Courseiva

CCNA Dev AWS Services Questions

75 of 268 questions · Page 1/4 · Dev AWS Services topic · Answers revealed

1
MCQmedium

A developer is using Amazon S3 to store application logs. The logs are generated every hour and must be retained for 90 days. After 90 days, the logs should be deleted automatically. Which S3 lifecycle policy should the developer configure?

A.Expire objects after 30 days.
B.Transition objects to Amazon S3 Glacier after 90 days.
C.Expire objects after 90 days.
D.Transition objects to S3 Standard-IA after 30 days and expire after 90 days.
AnswerC

Implementing an S3 Lifecycle rule to Expire objects after 90 days directly addresses the requirement for automatic deletion of application logs. This action permanently removes the objects from the S3 bucket 90 days after their creation, ensuring that old logs are automatically purged. This approach optimizes storage costs and maintains data hygiene without requiring manual intervention, aligning perfectly with a deletion mandate.

Why this answer

The requirement is to delete logs after 90 days, and the S3 lifecycle 'Expire' action permanently removes objects once they reach the specified age. No transitions are needed since the logs are not required to be stored in a different storage class before deletion.

Exam trap

The trap here is that candidates often overcomplicate the solution by adding unnecessary transitions (like Option D) or confuse 'transition' with 'expiration', thinking moving to Glacier after 90 days automatically deletes the data, which it does not.

How to eliminate wrong answers

Option A is wrong because expiring objects after 30 days would delete them far earlier than the required 90-day retention period. Option B is wrong because transitioning objects to S3 Glacier after 90 days does not delete them; it only moves them to a colder storage class, and they would continue to incur storage costs indefinitely unless an expiration action is also configured. Option D is wrong because while it includes an expiration after 90 days, the transition to S3 Standard-IA after 30 days is unnecessary and adds cost; the requirement only specifies deletion after 90 days, not tiering.

2
MCQmedium

A developer is building a serverless application using AWS Lambda to process images uploaded to an S3 bucket. The Lambda function needs to resize the image and store the result in another S3 bucket. The developer notices that the Lambda function fails intermittently with timeout errors for large images. What is the MOST efficient solution to resolve this issue?

A.Increase the Lambda function timeout and memory allocation to accommodate larger images.
B.Limit the S3 event notification to only trigger for images smaller than 5 MB.
C.Refactor the Lambda function to use multi-threading for parallel processing of image chunks.
D.Use AWS Step Functions to orchestrate the image processing in smaller steps.
AnswerA

Increasing the Lambda function's memory allocation directly scales its CPU power proportionally, providing more computational resources to process larger and more complex images efficiently. Concurrently, extending the timeout allows the function sufficient time to complete computationally intensive tasks like high-resolution image resizing or complex transformations without premature termination. This direct adjustment of allocated resources and execution duration is the most straightforward solution for handling larger image files within a single Lambda invocation.

Why this answer

Increasing the Lambda function timeout and memory allocation directly addresses the root cause of the failure: large images require more processing time and memory. Lambda's CPU and I/O throughput scale proportionally with allocated memory, so raising both parameters provides the necessary resources to complete the resize operation within the function's execution environment.

Exam trap

The trap here is that candidates often overcomplicate the solution by considering orchestration or parallel processing (Options C and D), when the simplest and most efficient fix is to adjust the Lambda function's resource limits, which directly control execution time and processing capacity.

How to eliminate wrong answers

Option B is wrong because limiting S3 event notifications to images smaller than 5 MB does not resolve the issue for larger images; it merely avoids processing them, which is not a solution for handling large images as required. Option C is wrong because Lambda functions run in a single-threaded execution environment by default, and multi-threading for image chunks is not supported; even with provisioned concurrency, image processing libraries like Pillow are not designed for parallel chunk processing within a single invocation. Option D is wrong because AWS Step Functions adds orchestration overhead and does not increase the per-invocation timeout or memory limits of the Lambda function; the underlying timeout error would still occur when a single step processes a large image.

3
MCQmedium

A developer is building a serverless application using AWS Lambda and Amazon API Gateway. The API must support different HTTP methods (GET, POST, PUT, DELETE) for the same resource path. The developer wants to define the API in a single Lambda function that can handle all methods without additional mapping configuration. Which Lambda integration type should the developer use?

A.Lambda proxy integration
B.Lambda custom integration
C.AWS service integration
D.HTTP integration
AnswerA

Lambda proxy integration is the correct choice because it forwards the complete client request, including HTTP method, headers, query string parameters, and body, directly to the integrated Lambda function as a single input event. This allows the Lambda function to act as a unified handler, inspecting the 'httpMethod' property within the event object to implement distinct logic for different operations (e.g., GET, POST, PUT, DELETE) on the same resource path. This approach significantly simplifies API Gateway configuration by eliminating the need for separate integration request mappings per method.

Why this answer

Lambda proxy integration (option A) is correct because it allows a single Lambda function to handle all HTTP methods (GET, POST, PUT, DELETE) for the same resource path without additional mapping configuration. In this integration type, API Gateway passes the entire client request (method, headers, query parameters, body) as a JSON event to the Lambda function, and the function must return a response in a specific format that includes status code, headers, and body. This eliminates the need for manual mapping templates or method-specific configurations.

Exam trap

The trap here is that candidates often confuse Lambda custom integration with Lambda proxy integration, thinking that custom integration provides more control, but they overlook that proxy integration is specifically designed to handle multiple HTTP methods without additional mapping configuration.

How to eliminate wrong answers

Option B (Lambda custom integration) is wrong because it requires explicit mapping templates to transform the client request into the Lambda function's input format and to transform the Lambda response back to the HTTP response, which adds configuration overhead and does not support handling all methods in a single function without additional mapping. Option C (AWS service integration) is wrong because it is designed to integrate API Gateway directly with other AWS services (e.g., DynamoDB, SQS) without invoking a Lambda function, and it does not support routing multiple HTTP methods to a single Lambda function. Option D (HTTP integration) is wrong because it is used to proxy requests to an external HTTP endpoint, not to a Lambda function, and it requires mapping templates or VPC link configurations, making it unsuitable for a serverless Lambda-based API.

4
MCQmedium

A Lambda function receives events from EventBridge. The developer wants failed invocations to be retried and then stored for later analysis if retries are exhausted. Which configuration should be used?

A.Enable API Gateway access logging
B.Configure EventBridge retry policy and a dead-letter queue
C.Increase reserved concurrency to zero
D.Store events in CloudFormation outputs
AnswerB

Configuring an EventBridge retry policy ensures that events are re-attempted if the initial Lambda invocation fails, improving resilience. Pairing this with a dead-letter queue (DLQ) for the EventBridge target is crucial. If all retries are exhausted and the Lambda function still fails to process an event, EventBridge will send that event to the specified DLQ, preventing data loss and allowing for subsequent investigation and reprocessing of failed events.

Why this answer

EventBridge supports a configurable retry policy (with a maximum event age up to 24 hours and up to 185 retries by default) and can route events that exceed the retry limit to an Amazon SQS dead-letter queue (DLQ). This ensures failed invocations are retried automatically and, if all retries are exhausted, the event is stored durably in the DLQ for later analysis or reprocessing.

Exam trap

The trap here is that candidates may confuse the Lambda function's own DLQ configuration (which applies to synchronous and asynchronous invocations) with EventBridge's rule-level retry policy and DLQ, but EventBridge manages retries and DLQ delivery independently of the Lambda service's built-in retry mechanism.

How to eliminate wrong answers

Option A is wrong because API Gateway access logging captures HTTP request/response data for REST or HTTP APIs, not Lambda invocation failures from EventBridge, and it does not provide retry or dead-letter storage. Option C is wrong because setting reserved concurrency to zero would prevent the Lambda function from executing at all, causing every invocation to fail immediately without retries or storage. Option D is wrong because CloudFormation outputs are used to export stack resource information (e.g., ARNs, endpoints) for cross-stack references, not for storing event data or handling failed invocations.

5
MCQmedium

A developer is building a serverless application using AWS SAM. The application includes an Amazon API Gateway endpoint with a Lambda function that processes user uploads. The developer wants to enable API caching in the development stage to speed up repeated requests, but disable caching in the production stage. What is the most efficient way to achieve this?

A.Configure caching in the SAM template using the CacheClusterEnabled property and use CloudFormation conditions to enable it only in the dev stage.
B.Create two separate SAM templates, one for dev with caching and one for prod without.
C.Enable caching in the API Gateway console after each deployment for the dev stage.
D.Use a custom CloudFormation resource to toggle caching based on a parameter.
AnswerA

This is the most robust and automated approach. The AWS::Serverless::Api resource in a SAM template can define Stage properties, including CacheClusterEnabled. By integrating a CloudFormation Condition that evaluates a StageName parameter, caching can be enabled specifically for the dev stage while remaining disabled for prod, all within a single, version-controlled template. This ensures consistent, environment-specific deployments via CI/CD pipelines.

Why this answer

AWS SAM extends AWS CloudFormation, allowing you to use CloudFormation conditions to conditionally enable the `CacheClusterEnabled` property on the `AWS::ApiGateway::Stage` resource. By defining a condition that evaluates to true only for the dev stage (e.g., based on a parameter like `StageName`), you can enable caching in dev and disable it in prod within a single SAM template, avoiding duplication and manual steps.

Exam trap

The trap here is that candidates may think caching must be configured per-deployment manually (Option C) or that separate templates are required (Option B), missing the power of CloudFormation conditions to conditionally enable features within a single SAM template.

How to eliminate wrong answers

Option B is wrong because creating two separate SAM templates introduces unnecessary duplication and maintenance overhead; the same effect can be achieved with a single template using CloudFormation conditions, which is more efficient. Option C is wrong because manually enabling caching in the API Gateway console after each deployment is error-prone, not repeatable, and violates infrastructure-as-code best practices; it also requires post-deployment steps that can be forgotten. Option D is wrong because using a custom CloudFormation resource to toggle caching is overly complex and introduces additional Lambda functions or custom logic when the native `CacheClusterEnabled` property combined with conditions already provides a straightforward, built-in solution.

6
MCQeasy

A developer is building a serverless application that uses Amazon DynamoDB. The application needs to retrieve an item by its primary key frequently. Which DynamoDB API call should the developer use to achieve the lowest latency?

A.Scan
B.Query
C.GetItem
D.BatchGetItem
AnswerC

The GetItem operation is the most efficient and recommended method for retrieving a single item from a DynamoDB table. It directly accesses the item using its complete primary key (partition key, and sort key if applicable), resulting in minimal latency and consuming the fewest provisioned read capacity units (RCUs). This direct lookup mechanism makes it ideal for precise, single-item data retrieval.

Why this answer

The GetItem API call is the most efficient way to retrieve a single item by its primary key in DynamoDB, as it directly accesses the item using the hash key (and optionally the sort key) with consistent, single-digit millisecond latency. Unlike Scan or Query, GetItem does not need to evaluate any conditions or filter through other items, making it the lowest-latency option for this specific use case.

Exam trap

The trap here is that candidates often confuse Query with GetItem, assuming Query is always faster because it uses a key condition, but Query still requires evaluating the sort key and can return multiple items, whereas GetItem is the only API optimized for a single-item primary key lookup.

How to eliminate wrong answers

Option A is wrong because Scan reads every item in the table or index and then filters out the results, which incurs high latency and consumes significant read capacity, especially on large tables. Option B is wrong because Query retrieves all items with a given partition key value and can return multiple items, requiring additional processing and potentially higher latency than a direct key-based lookup. Option D is wrong because BatchGetItem is designed for retrieving multiple items in a single operation, but it adds overhead for batching and may return partial results, making it slower than GetItem for a single item retrieval.

7
MCQhard

A company is using AWS CloudFormation to deploy infrastructure. The developer wants to create a custom resource that runs a Lambda function during stack creation and update. What must the developer do to ensure the custom resource works correctly?

A.The Lambda function must send a response to an S3 pre-signed URL.
B.The Lambda function must be defined in the same CloudFormation template.
C.The Lambda function must return a JSON object with the desired output.
D.The Lambda function must be written in Python.
AnswerA

When a CloudFormation custom resource invokes a Lambda function, CloudFormation provides a unique, time-limited S3 pre-signed URL within the event data. The Lambda function is absolutely required to send a JSON response to this specific URL, indicating the success or failure of the custom resource operation. This response mechanism allows CloudFormation to asynchronously track the status and retrieve any output attributes from the custom resource's execution, which is crucial for stack progression.

Why this answer

AWS CloudFormation custom resources require the Lambda function to send a response to an S3 pre-signed URL to signal completion. CloudFormation waits for this response to proceed with stack operations; without it, the stack creation or update will time out and fail.

Exam trap

The trap here is that candidates assume the Lambda function's return value is automatically captured by CloudFormation, but in reality, the function must explicitly send a response to the pre-signed URL to signal completion.

How to eliminate wrong answers

Option B is wrong because the Lambda function does not need to be defined in the same CloudFormation template; it can be referenced via an ARN from another stack or account. Option C is wrong because the Lambda function must send a response to the pre-signed URL using an HTTPS PUT request, not simply return a JSON object from the function invocation. Option D is wrong because the Lambda function can be written in any supported runtime (e.g., Node.js, Python, Java, Go), not exclusively Python.

8
MCQmedium

A developer is building a REST API using Amazon API Gateway and wants to validate the incoming request body against a JSON schema before passing the request to the backend Lambda function. Which API Gateway feature should the developer use?

A.Request validation
B.Mapping templates
C.Integration request
D.Stage variables
AnswerA

Amazon API Gateway's request validation feature allows developers to define a JSON schema for the request body, as well as specify required headers, query string parameters, and path parameters. This mechanism ensures that incoming requests conform to the API's expected structure and data types before they reach the backend integration. By rejecting malformed requests early, it enhances API security and reduces unnecessary processing by downstream services.

Why this answer

API Gateway's request validation feature allows you to define a JSON schema (using JSON Schema Draft 4) for the request body and automatically reject requests that do not conform before they reach the backend. This offloads validation from the Lambda function, reducing cold start overhead and ensuring only valid payloads are processed. The developer can configure this in the API Gateway console or via the OpenAPI specification.

Exam trap

The trap here is that candidates often confuse request validation with mapping templates, assuming that mapping templates can validate the request body, but mapping templates only transform data and do not enforce schema constraints.

How to eliminate wrong answers

Option B is wrong because mapping templates transform the request body or parameters into a different format (e.g., from JSON to XML) for the backend, but they do not perform schema-based validation. Option C is wrong because the integration request defines how API Gateway passes the request to the backend (e.g., HTTP method, headers, query strings) and can include mapping templates, but it does not natively validate the request body against a JSON schema. Option D is wrong because stage variables are key-value pairs used to configure deployment stages (e.g., Lambda function aliases, endpoint URLs) and have no role in request body validation.

9
Drag & Dropmedium

Drag and drop the steps to create a Lambda function that processes S3 events in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First set up permissions, then code, create function, configure trigger, and test.

10
MCQmedium

A developer must locally test a SAM-based Lambda function with an API event before deployment. Which tool command family is designed for this?

A.AWS SAM CLI local invoke/start-api
B.AWS Shield Advanced CLI
C.AWS Organizations policy simulator
D.Amazon Inspector SBOM export
AnswerA

The AWS SAM CLI `local invoke` and `local start-api` commands are specifically designed for testing serverless applications locally. `sam local invoke` allows developers to execute a single Lambda function with a provided event payload, simulating a direct invocation. `sam local start-api` launches a local HTTP server that emulates Amazon API Gateway, enabling testing of Lambda functions integrated with API Gateway by making actual HTTP requests to the local endpoint, providing a comprehensive local testing environment for SAM-based applications.

Why this answer

The AWS SAM CLI provides the `local invoke` and `local start-api` commands specifically for testing Lambda functions locally with simulated API Gateway events before deployment. `sam local start-api` creates a local HTTP server that mimics API Gateway, allowing developers to send requests to their Lambda functions as if they were deployed, while `sam local invoke` directly invokes the function with a specified event payload. This is the only tool family designed for local testing of SAM-based Lambda functions with API events.

Exam trap

The trap here is that candidates may confuse the AWS SAM CLI with other AWS CLI tools or services, mistakenly thinking that general-purpose CLI commands or unrelated security tools can perform local Lambda testing with API events.

How to eliminate wrong answers

Option B is wrong because AWS Shield Advanced CLI is a tool for managing DDoS protection services, not for testing Lambda functions or API events locally. Option C is wrong because AWS Organizations policy simulator is used to test IAM and SCP policies for multi-account environments, not for local Lambda or API Gateway testing. Option D is wrong because Amazon Inspector SBOM export is used to generate a software bill of materials for vulnerability assessment, not for testing Lambda functions or API events.

11
MCQmedium

An API Gateway REST API invokes Lambda synchronously. Clients receive 502 responses after a deployment, but Lambda logs show a successful business operation. What is the most likely issue?

A.The Lambda execution role lacks dynamodb:PutItem
B.The Lambda proxy integration response format is invalid
C.The API cache TTL is too short
D.The API stage has X-Ray tracing enabled
AnswerB

In a Lambda proxy integration, API Gateway expects the Lambda function's response to adhere to a specific JSON structure, including `statusCode`, `headers`, and a `body` field (which must be a string). If the Lambda function returns a response that deviates from this required format—for example, missing the `statusCode` or `body` fields, or if the `body` is not a string—API Gateway cannot properly parse it. Consequently, API Gateway will fail to construct a valid HTTP response for the client and will return a 500 Internal Server Error.

Why this answer

Lambda proxy integration requires the response to be in a specific JSON format: `{"statusCode": ..., "headers": ..., "body": ...}`. If the Lambda function returns a plain string or an object missing these keys, API Gateway cannot map it to an HTTP response, resulting in a 502 Internal Server Error. The successful business operation in logs confirms the Lambda code ran correctly, but the malformed response format causes the gateway error.

Exam trap

The trap here is that candidates see 'successful business operation' in logs and assume the Lambda is fine, overlooking that API Gateway proxy integration enforces a strict response contract, not just any valid return value.

How to eliminate wrong answers

Option A is wrong because a missing `dynamodb:PutItem` permission would cause a 403 Forbidden or 500 error from Lambda, not a 502, and the logs would show an access denied exception, not a successful operation. Option C is wrong because API cache TTL affects cached responses and latency, not the response format or 502 errors; a short TTL would cause more frequent cache misses, not gateway errors. Option D is wrong because enabling X-Ray tracing adds tracing headers and logs but does not alter the response format or cause 502 errors; it is purely a monitoring feature.

12
MCQeasy

A developer needs to store configuration parameters securely for a Lambda function. The parameters include database credentials and API keys. Which AWS service should be used?

A.AWS Systems Manager Parameter Store
B.AWS Secrets Manager
C.Amazon DynamoDB with encryption
D.Amazon S3 with server-side encryption
AnswerB

Secrets Manager is purpose-built for storing and rotating secrets securely.

Why this answer

AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, rotating, and managing sensitive configuration parameters such as database credentials and API keys throughout their lifecycle. It offers automatic rotation of secrets with built-in integration for Amazon RDS, Redshift, and DocumentDB, and enforces fine-grained access control via IAM policies. This makes it the most suitable service for the developer's requirement of securely storing and managing database credentials and API keys for a Lambda function.

Exam trap

The trap here is that candidates often confuse AWS Systems Manager Parameter Store (Option A) with Secrets Manager because both can store strings, but Parameter Store lacks automatic rotation and secret-specific lifecycle management, making it unsuitable for credentials that require regular rotation as per security best practices.

How to eliminate wrong answers

Option A is wrong because AWS Systems Manager Parameter Store is a general-purpose parameter store for configuration data like instance IDs or AMI IDs, but it lacks native automatic rotation of secrets and does not provide the same level of secret-specific features (e.g., cross-account access, versioning with staging labels) that Secrets Manager offers for sensitive credentials. Option C is wrong because Amazon DynamoDB with encryption is a NoSQL database service designed for storing application data, not for managing secrets; it requires custom code to handle secret rotation, access auditing, and lifecycle management, adding unnecessary complexity and security risk. Option D is wrong because Amazon S3 with server-side encryption is an object storage service that can store encrypted files, but it does not provide native secret rotation, automatic credential generation, or integration with AWS services like RDS for password management, making it a poor fit for dynamic secrets like database credentials and API keys.

13
MCQhard

A company is using AWS CodePipeline to automate their CI/CD pipeline. The pipeline includes a stage that runs a set of integration tests using AWS CodeBuild. The tests require access to a database running on a private subnet in a VPC. The CodeBuild project is configured to use a managed compute image. How can the CodeBuild project access the database?

A.Place the CodeBuild project in a public subnet and use a NAT gateway to route traffic to the private subnet.
B.Configure the CodeBuild project to use a custom VPC with the appropriate subnet and security group.
C.Set up a VPC peering connection between the CodeBuild VPC and the database VPC.
D.Create a VPC endpoint for the database service and attach it to the CodeBuild project.
AnswerB

Configuring the CodeBuild project to use a custom VPC with the appropriate subnet and security group is the correct solution. This allows CodeBuild to launch its build environments directly within your specified Amazon VPC, enabling it to access private resources like an Amazon RDS database using their private IP addresses. By placing the CodeBuild environment in a private subnet and associating it with a security group that permits outbound traffic to the database's security group, secure and private network communication is established.

Why this answer

CodeBuild projects using managed compute images run in an AWS-managed VPC by default, which cannot access resources in a customer VPC. By configuring the CodeBuild project to use a custom VPC with the appropriate subnet and security group, the build environment is launched directly into that VPC, enabling it to reach the database on the private subnet without needing a NAT gateway or internet access.

Exam trap

The trap here is that candidates assume a NAT gateway or VPC peering is required to bridge network boundaries, but they overlook that CodeBuild's default environment is isolated from the customer VPC, and the correct solution is to launch the build directly into the customer VPC using a custom VPC configuration.

How to eliminate wrong answers

Option A is wrong because placing a CodeBuild project in a public subnet is not a valid configuration; CodeBuild projects are not assigned to subnets directly—they run in an AWS-managed environment unless a custom VPC is specified, and using a NAT gateway would not grant access to a private subnet from the managed VPC. Option C is wrong because VPC peering connects two VPCs, but the CodeBuild project's default environment is not in a customer VPC, so there is no VPC to peer with; even if a custom VPC were used, peering would be unnecessary since the database is already in the same VPC. Option D is wrong because VPC endpoints are used to privately connect to AWS services (e.g., S3, DynamoDB) via the AWS network, not to access a customer-managed database running on an EC2 instance or RDS in a private subnet.

14
MCQeasy

A developer needs to securely store database credentials for a Lambda function. The credentials must be automatically rotated every 30 days. Which service should be used?

A.AWS Key Management Service (KMS)
B.AWS Secrets Manager
C.AWS Systems Manager Parameter Store
D.AWS CloudHSM
AnswerB

AWS Secrets Manager is purpose-built for securely storing, managing, and retrieving sensitive information such as database credentials, API keys, and other secrets. Its primary advantage for database credentials is the automatic rotation capability, which integrates directly with various AWS services and databases to periodically change credentials without requiring application downtime. This service also provides fine-grained access control, auditing, and automatic encryption of stored secrets, making it the ideal solution for this requirement.

Why this answer

AWS Secrets Manager is the correct choice because it is specifically designed to securely store, manage, and automatically rotate database credentials and other secrets. It supports built-in rotation with AWS Lambda, allowing you to set a rotation schedule (e.g., every 30 days) without custom infrastructure. This service integrates directly with Amazon RDS, Redshift, and DocumentDB for seamless credential rotation.

Exam trap

The trap here is that candidates often confuse AWS Systems Manager Parameter Store (which can store secrets with encryption) with AWS Secrets Manager, but Parameter Store lacks native automatic rotation, making it unsuitable for the 30-day rotation requirement.

How to eliminate wrong answers

Option A is wrong because AWS KMS is a key management service for creating and controlling encryption keys, not for storing or rotating secrets like database credentials. Option C is wrong because AWS Systems Manager Parameter Store can store secrets but does not natively support automatic rotation of credentials; it requires custom Lambda functions and manual setup for rotation. Option D is wrong because AWS CloudHSM provides dedicated hardware security modules for cryptographic operations, not a service for storing or rotating application secrets.

15
MCQmedium

A company is running a monolithic application on an EC2 instance. The application currently stores session state in local memory on the instance. The company plans to scale the application horizontally by adding more instances behind a load balancer. What change is required to ensure that session state is preserved across requests?

A.Store session data in Amazon S3 and retrieve it on each request.
B.Increase the EC2 instance size to handle more sessions per instance.
C.Use Amazon ElastiCache to store session state externally.
D.Use an Amazon RDS database to store session state.
AnswerC

Amazon ElastiCache provides a highly performant, in-memory data store, making it an ideal solution for externalizing session state. By storing session data in ElastiCache (e.g., Redis or Memcached), all EC2 instances can access a centralized, low-latency session store, enabling seamless horizontal scaling and high availability. This approach ensures that user sessions persist even if individual application instances are added, removed, or fail, promoting a truly stateless application design.

Why this answer

Amazon ElastiCache provides a managed, in-memory caching service (e.g., Redis or Memcached) that can store session state externally. By moving session data out of the EC2 instance's local memory and into a shared, low-latency data store, all instances behind the load balancer can access the same session state, ensuring persistence across requests regardless of which instance handles the request.

Exam trap

The trap here is that candidates often choose Option D (RDS) because they think a database is the only reliable external store, overlooking that ElastiCache is purpose-built for high-speed, ephemeral data like session state, while RDS introduces unnecessary latency and overhead for this use case.

How to eliminate wrong answers

Option A is wrong because Amazon S3 is an object storage service with high latency per request (typically 100-200 ms) and is not designed for frequent, sub-millisecond read/write operations required for session state; it would introduce unacceptable performance degradation. Option B is wrong because increasing the EC2 instance size only addresses vertical scaling (more sessions per instance) but does not solve the fundamental problem of session state being lost when a request is routed to a different instance in a horizontally scaled environment. Option D is wrong because Amazon RDS is a relational database with higher latency and connection overhead compared to in-memory caches; while it could technically store session state, it is not optimized for the high-throughput, low-latency access patterns of session management and would introduce unnecessary cost and complexity.

16
MCQmedium

A developer is debugging an AWS Lambda function that processes messages from an Amazon SQS queue. The function is failing with an error when processing certain messages. The developer wants to isolate the failed messages for later analysis without losing them. What should the developer do?

A.Publish the failed messages to an SNS topic for later processing.
B.Log the error and delete the message from the queue.
C.Increase the visibility timeout of the SQS queue.
D.Configure a dead-letter queue (DLQ) for the SQS queue.
AnswerD

Configuring a dead-letter queue (DLQ) for the SQS queue is the standard and most robust solution for handling message processing failures. When a Lambda function fails to process a message a specified number of times (defined by the maxReceiveCount on the redrive policy), SQS automatically moves that message to the DLQ. This isolates problematic messages for later inspection and debugging, prevents them from continuously blocking the main queue, and ensures no data is lost, allowing developers to analyze and re-process them.

Why this answer

Configuring a dead-letter queue (DLQ) for the SQS queue is the correct approach because it automatically captures messages that cannot be processed successfully after a specified number of retries (the redrive policy). This isolates the failed messages for later analysis without losing them, while allowing the function to continue processing other messages from the source queue.

Exam trap

The trap here is that candidates may think logging and deleting the message (Option B) is sufficient for debugging, but this permanently loses the message payload, whereas a DLQ preserves the message for later analysis without manual intervention.

How to eliminate wrong answers

Option A is wrong because publishing failed messages to an SNS topic would require custom code and does not provide automatic retry management or isolation; SNS is a pub/sub service, not a message retention mechanism for failed SQS messages. Option B is wrong because logging the error and deleting the message discards the message permanently, preventing later analysis of the failed message content. Option C is wrong because increasing the visibility timeout only delays when the message becomes visible again for reprocessing; it does not isolate the message or prevent it from being retried indefinitely, and it does not preserve the message for later analysis.

17
MCQeasy

A company is using AWS CodePipeline to automate its CI/CD pipeline. The pipeline has a source stage that uses Amazon S3. The developer updates a file in the S3 bucket, but the pipeline does not start automatically. What is the MOST likely cause?

A.The IAM role for CodePipeline does not have s3:GetObject permission.
B.The pipeline is configured to use polling instead of event-based triggers.
C.Amazon S3 versioning is not enabled on the bucket.
D.AWS CloudTrail is not enabled.
AnswerC

Amazon S3 versioning is a mandatory prerequisite for CodePipeline source actions that monitor an S3 bucket for changes. CodePipeline relies on S3 event notifications, specifically s3:ObjectCreated:* events, to detect new or updated artifacts. Without versioning enabled on the S3 bucket, these critical event notifications may not be reliably generated or processed by CodePipeline, preventing the pipeline from automatically triggering upon artifact uploads.

Why this answer

CodePipeline requires S3 versioning to be enabled on the source bucket to automatically detect changes and start the pipeline. Without versioning, CodePipeline cannot uniquely identify new object versions, so it relies on manual or scheduled polling instead of event-based triggers. Enabling versioning ensures that each PUT operation generates a new version ID, which CodePipeline uses to invoke the pipeline automatically.

Exam trap

The trap here is that candidates often assume the IAM role permissions (Option A) are the root cause, but the actual requirement is S3 versioning, which is a bucket-level configuration that enables event-driven pipeline starts.

How to eliminate wrong answers

Option A is wrong because the IAM role for CodePipeline needs s3:GetObject permission to read the source artifact, but the lack of this permission would cause the pipeline to fail during execution, not prevent it from starting. Option B is wrong because polling is a fallback mechanism; the pipeline is configured to use event-based triggers by default when versioning is enabled, and the issue is that versioning is disabled, not that polling is explicitly configured. Option D is wrong because AWS CloudTrail is not required for CodePipeline to detect S3 events; CloudTrail logs API calls for auditing but does not trigger pipeline executions.

18
Multi-Selecteasy

A developer is building a serverless application using AWS Lambda and Amazon API Gateway. The application processes user uploads stored in an S3 bucket. The developer needs to ensure that the Lambda function can read objects from the S3 bucket. Which TWO steps should the developer take to meet this requirement? (Choose two.)

Select 2 answers
A.Set the S3 bucket's object-level permissions to allow the Lambda function.
B.Use AWS Key Management Service (KMS) to grant the Lambda function access to the S3 bucket.
C.Add a bucket policy on the S3 bucket that grants access to the Lambda function's execution role.
D.Attach an IAM policy to the Lambda execution role with permissions for s3:GetObject.
E.Create an IAM user with S3 read permissions and configure the Lambda function to assume that user.
AnswersC, D

Because the Lambda function and the S3 bucket reside in different accounts (or because the bucket owner controls the resource), a bucket policy on the S3 bucket is the resource-based policy that can explicitly grant the Lambda execution role's ARN permission to s3:GetObject. S3 evaluates both the identity-based policy on the principal (the Lambda role) and the resource-based policy, and a statement in the bucket policy that allows the role's ARN satisfies the resource authorization. This is the recommended way to enable cross-account or cross-service access because it does not require creating or rotating IAM users.

Why this answer

To allow the Lambda function to read objects from S3, the developer must attach an IAM policy to the Lambda execution role that includes the s3:GetObject permission (Option D). Additionally, an S3 bucket policy can be used to explicitly grant access to the Lambda function's execution role (Option C). This provides cross-account access if needed.

Option A is incorrect because S3 object-level permissions are not set directly on objects; instead, bucket policies or IAM policies control access. Option B is incorrect because AWS KMS is used for encryption key management, not for granting access to S3. Option E is incorrect because Lambda functions use execution roles, not IAM users, to obtain permissions.

19
MCQeasy

A developer is writing an AWS Lambda function that processes files uploaded to an S3 bucket. The function should only be triggered when a new object is created in a specific subfolder (e.g., /uploads/). Which S3 event notification configuration should the developer use?

A.Configure the event notification with a prefix filter set to 'uploads/' and event type 's3:ObjectCreated:*'.
B.Configure a single event notification for all objects and filter on the prefix inside the Lambda function.
C.Configure the event notification using object tags to filter events.
D.Use AWS CloudTrail to detect S3 PutObject events and trigger Lambda.
AnswerA

This approach leverages Amazon S3's native event notification capabilities to precisely target specific object creation events. By setting a prefix filter to 'uploads/', the S3 bucket will only send notifications to the Lambda function when an object is created within that specific virtual folder. Combining this with the `s3:ObjectCreated:*` event type ensures that the Lambda function is invoked solely for new object uploads in the designated path, optimizing resource utilization and minimizing unnecessary Lambda invocations and associated costs.

Why this answer

S3 event notifications support prefix filtering, which allows you to specify a key prefix (e.g., 'uploads/') so that only object creation events in that subfolder trigger the Lambda function. By setting the event type to 's3:ObjectCreated:*', the function responds to all object creation operations (PUT, POST, Copy, etc.) within the filtered path, meeting the requirement precisely without unnecessary invocations.

Exam trap

The trap here is that candidates might think filtering inside the Lambda function is acceptable (Option B), but AWS best practice and the exam emphasize configuring filtering at the event source to minimize invocations and follow the principle of least privilege for triggers.

How to eliminate wrong answers

Option B is wrong because filtering on the prefix inside the Lambda function would still cause the function to be invoked for every object created in the bucket, leading to unnecessary executions and increased costs; S3 event notifications support prefix filtering natively, so this should be configured at the event source level. Option C is wrong because S3 event notifications do not support filtering by object tags; tag-based filtering is not a feature of S3 event notifications, and tags are not evaluated during event generation. Option D is wrong because AWS CloudTrail is not designed for real-time event-driven triggers; it logs API calls with a delay and is intended for auditing, not for invoking Lambda functions in response to S3 object creation events.

20
MCQeasy

A developer is building a RESTful API that allows clients to query a database and retrieve results. The backend logic is implemented in AWS Lambda, which queries an Amazon DynamoDB table. The developer wants to expose the API over HTTPS and manage authentication and throttling. Which AWS service should the developer use to create and manage the API endpoints?

A.Application Load Balancer
B.Amazon API Gateway
C.AWS CloudFront
D.Amazon S3
AnswerB

Amazon API Gateway is a fully managed service specifically designed for creating, publishing, maintaining, monitoring, and securing REST, HTTP, and WebSocket APIs at any scale. It acts as a secure 'front door' for applications to access data, business logic, or functionality from backend services like AWS Lambda or DynamoDB. Key features include request/response transformation, authentication (e.g., API keys, IAM, Cognito), throttling, caching, and custom domain support, making it ideal for exposing a database query API.

Why this answer

Amazon API Gateway is the correct choice because it is a fully managed service that enables developers to create, publish, maintain, monitor, and secure RESTful APIs at any scale. It directly supports HTTPS endpoints, integrates natively with AWS Lambda for backend logic, and provides built-in features for authentication (e.g., IAM, Cognito, Lambda authorizers) and throttling (usage plans and rate limits). This makes it the ideal service for exposing a Lambda-backed DynamoDB query as a secure, managed API.

Exam trap

The trap here is that candidates may confuse an Application Load Balancer with API Gateway because both can invoke Lambda functions, but ALB lacks API management features like authentication, throttling, and API key validation, which are explicitly required in the question.

How to eliminate wrong answers

Option A is wrong because an Application Load Balancer operates at Layer 7 of the OSI model and distributes traffic to targets like Lambda functions, but it does not provide API management features such as authentication, throttling, or API key validation; it is designed for load balancing, not for creating and managing RESTful API endpoints. Option C is wrong because AWS CloudFront is a content delivery network (CDN) that caches and accelerates content delivery, but it does not natively create API endpoints or manage authentication and throttling for a RESTful API; it can be placed in front of API Gateway but is not a substitute for it. Option D is wrong because Amazon S3 is an object storage service that can host static websites and serve content over HTTPS, but it cannot execute backend logic like querying a DynamoDB table, nor does it provide authentication or throttling for API requests; it is not designed for dynamic API endpoints.

21
MCQeasy

An organization uses AWS CodeCommit for source control and AWS CodeBuild for building a Java application. The build process needs to run integration tests that require a MySQL database. The team wants to ensure the database is provisioned only during the build and cleaned up afterward to minimize costs. What is the most efficient solution?

A.Provision a small RDS MySQL instance and keep it running for the build process.
B.Use AWS CloudFormation to create an RDS instance at the start of the build and delete it at the end.
C.Use a Docker container running MySQL within the CodeBuild environment.
D.Use Amazon DynamoDB as a substitute for MySQL for the integration tests.
AnswerC

Using a Docker container running MySQL directly within the CodeBuild environment is an efficient and cost-effective solution. CodeBuild supports running services as Docker containers alongside the build environment, allowing MySQL to be spun up quickly and ephemerally for each build. This approach ensures a clean database instance for every integration test run, providing isolation and repeatability without incurring persistent costs for an always-on database.

Why this answer

Using CodeBuild's built-in support for Docker, you can run a MySQL container as part of the build. This provides an ephemeral database only during the build process, minimizing cost. Option A is wrong because keeping an RDS instance running incurs ongoing costs even when not in use.

Option B is wrong because using CloudFormation to provision an RDS instance at the start of each build and delete it at the end is slower than running a Docker container and may hit API rate limits. Option D is wrong because DynamoDB is a NoSQL database and may not support the SQL queries required by the integration tests.

22
MCQmedium

A company uses Amazon API Gateway to expose a REST API backed by AWS Lambda. The API is experiencing high latency. The developer suspects cold starts are contributing to the latency. Which action would be MOST effective in reducing cold start latency?

A.Increase the memory allocation of the Lambda function.
B.Place the Lambda function in a VPC to improve network latency.
C.Enable Lambda@Edge to cache responses.
D.Increase the function timeout to 15 minutes.
AnswerA

Increasing the memory allocation for a Lambda function directly correlates with an increase in allocated CPU power. AWS Lambda provisions CPU cycles proportionally to the memory configured for the function. More CPU resources allow the function's execution environment to initialize faster, load dependencies more quickly, and execute the handler code more efficiently during a cold start, thereby reducing the overall latency experienced by the user.

Why this answer

Increasing the memory allocation of a Lambda function directly correlates to allocating more CPU power, which reduces the initialization time during a cold start. AWS Lambda provisions CPU proportionally to the configured memory, so a higher memory setting speeds up the runtime environment setup and code loading, thereby lowering cold start latency.

Exam trap

The trap here is that candidates often confuse increasing timeout with improving performance, but timeout only affects how long a function can run, not how quickly it starts.

How to eliminate wrong answers

Option B is wrong because placing a Lambda function in a VPC adds an Elastic Network Interface (ENI) setup step during cold starts, which actually increases latency, not reduces it. Option C is wrong because Lambda@Edge is designed for content delivery and caching at CloudFront edge locations, not for reducing cold start latency of an API Gateway backend Lambda function. Option D is wrong because increasing the function timeout to 15 minutes does not affect the initialization phase of a cold start; it only allows the function to run longer, which does not address the latency issue.

23
MCQeasy

A company is using AWS CodePipeline to automate deployments. The pipeline has a source stage that retrieves code from Amazon S3, a build stage using AWS CodeBuild, and a deploy stage using AWS CodeDeploy. The build stage is failing intermittently with errors related to missing dependencies. What should a developer do to ensure the build environment has all required dependencies?

A.Configure environment variables in CodePipeline to set dependency paths.
B.Manually install dependencies on the CodeBuild build server each time.
C.Use AWS CodeCommit as the source repository instead of S3.
D.Create a custom buildspec.yml file in the source code that installs the dependencies in the install phase.
AnswerD

Creating a custom `buildspec.yml` file in the source code is the standard and most effective method for automating dependency installation within AWS CodeBuild. By defining commands in the `install` phase of the `buildspec.yml` (e.g., `npm install`, `pip install`), CodeBuild automatically executes these steps every time the project is built. This ensures that all necessary dependencies are consistently fetched and installed, making the build process reproducible, reliable, and fully integrated with the source code version control.

Why this answer

The buildspec.yml file defines the build phases for AWS CodeBuild, including the install phase where you can specify commands to install dependencies (e.g., using package managers like pip, npm, or apt-get). By placing this file in the source code, the build environment automatically executes these commands on every build, ensuring all required dependencies are present and consistent across runs, which resolves intermittent failures caused by missing dependencies.

Exam trap

The trap here is that candidates may think environment variables (Option A) can solve dependency issues, but they confuse configuration with actual installation, or they assume changing the source repository (Option C) will somehow fix build failures, when the real solution lies in defining the build process within the source code itself.

How to eliminate wrong answers

Option A is wrong because environment variables in CodePipeline can set paths or configuration values but cannot install or fetch missing dependencies; they only influence runtime behavior of existing tools. Option B is wrong because manually installing dependencies on the CodeBuild build server is impractical and defeats automation—CodeBuild uses ephemeral, disposable build environments that are recreated for each build, so manual changes are lost. Option C is wrong because switching to CodeCommit as the source repository does not address missing dependencies; the source type (S3 vs.

CodeCommit) has no impact on dependency installation in the build stage.

24
MCQhard

A developer is running a Lambda function that uses the 'requests' library. The error shown in the exhibit occurs when invoking the function. Which step should the developer take to fix this?

A.Change the Lambda runtime to Python 3.9 which includes requests
B.Package the 'requests' library with the Lambda deployment package
C.Use the 'urllib' library instead of 'requests'
D.Install the 'requests' library using pip in the Lambda console
AnswerB

To successfully use the `requests` library in an AWS Lambda function, it must be included as part of the deployment package. This typically involves installing `requests` and its dependencies into a local directory, then zipping that directory along with the function's handler code. Alternatively, for shared dependencies across multiple functions, a Lambda Layer can be created and attached, which is a best practice for managing common libraries efficiently.

Why this answer

The 'requests' library is not included in the AWS Lambda Python runtime by default. To use it, the developer must package the library as a dependency layer or include it in the deployment package. Option B correctly identifies this approach, ensuring the library is available at runtime.

Exam trap

The trap here is that candidates assume AWS Lambda runtimes include popular third-party libraries like 'requests', but in reality only the standard library is provided, so dependencies must be bundled manually.

How to eliminate wrong answers

Option A is wrong because no AWS Lambda Python runtime (including Python 3.9) includes the 'requests' library by default; it must be bundled manually. Option C is wrong because switching to 'urllib' is a workaround, not a fix for the missing dependency, and may require significant code changes. Option D is wrong because the Lambda console does not support installing libraries via pip; dependencies must be packaged locally or via a Lambda layer.

25
MCQmedium

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores session state in an S3 bucket. Users report that after logging in, they are sometimes redirected to the login page again on subsequent requests. What is the MOST likely cause?

A.S3 is not a suitable store for session state due to its higher latency compared to in-memory stores like ElastiCache or DynamoDB.
B.The EC2 instances do not have internet access to reach S3.
C.The ALB does not have sticky sessions enabled.
D.The application is not scaling properly, causing session loss.
AnswerA

Amazon S3, while highly durable and scalable, is an object storage service optimized for throughput of large objects and cost-effectiveness, not for low-latency, high-frequency access to small, frequently changing data like session state. Its typical latency, even with strong consistency, is significantly higher than in-memory caches like ElastiCache (Redis/Memcached) or specialized NoSQL databases like DynamoDB. This higher latency can cause the application to time out when attempting to retrieve session data, leading to the perception of a lost session and subsequent redirection to the login page.

Why this answer

Amazon S3 now provides strong read-after-write consistency, so eventual consistency is not the cause. However, S3's higher latency compared to in-memory stores like ElastiCache or DynamoDB makes it unsuitable for session management, which requires fast, frequent reads and writes. The higher latency can cause delays in session retrieval, leading to timeouts and the login page being displayed again.

Exam trap

Candidates may incorrectly attribute the problem to S3's eventual consistency, which was fixed. The real issue is S3's higher latency relative to in-memory services, making it a poor choice for session state.

How to eliminate wrong answers

Option B is wrong because EC2 instances in a VPC can access S3 via a VPC endpoint or NAT gateway without requiring internet access; the lack of internet access alone would not cause intermittent session loss. Option C is wrong because sticky sessions (session affinity) are used to route requests to the same EC2 instance, but the session state is stored in S3, not on the instance, so sticky sessions are irrelevant to session persistence. Option D is wrong because scaling issues would cause all sessions to be lost or new instances to be unable to serve existing sessions, not intermittent redirects to the login page; the described behavior points to a data consistency problem, not capacity.

26
MCQmedium

A company runs a microservices architecture on Amazon ECS with Fargate. The application experiences intermittent high latency. The operations team wants to trace requests across services and identify bottlenecks. Which AWS service should be used?

A.VPC Flow Logs
B.Amazon CloudWatch Logs
C.AWS X-Ray
D.Amazon CloudWatch Metrics
AnswerC

AWS X-Ray is purpose-built for end-to-end tracing and analysis of requests as they flow through distributed applications, including those running on Amazon ECS microservices. It collects data about requests, responses, and calls to downstream services, providing a visual service map, detailed trace data, and latency breakdowns for each segment. This enables developers to precisely identify performance bottlenecks, errors, and the full execution path of individual requests across complex architectures.

Why this answer

AWS X-Ray is the correct service because it provides end-to-end tracing of requests as they travel through microservices, capturing latency at each hop. It generates a service map that visualizes the flow and pinpoints bottlenecks, which is exactly what the operations team needs for a distributed application on ECS Fargate.

Exam trap

The trap here is that candidates confuse CloudWatch Logs (which shows logs) or Metrics (which shows aggregates) with the distributed tracing capability that X-Ray uniquely provides for microservices architectures.

How to eliminate wrong answers

Option A is wrong because VPC Flow Logs capture IP traffic metadata (source/destination, ports, protocols) but do not trace application-level requests or measure service latency. Option B is wrong because Amazon CloudWatch Logs aggregates log data but lacks the distributed tracing capability to follow a single request across multiple services and identify per-service latency. Option D is wrong because Amazon CloudWatch Metrics provides aggregated performance data (e.g., CPU, memory) but cannot trace individual request paths or pinpoint which specific service call caused the latency.

27
Multi-Selecthard

Which TWO of the following are required to enable cross-origin resource sharing (CORS) for an API hosted on Amazon API Gateway? (Choose two.)

Select 2 answers
A.Modify the Lambda function to return CORS headers in the response
B.Configure Amazon CloudFront to add CORS headers
C.Add an OPTIONS method to the API Gateway resource and configure it to return the required CORS headers
D.Configure an S3 bucket CORS policy
E.Enable CORS on the API Gateway resource and deploy the API
AnswersC, E

Browsers perform an HTTP OPTIONS 'preflight' request before certain cross-origin requests (e.g., those using non-simple methods or custom headers). To enable CORS, API Gateway must explicitly respond to these OPTIONS requests with the appropriate `Access-Control-Allow-*` headers. Manually adding an OPTIONS method to the resource and configuring its integration response to return these specific headers is a fundamental and correct way to satisfy the CORS preflight requirement.

Why this answer

CORS requires a preflight OPTIONS request to determine if the actual request is safe to send. By adding an OPTIONS method to the API Gateway resource and configuring it to return the required CORS headers (such as Access-Control-Allow-Origin, Access-Control-Allow-Methods, and Access-Control-Allow-Headers), the API can respond to the browser's preflight request and enable cross-origin requests.

Exam trap

The trap here is that candidates often think modifying the Lambda function to return CORS headers is sufficient, but they forget that the browser's preflight OPTIONS request must be handled separately, and without an OPTIONS method on the API Gateway resource, the preflight will fail.

28
MCQmedium

A developer is deploying a Lambda function that processes messages from an SQS queue. The queue has a batch size of 10. To optimize cost and performance, the developer wants to minimize the number of Lambda invocations while ensuring that all messages are processed within the SQS visibility timeout. Which configuration should the developer use?

A.Set the Lambda function timeout to less than the SQS visibility timeout.
B.Increase the SQS visibility timeout to 5 minutes and set Lambda timeout to 5 minutes.
C.Configure the Lambda function to process messages asynchronously.
D.Set the Lambda reserved concurrency to 1 to limit concurrent executions.
AnswerA

This ensures messages are processed before becoming visible again, reducing duplicate invocations.

Why this answer

Setting the Lambda function timeout to less than the SQS visibility timeout ensures that the function completes (success or failure) before the message visibility timeout expires. This prevents the message from becoming visible again while the function is still running, which would cause duplicate invocations. If the function fails, the message remains in the queue and becomes visible again after the original visibility timeout, allowing for reprocessing without overlapping executions.

This configuration keeps the number of invocations to one per batch for successful processing and avoids unintended duplicates, rather than adding extra retries.

Exam trap

The trap here is that candidates often confuse Lambda timeout with SQS visibility timeout, thinking they should be equal or that increasing both is safe, but the key is to keep Lambda timeout shorter to allow timely retries and avoid message duplication.

How to eliminate wrong answers

Option B is wrong because increasing the SQS visibility timeout to 5 minutes and setting Lambda timeout to 5 minutes risks messages being stuck if the function fails, as the visibility timeout won't expire to allow reprocessing until after 5 minutes, potentially causing duplicate processing or message loss. Option C is wrong because configuring the Lambda function to process messages asynchronously is irrelevant here; SQS already triggers Lambda synchronously (via event source mapping), and asynchronous invocation would not change the batch processing behavior or reduce invocations. Option D is wrong because setting Lambda reserved concurrency to 1 limits concurrent executions to a single instance, which can cause a bottleneck and increase invocation count as messages accumulate, defeating the goal of minimizing invocations.

29
MCQmedium

A developer needs to securely store database credentials for a Lambda function that accesses an Amazon RDS instance. The credentials must be automatically rotated every 30 days. Which AWS service should be used?

A.AWS IAM Roles for Lambda
B.AWS Secrets Manager
C.AWS Key Management Service (KMS)
D.AWS Systems Manager Parameter Store
AnswerB

AWS Secrets Manager is purpose-built for securely storing, managing, and retrieving sensitive information such as database credentials, API keys, and other secrets. It offers critical security features like automatic rotation of secrets, which is essential for enhancing security posture and reducing the risk of compromise. Furthermore, Secrets Manager provides fine-grained access control and integrates seamlessly with various AWS services and databases for streamlined secret management.

Why this answer

AWS Secrets Manager is the correct choice because it is specifically designed to securely store, manage, and automatically rotate database credentials for services like Amazon RDS. It supports built-in rotation with a configurable schedule (e.g., every 30 days) using a Lambda rotation function, and it integrates directly with RDS to update credentials without manual intervention. This meets the requirement for automatic rotation and secure storage.

Exam trap

Candidates often choose Parameter Store because it is cheaper and can store secrets, but it lacks native rotation scheduling for RDS credentials.

How to eliminate wrong answers

Option A is wrong because AWS IAM Roles for Lambda provide temporary credentials for API calls but cannot store or rotate database credentials; they are used for granting permissions to AWS services, not for managing secrets like usernames and passwords. Option C is wrong because AWS Key Management Service (KMS) is a key management service for encrypting data at rest and in transit, but it does not store secrets or provide automatic rotation of database credentials; it is used as an encryption key source, not a secret store. Option D is wrong because AWS Systems Manager Parameter Store can store secrets securely, but it lacks built-in automatic rotation capabilities for database credentials; while it can be integrated with custom rotation logic, it does not natively support scheduled rotation like Secrets Manager does.

30
MCQeasy

A developer wants to deploy a containerized application on AWS. The application requires persistent storage that can be accessed by multiple containers running on different EC2 instances. Which AWS service should the developer use?

A.Amazon Elastic File System (EFS)
B.Amazon Elastic Block Store (EBS)
C.Amazon Simple Storage Service (S3)
D.Amazon DynamoDB
AnswerA

Amazon Elastic File System (EFS) provides a scalable, fully managed, shared file system that can be mounted by multiple container instances (e.g., running on EC2 or Fargate) simultaneously. This allows containerized applications to access common data, such as configuration files, user-generated content, or persistent state, ensuring data consistency and availability across all containers. Its POSIX compliance makes it suitable for traditional file system operations required by many applications.

Why this answer

Amazon EFS provides a fully managed, scalable, and elastic NFS file system that can be mounted concurrently on multiple EC2 instances across different Availability Zones. This makes it the ideal choice for a containerized application requiring shared persistent storage accessible by multiple containers running on different instances, as it supports the NFSv4.1 and NFSv4.0 protocols for simultaneous access.

Exam trap

The trap here is that candidates often confuse EBS with EFS, assuming EBS supports multi-instance access by default, but EBS volumes are single-instance attached unless using the limited multi-attach feature, which is not designed for general-purpose shared file system use.

How to eliminate wrong answers

Option B (Amazon EBS) is wrong because EBS volumes are block-level storage devices that can only be attached to a single EC2 instance at a time (except for specific multi-attach EBS configurations, which are limited to io1/io2 volumes and a small number of instances, not suitable for general multi-container access across different instances). Option C (Amazon S3) is wrong because S3 is an object storage service accessed via HTTP/HTTPS APIs, not a file system mountable via NFS, and it does not provide low-latency file-level locking or POSIX-like semantics required for shared file system access by containers. Option D (Amazon DynamoDB) is wrong because DynamoDB is a NoSQL key-value and document database, not a file storage service, and it is designed for structured data access patterns, not for storing and sharing container files or directories.

31
MCQhard

A company has a monolithic application running on an EC2 instance that needs to be migrated to a microservices architecture on AWS. The development team wants to use AWS services to handle service discovery, configuration management, and secrets management. Which combination of AWS services should the team use?

A.Use Amazon ECS Service Discovery for service discovery, AWS Config for configuration, and AWS Systems Manager Parameter Store for secrets.
B.Use AWS Cloud Map for service discovery, AWS AppConfig for configuration, and AWS Secrets Manager for secrets.
C.Use AWS Cloud Map for service discovery, AWS Systems Manager Parameter Store for configuration, and AWS Secrets Manager for secrets.
D.Use AWS Service Discovery for service discovery, EC2 Image Builder for configuration, and AWS Key Management Service (KMS) for secrets.
AnswerB

This option correctly identifies the purpose-built AWS services for each requirement. AWS Cloud Map provides a unified service registry for all application resources, enabling dynamic discovery for EC2-based applications through DNS or API calls. AWS AppConfig is specifically designed for safe, controlled deployment and management of application configurations, including validation and rollback capabilities. AWS Secrets Manager is the most secure and feature-rich service for storing, rotating, and managing sensitive credentials and API keys.

Why this answer

AWS Cloud Map provides service discovery for microservices by registering service instances and enabling DNS-based or API-based resolution. AWS AppConfig manages application configuration with validation and controlled rollouts, and AWS Secrets Manager handles secrets management with automatic rotation and fine-grained access control. Together, these services meet the specific needs of service discovery, configuration management, and secrets management in a microservices architecture.

Exam trap

The trap here is that candidates often confuse AWS Systems Manager Parameter Store (which can store secrets but lacks automatic rotation and advanced access control) with AWS Secrets Manager, or mistakenly think AWS Config is suitable for application configuration management when it is actually for resource compliance and auditing.

How to eliminate wrong answers

Option A is wrong because AWS Config is designed for resource compliance and auditing, not for managing application configuration; it cannot push configuration updates or handle feature flags. Option C is wrong because AWS Systems Manager Parameter Store is a general-purpose parameter store that lacks built-in secrets rotation and advanced access control compared to Secrets Manager, making it less suitable for secrets management in a microservices context. Option D is wrong because 'AWS Service Discovery' is not a standalone AWS service (the correct service is AWS Cloud Map), EC2 Image Builder is for creating machine images, not configuration management, and AWS KMS is a key management service, not a secrets management service.

32
MCQeasy

A developer is building a microservices application that processes event messages from multiple sources. The application requires at-least-once delivery, but message ordering is not important. Which Amazon SQS queue type should the developer use?

A.Standard queue
B.FIFO queue
C.Dead-letter queue
D.Delay queue
AnswerA

Standard queues are the default SQS queue type, designed for high throughput and best-effort ordering. They guarantee at-least-once message delivery, meaning a message might be delivered more than once, which requires consumers to be idempotent. This queue type is ideal for microservices where strict message ordering is not critical, and the application can handle occasional duplicates or out-of-order processing efficiently.

Why this answer

Amazon SQS Standard queues provide at-least-once delivery and best-effort ordering, making them ideal for microservices that can tolerate duplicate messages and do not require strict message sequencing. Since the application processes events from multiple sources and message ordering is not important, a Standard queue meets the requirements without the throughput limitations of FIFO queues.

Exam trap

The trap here is that candidates often confuse the 'at-least-once' delivery requirement with the need for ordering, leading them to choose FIFO queues, but the question explicitly states ordering is not important, making Standard queues the correct and more performant choice.

How to eliminate wrong answers

Option B is wrong because FIFO queues guarantee exactly-once processing and strict message ordering, which are unnecessary here and would impose a throughput limit of 3,000 transactions per second (with batching) or 300 without, adding cost and complexity. Option C is wrong because a dead-letter queue is not a primary queue type for receiving messages; it is a secondary queue used to capture messages that fail processing after a specified number of receive attempts. Option D is wrong because a delay queue is not a distinct queue type but a feature of Standard or FIFO queues that introduces an initial message delay (up to 15 minutes), which does not address the core requirement of at-least-once delivery.

33
MCQhard

A developer is using AWS CodePipeline to deploy a serverless application. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CloudFormation). The developer wants to automatically roll back the deployment if the CloudFormation stack update fails. Which configuration should be used?

A.Add a stack policy to the CloudFormation stack to prevent updates.
B.Set the deployment to use AWS CodeDeploy and enable rollback.
C.Configure a manual approval action in the pipeline to trigger a rollback.
D.Configure the CloudFormation stack to roll back on failure using the RollbackConfiguration.
AnswerD

Configuring the CloudFormation stack with a `RollbackConfiguration` is the correct and most effective method for automatically rolling back a failed stack update. This feature allows you to specify CloudWatch alarms that CloudFormation monitors during and after a stack update. If any specified alarm enters an `ALARM` state within a defined monitoring period, CloudFormation will automatically initiate a rollback to the stack's previous stable state, ensuring service stability.

Why this answer

CloudFormation natively supports automatic rollback on stack update failure through the `RollbackConfiguration` property. When a stack update fails, CloudFormation can automatically revert to the last known good state, which is exactly what the developer needs for a serverless deployment pipeline. This configuration can be set in the CloudFormation template or passed as a parameter during the deploy action in CodePipeline.

Exam trap

The trap here is that candidates may confuse CloudFormation's built-in rollback capability with external services like CodeDeploy, or assume that manual approval is required for rollback, when in fact CloudFormation can handle it automatically via `RollbackConfiguration`.

How to eliminate wrong answers

Option A is wrong because a stack policy prevents updates to specific resources but does not provide rollback on failure; it would block the deployment entirely. Option B is wrong because CodeDeploy is used for deploying applications to EC2, Lambda, or ECS, not for CloudFormation stack updates; it cannot manage CloudFormation rollbacks. Option C is wrong because a manual approval action pauses the pipeline for human review but does not automatically trigger a rollback; it requires manual intervention to initiate a rollback, which contradicts the requirement for automatic rollback.

34
MCQhard

A developer creates the CloudFormation stack with the template above. After the stack is created, messages that are not processed after 5 receives are moved to the DLQ. However, the developer notices that the RedrivePolicy references a queue ARN that is hardcoded. What is the best practice to avoid this hardcoded ARN?

A.Use Ref to reference the DLQ's QueueName and construct the ARN.
B.Use Fn::Sub to substitute the queue name into a hardcoded ARN template.
C.Use Fn::ImportValue to import the DLQ ARN from another stack.
D.Use Fn::GetAtt with "Arn" attribute on the DLQ resource.
AnswerD

Fn::GetAtt is the correct and most robust intrinsic function for retrieving a specific attribute from a resource defined within the same CloudFormation template. For an AWS::SQS::Queue resource, the Arn attribute directly provides the complete Amazon Resource Name (ARN) of the queue. This approach dynamically fetches the fully qualified ARN, eliminating the need for hardcoding account IDs, regions, or manual string construction, ensuring accuracy and portability across environments.

Why this answer

`Fn::GetAtt` with the `Arn` attribute retrieves the actual Amazon Resource Name (ARN) of the Dead Letter Queue (DLQ) resource dynamically at stack creation time. This avoids hardcoding the ARN, making the template portable across accounts and regions. The RedrivePolicy property requires the full ARN of the DLQ, and `Fn::GetAtt` is the intrinsic function designed to return resource attributes like ARN.

Exam trap

The trap here is that candidates often confuse `Ref` (which returns the QueueName or Queue URL) with `Fn::GetAtt` (which returns the ARN), leading them to choose Option A or attempt manual ARN construction with `Fn::Sub`.

How to eliminate wrong answers

Option A is wrong because `Ref` on an SQS queue returns the QueueName (or Queue URL in some contexts), not the ARN, and constructing the ARN manually is error-prone and not a best practice. Option B is wrong because `Fn::Sub` with a hardcoded ARN template still contains a static ARN pattern (e.g., `arn:aws:sqs:${AWS::Region}:${AWS::AccountId}:queue-name`), which is fragile if the queue name changes or if the stack is deployed to a different partition (e.g., GovCloud). Option C is wrong because `Fn::ImportValue` is used to import outputs from another stack, but the DLQ is defined within the same stack, so cross-stack referencing is unnecessary and adds complexity.

35
MCQhard

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses an Amazon RDS MySQL database. Recently, the application started experiencing frequent database connection timeouts. The development team discovered that the application is not closing database connections properly, leading to exhausted database connections. The team wants a solution that does not require code changes. Which option should they choose?

A.Configure Amazon RDS Proxy in front of the RDS instance and update the application to connect through the proxy.
B.Enable Multi-AZ on the RDS instance to handle failover and reduce connection timeouts.
C.Migrate the database to Amazon Aurora and enable Auto Scaling for read replicas.
D.Increase the max_connections parameter in the RDS parameter group to allow more concurrent connections.
AnswerA

Configuring Amazon RDS Proxy in front of the RDS instance is the most effective solution because it provides connection pooling and multiplexing. RDS Proxy maintains a pool of established database connections and reuses them for new application requests, significantly reducing the overhead on the database and making the application more resilient to transient connection issues or inefficient connection handling, such as connection leaks. This approach prevents connection exhaustion without requiring extensive application code changes to fix the underlying connection management issues.

Why this answer

Amazon RDS Proxy provides connection pooling, allowing the application to reuse database connections efficiently, reducing the number of open connections without code changes. Option B is incorrect: Multi-AZ provides high availability and failover but does not address connection leaks or exhaustion. Option C is incorrect: Migrating to Aurora with Auto Scaling for read replicas adds scalability for read traffic but does not fix connection leaks; it also requires migration effort.

Option D is incorrect: Increasing max_connections may temporarily alleviate the symptom but does not solve the underlying issue of connections not being closed, and it can lead to resource contention.

36
MCQmedium

A company is using Amazon API Gateway to expose a REST API. The API must authenticate requests using an external OAuth 2.0 provider. Which API Gateway feature should be used?

A.IAM authorization
B.Resource policy
C.Lambda authorizer
D.Amazon Cognito User Pools
AnswerC

A Lambda authorizer (formerly custom authorizer) is a powerful and flexible mechanism where API Gateway invokes a custom AWS Lambda function before forwarding the request to the backend. This Lambda function receives the incoming request's authorization header, allowing it to execute arbitrary custom logic to validate the external OAuth token. The function can perform tasks like calling an OAuth provider's introspection endpoint, verifying JWT signatures against public keys, or checking token claims, ultimately returning an IAM policy that grants or denies access to the API resources based on the token's validity.

Why this answer

A Lambda authorizer (formerly known as a custom authorizer) allows you to implement custom authentication logic using an external OAuth 2.0 provider. The Lambda function receives the OAuth 2.0 bearer token from the request, validates it against the external provider's token introspection endpoint or by verifying the JWT signature, and returns an IAM policy that grants or denies access to the API Gateway method.

Exam trap

The trap here is that candidates often confuse Amazon Cognito User Pools with a generic OAuth 2.0 integration, but Cognito is a specific AWS-managed IdP and cannot validate tokens issued by an external OAuth 2.0 provider like Auth0 or Okta.

How to eliminate wrong answers

Option A is wrong because IAM authorization uses AWS Signature Version 4 (SigV4) to sign requests with IAM credentials, which is designed for internal AWS authentication and cannot integrate with an external OAuth 2.0 provider. Option B is wrong because a resource policy controls access at the API level based on IP addresses, VPC endpoints, or AWS accounts, but it does not handle token validation or OAuth 2.0 flows. Option D is wrong because Amazon Cognito User Pools is a managed identity provider that issues its own JWTs, but the requirement explicitly states using an external OAuth 2.0 provider, and Cognito cannot delegate authentication to an arbitrary third-party OAuth 2.0 server.

37
MCQeasy

A developer needs to store a large number of binary files (e.g., images) that are accessed infrequently but must be retrievable within minutes. The storage solution should be cost-effective. Which Amazon S3 storage class is MOST suitable?

A.S3 Intelligent-Tiering
B.S3 One Zone-Infrequent Access
C.S3 Glacier Instant Retrieval
D.S3 Standard
AnswerC

S3 Glacier Instant Retrieval is specifically designed for long-lived, infrequently accessed data that requires millisecond retrieval, making it ideal for a "large number of binary files." It offers a significantly lower per-GB storage cost than S3 Standard or S3 Standard-IA, while still providing high durability across multiple Availability Zones. This class perfectly balances cost-efficiency for infrequent access with the necessity of immediate data availability when needed.

Why this answer

S3 Glacier Instant Retrieval is the most suitable because it is designed for long-lived, infrequently accessed data that requires retrieval in milliseconds (within minutes), offering a lower storage cost than S3 Standard while still providing rapid access. The question specifies 'retrievable within minutes' and 'cost-effective,' which aligns with Glacier Instant Retrieval's sub-second retrieval times and lower storage price point compared to S3 Standard or Intelligent-Tiering for data accessed rarely.

Exam trap

The trap here is that candidates confuse 'retrievable within minutes' with the longer retrieval times of S3 Glacier Flexible Retrieval (minutes to hours) or S3 Glacier Deep Archive (hours), and overlook that S3 Glacier Instant Retrieval provides millisecond retrieval while still being cost-effective for infrequently accessed data.

How to eliminate wrong answers

Option A is wrong because S3 Intelligent-Tiering automatically moves data between access tiers based on usage patterns, but it is not the most cost-effective for data that is accessed infrequently and predictably; it incurs a monitoring and automation fee that makes it more expensive than a direct infrequent-access class for this use case. Option B is wrong because S3 One Zone-Infrequent Access stores data in a single Availability Zone, which risks data loss if that AZ fails, and the question does not specify tolerance for such risk; it is also not optimized for retrieval within minutes as it is designed for infrequent access but with the same millisecond retrieval as Standard, making it less cost-effective than Glacier Instant Retrieval for this scenario. Option D is wrong because S3 Standard is designed for frequently accessed data with low latency and high throughput, but it is the most expensive storage class and not cost-effective for infrequently accessed data, violating the cost-effectiveness requirement.

38
MCQhard

A company is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The developer wants to identify the specific error on a failed instance. Which AWS CLI command should the developer use?

A.aws deploy get-deployment
B.aws deploy get-deployment-instance
C.aws deploy list-deployments
D.aws deploy list-deployment-instances
AnswerB

This command is specifically designed to retrieve comprehensive details for a single target instance within a CodeDeploy deployment. It provides the instance's lifecycle event status (e.g., BeforeInstall, Install, ApplicationStop), any associated error messages, and the instance's overall status within that deployment. This granular information is crucial for diagnosing why a deployment failed on a particular instance, offering insights into specific script failures or configuration issues.

Why this answer

The `aws deploy get-deployment-instance` command retrieves detailed information about a single instance in a deployment group, including the specific error messages and lifecycle event logs that caused the instance to fail. This allows the developer to diagnose the root cause of the failure on a particular instance, which is exactly what is needed when the overall deployment fails with a generic error message.

Exam trap

The trap here is that candidates often confuse `list-deployment-instances` (which only returns instance IDs) with `get-deployment-instance` (which returns detailed error data), leading them to choose the list command when they actually need the detailed diagnostic output.

How to eliminate wrong answers

Option A is wrong because `aws deploy get-deployment` returns high-level deployment summary information (status, total instances, error count) but does not provide per-instance error details or lifecycle event logs. Option C is wrong because `aws deploy list-deployments` only lists deployment IDs and basic metadata (e.g., application name, creation time) for a given application or deployment group, not instance-level failure information. Option D is wrong because `aws deploy list-deployment-instances` returns a list of instance IDs associated with a deployment, but does not include the detailed error messages or lifecycle event logs needed to identify the specific error on a failed instance.

39
MCQeasy

A developer is writing an AWS Lambda function in Python that needs to download a file from Amazon S3, process it, and upload the result to a different S3 bucket. The function currently runs within the default 3-second timeout, but the developer expects the file size to increase. What is the MOST cost-effective way to handle the increase in processing time?

A.Increase the Lambda function's timeout to a value higher than the expected processing time.
B.Increase the Lambda function's timeout to 15 minutes.
C.Use Lambda provisioned concurrency to keep the function warm.
D.Refactor the code to use AWS Step Functions to orchestrate the processing.
AnswerA

AWS Lambda functions have a configurable timeout setting, which defines the maximum duration a function can execute before being terminated. By increasing this timeout to a value exceeding the anticipated processing time, the developer directly resolves the issue of the function being prematurely terminated. This is the most straightforward and cost-effective approach for a single Lambda function needing more execution time, without introducing additional architectural complexity.

Why this answer

Increasing the Lambda function's timeout is the most cost-effective solution because it directly addresses the expected increase in processing time without incurring additional costs. Lambda pricing is based on the number of invocations and duration (in GB-seconds), so extending the timeout only charges for the actual time the function runs, not for idle time or additional services. This approach avoids the complexity and cost of Step Functions or provisioned concurrency, which would add unnecessary overhead for a simple sequential task.

Exam trap

The trap here is that candidates may overcomplicate the solution by choosing Step Functions or provisioned concurrency, thinking they are needed for long-running tasks, when the simplest and most cost-effective fix is merely adjusting the Lambda timeout.

How to eliminate wrong answers

Option B is wrong because increasing the timeout to 15 minutes is excessive and may exceed the Lambda maximum execution timeout of 15 minutes, but more importantly, it does not address cost-effectiveness—it simply sets a maximum limit without considering the actual processing time. Option C is wrong because provisioned concurrency is designed to reduce cold start latency for latency-sensitive applications, not to handle longer processing times, and it incurs additional costs for keeping functions initialized. Option D is wrong because refactoring to use AWS Step Functions introduces unnecessary complexity and cost for a simple download-process-upload workflow; Step Functions are better suited for orchestrating multiple independent tasks or handling retries and error handling across services, not for extending a single function's execution time.

40
MCQmedium

A company has a Node.js application running on an EC2 instance. The application needs to store session state. The developer wants to ensure high availability and scalability by storing session data externally. Which AWS service is BEST suited for this purpose?

A.Amazon DynamoDB
B.Amazon S3
C.Amazon ElastiCache for Redis
D.Amazon RDS for MySQL
AnswerC

Redis is commonly used for session caching due to its speed and support for data expiration.

Why this answer

Amazon ElastiCache for Redis is the best choice for external session storage because it provides an in-memory data store with sub-millisecond latency, which is critical for session state access in a high-traffic Node.js application. Redis supports data structures like hashes and TTL (time-to-live) for automatic session expiration, and it can be clustered for high availability and scalability, making it ideal for stateless EC2 instances behind a load balancer.

Exam trap

The trap here is that candidates often choose Amazon DynamoDB because it is a managed key-value store, but they overlook that session state requires ultra-low latency and native TTL support, which Redis provides natively, while DynamoDB's higher latency and eventual consistency can degrade user experience in a high-availability architecture.

How to eliminate wrong answers

Option A is wrong because Amazon DynamoDB is a NoSQL database designed for document and key-value storage with eventual consistency, but its latency is higher than in-memory caching, and it lacks native TTL-based session expiration without additional configuration, making it less optimal for high-frequency session reads/writes. Option B is wrong because Amazon S3 is an object storage service with high latency for small, frequent read/write operations, and it does not support key-value access patterns or automatic session expiration, making it unsuitable for real-time session state. Option D is wrong because Amazon RDS for MySQL is a relational database that introduces significant overhead for simple key-value session lookups, requires schema management, and has higher latency than in-memory solutions, which can become a bottleneck under load.

41
MCQhard

A company uses Amazon API Gateway with a Lambda authorizer to control access to its APIs. The Lambda authorizer returns an IAM policy that grants access to the API. Recently, the company noticed that some API calls are being throttled due to high latency from the authorizer. What is the MOST effective way to reduce latency?

A.Enable caching for the Lambda authorizer responses.
B.Use a custom authorizer instead of a Lambda authorizer.
C.Reduce the TTL of the authorizer cache.
D.Increase the memory allocated to the Lambda authorizer function.
AnswerA

Enabling caching for Lambda authorizer responses significantly optimizes API Gateway performance and cost. Once an authorizer successfully authenticates a request and returns a policy, API Gateway stores this decision for a configurable duration. Subsequent requests with the same identity source within the cache's Time-To-Live (TTL) period will bypass the Lambda authorizer invocation entirely, drastically reducing latency and Lambda execution costs.

Why this answer

Enabling caching for the Lambda authorizer responses allows API Gateway to reuse the IAM policy returned by the authorizer for subsequent requests that match the same cache key, without invoking the Lambda function again. This eliminates the latency of the authorizer invocation on cache hits, directly addressing the throttling caused by high authorizer latency.

Exam trap

The trap here is that candidates may assume increasing Lambda memory (Option D) is the universal fix for Lambda performance issues, but in this context the latency stems from the invocation overhead and network round-trip, not from CPU-bound processing, making caching the more effective solution.

How to eliminate wrong answers

Option B is wrong because 'custom authorizer' is an ambiguous term; in API Gateway, a Lambda authorizer is already a type of custom authorizer, and switching to a different implementation (e.g., a Cognito user pool authorizer) would not necessarily reduce latency and may not support the required IAM policy-based access control. Option C is wrong because reducing the TTL of the authorizer cache would cause the cache to expire more frequently, increasing the number of Lambda invocations and potentially worsening latency and throttling. Option D is wrong because while increasing Lambda memory can reduce execution time for compute-intensive tasks, the primary bottleneck here is the invocation overhead and network round-trip, not CPU-bound processing; caching addresses the root cause more effectively.

42
MCQeasy

A company uses AWS CodeCommit and wants to automatically trigger a build in AWS CodePipeline when code is pushed to the master branch. Which action should be taken?

A.Configure a CloudWatch Events rule to start the pipeline on repository changes
B.Add a webhook in CodeCommit to directly invoke CodePipeline
C.Set up a scheduled pipeline that polls CodeCommit every minute
D.Use an S3 trigger to start the pipeline when code is uploaded
AnswerA

CloudWatch Events (now Amazon EventBridge) is the standard and most efficient mechanism for integrating AWS CodeCommit with AWS CodePipeline. CodeCommit automatically publishes events, such as ReferenceUpdated for code pushes, to CloudWatch Events. A rule can then be configured to filter these specific events from the CodeCommit repository and branch, triggering a CodePipeline execution as its target. This creates a real-time, event-driven CI/CD workflow.

Why this answer

AWS CodePipeline can be configured to automatically start when changes are pushed to a CodeCommit repository by using an Amazon CloudWatch Events rule. The rule listens for CodeCommit repository state changes (e.g., 'ReferenceCreated' or 'ReferenceUpdated' events on the master branch) and targets the pipeline as a CloudWatch Events target, triggering the pipeline execution without polling or manual intervention.

Exam trap

The trap here is that candidates often confuse CodeCommit's integration with webhooks (which work with external Git providers) and assume CodeCommit supports them natively, or they overcomplicate the solution by suggesting polling or S3 triggers instead of using the native CloudWatch Events integration.

How to eliminate wrong answers

Option B is wrong because CodeCommit does not support webhooks to directly invoke CodePipeline; webhooks are used with third-party Git providers like GitHub or Bitbucket, not with CodeCommit. Option C is wrong because scheduling a pipeline to poll every minute is inefficient and not a native integration; CodePipeline does not natively poll CodeCommit at a fixed interval, and CloudWatch Events provides a real-time, event-driven approach. Option D is wrong because an S3 trigger is used for S3 bucket events, not for CodeCommit repository changes; CodeCommit events are not published to S3, and this approach would require unnecessary intermediate steps.

43
MCQmedium

A developer is building a serverless application using AWS SAM that includes an API Gateway REST API and a Lambda function. The developer wants to pass environment variables to the Lambda function based on the deployment stage (dev/prod). The stage name is provided as a SAM parameter. How should the developer define this in the SAM template?

A.Define a SAM Parameter for the stage name, and reference it in the Lambda function's Environment property
B.Use the Globals section of the SAM template to set environment variables
C.Hard-code the environment variables with different values in the template
D.Use an AWS Systems Manager Parameter Store parameter and reference it in the function
AnswerA

Defining a SAM Parameter for the stage name is the correct and recommended approach. This allows the stage name to be passed as an input during the `sam deploy` command, which then populates a CloudFormation parameter. The Lambda function's `Environment.Variables` property can then reference this parameter using `!Ref` or `Fn::Sub`, dynamically injecting the correct stage name into the function's runtime environment based on the deployment target.

Why this answer

AWS SAM allows you to define parameters (e.g., StageName) and reference them directly in the Lambda function's Environment property using CloudFormation intrinsic functions like !Ref. This enables dynamic injection of environment variables based on the deployment stage without modifying the template structure, aligning with Infrastructure as Code best practices for multi-environment deployments.

Exam trap

The trap here is that candidates may overcomplicate the solution by choosing Parameter Store (Option D) for dynamic values, missing that SAM parameters are the simplest native mechanism for stage-specific environment variables without external service dependencies.

How to eliminate wrong answers

Option B is wrong because the Globals section sets default values for all functions in the template, but it cannot dynamically vary environment variables per deployment stage without additional logic like conditions or parameters, making it unsuitable for stage-specific values. Option C is wrong because hard-coding environment variables for each stage would require maintaining separate templates or manual edits, violating the principle of reusable, parameterized templates and increasing error risk. Option D is wrong because while AWS Systems Manager Parameter Store can store values, referencing it directly in the function does not inherently tie the value to the SAM deployment stage; you would still need a parameter or mapping to select the correct Parameter Store path per stage, making Option A more straightforward.

44
MCQmedium

A company is using AWS Lambda functions behind an Amazon API Gateway REST API. Users report intermittent 503 errors. The Lambda function code appears correct. Which action is MOST likely to resolve the issue?

A.Increase the Lambda function memory allocation.
B.Increase the Lambda function timeout.
C.Request a service quota increase for Lambda concurrent executions.
D.Increase the API Gateway throttling limits.
AnswerC

A 503 Service Unavailable error from Lambda indicates that the service is currently unable to handle the request, most commonly because the account's or function's concurrent execution quota has been reached. Each AWS account has a default regional concurrency limit for Lambda functions, and exceeding this limit causes subsequent invocation attempts to be throttled. Requesting a service quota increase directly addresses this bottleneck, allowing more Lambda instances to run in parallel and process incoming API Gateway requests.

Why this answer

Intermittent 503 errors from API Gateway often indicate that Lambda concurrent execution limits have been reached. When the number of simultaneous invocations exceeds the account-level or function-level reserved concurrency, API Gateway returns a 503 'Service Unavailable' response. Increasing the Lambda concurrent executions quota allows more invocations to be processed without throttling.

Exam trap

The trap here is that candidates confuse API Gateway throttling limits (which return 429 errors) with Lambda concurrency limits (which return 503 errors), leading them to incorrectly choose option D.

How to eliminate wrong answers

Option A is wrong because increasing memory allocation improves CPU performance and execution speed, but does not resolve throttling due to concurrency limits. Option B is wrong because increasing the timeout only allows the function to run longer, but does not prevent new invocations from being rejected when concurrency is exhausted. Option D is wrong because API Gateway throttling limits (e.g., 10,000 requests per second by default) are typically much higher than Lambda concurrency limits, and the 503 error is caused by Lambda throttling, not API Gateway throttling.

45
MCQhard

A developer is using AWS X-Ray to trace a serverless application. The application uses an AWS Lambda function to query a DynamoDB table. The trace shows that the DynamoDB subsegment takes a significant portion of the total response time. The developer wants to reduce the DynamoDB query latency. Which service should the developer integrate with the Lambda function to achieve the lowest latency for repeated read queries?

A.DynamoDB Accelerator (DAX)
B.Amazon ElastiCache for Redis
C.DynamoDB Global Tables
D.DynamoDB Streams
AnswerA

DynamoDB Accelerator (DAX) is a fully managed, in-memory cache specifically designed to sit in front of DynamoDB tables. It provides microsecond response times for read-heavy workloads by caching frequently accessed data, significantly improving performance for serverless applications. DAX is API-compatible with DynamoDB, requiring minimal application code changes to integrate and benefit from its high-performance caching capabilities, making it ideal for reducing read latency.

Why this answer

DynamoDB Accelerator (DAX) is a fully managed, highly available, in-memory cache for DynamoDB that delivers up to 10x read performance improvement by reducing response times from milliseconds to microseconds for repeated read queries. By integrating DAX with the Lambda function, the developer can cache the results of frequent DynamoDB queries directly in memory, bypassing the read capacity units and the underlying storage engine, which directly addresses the latency bottleneck shown in the X-Ray trace.

Exam trap

The trap here is that candidates often choose ElastiCache for Redis because it is a well-known caching solution, but they overlook that DAX is purpose-built for DynamoDB and provides lower latency with zero application-level cache management, making it the correct choice for reducing DynamoDB query latency in a serverless application.

How to eliminate wrong answers

Option B (Amazon ElastiCache for Redis) is wrong because it is a general-purpose caching solution that requires the developer to manually manage cache invalidation, data synchronization, and application-level logic to keep the cache consistent with DynamoDB, adding complexity and potential latency overhead compared to DAX's native DynamoDB integration. Option C (DynamoDB Global Tables) is wrong because it is designed for multi-region replication and disaster recovery, not for reducing read latency within a single region; it actually increases write latency due to cross-region replication and does not cache repeated read queries. Option D (DynamoDB Streams) is wrong because it captures a time-ordered sequence of item-level changes in a DynamoDB table for event-driven processing (e.g., triggering Lambda functions), but it does not provide any caching or read acceleration functionality.

46
MCQmedium

A developer is building a serverless application using AWS Lambda to process events from an Amazon SQS queue. The Lambda function is CPU-bound and currently experiences timeouts. What is the MOST cost-effective way to reduce execution time?

A.Increase the SQS batch window size
B.Switch the Lambda runtime from Python to Node.js
C.Increase the Lambda function's memory allocation
D.Enable Provisioned Concurrency for the function
AnswerC

Increasing a Lambda function's memory allocation is the most direct and effective way to improve performance for CPU-bound tasks. AWS Lambda provisions CPU power proportionally to the configured memory. Therefore, allocating more memory provides the function with a larger share of CPU resources, enabling it to complete computationally intensive operations faster and reduce overall execution time.

Why this answer

Increasing the Lambda function's memory allocation is the most cost-effective way to reduce execution time for a CPU-bound function because Lambda allocates CPU proportionally to memory. More memory means more vCPU capacity, which directly speeds up CPU-bound processing. This reduces the function's duration, and since Lambda billing is based on compute time (GB-seconds), the total cost can decrease even if the per-GB-second rate is higher.

Exam trap

The trap here is that candidates assume increasing memory only helps memory-bound workloads, but AWS Lambda's CPU allocation scales with memory, making it the primary lever for CPU-bound performance improvements.

How to eliminate wrong answers

Option A is wrong because increasing the SQS batch window size only delays event retrieval, it does not reduce the Lambda function's execution time or address CPU-bound timeouts. Option B is wrong because switching the runtime from Python to Node.js does not guarantee a performance improvement for CPU-bound tasks; the bottleneck is CPU capacity, not language overhead, and this change introduces migration risk without a cost-effective guarantee. Option D is wrong because Provisioned Concurrency keeps functions initialized and ready to handle bursts of traffic, but it does not reduce the execution time of a single invocation; it adds cost for pre-warmed instances without addressing the CPU-bound timeout issue.

47
MCQmedium

A development team is using AWS CodeBuild to compile and test their code. They want to store build artifacts in an Amazon S3 bucket. The buildspec.yml file includes an artifacts section. Which configuration correctly specifies the output artifacts?

A.artifacts: files: - '**/*' discard-paths: no
B.artifacts: base-directory: 'build' files: '**/*'
C.artifacts: file: '**/*' discard-paths: no
D.artifacts: path: '**/*' discard-paths: false
AnswerA

This configuration correctly specifies that all files and directories from the build output directory should be included as artifacts. The `files` key expects a YAML list of glob patterns, where `**/*` matches everything recursively from the `base-directory` (or root of the build output if not specified). Setting `discard-paths: no` ensures that the original directory structure of the collected files is preserved within the generated artifact archive, which is crucial for maintaining file organization during deployments.

Why this answer

It uses the correct `files` key with a glob pattern `'**/*'` to include all files, and `discard-paths: no` preserves the directory structure in the S3 bucket. In CodeBuild, the `artifacts` section requires `files` (not `file` or `path`) to specify which files to output, and `discard-paths` controls whether the relative path is kept.

Exam trap

The trap here is confusing the `files` key (plural, required) with `file` (singular, invalid) or `path` (used in other AWS services like CodePipeline), leading candidates to select options with incorrect key names.

How to eliminate wrong answers

Option B is wrong because `files` must be a list (e.g., `['**/*']`), not a string `'**/*'`; CodeBuild expects a sequence of file patterns, and a single string will cause a validation error. Option C is wrong because it uses `file:` instead of `files:`; the correct key is `files` (plural), and `file` is not a valid artifact configuration key. Option D is wrong because it uses `path:` instead of `files:`; `path` is not a valid key in the artifacts section—the correct key is `files` to define the file patterns to include.

48
MCQhard

A developer is building a serverless application using AWS Lambda and Amazon API Gateway. The developer wants to enable caching for API responses to reduce latency and cost. Which step is REQUIRED to enable caching?

A.Enable caching in the Lambda function code
B.Set the TTL in the API Gateway method request integration
C.Create a cache cluster in API Gateway for the stage
D.Use Amazon ElastiCache and modify the Lambda function to check cache
AnswerC

This is the correct approach for reducing latency by caching API responses directly within API Gateway. To enable caching, a cache cluster must be provisioned and associated with a specific API Gateway stage, where you define its capacity (e.g., 0.5 GB to 237 GB) and the default Time-To-Live (TTL) for cached responses. Once enabled, API Gateway intercepts requests, serves cached responses if available and valid, and only invokes the backend Lambda function when a cache miss occurs or the cache entry expires.

Why this answer

API Gateway caching requires a dedicated cache cluster to be enabled and configured at the stage level. This cluster stores API responses and serves them directly from the cache for identical requests, reducing the number of calls to the backend Lambda function and lowering latency. Without creating and enabling this cache cluster in the API Gateway stage settings, caching cannot function.

Exam trap

The trap here is that candidates often confuse API Gateway's built-in caching with external caching solutions like ElastiCache or assume that caching can be enabled solely by modifying Lambda code or integration settings, when in fact a dedicated cache cluster must be explicitly created and enabled at the API Gateway stage level.

How to eliminate wrong answers

Option A is wrong because caching is not implemented within the Lambda function code; Lambda functions are stateless and do not natively cache API responses. Option B is wrong because the TTL (time-to-live) for API Gateway caching is configured in the stage settings or per-method cache settings, not in the method request integration. Option D is wrong because while Amazon ElastiCache could be used for custom caching logic, it is not a required step for enabling API Gateway's built-in caching; the question asks for the required step to enable caching in API Gateway, which is to create a cache cluster in API Gateway for the stage.

49
MCQeasy

A developer is building a serverless application using AWS Lambda and Amazon DynamoDB. The Lambda function needs to read and write items to a DynamoDB table. What is the BEST way to securely provide the Lambda function with the necessary AWS credentials?

A.Store the AWS access key and secret key in the Lambda environment variables.
B.Create an IAM role with DynamoDB permissions and attach it to the Lambda function.
C.Create an IAM user with programmatic access and store the credentials in the Lambda code.
D.Use the Lambda function's default full admin access provided by AWS.
AnswerB

Creating an IAM role with specific DynamoDB permissions and attaching it to the Lambda function is the AWS-recommended and most secure approach. When the Lambda function executes, it automatically assumes this IAM role, which provides temporary, short-lived credentials to interact with DynamoDB. This method adheres to the principle of least privilege by granting only necessary permissions and eliminates the need to manage static credentials within the function code or configuration, significantly enhancing security.

Why this answer

The best practice for granting AWS Lambda functions access to DynamoDB is to create an IAM role with the necessary DynamoDB permissions (e.g., dynamodb:GetItem, dynamodb:PutItem) and attach that role to the Lambda function. This follows the principle of least privilege and leverages AWS Identity and Access Management (IAM) roles, which provide temporary, automatically rotated credentials via the AWS Security Token Service (STS). This approach eliminates the need to manage long-term access keys and ensures secure, auditable access.

Exam trap

The trap here is that candidates may think environment variables (Option A) are a secure storage mechanism because they are not in the code, but they fail to recognize that long-term access keys are still exposed and violate the IAM roles best practice for serverless applications.

How to eliminate wrong answers

Option A is wrong because storing AWS access keys and secret keys in Lambda environment variables is insecure and violates best practices; environment variables can be exposed in logs or through the Lambda console, and long-term credentials increase the risk of compromise. Option C is wrong because creating an IAM user with programmatic access and embedding the credentials in Lambda code is a security anti-pattern; it requires manual credential rotation, exposes secrets in code, and bypasses the automatic credential management provided by IAM roles. Option D is wrong because AWS does not provide 'default full admin access' to Lambda functions; the Lambda function must have an explicit IAM role attached, and granting full admin access would violate the principle of least privilege and create a severe security risk.

50
MCQmedium

A company uses AWS CloudFormation to deploy infrastructure. The developer needs to pass a list of security group IDs to an EC2 instance launch configuration. The security groups are created in another stack. How should the developer obtain the security group IDs?

A.Use Fn::GetAtt to retrieve the IDs from the other stack's resources.
B.Use Fn::ImportValue to import the exported outputs from the other stack.
C.Use a nested stack to include the security group resources in the same template.
D.Use Fn::Ref to reference the security group IDs directly.
AnswerB

The Fn::ImportValue intrinsic function is the correct mechanism for referencing outputs from other CloudFormation stacks. It allows a stack to consume values that have been explicitly exported by another stack using the Fn::Export function in its `Outputs` section, referencing the unique name provided during export. This design pattern promotes modularity and enables decoupled infrastructure deployments by facilitating secure and managed cross-stack communication.

Why this answer

Fn::ImportValue is designed to retrieve exported outputs from another CloudFormation stack. When security groups are created in a separate stack, the developer must export their IDs using the Export field in the Outputs section of that stack, and then use Fn::ImportValue in the current stack to reference those exported values. This is the standard cross-stack reference mechanism in CloudFormation, enabling decoupled infrastructure management.

Exam trap

The trap here is that candidates often confuse Fn::GetAtt and Fn::ImportValue, mistakenly thinking that GetAtt can retrieve attributes across stacks, when in fact it is strictly intra-stack, while ImportValue is the only native CloudFormation function for cross-stack references.

How to eliminate wrong answers

Option A is wrong because Fn::GetAtt retrieves attributes of resources within the same stack, not from another stack; it cannot reference resources across stack boundaries. Option C is wrong because using a nested stack would require restructuring the template and embedding the security group resources, which contradicts the requirement that they are created in another stack and does not solve the cross-stack reference problem. Option D is wrong because Fn::Ref returns the logical ID or physical ID of a resource only within the same template; it cannot resolve values from a different stack.

51
MCQmedium

A developer is creating a REST API using Amazon API Gateway and multiple AWS Lambda functions for different endpoints. The API must support CORS for a web application hosted on a different domain. The developer is using Lambda proxy integration. Which configuration is required to enable CORS?

A.Enable CORS in API Gateway and configure the Lambda functions to return the required CORS headers.
B.Configure API Gateway to return CORS headers and Lambda functions can ignore CORS.
C.Configure Lambda functions to return CORS headers and API Gateway will pass them through automatically.
D.Use a Lambda@Edge function at Amazon CloudFront to add CORS headers.
AnswerA

Enabling CORS in API Gateway generates an OPTIONS method and configures headers for non-proxy integrations, but for proxy integrations, the Lambda must also return the headers. Both steps are needed to ensure full CORS support.

Why this answer

With Lambda proxy integration in API Gateway, the entire request and response are passed through to the Lambda function, which must return the HTTP response including status code, headers, and body. To enable CORS, the Lambda function must include the required CORS headers (e.g., Access-Control-Allow-Origin) in its response. While API Gateway can be configured to add CORS headers for non-proxy integrations, with proxy integration the Lambda function is solely responsible for returning all headers.

Exam trap

The trap here is that candidates assume API Gateway's CORS configuration works universally, but with Lambda proxy integration, the Lambda function has full control over the response headers, making API Gateway's CORS settings ineffective.

How to eliminate wrong answers

Option B is wrong because with Lambda proxy integration, API Gateway cannot independently add CORS headers; the Lambda function controls the entire response. Option C is wrong because API Gateway does not automatically pass through headers from the Lambda function; the Lambda function must explicitly return them in the response object. Option D is wrong because Lambda@Edge is used with CloudFront for edge processing, not for API Gateway CORS configuration, and it would add unnecessary complexity and latency.

52
MCQeasy

A developer is building a serverless web application using AWS Lambda and Amazon DynamoDB. The application needs to perform complex aggregations on data stored in DynamoDB. Which AWS service should the developer use to perform these aggregations efficiently without reading all the data into Lambda?

A.AWS Glue
B.Amazon EMR
C.DynamoDB Streams with AWS Lambda
D.Amazon Redshift
AnswerC

DynamoDB Streams capture a time-ordered sequence of item-level modifications (inserts, updates, and deletes) in a DynamoDB table, providing a near real-time data feed. AWS Lambda functions can subscribe to these streams, processing batches of records as they become available. This serverless pattern allows for efficient, event-driven aggregation updates, such as maintaining counters or summary tables, without requiring expensive full table scans, making it the ideal solution for responsive data insights in a serverless web application.

Why this answer

DynamoDB Streams captures item-level changes in near real-time and can trigger a Lambda function to perform incremental aggregations without scanning the entire table. This pattern avoids reading all data into Lambda, making it efficient for continuous aggregation workloads.

Exam trap

The trap here is that candidates may choose AWS Glue or Amazon EMR because they associate 'complex aggregations' with big data tools, overlooking that DynamoDB Streams with Lambda provides a serverless, incremental aggregation pattern that avoids full table scans.

How to eliminate wrong answers

Option A is wrong because AWS Glue is a serverless ETL service designed for batch data processing and cataloging, not for real-time aggregations triggered by DynamoDB changes. Option B is wrong because Amazon EMR is a big data platform for running Apache Spark, Hadoop, or Hive clusters, which is overkill and not serverless for simple aggregations on DynamoDB data. Option D is wrong because Amazon Redshift is a petabyte-scale data warehouse for SQL analytics, not a service for performing aggregations directly on DynamoDB data without moving it first.

53
MCQmedium

A developer is building a serverless application using AWS Lambda to process files uploaded to an S3 bucket. The files are encrypted with S3 server-side encryption using AWS KMS (SSE-KMS). The Lambda function needs to read the files and store metadata in DynamoDB. Which IAM policy statement should be attached to the Lambda execution role to allow it to decrypt the objects?

A.{"Effect":"Allow","Action":["kms:Encrypt"],"Resource":"*"}
B.{"Effect":"Allow","Action":["kms:Decrypt"],"Resource":"arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab"}
C.{"Effect":"Allow","Action":["kms:GenerateDataKey"],"Resource":"*"}
D.{"Effect":"Allow","Action":["s3:GetObject"],"Resource":"arn:aws:s3:::my-bucket/*"}
AnswerB

When an object is stored in Amazon S3 using Server-Side Encryption with AWS KMS keys (SSE-KMS), the S3 service encrypts the object data using a unique data key, which is then encrypted by the specified KMS customer master key (CMK). To retrieve and read this object, the calling entity (e.g., a Lambda function) must have explicit `kms:Decrypt` permission on the specific KMS key used for encryption. This allows S3 to use the caller's permissions to request decryption of the data key, enabling the object's content to be returned in plaintext.

Why this answer

The Lambda function needs to decrypt objects encrypted with SSE-KMS. The kms:Decrypt action on the specific KMS key ARN grants the necessary permission to decrypt the S3 object data using AWS KMS. Without this, the Lambda function will receive an access denied error when trying to read the encrypted file.

Exam trap

The trap here is that candidates often assume s3:GetObject alone is sufficient for reading encrypted objects, forgetting that SSE-KMS requires explicit kms:Decrypt permission on the specific KMS key, not just a wildcard or unrelated KMS actions.

How to eliminate wrong answers

Option A is wrong because kms:Encrypt is used to encrypt data, not decrypt it, and the resource wildcard is overly permissive and unnecessary for this use case. Option C is wrong because kms:GenerateDataKey is used to generate a data key for client-side encryption, not to decrypt existing objects; it does not fulfill the requirement to read and decrypt SSE-KMS encrypted files. Option D is wrong because s3:GetObject alone is insufficient; while it allows reading the object, the Lambda function also needs explicit kms:Decrypt permission on the KMS key to decrypt the SSE-KMS encrypted content.

54
MCQeasy

A developer is building a RESTful API using Amazon API Gateway. The API experiences high traffic spikes, and many requests are for the same data (e.g., a product catalog). The developer wants to reduce the load on the backend Lambda functions and improve response times for repeated requests. Which feature should the developer enable?

A.Enable API Gateway caching and set a TTL.
B.Use CloudFront with the API Gateway as an origin.
C.Enable throttling on the API Gateway usage plan.
D.Use a DynamoDB Accelerator (DAX) cluster for the backend database.
AnswerA

Enabling API Gateway caching directly addresses the problem by storing responses for a specified Time-To-Live (TTL). When subsequent identical requests arrive within the TTL, API Gateway serves the response from its managed cache, completely bypassing the backend Lambda function. This significantly reduces the load on the Lambda function, lowers invocation costs, and improves API response times for repeated requests.

Why this answer

API Gateway caching stores responses from backend Lambda functions for a configurable time-to-live (TTL). When a request for the same data (e.g., a product catalog) arrives within the TTL period, API Gateway serves the cached response directly, reducing the number of invocations to the Lambda function and improving response latency. This directly addresses the need to reduce load on the backend and improve response times for repeated requests.

Exam trap

The trap here is that candidates often confuse API Gateway caching with CloudFront caching, thinking that CloudFront alone reduces backend load, but CloudFront caches at the edge and still forwards cache misses to API Gateway, which then invokes Lambda; only API Gateway caching directly reduces Lambda invocations for repeated requests.

How to eliminate wrong answers

Option B is wrong because CloudFront with API Gateway as an origin adds a CDN layer that caches responses at edge locations, but it does not reduce the load on the backend Lambda functions for repeated requests to the same API endpoint; it primarily improves latency for geographically distributed users and can still forward requests to API Gateway, which then invokes Lambda. Option C is wrong because enabling throttling on the API Gateway usage plan limits the rate of requests to protect the backend from being overwhelmed, but it does not cache responses or improve response times for repeated requests; it may actually reject or delay requests. Option D is wrong because using a DynamoDB Accelerator (DAX) cluster caches database queries at the data layer, but the problem is about reducing load on Lambda functions and improving response times for API requests, not about optimizing database access; DAX does not cache API responses or reduce Lambda invocations.

55
MCQmedium

A company is using AWS CodePipeline to automate its CI/CD pipeline. The pipeline has a build stage that uses AWS CodeBuild. The developer wants to run unit tests and only proceed to the deploy stage if the tests pass. Which configuration should the developer use to achieve this?

A.Configure a manual approval step before the deploy stage.
B.Configure Amazon CloudWatch alarms to stop the pipeline if tests fail.
C.Configure the build stage to run tests and fail the build if tests fail; CodePipeline will automatically stop.
D.Configure AWS Lambda to invoke a function that checks test results and manually stops the pipeline.
AnswerC

The AWS CodeBuild action within a CodePipeline build stage is specifically designed to execute build commands and tests. If any command within the CodeBuild `buildspec.yml` exits with a non-zero status, CodeBuild reports a failure to CodePipeline. CodePipeline then automatically recognizes this failed action, stops the current pipeline execution, and prevents any subsequent stages, such as deployment, from being initiated, ensuring a 'fail fast' approach.

Why this answer

AWS CodeBuild can be configured to run unit tests as part of the build phase. If any test fails, CodeBuild exits with a non-zero status, causing the build to fail. CodePipeline automatically stops the pipeline execution when a stage fails, preventing the deploy stage from running.

This is the native and simplest way to gate deployment on test success.

Exam trap

The trap here is that candidates may over-engineer a solution (like Lambda or manual approval) when the native failure propagation in CodePipeline already handles the requirement automatically.

How to eliminate wrong answers

Option A is wrong because a manual approval step requires human intervention to proceed, but it does not automatically check test results; tests could fail and the pipeline would still wait for approval, which is not the desired automated behavior. Option B is wrong because Amazon CloudWatch alarms monitor metrics and can trigger notifications or actions, but they cannot directly stop a CodePipeline execution; they are not integrated to halt pipeline stages based on test failures. Option D is wrong because invoking a Lambda function to manually stop the pipeline adds unnecessary complexity and latency; CodePipeline already has built-in failure handling that stops the pipeline when a stage fails, making a custom Lambda solution redundant and less reliable.

56
MCQmedium

The developer runs a scan on the DynamoDB table 'orders' with a filter expression to find items with order_status equal to 'SHIPPED'. The output shows ScannedCount of 10000 but Count of 0. Which statement is correct?

A.The scan retrieved 10,000 items from the table, but none matched the filter condition.
B.The scan only returned items that matched the filter, so there are no items with status SHIPPED.
C.The filter expression syntax is incorrect, causing the scan to return zero items.
D.The scan applied the filter before reading items, so only matching items were scanned.
AnswerA

The `ScannedCount` metric in DynamoDB represents the total number of items read from the table before any `FilterExpression` is applied. If the `ScannedCount` is 10,000 and the `Count` (number of items returned after filtering) is 0, it indicates that all 10,000 items were successfully retrieved from the table, but none of them met the criteria specified in the `FilterExpression`. This is a common scenario when the filter condition is very specific or no matching data exists.

Why this answer

In DynamoDB, a Scan operation retrieves all items in the table or index up to the 1 MB limit, then applies any filter expression client-side. The ScannedCount of 10,000 indicates that 10,000 items were read from the table, but the Count of 0 means none of those items satisfied the filter condition (order_status = 'SHIPPED'). This is the expected behavior: filters are applied after the data is read, not before.

Exam trap

The trap here is that candidates often confuse ScannedCount with Count, assuming that the filter is applied before reading (like a SQL WHERE clause), when in fact DynamoDB scans all items first and then filters, so ScannedCount reflects total items read and Count reflects matches only.

How to eliminate wrong answers

Option B is wrong because it incorrectly states that the scan only returned items that matched the filter; in reality, the scan returns all items up to the limit, and the filter is applied afterward, so Count reflects only matches. Option C is wrong because if the filter expression syntax were incorrect, DynamoDB would return a validation error (e.g., ValidationException), not a Count of 0 with a valid ScannedCount. Option D is wrong because it claims the filter is applied before reading items; DynamoDB always reads items first and then applies the filter, which is why ScannedCount can be larger than Count.

57
MCQhard

A developer is building a REST API using Amazon API Gateway with a Lambda integration. The API must validate that the 'Authorization' header contains a valid JWT token before invoking the backend. Which approach provides the LOWEST latency for token validation?

A.Use a VPC Link to connect to a private server for validation.
B.Validate the token inside the Lambda function integrated with the API.
C.Use API Gateway request validation to check the header format.
D.Use a Lambda authorizer (formerly custom authorizer) on the API Gateway.
AnswerD

A Lambda authorizer, previously known as a custom authorizer, is a dedicated Lambda function invoked by API Gateway *before* the request reaches the backend integration. This authorizer receives the incoming token, performs custom validation logic (e.g., JWT signature verification, expiration checks), and returns an IAM policy that either permits or denies access to the requested API resource. Crucially, API Gateway can cache the policy generated by the authorizer, significantly reducing latency and computational overhead for subsequent requests with the same valid token.

Why this answer

A Lambda authorizer (formerly custom authorizer) runs before the backend Lambda invocation, caching the JWT validation result for a configurable TTL (default 300 seconds). This avoids re-validating the token on every request, providing the lowest latency for token validation compared to validating inside the backend Lambda.

Exam trap

It is a common misconception that API Gateway request validation can handle JWT token validation, but it only validates structural format (e.g., header presence), not cryptographic signature verification.

How to eliminate wrong answers

Option A is wrong because a VPC Link connects to a private server inside a VPC, which adds network latency and complexity without any caching or pre-invocation validation benefit. Option B is wrong because validating the token inside the integrated Lambda function requires the backend to run on every request, even for invalid tokens, increasing latency and cost. Option C is wrong because API Gateway request validation only checks header presence and format (e.g., regex), not the cryptographic validity of a JWT token.

58
MCQmedium

A company runs a containerized web application on Amazon ECS using Fargate. The application needs to store files in Amazon S3. The developer wants to follow the principle of least privilege for the ECS task IAM role. Which IAM policy should be attached to the task role?

A.{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:*","Resource":"*"}]}
B.{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:*","Resource":"arn:aws:s3:::example-bucket/*"}]}
C.{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::example-bucket/*"}]}
D.{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:GetObject","s3:PutObject"],"Resource":"arn:aws:s3:::example-bucket/*"}]}
AnswerC

This policy precisely adheres to the principle of least privilege, granting only the `s3:PutObject` action, which is the exact permission required for the web application to upload files to Amazon S3. The resource is correctly scoped to `arn:aws:s3:::example-bucket/*`, ensuring the application can only write objects into the specified bucket and not affect other S3 resources or perform any other S3 operations. This minimal permission set significantly enhances security by limiting potential damage if the task's credentials were ever compromised.

Why this answer

It grants only the s3:PutObject action on the specific S3 bucket, which is the minimum permission required for the application to store files. This adheres to the principle of least privilege by not including unnecessary read or list actions. The task role should be scoped to the exact resource and action needed.

Exam trap

The trap here is that candidates often choose Option D thinking both read and write are needed for storing files, but the question explicitly states 'store files' which implies write-only, making the read permission unnecessary and a violation of least privilege.

How to eliminate wrong answers

Option A is wrong because it grants full s3:* access to all S3 resources, which violates least privilege by allowing any S3 operation on any bucket. Option B is wrong because it grants all s3:* actions on the specified bucket, which includes read, delete, and administrative actions not needed for storing files. Option D is wrong because it includes s3:GetObject, which is unnecessary for a write-only use case and violates least privilege by granting read access.

59
MCQmedium

A developer is building a system that reads messages from an Amazon SQS queue, processes them, and stores results in an Amazon DynamoDB table. The developer wants to use a managed service to coordinate the processing steps, including error handling and retry logic, without provisioning any servers. Which AWS service should the developer use?

A.AWS Step Functions
B.Amazon Simple Workflow Service (SWF)
C.AWS Glue
D.Amazon MQ
AnswerA

AWS Step Functions is a serverless workflow service that enables developers to build resilient, distributed applications using visual state machines. It excels at orchestrating complex, multi-step processes, integrating seamlessly with Amazon SQS to consume messages and coordinate subsequent actions across various AWS services. Step Functions provides built-in state management, error handling, and retry policies, making it ideal for creating reliable, fault-tolerant workflows initiated by SQS messages.

Why this answer

AWS Step Functions is a serverless orchestration service that lets you coordinate multiple AWS services into a workflow. It directly supports error handling, retry logic, and conditional branching, making it ideal for managing the processing steps of messages from SQS through to DynamoDB without provisioning any servers.

Exam trap

The trap here is that candidates confuse Amazon MQ (a message broker) with a workflow orchestrator, or mistakenly think SWF is the correct choice because it was historically used for workflow coordination, but Step Functions is the modern, serverless, and fully managed alternative that directly integrates with SQS and DynamoDB.

How to eliminate wrong answers

Option B is wrong because Amazon Simple Workflow Service (SWF) is a legacy workflow service that requires you to manage workers (deciders and activity workers) and does not natively integrate with SQS or DynamoDB as seamlessly as Step Functions; it also lacks the built-in retry and error-handling patterns of Step Functions. Option C is wrong because AWS Glue is a serverless ETL service designed for data preparation and transformation, not for orchestrating message processing workflows with SQS and DynamoDB. Option D is wrong because Amazon MQ is a managed message broker service for Apache ActiveMQ and RabbitMQ, not a workflow orchestration service; it provides message queuing but does not handle coordination, error handling, or retry logic across processing steps.

60
MCQeasy

A developer is writing an AWS Lambda function that needs to read a secret from AWS Secrets Manager. The function is written in Python. What is the BEST practice for retrieving the secret?

A.Use AWS Systems Manager Parameter Store to store the secret.
B.Retrieve the secret inside the handler function every time it is invoked.
C.Store the secret in an environment variable.
D.Retrieve the secret outside the handler function and cache it in a global variable.
AnswerD

Retrieving secrets outside the handler function, typically during the Lambda function's initialization phase, and caching them in a global variable is an optimal strategy for performance and cost efficiency. This approach ensures the secret is fetched only once per execution environment (during a cold start) and then reused for subsequent invocations (warm starts), significantly reducing latency and API call costs associated with repeated secret retrieval.

Why this answer

The best practice because retrieving the secret outside the handler function (at initialization time) and caching it in a global variable avoids making a Secrets Manager API call on every invocation. This reduces latency, cost, and the risk of hitting API rate limits. The cached value persists across warm starts within the same execution environment, aligning with AWS Lambda's lifecycle best practices.

Exam trap

The trap here is that candidates may think retrieving the secret inside the handler (Option B) is simpler or more reliable, but they overlook the performance and cost implications of repeated API calls, as well as the Lambda execution environment reuse model that makes caching outside the handler both safe and efficient.

How to eliminate wrong answers

Option A is wrong because it suggests using AWS Systems Manager Parameter Store instead of Secrets Manager, which does not address the requirement of reading a secret from Secrets Manager; Parameter Store is a different service with different features (e.g., no automatic rotation). Option B is wrong because retrieving the secret inside the handler function on every invocation leads to unnecessary API calls, increased latency, and potential throttling, especially under high concurrency. Option C is wrong because storing secrets in environment variables is insecure; environment variables are visible in the Lambda console, logs, and can be exposed through function configuration, violating security best practices.

61
MCQmedium

A developer is running a web application on multiple Amazon EC2 instances behind an Application Load Balancer (ALB). The application needs to store user session state that must be available across all instances. The session data is small and temporary but must survive individual instance failures. Which AWS service should the developer use to store this session state?

A.Store session state in an Amazon ElastiCache cluster
B.Store session state in the /tmp directory of each EC2 instance
C.Use an Amazon SQS queue to persist session data
D.Store session state in an Amazon S3 bucket
AnswerA

Amazon ElastiCache provides a fully managed, in-memory caching service, making it an excellent choice for storing web application session state. By centralizing session data in an ElastiCache Redis or Memcached cluster, all EC2 instances can access and update the same session information, ensuring session stickiness and persistence even if a user's subsequent request is routed to a different instance. Its low-latency access and high availability features, including replication and automatic failover, are critical for responsive and resilient user experiences in distributed environments.

Why this answer

Amazon ElastiCache (e.g., using Redis or Memcached) provides a centralized, in-memory data store that is external to the EC2 instances. This allows all instances behind the ALB to read and write the same session state, ensuring consistency across the fleet. Because the data is stored in a managed cluster, it survives individual instance failures and is ideal for small, temporary session data that requires low-latency access.

Exam trap

The trap here is that candidates often confuse 'survive instance failures' with 'persistent storage' and choose S3 or SQS, overlooking that session state requires low-latency, in-memory access with automatic expiry, which only ElastiCache provides among the options.

How to eliminate wrong answers

Option B is wrong because storing session state in the /tmp directory of each EC2 instance is ephemeral—data is lost if the instance terminates or fails, and it is not shared across instances, breaking the requirement for cross-instance availability. Option C is wrong because Amazon SQS is a message queue service designed for decoupling and asynchronous communication, not for storing session state; it lacks the low-latency, key-value lookup capabilities needed for session management. Option D is wrong because Amazon S3 is an object storage service with higher latency and no built-in support for fast, atomic read/write operations on small session data, making it unsuitable for real-time session state storage.

62
Matchingmedium

Match each AWS security feature to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Temporary permissions for services

Stateful firewall for EC2

Web application firewall

DDoS protection

SSL/TLS certificate management

Why these pairings

The correct matches are IAM with access control, Security Groups with EC2 firewall, KMS with encryption key management, and CloudTrail with API auditing. Common confusions include mistaking IAM for CloudTrail and Security Groups for NACLs.

63
MCQmedium

A developer is writing a Lambda function that processes events from an Amazon S3 bucket. The function needs to access a DynamoDB table to store metadata about the S3 objects. Which of the following is the MOST efficient way to initialize the DynamoDB client in the Lambda function?

A.Store the DynamoDB table name as a global variable and create the client inside the handler.
B.Use a static variable inside the handler to cache the DynamoDB client.
C.Create the DynamoDB client inside the Lambda handler function every invocation.
D.Create the DynamoDB client outside the Lambda handler function, in the global scope.
AnswerD

Creating the DynamoDB client outside the Lambda handler function, in the global scope, is the recommended best practice for optimizing Lambda performance. This ensures the client is initialized only once when the Lambda execution environment is first created during a cold start. For subsequent 'warm' invocations within the same execution environment, the pre-initialized client is reused, significantly reducing latency by avoiding repeated client setup overhead and connection establishment.

Why this answer

Initializing the DynamoDB client outside the Lambda handler (in global scope) allows the client to be reused across multiple invocations within the same execution environment. This avoids the overhead of creating a new client on every invocation, which reduces latency and conserves resources. AWS Lambda reuses the global scope for subsequent invocations after the first, making this the most efficient approach.

Exam trap

The trap here is that candidates may think creating the client inside the handler is safer for avoiding stale connections, but AWS Lambda's execution environment reuse makes global initialization both safe and more efficient.

How to eliminate wrong answers

Option A is wrong because storing the table name as a global variable is acceptable, but creating the client inside the handler on every invocation still incurs unnecessary initialization overhead. Option B is wrong because using a static variable inside the handler does not prevent the client from being recreated on each invocation; static variables in Python are effectively global but the client creation inside the handler still runs on every call. Option C is wrong because creating the DynamoDB client inside the handler on every invocation wastes time and resources, as the client could be reused across invocations in the same execution environment.

64
Multi-Selecthard

A developer is using AWS Secrets Manager to rotate database credentials. The rotation Lambda function fails with an error. Which THREE steps should the developer take to troubleshoot? (Choose THREE.)

Select 3 answers
A.Check VPC Flow Logs for the Lambda function's ENI.
B.Verify that the Lambda function has network access to the database.
C.Ensure the KMS key used to encrypt the secret is rotated.
D.Verify that the Lambda function's IAM role has permission to update the secret.
E.Check the CloudWatch Logs for the Lambda function.
AnswersB, D, E

For the Lambda function to successfully rotate database credentials, it must establish a network connection to the database instance. If the database resides within a VPC, the Lambda function must be configured to execute within that same VPC or a peered VPC, with appropriate security groups and network ACLs allowing outbound connections to the database's port and inbound connections from the Lambda's Elastic Network Interface (ENI). Lack of network reachability is a common cause of rotation failures.

Why this answer

The Lambda function must have network access to the database to perform the rotation (e.g., connecting to the database to change the password). Without network connectivity, the rotation cannot complete. Option D is correct because the Lambda function's IAM role needs permission to call `secretsmanager:PutSecretValue` and `secretsmanager:GetSecretValue` to update the secret in Secrets Manager.

Option E is correct because CloudWatch Logs capture the Lambda function's execution output, including any error messages, stack traces, or logs from the rotation logic, which are essential for diagnosing failures.

Exam trap

The trap here is that candidates often confuse VPC Flow Logs (which show network traffic) with CloudWatch Logs (which show application logs), and they may think that rotating the KMS key is necessary for secret rotation, when in fact KMS key rotation is automatic and unrelated to the rotation process.

65
MCQhard

A developer is designing a serverless application that processes images uploaded to an S3 bucket. Each image must be resized and then stored in a different S3 bucket. The process must be asynchronous and fault-tolerant. Which AWS service should trigger the Lambda function?

A.Amazon S3 Event Notifications
B.Amazon SQS
C.Amazon API Gateway
D.AWS Step Functions
AnswerA

Amazon S3 Event Notifications are the native mechanism for S3 buckets to publish events, such as object creation (s3:ObjectCreated:*), to various destinations. These notifications can directly invoke AWS Lambda functions asynchronously, providing a highly scalable and decoupled way to trigger serverless processing whenever new data arrives in an S3 bucket. This direct integration eliminates the need for intermediary services for simple object-triggered workflows, making it the most suitable and efficient choice for this scenario.

Why this answer

Amazon S3 Event Notifications are the correct trigger because they natively support event-driven architectures where S3 object creation events (e.g., s3:ObjectCreated:Put) can directly invoke a Lambda function. This enables asynchronous processing of uploaded images without any intermediate polling or custom integration, ensuring fault tolerance through Lambda's built-in retry mechanism and dead-letter queue (DLQ) support.

Exam trap

The trap here is that candidates often confuse the service that triggers the Lambda (S3 Event Notifications) with the service that stores or routes the event data (SQS or Step Functions), leading them to pick an option that adds unnecessary complexity or is designed for a different use case.

How to eliminate wrong answers

Option B (Amazon SQS) is wrong because SQS is a message queue service that requires a separate producer to send messages; while S3 can publish events to SQS, the question asks for the service that triggers the Lambda function, and SQS itself does not trigger Lambda unless configured as an event source mapping, which adds unnecessary complexity for a direct S3-to-Lambda use case. Option C (Amazon API Gateway) is wrong because API Gateway is designed for creating RESTful or WebSocket APIs to handle synchronous HTTP requests, not for reacting to S3 object creation events asynchronously. Option D (AWS Step Functions) is wrong because Step Functions is a workflow orchestration service that coordinates multiple AWS services, not a direct trigger for Lambda; using it here would introduce an unnecessary orchestration layer when a simple S3 event notification suffices.

66
MCQmedium

A developer is deploying a web application using AWS Elastic Beanstalk. The application needs to store session state. The developer wants to ensure that session data is not lost if an EC2 instance is terminated. Which solution should the developer implement?

A.Store session data in an Amazon EBS volume.
B.Store session data in an Amazon S3 bucket.
C.Store session data in the instance store.
D.Store session data in an Amazon ElastiCache cluster.
AnswerD

Amazon ElastiCache, particularly when configured with Redis, provides a highly scalable, in-memory data store offering extremely low-latency read and write access essential for responsive session management. It supports high availability through replication and automatic failover, ensuring session data persistence and resilience against node failures. This centralized caching layer allows multiple web servers to efficiently share and access session state, enabling stateless application design crucial for scalability and seamless user experience across instances.

Why this answer

Amazon ElastiCache provides a managed, highly available, and durable in-memory cache that can store session state externally from EC2 instances. By using ElastiCache (e.g., Redis with replication and persistence), session data survives instance termination because it is stored in a separate, resilient service, not on the local instance.

Exam trap

The trap here is that candidates often confuse persistent storage (EBS) with shared, low-latency session storage, failing to recognize that EBS volumes are instance-attached and not designed for cross-instance session sharing, while ElastiCache provides the necessary distributed, in-memory session store.

How to eliminate wrong answers

Option A is wrong because an Amazon EBS volume is tied to a single Availability Zone and, while persistent, it is attached to a specific EC2 instance; if the instance is terminated, the EBS volume may be detached but the session data is not automatically shared across instances and requires manual reattachment, making it unsuitable for stateless session management. Option B is wrong because Amazon S3 is an object storage service designed for large, static objects and high-latency access; it is not optimized for low-latency session state reads/writes and incurs significant overhead per request, making it impractical for real-time session handling. Option C is wrong because the instance store provides temporary, block-level storage that is physically attached to the host computer; data is lost when the instance is stopped, terminated, or fails, directly contradicting the requirement to preserve session data after instance termination.

67
MCQhard

A developer is using Amazon DynamoDB to store session data for a web application. The application reads and writes a single item per user session. The traffic pattern shows occasional spikes. The developer wants to minimize read and write costs. Which DynamoDB capacity mode should the developer choose?

A.Reserved capacity
B.On-demand capacity
C.Provisioned capacity with manual scaling
D.Provisioned capacity with auto scaling
AnswerB

DynamoDB On-demand capacity mode is specifically designed for workloads with unpredictable traffic patterns and sudden, sharp spikes. It operates on a pay-per-request model, automatically scaling throughput up or down instantly to accommodate actual traffic volume without requiring any capacity planning. This eliminates the risk of throttling during peak loads and avoids over-provisioning during quiet periods, making it ideal for highly variable session data.

Why this answer

On-demand capacity mode is ideal for unpredictable traffic patterns with occasional spikes because it automatically scales read and write throughput based on actual usage, charging only for consumed operations. Since the application reads and writes a single item per session and experiences spikes, on-demand eliminates the need to provision for peak capacity, minimizing costs compared to over-provisioning.

Exam trap

The trap here is that candidates may confuse 'Reserved capacity' with a valid DynamoDB option or assume that auto scaling (Option D) is always the cheapest for variable traffic, but on-demand is specifically designed for unpredictable spikes to avoid over-provisioning costs and throttling.

How to eliminate wrong answers

Option A is wrong because DynamoDB does not offer a 'Reserved capacity' pricing model; that concept applies to services like Amazon EC2 or RDS, not DynamoDB. Option C is wrong because provisioned capacity with manual scaling requires you to predict and manually adjust capacity for spikes, which risks either throttling during spikes or over-provisioning and higher costs during low traffic. Option D is wrong because provisioned capacity with auto scaling still requires you to set a minimum and maximum capacity, and during sudden spikes, auto scaling may lag behind, causing throttling or requiring over-provisioning to avoid it, whereas on-demand handles spikes instantly without configuration.

68
MCQmedium

A developer is using Amazon DynamoDB as the data store for a web application. The application experiences frequent throttling errors. Which action can reduce throttling without changing the application code?

A.Add a secondary index
B.Decrease the provisioned write capacity
C.Enable DynamoDB Auto Scaling
D.Increase the provisioned read capacity only
AnswerC

Enabling DynamoDB Auto Scaling, powered by AWS Application Auto Scaling, is the most effective solution for preventing throttling due to fluctuating workloads. Auto Scaling dynamically adjusts the table's provisioned read and write capacity units (RCUs/WCUs) up or down in response to actual traffic patterns and utilization metrics. By automatically increasing capacity during peak demand and decreasing it during lulls, it ensures sufficient throughput to avoid throttling while optimizing costs.

Why this answer

DynamoDB Auto Scaling automatically adjusts the provisioned throughput capacity based on actual traffic patterns, using the AWS Application Auto Scaling service. This prevents throttling by increasing capacity during demand spikes and reduces costs by scaling down during low traffic, all without requiring any code changes.

Exam trap

The trap here is that candidates often assume throttling can only be fixed by manually increasing capacity (Option D) or by optimizing queries (Option A), but they overlook the managed scaling solution that requires no code changes.

How to eliminate wrong answers

Option A is wrong because adding a secondary index does not directly increase the base read/write capacity of the table; it only provides alternative query patterns and can even increase consumed capacity if not designed carefully. Option B is wrong because decreasing provisioned write capacity would worsen throttling by reducing the available throughput, directly contradicting the goal of reducing throttling. Option D is wrong because increasing only read capacity does not address write throttling, and the question describes 'frequent throttling errors' without specifying read or write, so a balanced solution is needed.

69
MCQhard

A Step Functions workflow calls three independent Lambda functions and should continue only after all results are available. Which state pattern should be used?

A.Choice state
B.Wait state
C.Parallel state
D.Fail state
AnswerC

The Parallel state is specifically designed to execute multiple independent branches of a workflow concurrently. Each branch within a Parallel state runs simultaneously, allowing for the efficient, parallel invocation of services like AWS Lambda functions. The state completes only when all its branches have finished their execution, aggregating their outputs into a single result, which perfectly addresses the requirement of calling three independent Lambda functions at the same time.

Why this answer

The Parallel state in AWS Step Functions is designed to execute multiple branches of work concurrently and then aggregate their outputs into a single array. This is exactly what is needed when three independent Lambda functions must all complete before the workflow continues, as the Parallel state waits for all branches to finish before proceeding to the next state.

Exam trap

The trap here is that candidates may confuse the Parallel state with the Map state, but the Map state is for processing items in an array with the same logic, not for running distinct independent tasks.

How to eliminate wrong answers

Option A is wrong because a Choice state is used for conditional branching based on input data, not for executing multiple tasks concurrently. Option B is wrong because a Wait state only introduces a delay in the workflow and does not execute or coordinate multiple Lambda functions. Option D is wrong because a Fail state is used to stop the execution and mark it as failed, not to run parallel tasks.

70
MCQmedium

A developer is building a REST API using Amazon API Gateway and AWS Lambda. The API must support request validation, request throttling, and API keys. Which API Gateway feature should the developer use to enforce a daily request limit for each API key?

A.Usage plans
B.API keys
C.Throttling settings at the method level
D.AWS WAF
AnswerA

Usage plans in Amazon API Gateway are the definitive mechanism for enforcing per-client quotas and throttling limits. They allow you to associate specific API keys with defined request rates (e.g., requests per second) and burst capacities, as well as total request quotas over a given period. This ensures that individual API consumers adhere to their subscribed service tiers, preventing any single client from monopolizing API resources and providing granular control over API consumption.

Why this answer

Usage plans in API Gateway allow you to set throttling and quota limits per API key, enabling daily request limits for each key. This feature is specifically designed to control usage by associating API keys with a plan that defines rate limits and quotas, such as a daily request cap. Option A is correct because it directly addresses the requirement to enforce a daily request limit per API key.

Exam trap

The trap here is that candidates often confuse API keys with usage plans, thinking that simply enabling API keys automatically enforces throttling or quotas, but API keys alone provide no rate limiting without a usage plan.

How to eliminate wrong answers

Option B is wrong because API keys alone are just identifiers used to authenticate requests; they do not enforce any throttling or quota limits. Option C is wrong because throttling settings at the method level apply globally to all requests for that method, not per API key, and cannot enforce a daily limit per key. Option D is wrong because AWS WAF is a web application firewall that protects against common web exploits, not a feature for managing API usage quotas or throttling per API key.

71
MCQeasy

A developer is creating a CloudFormation template to deploy an Amazon S3 bucket. The developer wants the bucket to be deleted automatically when the CloudFormation stack is deleted. What should the developer specify in the template?

A.Set the DeletionPolicy attribute to Delete.
B.Specify a unique bucket name to avoid conflicts.
C.Use the DependsOn attribute to specify the bucket depends on the stack.
D.Set the DeletionPolicy attribute to Retain.
AnswerA

When a CloudFormation stack is deleted, resources with DeletionPolicy: Delete are removed from the AWS account. For an S3 bucket, applying DeletionPolicy: Delete ensures that the bucket and all its contents are permanently deleted when the associated CloudFormation stack is terminated. This is the correct approach to ensure the bucket's lifecycle is tied directly to the stack's lifecycle, preventing orphaned resources. This attribute explicitly instructs CloudFormation to remove the resource.

Why this answer

The `DeletionPolicy` attribute in AWS CloudFormation controls what happens to a resource when its stack is deleted. By setting `DeletionPolicy: Delete` on the S3 bucket resource, the developer ensures that the bucket is automatically deleted when the stack is deleted. This is the default behavior for most resources, but explicitly setting it confirms the intent and overrides any other policy like `Retain`.

Exam trap

The trap here is that candidates often confuse `DeletionPolicy` with `UpdatePolicy` or assume that `Retain` is the default, leading them to choose Option D, when in fact `Delete` is the default and correct choice for automatic deletion.

How to eliminate wrong answers

Option B is wrong because specifying a unique bucket name avoids naming conflicts but does not control deletion behavior; CloudFormation can still delete the bucket regardless of its name. Option C is wrong because the `DependsOn` attribute only establishes resource creation order within the stack, not deletion behavior; it does not affect whether the bucket is deleted when the stack is removed. Option D is wrong because setting `DeletionPolicy` to `Retain` explicitly prevents the bucket from being deleted when the stack is deleted, which is the opposite of what the developer wants.

72
MCQeasy

A developer is using AWS Lambda to process events from an Amazon Kinesis stream. The function has been failing with 'ProvisionedThroughputExceededException' errors when writing to a DynamoDB table. What should the developer do to resolve this issue?

A.Decrease the batch size of the Kinesis event source mapping.
B.Implement retry logic with exponential backoff in the Lambda function.
C.Increase the number of shards in the Kinesis stream.
D.Increase the memory allocated to the Lambda function.
AnswerB

Implementing retry logic with exponential backoff in the Lambda function is the standard and most effective approach for handling `ProvisionedThroughputExceededException`. This exception indicates a temporary throttling by DynamoDB when its provisioned capacity is exceeded. Exponential backoff allows the Lambda function to automatically reattempt failed writes after increasing delays, giving DynamoDB time to recover capacity and successfully process the request, thereby smoothing out write spikes and preventing data loss.

Why this answer

The 'ProvisionedThroughputExceededException' error indicates that the Lambda function is exceeding the write capacity units (WCUs) provisioned for the DynamoDB table. Implementing retry logic with exponential backoff in the Lambda function allows it to handle throttling gracefully by pausing and retrying failed writes, which is the standard AWS-recommended pattern for managing DynamoDB throttling.

Exam trap

The trap here is that candidates often confuse scaling the source (Kinesis shards) or the compute (Lambda memory) with managing the downstream resource's capacity limits, leading them to choose options that increase parallelism rather than implementing proper retry and backoff logic.

How to eliminate wrong answers

Option A is wrong because decreasing the batch size of the Kinesis event source mapping reduces the number of records per invocation but does not address the root cause of exceeding DynamoDB's provisioned throughput; it may only reduce the burst of writes but not prevent throttling if the table's capacity is insufficient. Option C is wrong because increasing the number of shards in the Kinesis stream increases the parallelism of Lambda invocations, which can actually exacerbate the throttling issue by sending more concurrent write requests to DynamoDB. Option D is wrong because increasing the memory allocated to the Lambda function only affects CPU and network performance, not the rate at which it writes to DynamoDB; it does not resolve throughput limit errors.

73
Multi-Selecteasy

A developer is building a serverless application using AWS Lambda. The Lambda function needs to access a VPC to connect to an RDS database. Which TWO resources must the developer configure to allow the Lambda function to access the VPC?

Select 2 answers
A.A NAT gateway in the VPC.
B.A security group that allows inbound/outbound traffic to the RDS database.
C.VPC subnet IDs for the Lambda function.
D.An IAM role with permissions to access RDS.
E.An internet gateway attached to the VPC.
AnswersB, C

A security group acts as a virtual firewall for your RDS database instance, controlling both inbound and outbound traffic at the instance level. To allow a Lambda function to connect to RDS, the RDS security group must have an inbound rule permitting traffic on the database port (e.g., 3306 for MySQL) from the security group associated with the Lambda function's ENI. This ensures network-level access is granted for the serverless application.

Why this answer

A security group acts as a virtual firewall for the Lambda function, controlling inbound and outbound traffic. To connect to an RDS database in a VPC, the Lambda function's security group must allow outbound traffic to the RDS database's security group on the database port (e.g., 3306 for MySQL), and the RDS security group must allow inbound traffic from the Lambda security group. This two-way rule ensures the Lambda function can establish a TCP connection to the database.

Exam trap

The trap here is that candidates often confuse the resources needed for VPC access (subnet IDs and security groups) with network infrastructure components (NAT gateway, internet gateway) or database-level permissions (IAM role), but the question specifically asks for the two resources that enable the Lambda function to connect to the VPC network layer, not the database service itself.

74
MCQeasy

A developer is building an AWS Lambda function that needs to retrieve a database password securely. The password is stored in AWS Secrets Manager and is rotated every 30 days. The function must minimize the number of API calls to Secrets Manager. Which approach should the developer use?

A.Store the database password as an encrypted environment variable in the Lambda function.
B.Call Secrets Manager on every invocation to get the latest secret.
C.Retrieve the secret from Secrets Manager once outside the handler function, cache it in a global variable, and refresh the cache if the secret fails.
D.Use AWS Systems Manager Parameter Store SecureString instead of Secrets Manager.
AnswerC

Retrieving the secret from Secrets Manager once outside the handler function and caching it in a global variable is an optimal pattern for Lambda. This approach leverages the execution environment's persistence, significantly reducing latency and cost by minimizing `GetSecretValue` API calls across warm invocations. If the secret is rotated, the cached value will eventually fail authentication, triggering a refresh from Secrets Manager to retrieve the latest version, ensuring both efficiency and up-to-date security.

Why this answer

It retrieves the secret once during the Lambda cold start (outside the handler), caches it in a global variable, and only refreshes the cache if the secret fails (e.g., due to rotation). This minimizes API calls to Secrets Manager while still handling secret rotation gracefully, as the cached secret remains valid until a failure occurs.

Exam trap

The trap here is that candidates assume 'minimize API calls' means never calling Secrets Manager again, but the correct approach allows a single call per cold start with a fallback refresh on failure, not zero calls forever.

How to eliminate wrong answers

Option A is wrong because storing the password as an encrypted environment variable does not support automatic rotation—the value is static until the function is redeployed, violating the requirement that the password is rotated every 30 days. Option B is wrong because calling Secrets Manager on every invocation maximizes API calls, incurring unnecessary cost and latency, and contradicts the requirement to minimize API calls. Option D is wrong because switching to Systems Manager Parameter Store does not inherently reduce API calls; the same caching strategy would still be needed, and the question specifically asks about Secrets Manager, not an alternative service.

75
MCQhard

A company runs a containerized application on Amazon ECS with Fargate. The application writes logs to stdout. The operations team wants to send these logs to a centralized log management tool that requires logs in JSON format. What is the BEST way to achieve this without modifying application code?

A.Use the FireLens log driver to route logs to Fluent Bit and then to the tool
B.Use the awslogs log driver and configure a JSON output format
C.Install the CloudWatch Logs agent on the container
D.Modify the application to output logs in JSON format
AnswerA

The FireLens log driver is the appropriate solution for routing and transforming container logs on Amazon ECS, especially when running on AWS Fargate. It integrates seamlessly with Fluent Bit or Fluentd as a sidecar container, enabling powerful log processing capabilities like parsing unstructured logs into JSON, filtering, and routing them to various destinations beyond CloudWatch Logs. This approach centralizes log management without requiring modifications to the application code itself, aligning with best practices for containerized environments.

Why this answer

FireLens is an ECS log driver that integrates with Fluent Bit or Fluentd to route, filter, and transform container logs without modifying application code. By using FireLens with Fluent Bit, you can configure a JSON parser to convert stdout logs into JSON format before forwarding them to the centralized log management tool, meeting the requirement exactly.

Exam trap

The trap here is that candidates assume the awslogs log driver can format logs as JSON (it cannot) or that installing an agent on Fargate containers is possible (it is not), leading them to overlook FireLens as the only serverless-compatible, code-free option for log transformation and routing.

How to eliminate wrong answers

Option B is wrong because the awslogs log driver sends logs to Amazon CloudWatch Logs in plain text, not JSON, and it does not support configuring a JSON output format; it is designed for direct CloudWatch ingestion, not third-party tools. Option C is wrong because installing the CloudWatch Logs agent on a container is not supported in Fargate (which is serverless and does not allow host-level agents), and even if it were, it would not transform logs to JSON. Option D is wrong because it requires modifying application code, which the question explicitly prohibits.

Page 1 of 4 · 268 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Dev AWS Services questions.