. DynamoDB Auto Scaling adjusts the provisioned capacity based on traffic, preventing throttling. ECS Service Auto Scaling adds more tasks to handle increased load.

Option A is wrong because increasing the throughput limit without auto scaling would still require manual changes. Option C is wrong because DynamoDB Accelerator (DAX) is a cache for reads, not writes. Option D is wrong because SQS for write requests adds complexity and may not be real-time.

Options A, C, and D are correct. Option A is correct because an approval action is added to the pipeline. Option B is wrong because CodeBuild is for build, not deployment.

Option C is correct because approval requires an SNS topic to send notifications. Option D is correct because an IAM role is needed for the approval action to publish to SNS. Option E is wrong because the approval action is added to the pipeline, not a separate stage.

Option B is correct because private subnets need a VPC endpoint (or NAT gateway) to access DynamoDB. Option A is wrong because security groups control traffic at instance level, but the issue is routing. Option C is wrong because IAM roles are for permissions, not network connectivity.

Option D is wrong because task definitions don't have network settings for VPC endpoints.

Reserved concurrency limits the maximum number of concurrent invocations to 5. Lambda will poll the SQS queue and process messages up to the reserved concurrency. If the batch size is 10, each invocation processes up to 10 messages, so up to 50 messages can be processed concurrently.

The rest remain in the queue. Lambda does not scale beyond reserved concurrency.

Option C is correct. Increasing Lambda concurrency to at least 20 (2 per shard) will reduce throttling. Reducing batch size to 10 will lower processing time per batch, preventing timeouts.

Option A is wrong because increasing timeout to 5 minutes doesn't address throttling. Option B is wrong because increasing shards to 20 without increasing concurrency will not help. Option D is wrong because disabling concurrency limit could cause uncontrolled scaling.

Option D is correct because increasing the timeout to 10 seconds allows the function to complete. Option A is incorrect because increasing memory does not directly affect timeout. Option B is incorrect because async invocation does not change timeout.

Option C is incorrect because reserved concurrency does not affect timeout.

Options B and C are correct. Using a DynamoDB table to store connection IDs (B) is a common pattern for managing WebSocket connections. Setting the Lambda function concurrency limit (C) prevents throttling of other functions.

Option A is wrong because Lambda functions in a VPC have limited elastic network interfaces. Option D is wrong because API Gateway handles scaling automatically. Option E is wrong because CloudFront does not support WebSocket APIs.

Option B is correct because EFS can be mounted as a volume in Fargate tasks and shared among containers. Option A (EBS) is not supported in Fargate. Option C (S3) is object storage, not a file system.

Option D (Instance store) is ephemeral and not available in Fargate.

Option A is correct because a Lambda authorizer can validate tokens. Option C is correct because the authorizer can be configured only on the POST method. Option E is correct because the Lambda authorizer returns an IAM policy that allows or denies access.

Option B is incorrect because Cognito User Pools authorizer would apply to the entire API. Option D is incorrect because resource policies are global, not method-specific.

ElastiCache (Redis or Memcached) is a managed in-memory cache that is commonly used for session state storage across multiple EC2 instances. DynamoDB is also an option but is not listed. S3 is not suitable for session state.

RDS is a relational database, not ideal for session state. Lambda is compute, not storage.

CloudFormation does not automatically detect changes in S3. Using the same S3 key with a version ID ensures that CloudFormation sees a change and updates the function. Using a parameter for the bucket does not trigger updates.

Custom Resource or CodePipeline is overkill for simple updates.

Option C is correct because 'aws cloudformation change-set create' creates a change set that previews changes. Option A is wrong because 'update-stack' directly updates without preview. Option B is wrong because 'deploy' is for CodeDeploy.

Option D is wrong because 'validate-template' only checks syntax.

Options B, C, and E are correct. Increasing the Lambda timeout (B) allows the function to wait longer for the API response. Implementing a retry logic with exponential backoff (C) helps handle transient delays.

Using an asynchronous invocation pattern (E) decouples the request from the response, allowing the function to return quickly and process the response later. Option A is incorrect because VPC configuration does not affect timeout. Option D is incorrect because reducing batch size is not relevant to timeout.

Option D is correct because S3 static website hosting uses the Index document and Error document settings; if the error document is not configured correctly, S3 returns a generic 403. Option A is wrong because error page is not tied to object permissions. Option B is wrong because error page is different from index.

Option C is wrong because bucket policy does not affect error page routing.

Option B is correct because AWS Systems Manager Parameter Store with SecureString provides encrypted storage for secrets. Option A is wrong because S3 is not designed for secret management. Option C is wrong because EC2 user data is not encrypted.

Option D is wrong because CloudFormation is for infrastructure, not runtime secret retrieval.

The correct answers are B, C, and D. SAM uses a template.yaml file, and the aws cloudformation package and deploy commands are used to deploy. Option A is wrong because Terraform is a separate tool.

Option E is wrong because the AWS CLI alone cannot handle SAM packaging and deployment.

In AWS SAM, the AWS::Serverless::Function resource has a Policies property that can be used to attach IAM policies. The developer can use a managed policy like 'AmazonDynamoDBFullAccess' or a custom policy. However, the recommended approach is to use the 'Policies' property with a statement that grants specific DynamoDB actions.

AWS::IAM::Role can be used but is not necessary if using SAM. AWS::Lambda::Permission is for resource-based policies, not for Lambda execution role. AWS::DynamoDB::Table defines the table, not permissions.

The correct answers are C and D. Amazon ElastiCache for Redis provides in-memory caching with low latency, and Amazon DynamoDB provides fast NoSQL storage. Option A is wrong because EFS is a file system, not optimized for key-value session data.

Option B is wrong because RDS is relational and adds latency. Option E is wrong because S3 is object storage with higher latency.

Option A (Change sets) is correct because they allow previewing changes. Option B (Stack policy) is correct because it can protect specific resources during updates. Option D (UpdateReplace policy) is correct because it can create a replacement before deletion.

Option C is wrong because deletion policy is about stack deletion, not updates. Option E is wrong because it's a parameter, not a strategy.

Option B is correct because setting the batch size to 1 and the concurrency to the number of shards (or reserved concurrency of 1) ensures per-shard ordering and single-threaded processing per shard. Option A is wrong because parallelization factor processes batches in parallel, breaking ordering. Option C is wrong because Lambda processes multiple shards concurrently by default, but reserving concurrency per shard is not possible; instead, set concurrency to 1.

Option D is wrong because Kinesis ordering is per-shard, not across the stream.

Option B is correct. CloudFormation has API rate limits; adding a retry with backoff in the pipeline configuration will handle transient throttling. Option A is wrong because increasing the timeout does not address rate limits.

Option C is wrong because using a different deployment method may not avoid CloudFormation API calls. Option D is wrong because the issue is not related to IAM permissions.