Courseiva

CCNA Dev AWS Services Questions

75 of 388 questions · Page 4/6 · Dev AWS Services topic · Answers revealed

226
MCQmedium

A company is building a serverless application using AWS Lambda and Amazon DynamoDB. The Lambda function processes user uploads from Amazon S3 and stores metadata in DynamoDB. The function is experiencing high latency during peak hours. Which action would MOST improve the performance without increasing the function timeout?

A.Increase the DynamoDB table's provisioned read and write capacity.
B.Increase the Lambda reserved concurrency.
C.Move the Lambda function into a VPC with a DynamoDB VPC endpoint.
D.Enable DynamoDB Accelerator (DAX) for the table.
AnswerA

Increasing the DynamoDB table's provisioned read and write capacity directly addresses performance bottlenecks caused by insufficient throughput. When a Lambda function attempts to write or read data faster than the table's allocated capacity, DynamoDB throttles these requests, resulting in `ProvisionedThroughputExceededException` errors and increased latency. By raising the provisioned capacity units, the table can handle a higher volume of operations per second, preventing throttling and ensuring consistent, low-latency data access for the serverless application.

Why this answer

Increasing the DynamoDB table's provisioned read and write capacity directly addresses the root cause of high latency during peak hours: throttling due to insufficient throughput. When the Lambda function's write requests exceed the table's capacity, DynamoDB throttles them, causing retries and increased latency. Raising the capacity allows DynamoDB to handle the burst of metadata writes without throttling, reducing response times without requiring a longer function timeout.

Exam trap

The trap here is that candidates often confuse read optimization (DAX) with write optimization, or assume that increasing concurrency or improving network connectivity will fix a throughput bottleneck, when the actual issue is insufficient DynamoDB write capacity.

How to eliminate wrong answers

Option B is wrong because increasing Lambda reserved concurrency only ensures more concurrent function executions, but it does not resolve the bottleneck at the DynamoDB layer; if the table is throttling, more concurrent invocations will only increase the number of throttled requests and worsen latency. Option C is wrong because moving the Lambda function into a VPC with a DynamoDB VPC endpoint reduces network latency and avoids NAT gateway costs, but it does not address the throughput capacity of the DynamoDB table itself; the primary latency issue is throttling, not network path. Option D is wrong because DynamoDB Accelerator (DAX) is an in-memory cache for read-heavy workloads and does not improve write performance; the Lambda function is storing metadata (write operations), so DAX would not reduce write latency.

227
MCQeasy

A developer needs to store application configuration data, such as database connection strings and third-party API keys, securely. The data must be encrypted at rest and automatically rotated. Which AWS service should the developer use?

A.Amazon S3 with server-side encryption
B.AWS Key Management Service (KMS)
C.AWS Systems Manager Parameter Store
D.AWS Secrets Manager
AnswerD

AWS Secrets Manager is purpose-built for securely storing, retrieving, and rotating various types of secrets, including database credentials, API keys, and other sensitive configuration data, throughout their entire lifecycle. It offers robust features such as automatic rotation for many AWS services (e.g., RDS, Redshift, DocumentDB) and custom secrets, fine-grained access control, comprehensive auditing, and seamless integration with applications for dynamic credential retrieval, making it the optimal solution for managing application configuration data that requires secure handling and automated rotation.

Why this answer

AWS Secrets Manager is the correct choice because it is specifically designed to securely store, encrypt, and automatically rotate secrets such as database connection strings and API keys. It integrates with AWS KMS for encryption at rest and provides built-in rotation capabilities for supported services like Amazon RDS, Redshift, and DocumentDB, meeting the requirement for automatic rotation without custom code.

Exam trap

The trap here is that candidates often confuse AWS Systems Manager Parameter Store (which can store secrets with encryption but lacks automatic rotation) with AWS Secrets Manager, overlooking the explicit requirement for automatic rotation in the question.

How to eliminate wrong answers

Option A is wrong because Amazon S3 with server-side encryption only encrypts objects at rest but does not provide automatic rotation of secrets or native secret management features. Option B is wrong because AWS KMS is a key management service that creates and controls encryption keys, not a service for storing application configuration data or rotating secrets directly. Option C is wrong because AWS Systems Manager Parameter Store can store configuration data securely with encryption via KMS, but it does not offer built-in automatic rotation of secrets; rotation requires custom implementation using AWS Lambda or other automation.

228
MCQhard

An application uses DynamoDB Streams to trigger downstream processing. The processor must receive both old and new item images after updates. Which stream view type should be configured?

A.KEYS_ONLY
B.NEW_AND_OLD_IMAGES
C.NEW_IMAGE only
D.OLD_IMAGE only
AnswerB

The NEW_AND_OLD_IMAGES stream view type provides both the item's state immediately before and immediately after any modification. This comprehensive data is essential for downstream applications that need to perform detailed change detection, audit specific attribute transitions, or compute differences between the old and new versions of an item. It allows for robust processing logic that can react precisely to how an item's data has evolved.

Why this answer

B is correct because DynamoDB Streams must be configured with the NEW_AND_OLD_IMAGES stream view type to capture both the item's state before and after a write operation (update, insert, or delete). This ensures the downstream processor receives the complete old and new item data, which is required for use cases like auditing, change data capture, or reconciling state changes.

Exam trap

The trap here is that candidates often confuse the stream view types and assume NEW_IMAGE alone is sufficient for updates, forgetting that the requirement explicitly demands both old and new images for complete state comparison.

How to eliminate wrong answers

Option A is wrong because KEYS_ONLY captures only the key attributes of the modified item, not the full old or new images, so the processor would lack the complete item data needed for downstream logic. Option C is wrong because NEW_IMAGE only captures the item's state after the update, omitting the previous state, which fails the requirement to receive both old and new images. Option D is wrong because OLD_IMAGE only captures the item's state before the update, omitting the new state, which also fails the requirement for both images.

229
MCQeasy

A developer is using AWS CodeCommit as a source repository and AWS CodePipeline for CI/CD. The developer wants to automatically trigger a pipeline execution when changes are pushed to the main branch. Which action should the developer take?

A.Configure CodePipeline to poll the CodeCommit repository every minute.
B.Set up a webhook in CodeCommit to notify CodePipeline on push events.
C.Create an Amazon CloudWatch Events rule that detects changes to the CodeCommit repository and triggers the pipeline.
D.Use an SNS topic to send a notification to CodePipeline when a push occurs.
AnswerC

This is the correct and recommended approach for integrating CodeCommit with CodePipeline. An Amazon CloudWatch Events rule can be configured to monitor specific events within a CodeCommit repository, such as a ReferenceCreated or ReferenceUpdated event, which signifies a push to a branch. Upon detecting such an event, the rule can directly invoke AWS CodePipeline, initiating a new pipeline execution automatically and efficiently.

Why this answer

Amazon CloudWatch Events (now Amazon EventBridge) can detect CodeCommit repository state changes, such as push events to a specific branch, and automatically trigger a CodePipeline execution as a target. This is the recommended AWS-native approach for event-driven pipeline triggers without polling or manual webhook configuration.

Exam trap

The trap here is that candidates may confuse CodeCommit with GitHub or Bitbucket, assuming webhooks are available, but AWS CodeCommit relies on CloudWatch Events for event-driven triggers instead.

How to eliminate wrong answers

Option A is wrong because polling a CodeCommit repository every minute introduces unnecessary latency and cost, and AWS recommends event-driven triggers over polling for efficiency. Option B is wrong because CodeCommit does not support configuring webhooks directly; webhooks are typically used with third-party repositories like GitHub, not CodeCommit. Option D is wrong because an SNS topic cannot directly trigger a CodePipeline execution; SNS can send notifications but not invoke pipeline executions without a custom integration or Lambda function.

230
MCQmedium

A company has a REST API running on Amazon EC2 instances behind an Application Load Balancer. The API is accessed by mobile clients. The company wants to add authentication and authorization without modifying the backend code. Which AWS service should be used?

A.Amazon Cognito user pools integrated with the Application Load Balancer
B.AWS Identity and Access Management (IAM)
C.Amazon API Gateway with a Lambda authorizer
D.Amazon CloudFront with Lambda@Edge
AnswerA

Amazon Cognito User Pools can be seamlessly integrated with an Application Load Balancer (ALB) to offload user authentication for web and mobile applications. The ALB's authentication feature redirects unauthenticated requests to Cognito for sign-in, and upon successful authentication, Cognito returns a JSON Web Token (JWT). The ALB then validates this token and forwards the request to the backend EC2 instances, optionally injecting user claims as HTTP headers, which simplifies application development by centralizing user management and authentication.

Why this answer

Amazon Cognito user pools can be integrated directly with an Application Load Balancer (ALB) to handle authentication and authorization without modifying backend code. The ALB uses an OIDC-compatible identity provider (Cognito) to authenticate users before forwarding requests to the EC2 instances, allowing the backend to remain unchanged.

Exam trap

The trap here is that candidates often assume API Gateway with a Lambda authorizer is the only way to add auth without code changes, overlooking the ALB's native OIDC integration with Cognito for existing load-balanced architectures.

How to eliminate wrong answers

Option B is wrong because AWS IAM is designed for signing AWS API requests with access keys and is not suitable for authenticating mobile app users against a REST API without modifying the backend code. Option C is wrong because Amazon API Gateway with a Lambda authorizer would require replacing the existing ALB and EC2 setup, which is not a direct integration with the current architecture. Option D is wrong because Amazon CloudFront with Lambda@Edge can perform authentication but requires custom code and does not natively integrate with an ALB to offload authentication without backend changes.

231
MCQmedium

A company is building a RESTful API using Amazon API Gateway and AWS Lambda. The API must allow users to authenticate using an identity provider that supports OpenID Connect (OIDC). The developer wants to offload authentication and authorization to API Gateway. Which API Gateway feature should the developer use?

A.Amazon Cognito User Pools authorizer
B.Custom Lambda authorizer
C.Native JWT authorizer (HTTP API)
D.AWS IAM authorizer
AnswerC

The native JWT authorizer for API Gateway HTTP APIs provides built-in support for validating JSON Web Tokens (JWTs) issued by any OpenID Connect (OIDC) compliant identity provider. Developers configure the issuer URL and optional audience claims directly within API Gateway, offloading token validation, signature verification, and claim checks. This managed solution eliminates the need for custom code, ensuring efficient and secure authentication for RESTful APIs.

Why this answer

The Native JWT authorizer for HTTP APIs in API Gateway directly validates JSON Web Tokens (JWTs) from an OIDC-compliant identity provider without requiring custom code. This offloads both authentication and authorization to API Gateway by configuring the issuer URL and audience, matching the requirement to use an OIDC provider.

Exam trap

The trap here is that candidates often confuse the Native JWT authorizer (available only for HTTP APIs) with the Cognito User Pools authorizer (available for REST APIs), assuming any OIDC provider requires a Lambda authorizer or Cognito integration.

How to eliminate wrong answers

Option A is wrong because Amazon Cognito User Pools authorizer is a proprietary solution that requires users to authenticate through Cognito, not a generic OIDC identity provider; it does not support arbitrary OIDC providers. Option B is wrong because a Custom Lambda authorizer involves writing and managing custom code to validate tokens, which contradicts the requirement to offload authentication and authorization to API Gateway. Option D is wrong because AWS IAM authorizer uses AWS Signature Version 4 for request signing and is designed for AWS credentials, not OIDC tokens from a third-party identity provider.

232
MCQmedium

A company runs a web application on EC2 instances behind an Application Load Balancer. The application uses sessions stored in an ElastiCache Redis cluster. Recently, users have been experiencing session timeouts and errors. The developer notices that the Redis cluster is running out of memory. What should the developer do to resolve this issue?

A.Increase the session timeout in the application configuration.
B.Enable the 'allkeys-lru' eviction policy in the Redis parameter group.
C.Reduce the number of EC2 instances behind the load balancer.
D.Migrate from Redis to a Memcached cluster.
AnswerB

Enabling the 'allkeys-lru' eviction policy in the Redis parameter group is the correct approach for managing memory pressure. This policy instructs Redis to automatically remove the least recently used (LRU) keys from *all* keys in the dataset when the configured `maxmemory` limit is reached. This proactive memory management ensures that the cache can free up space for new data, preventing out-of-memory errors and maintaining application performance.

Why this answer

Enabling the 'allkeys-lru' eviction policy in the Redis parameter group allows Redis to automatically evict the least recently used keys when memory is full, preventing session timeouts and errors caused by out-of-memory conditions. This policy is specifically designed for use cases like session storage where losing old sessions is acceptable to free memory for new ones.

Exam trap

The trap here is that candidates may confuse eviction policies with TTL-based expiration, thinking that increasing session timeouts (Option A) or reducing application instances (Option C) will solve memory pressure, when in fact only a proper eviction policy directly addresses out-of-memory errors in Redis.

How to eliminate wrong answers

Option A is wrong because increasing the session timeout would keep sessions in memory longer, worsening the memory pressure and potentially causing more timeouts and errors. Option C is wrong because reducing the number of EC2 instances behind the load balancer does not affect the Redis cluster's memory usage; it only reduces application capacity and could increase load on remaining instances. Option D is wrong because Memcached does not support replication, persistence, or advanced eviction policies like LRU, and migrating would not resolve the memory issue—it would only change the caching engine without addressing the root cause of memory exhaustion.

233
MCQhard

A developer notices that an AWS Lambda function is timing out after 15 seconds. The function makes HTTP requests to an external API. How can the developer resolve this issue without changing the function code?

A.Increase the reserved concurrency
B.Increase the timeout setting of the Lambda function
C.Place the Lambda function in a VPC
D.Decrease the memory allocation of the Lambda function
AnswerB

When an AWS Lambda function is timing out, it means its execution duration has exceeded the configured timeout limit. Increasing this timeout setting directly addresses the issue by allowing the function more time to complete its processing before Lambda terminates it. The maximum configurable timeout for a Lambda function is 15 minutes (900 seconds), providing ample flexibility for longer-running tasks.

Why this answer

The Lambda function is timing out because its configured execution timeout (15 seconds) is too short for the HTTP requests to the external API to complete. Increasing the timeout setting (up to the maximum limit of 15 minutes) allows the function to run longer and wait for the API response, resolving the timeout without modifying the code. This is a configuration change in the Lambda function settings, not a code change.

Exam trap

The trap here is that candidates may confuse timeout with concurrency or memory, assuming that increasing resources or isolation will speed up execution, when in fact the issue is simply the allowed execution duration.

How to eliminate wrong answers

Option A is wrong because reserved concurrency controls the number of concurrent executions, not the duration of a single execution; it does not address timeout issues. Option C is wrong because placing the Lambda function in a VPC does not affect the timeout; it only provides network isolation and may actually increase latency due to NAT gateway requirements. Option D is wrong because decreasing memory allocation reduces CPU and network throughput, likely making the HTTP requests slower and worsening the timeout problem.

234
MCQmedium

A developer is using AWS AppSync to build a GraphQL API. The API needs to allow clients to receive real-time updates when data changes in a DynamoDB table. Which AppSync feature should the developer use?

A.Resolvers
B.Subscriptions
C.Queries
D.Mutations
AnswerB

AWS AppSync subscriptions are specifically designed to provide real-time, push-based data updates to clients. They leverage WebSockets to maintain a persistent connection, allowing the AppSync service to notify subscribed clients immediately when relevant data changes occur, typically triggered by a GraphQL mutation. This mechanism ensures that clients automatically receive new or modified data without needing to repeatedly poll the API.

Why this answer

Subscriptions in AWS AppSync are the feature designed for real-time updates. They use WebSocket connections to push data to clients automatically when a mutation modifies the underlying data source, such as a DynamoDB table. By configuring a subscription on a specific mutation, the developer enables clients to receive live changes without polling.

Exam trap

The trap here is that candidates often confuse mutations (which trigger the update) with subscriptions (which deliver the update), leading them to select 'Mutations' instead of 'Subscriptions'.

How to eliminate wrong answers

Option A is wrong because resolvers are functions that map GraphQL operations (queries, mutations, subscriptions) to data sources like DynamoDB; they do not themselves provide real-time push capabilities. Option C is wrong because queries are request-response operations that fetch data on demand, not real-time updates. Option D is wrong because mutations are write operations that modify data; while they can trigger subscriptions, they are not the mechanism for delivering real-time updates to clients.

235
MCQhard

A developer is designing a microservice that processes orders. The service must ensure that each order is processed exactly once. The developer uses an SQS queue to decouple the order submission from processing. Which SQS feature should be used to prevent duplicate processing?

A.Standard queue with visibility timeout
B.FIFO queue with content-based deduplication
C.FIFO queue with a dead-letter queue
D.Standard queue with message retention period
AnswerB

Amazon SQS FIFO queues are specifically designed to provide exactly-once processing and strict message ordering, crucial for critical operations like order processing. When content-based deduplication is enabled, SQS automatically uses a SHA-256 hash of the message body to identify and prevent duplicate messages from being delivered within a 5-minute deduplication interval. This combination ensures that each unique order request is processed precisely once.

Why this answer

A FIFO queue with content-based deduplication ensures that each unique order is processed exactly once. FIFO queues guarantee first-in-first-out delivery and exactly-once processing, while content-based deduplication uses the message body to generate a deduplication ID, preventing duplicate messages from being added to the queue within a 5-minute deduplication interval.

Exam trap

The trap here is that candidates often confuse visibility timeout with deduplication, assuming that hiding a message temporarily prevents duplicates, but visibility timeout only delays reprocessing and does not guarantee exactly-once delivery.

How to eliminate wrong answers

Option A is wrong because a standard queue with visibility timeout does not prevent duplicates; it only hides messages temporarily, and if a consumer fails to delete the message before the timeout expires, the message becomes visible again and can be processed again, leading to at-least-once delivery. Option C is wrong because a dead-letter queue is used to capture messages that fail processing after a specified number of retries, not to prevent duplicate processing; it handles poison pills, not deduplication. Option D is wrong because message retention period defines how long a message stays in the queue before being deleted, not how duplicates are prevented; it does not affect exactly-once processing.

236
MCQeasy

A developer wants to debug an AWS Lambda function by viewing real-time logs. Which AWS service should the developer use?

A.Amazon CloudWatch Logs
B.AWS X-Ray
C.Amazon S3
D.AWS CloudTrail
AnswerA

Amazon CloudWatch Logs is the primary and automatic destination for AWS Lambda function execution logs. When a Lambda function runs, any output from `console.log` (Node.js), `print()` (Python), or similar logging statements in the function code is automatically streamed to a dedicated log group in CloudWatch Logs. Developers can then view these logs in real-time, filter them, and search for specific events or errors, making it essential for debugging application logic and understanding function behavior.

Why this answer

Amazon CloudWatch Logs is the correct service because AWS Lambda automatically streams all execution logs, including real-time output from console.log() statements and any errors, to CloudWatch Logs. The developer can use the CloudWatch Logs console or the `aws logs tail` command to view these logs in near real-time, enabling effective debugging of function behavior as it executes.

Exam trap

The trap here is that candidates often confuse AWS X-Ray's tracing capabilities with real-time log viewing, but X-Ray provides request-level traces and service maps, not the raw log output needed for debugging code execution.

How to eliminate wrong answers

Option B is wrong because AWS X-Ray is a distributed tracing service for analyzing and debugging request flows across microservices, not for viewing real-time log output from a single Lambda function. Option C is wrong because Amazon S3 is an object storage service and does not provide any capability for streaming or viewing real-time logs; it can store log files after they are generated but not display them live. Option D is wrong because AWS CloudTrail records API activity and management events for auditing, not the runtime logs or real-time output of a Lambda function's execution.

237
MCQhard

A developer is using AWS Step Functions to orchestrate a workflow that includes a Lambda function for data transformation. The Lambda function occasionally times out after 15 seconds. The Step Function execution fails with a 'States.Timeout' error. The developer wants to retry the Lambda task up to 3 times with exponential backoff. Which configuration should the developer add to the state definition in the Amazon States Language (ASL)?

A."Retry": [ { "ErrorEquals": ["States.Timeout"], "IntervalSeconds": 1, "BackoffRate": 2, "MaxAttempts": 3 } ]
B."Retry": [ { "ErrorEquals": ["States.Timeout"], "IntervalSeconds": 2, "BackoffRate": 3, "MaxAttempts": 5 } ]
C."Retry": [ { "ErrorEquals": ["States.Timeout"], "IntervalSeconds": 1, "BackoffRate": 2, "MaxAttempts": 2 } ]
D."Retry": [ { "ErrorEquals": ["Lambda.ServiceException"], "IntervalSeconds": 1, "BackoffRate": 2, "MaxAttempts": 3 } ]
AnswerA

This configuration correctly specifies a retry mechanism for the `States.Timeout` error, which occurs when a state's execution exceeds its defined timeout. It initiates the first retry after 1 second, employing an exponential backoff strategy by doubling the interval (`BackoffRate: 2`) for subsequent attempts. The `MaxAttempts: 3` ensures that the state will be retried up to three times before ultimately failing, providing a robust handling for transient timeout conditions.

Why this answer

It defines a retry policy for the 'States.Timeout' error, which is the error that occurs when the Lambda function times out. The configuration sets a 1-second initial interval, doubles the interval on each retry (BackoffRate of 2), and allows up to 3 retries, matching the requirement exactly.

Exam trap

The trap here is that candidates may confuse the error name for a Lambda timeout ('States.Timeout') with service-specific errors like 'Lambda.ServiceException', or misconfigure the retry count or backoff rate to not match the exact requirement.

How to eliminate wrong answers

Option B is wrong because it sets MaxAttempts to 5, which exceeds the required 3 retries, and uses a BackoffRate of 3, which is not the standard exponential backoff pattern requested. Option C is wrong because it sets MaxAttempts to 2, which is fewer than the required 3 retries. Option D is wrong because it retries on 'Lambda.ServiceException', which is a different error type; the actual error from a Lambda timeout is 'States.Timeout', not 'Lambda.ServiceException'.

238
MCQmedium

A Lambda function must retrieve feature flags at runtime with low latency and controlled rollout. Which AWS service is most appropriate?

A.AWS CloudFormation Parameters
B.AWS IAM Access Analyzer
C.Amazon Inspector
D.AWS AppConfig
AnswerD

AWS AppConfig is specifically designed for creating, managing, and deploying application configurations, including feature flags, at runtime. It enables developers to quickly and safely deploy configuration changes to applications hosted on EC2 instances, containers, Lambda functions, or on-premises servers. AppConfig provides controlled deployments with validation, monitoring, and automatic rollback capabilities, ensuring that feature flag updates are delivered reliably without requiring code redeployment.

Why this answer

AWS AppConfig is the correct choice because it is purpose-built for managing application configuration at runtime, including feature flags, with support for controlled rollouts (e.g., percentage-based deployments, canary releases) and low-latency retrieval via the AppConfig agent or direct API calls. It integrates with AWS Lambda to fetch configuration values on-demand without requiring a full deployment, enabling dynamic feature toggling.

Exam trap

The trap here is that candidates may confuse AWS AppConfig with AWS Systems Manager Parameter Store or AWS Secrets Manager, but AppConfig is the only service that combines runtime configuration retrieval with controlled rollout and validation, which is explicitly required for feature flags.

How to eliminate wrong answers

Option A is wrong because AWS CloudFormation Parameters are used to pass values into CloudFormation templates at stack creation or update time, not for runtime retrieval of feature flags with low latency and controlled rollout. Option B is wrong because AWS IAM Access Analyzer is a security tool that analyzes resource policies to identify unintended access, not a service for managing feature flags or application configuration. Option C is wrong because Amazon Inspector is a vulnerability management service that scans workloads for software vulnerabilities and network exposure, not a runtime configuration or feature flag service.

239
Multi-Selectmedium

A developer is designing a system that requires processing of streaming data from IoT devices in real time. The processed data will be stored in an S3 bucket for analytics. Which AWS services should the developer use together to build this solution? (Choose TWO.)

Select 2 answers
A.Amazon Kinesis Data Firehose
B.Amazon Kinesis Data Streams
C.AWS Lambda
D.Amazon S3
E.Amazon SQS
AnswersA, B

Amazon Kinesis Data Firehose is a fully managed service designed for reliably loading streaming data into data lakes, data stores, and analytics services like Amazon S3, Amazon Redshift, or Splunk. It automatically scales to match data throughput, handles batching, compression, and encryption, and can perform basic data transformations with AWS Lambda before delivery. This service is ideal for preparing and delivering data for downstream analytics and processing without managing underlying infrastructure.

Why this answer

Amazon Kinesis Data Streams is a scalable real-time data streaming service that ingests and processes streaming data from IoT devices in real time. It allows developers to build custom applications that consume and analyze the data as it arrives. Amazon Kinesis Data Firehose is a fully managed service that reliably loads streaming data into Amazon S3 for analytics, handling buffering, compression, and partitioning.

Together, Data Streams provides real-time processing capabilities while Firehose automates delivery to S3, making them a complementary pair for this solution.

Exam trap

The trap here is that candidates often confuse Amazon Kinesis Data Streams with Amazon Kinesis Data Firehose, thinking both are interchangeable for direct S3 delivery, but Data Streams requires a separate consumer (e.g., Lambda) to write to S3, while Firehose is the managed delivery service that directly writes to S3.

240
Drag & Dropmedium

Drag and drop the steps to configure an S3 bucket for static website hosting in the correct order.

Drag or tap steps into the slots.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First create the bucket, then enable static website hosting, configure index and error documents, set appropriate permissions, and finally upload content.

241
Multi-Selectmedium

A developer is designing a serverless application that uses AWS Lambda and Amazon DynamoDB. The application needs to handle high traffic spikes without data loss. Which TWO actions should the developer take?

Select 2 answers
A.Enable DynamoDB Auto Scaling
B.Use Provisioned IOPS for DynamoDB
C.Enable DynamoDB Streams
D.Use Amazon SQS to buffer requests to Lambda
E.Increase the Lambda concurrency limit to the maximum
AnswersA, D

DynamoDB Auto Scaling automatically adjusts the provisioned read and write capacity units (RCUs and WCUs) for a table or its global secondary indexes. It uses AWS Application Auto Scaling to respond to actual traffic patterns, ensuring that the database can handle sudden spikes in demand without throttling, while also scaling down during periods of low activity to optimize costs. This dynamic adjustment is crucial for maintaining application performance in serverless architectures by preventing performance degradation.

Why this answer

Option A (Enable DynamoDB Auto Scaling) is correct because DynamoDB Auto Scaling automatically adjusts provisioned read/write capacity in response to traffic spikes, ensuring the table can absorb sudden load without throttling or data loss. Option D (Use Amazon SQS to buffer requests to Lambda) is correct because placing an SQS queue between the request source and Lambda decouples the components, buffers bursts of traffic, and provides durable at-least-once delivery so requests are not lost if Lambda throttles or fails. Option B is incorrect because Provisioned IOPS is an EBS storage feature, not a DynamoDB capacity mode, and does not address DynamoDB throughput scaling.

Option C is incorrect because DynamoDB Streams captures item-level changes for change data capture and triggers, but it does not itself handle traffic spikes or prevent data loss under load. Option E is incorrect because simply raising the Lambda concurrency limit to the maximum does not buffer requests or guarantee delivery; without a queue, excess invocations can still be throttled and dropped.

Exam trap

The trap here is that candidates often confuse DynamoDB Streams with a scaling mechanism, but it is purely a change-data-capture feature, not a solution for handling traffic spikes or preventing data loss.

242
MCQhard

A developer is working on a serverless application that uses Amazon DynamoDB as the database. The application reads and writes data to a DynamoDB table named 'Orders'. The table has a partition key 'OrderID' and a sort key 'OrderDate'. The application experiences high read latency during peak hours. The developer checks the CloudWatch metrics and notices high ReadThrottleEvents for the table. The table's read capacity is set to on-demand mode. The developer also notices that the application performs many queries that scan the entire table to find orders by customer ID, which is not a key attribute. What should the developer do to reduce read throttling?

A.Enable DynamoDB Accelerator (DAX) to cache the read results.
B.Switch the table to provisioned capacity mode and increase the read capacity units.
C.Create a Global Secondary Index (GSI) on the CustomerID attribute and query the index instead of scanning the table.
D.Keep the table in on-demand mode but increase the maximum read capacity limit.
AnswerC

Scanning the whole table consumes read capacity on every partition, driving ReadThrottleEvents even in on-demand mode. A Global Secondary Index keyed on CustomerID lets queries target only the relevant items, replacing full scans with efficient index lookups and cutting consumed read capacity.

Why this answer

The correct option is C: create a Global Secondary Index (GSI) on the CustomerID attribute and query the index instead of scanning the table. The application's high ReadThrottleEvents stem from full-table Scan operations to find orders by a non-key attribute, and a GSI with CustomerID as its partition key lets those lookups use efficient Query operations that read only the matching items, drastically reducing consumed read capacity. Because the table is in on-demand mode, throttling is caused by the sheer volume of scanned data rather than a fixed capacity ceiling, so the GSI directly addresses the root cause.

Option A (DAX) only caches reads and does not fix the inefficient Scan access pattern, and it cannot help with the underlying non-key lookup design. Option B is unnecessary because on-demand mode already scales automatically, and switching to provisioned capacity does not eliminate the wasteful Scans. Option D is invalid because on-demand tables have no user-configurable maximum read capacity limit to increase.

243
MCQhard

A developer uses the AWS SDK to list thousands of DynamoDB items from a query. Only the first page is processed. What should be implemented?

A.Pagination using LastEvaluatedKey until no further key is returned
B.A larger Lambda memory setting only
C.A global secondary index with the same key
D.Strongly consistent reads on every request
AnswerA

DynamoDB `Scan` and `Query` operations return results in 1MB chunks. To retrieve thousands of items, the developer must repeatedly call the API, passing the `LastEvaluatedKey` from the previous response as the `ExclusiveStartKey` in the subsequent request. This pagination continues until `LastEvaluatedKey` is no longer present in the response, indicating all items matching the criteria have been retrieved. This is the standard and most efficient way to handle large result sets.

Why this answer

The DynamoDB Query API returns paginated results, with a maximum of 1 MB of data per page. The `LastEvaluatedKey` in the response indicates that more items exist. To retrieve all items, the application must check for `LastEvaluatedKey` and, if present, issue a subsequent Query request with the `ExclusiveStartKey` parameter set to that value, repeating until `LastEvaluatedKey` is no longer returned.

This is the standard pagination pattern for DynamoDB.

Exam trap

The trap here is that candidates may assume DynamoDB returns all matching items in a single response, overlooking the 1 MB pagination limit and the necessity of handling `LastEvaluatedKey` in a loop.

How to eliminate wrong answers

Option B is wrong because increasing Lambda memory only increases CPU and network bandwidth, but does not change the DynamoDB API's 1 MB page size limit or the need to handle pagination; the query would still return only the first page. Option C is wrong because a global secondary index (GSI) with the same key would not solve the pagination issue; it would simply provide an alternative query path that also returns paginated results. Option D is wrong because strongly consistent reads ensure the most up-to-date data but do not affect the number of items returned per page or the pagination mechanism; they are unrelated to the pagination problem.

244
MCQeasy

An application running on Amazon EC2 instances behind an Application Load Balancer (ALB) intermittently returns 503 errors. The ALB health checks are failing for some instances intermittently. The developer checks the instance system logs and finds no application errors. What is the most likely cause of the health check failures?

A.The application on the instances is experiencing resource exhaustion (e.g., memory or CPU) which causes it to stop responding to health checks temporarily
B.The security group for the instances does not allow inbound traffic from the ALB on the health check port
C.The health check path is not configured correctly and the default path returns a 404 status
D.The target group is not configured with the correct protocol
AnswerA

When an application experiences intermittent resource exhaustion, such as high CPU utilization or memory pressure, it can temporarily become unresponsive to incoming requests, including health checks from an Application Load Balancer (ALB). During these transient spikes, the application might fail to respond within the health check timeout period, causing the ALB to mark the instance as unhealthy. Once resources are freed or the load subsides, the application recovers and starts responding to health checks again, leading to an intermittent pattern of healthy/unhealthy states.

Why this answer

Intermittent 503 errors from the ALB combined with intermittent health check failures and no application errors in the system logs strongly point to transient resource exhaustion (CPU or memory) on the EC2 instances. When an instance runs out of memory or CPU, the application process may become unresponsive or be killed by the OS (e.g., OOM killer), causing it to fail health checks temporarily. Once resources are freed (e.g., after a spike subsides), the application resumes responding, which explains the intermittent nature of the failures.

Exam trap

The trap here is that candidates often assume health check failures are always due to misconfiguration (security groups, paths, or protocols) and overlook transient resource exhaustion, which is a common cause of intermittent failures in production.

How to eliminate wrong answers

Option B is wrong because if the security group did not allow inbound traffic from the ALB on the health check port, health checks would fail consistently, not intermittently. Option C is wrong because a misconfigured health check path returning a 404 would cause persistent health check failures, not intermittent ones. Option D is wrong because an incorrect target group protocol (e.g., HTTP vs HTTPS) would cause all health checks to fail consistently, not intermittently.

245
Multi-Selectmedium

A company is designing a microservices architecture using AWS Lambda. Each microservice has its own DynamoDB table. The Lambda functions need to perform CRUD operations on their respective tables. Which TWO IAM best practices should be applied? (Choose TWO.)

Select 2 answers
A.Grant access to all DynamoDB tables using a wildcard in the resource ARN.
B.Use a single IAM role shared by all Lambda functions.
C.Attach the IAM policy to the AWS account instead of the role.
D.Scope the IAM policy resource to the specific DynamoDB table ARN.
E.Create a separate IAM role for each Lambda function.
AnswersD, E

Scoping the IAM policy resource to the specific DynamoDB table ARN (e.g., `arn:aws:dynamodb:region:account-id:table/TableName`) is a fundamental best practice for enforcing the principle of least privilege. This ensures that the Lambda function's execution role only has permissions to interact with the exact DynamoDB table it requires for its operations. This precise resource definition minimizes the potential blast radius of a security incident, as unauthorized access would be confined to only the explicitly allowed resource.

Why this answer

Scoping the IAM policy resource to the specific DynamoDB table ARN follows the principle of least privilege, ensuring each Lambda function can only access its own table. Option E is correct because creating a separate IAM role for each Lambda function isolates permissions, preventing a compromised function from affecting others. Together, these practices enforce granular access control in a microservices architecture.

Exam trap

The trap here is that candidates may think a single shared role simplifies management (Option B) or that wildcards are acceptable for convenience (Option A), overlooking the critical security requirement for least privilege in microservices.

246
MCQeasy

A developer is using the AWS SDK for Python (Boto3) to upload objects to an S3 bucket. The developer wants to encrypt the objects at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). Which parameter should the developer include in the put_object call?

A.SSEAlgorithm: 'AES256'
B.SSEKMSKeyId: 'alias/aws/s3'
C.ServerSideEncryption: 'aws:kms'
D.ServerSideEncryption: 'AES256'
AnswerC

This is the correct parameter and value combination to enable Server-Side Encryption with AWS Key Management Service (SSE-KMS) for objects uploaded to S3. When 'ServerSideEncryption' is set to 'aws:kms', S3 uses a customer master key (CMK) from AWS KMS to encrypt the object data before storing it. This method provides enhanced security and auditability by leveraging KMS for key management, offering more control over the encryption keys than SSE-S3.

Why this answer

To use server-side encryption with AWS KMS managed keys (SSE-KMS) when uploading an object to S3 via the put_object call, you must set the ServerSideEncryption parameter to 'aws:kms'. This tells S3 to encrypt the object using a KMS key. Option C is correct because it specifies the exact value required for SSE-KMS encryption.

Exam trap

The trap here is that candidates often confuse the parameter values for SSE-S3 ('AES256') and SSE-KMS ('aws:kms'), or mistakenly think SSEKMSKeyId alone enables KMS encryption without the required ServerSideEncryption parameter.

How to eliminate wrong answers

Option A is wrong because SSEAlgorithm is not a valid parameter in the put_object call; the correct parameter is ServerSideEncryption, and 'AES256' is used for SSE-S3, not SSE-KMS. Option B is wrong because SSEKMSKeyId is an optional parameter used to specify a specific KMS key ID or alias, but it is not the parameter that enables SSE-KMS; you must first set ServerSideEncryption to 'aws:kms'. Option D is wrong because ServerSideEncryption: 'AES256' is the value for SSE-S3, not SSE-KMS; SSE-KMS requires 'aws:kms'.

247
MCQeasy

A developer needs to store application configuration data that can be read by multiple EC2 instances. The data is less than 1 KB and changes frequently. Which AWS service is BEST suited for this?

A.Amazon S3
B.AWS Systems Manager Parameter Store
C.AWS AppConfig
D.Amazon DynamoDB
AnswerC

AWS AppConfig is purpose-built for managing application configurations, enabling developers to quickly and safely deploy configuration changes to applications. It supports controlled deployments, allowing changes to be rolled out gradually to a subset of targets, and includes built-in validation and automatic rollback capabilities to prevent outages. This makes it ideal for frequent updates to feature flags, throttling limits, or other dynamic application settings, ensuring application stability.

Why this answer

AWS AppConfig is the best choice because it is designed for dynamic, frequent configuration changes that need to be deployed to multiple EC2 instances without redeploying code or restarting applications. It supports hosted configuration data (up to 1 MB) and provides controlled rollouts, validation, and monitoring, making it ideal for sub-1 KB data that changes frequently.

Exam trap

The trap here is that candidates often confuse AWS Systems Manager Parameter Store (which is for static parameters) with AppConfig (which is for dynamic, frequently changing configurations with deployment controls), leading them to choose Parameter Store despite its throughput and validation limitations.

How to eliminate wrong answers

Option A is wrong because Amazon S3 is an object storage service, not optimized for frequently changing small configuration data; it lacks built-in validation, staged rollouts, and real-time deployment controls. Option B is wrong because AWS Systems Manager Parameter Store is designed for static or infrequently changing parameters (e.g., database passwords, AMI IDs) and has a throughput limit of 40 transactions per second per region by default, making it unsuitable for high-frequency updates. Option D is wrong because Amazon DynamoDB is a NoSQL database for high-scale transactional workloads, not a configuration management service; it requires additional code for validation, rollback, and deployment orchestration, adding unnecessary complexity.

248
Multi-Selectmedium

A developer is deploying an application on Amazon ECS using Fargate. The application needs to securely access an Amazon RDS database. The developer wants to avoid hardcoding database credentials in the application code. Which THREE actions should the developer take to meet these requirements? (Choose THREE.)

Select 3 answers
A.Hardcode the credentials in the application code and encrypt the code using AWS KMS.
B.Store the database credentials in AWS Systems Manager Parameter Store or AWS Secrets Manager.
C.Reference the secrets in the task definition as environment variables using the 'secrets' parameter.
D.Grant the ECS task execution role permission to read the secrets from Parameter Store or Secrets Manager.
E.Store the credentials in Amazon Elastic Container Registry (ECR) as a tag.
AnswersB, C, D

AWS Systems Manager Parameter Store and AWS Secrets Manager are purpose-built services for securely storing and managing configuration data and secrets, respectively. Parameter Store offers secure string types encrypted with KMS, suitable for non-rotating secrets, while Secrets Manager provides advanced features like automatic secret rotation, fine-grained access control, and integration with various AWS services and databases. Utilizing these services centralizes secret management, enhances security, and simplifies compliance.

Why this answer

AWS Systems Manager Parameter Store and AWS Secrets Manager are AWS-native services designed to securely store and manage sensitive information like database credentials. By storing credentials in these services, the developer avoids hardcoding them in the application code, adhering to security best practices. The application can then retrieve the credentials at runtime using IAM roles and permissions.

Exam trap

The trap here is that candidates might think storing credentials in ECR tags or encrypting code with KMS is sufficient, but AWS explicitly requires using Parameter Store or Secrets Manager for secrets management in ECS tasks to avoid exposure in the container image or codebase.

249
MCQhard

A company uses Amazon DynamoDB as a session store for a web application. The application recently experienced a spike in traffic, causing increased read latency. The DynamoDB table has a read capacity of 5000 RCUs and uses eventual consistent reads. The application performs many GetItem calls. What should a developer do to improve read performance with minimal cost?

A.Enable DynamoDB Accelerator (DAX) for the table
B.Increase the read capacity to 10000 RCUs
C.Configure DynamoDB global tables for the application
D.Enable DynamoDB Streams and process updates asynchronously
AnswerA

DynamoDB Accelerator (DAX) is a fully managed, highly available, in-memory cache specifically designed to reduce read latency for DynamoDB tables. By caching frequently accessed session data, DAX can serve requests with microsecond response times, significantly improving the performance of read-heavy applications like web session stores. This offloads read traffic from the underlying DynamoDB table, optimizing both latency and cost efficiency by minimizing direct DynamoDB calls.

Why this answer

DynamoDB Accelerator (DAX) is an in-memory cache that reduces read latency for GetItem calls from single-digit milliseconds to microseconds. Since the application uses eventual consistent reads and performs many GetItem operations, DAX offloads reads from the table, improving performance without increasing provisioned RCUs. This is the most cost-effective solution because it avoids scaling the table's read capacity and only charges for the cache nodes used.

Exam trap

The trap here is that candidates often assume increasing provisioned capacity (Option B) is the only way to handle read spikes, overlooking the cost and performance benefits of a caching layer like DAX for read-heavy workloads.

How to eliminate wrong answers

Option B is wrong because increasing read capacity to 10000 RCUs would double the provisioned throughput cost without addressing the root cause of latency, and it does not leverage caching to reduce response times. Option C is wrong because DynamoDB global tables replicate data across regions for disaster recovery and low-latency writes, not to improve read performance within a single region; they add complexity and cost without reducing read latency for GetItem calls. Option D is wrong because DynamoDB Streams capture item-level changes for asynchronous processing (e.g., triggers or replication), but they do not cache data or accelerate read operations; they are irrelevant to improving GetItem latency.

250
MCQeasy

A developer is building a CI/CD pipeline using AWS CodePipeline. The source stage is an Amazon S3 bucket. The developer wants to automatically start the pipeline when a new file is uploaded to the S3 bucket. What should the developer do?

A.Configure the S3 bucket to send events to an SQS queue, and poll the queue from CodePipeline.
B.Create an Amazon CloudWatch Events rule that triggers on S3 object creation events and targets the pipeline.
C.Set up a periodic Lambda function that checks the S3 bucket for new files and starts the pipeline.
D.Configure the S3 bucket to send events to an SNS topic, and subscribe CodePipeline to the topic.
AnswerB

This is the correct and recommended approach. Amazon S3 can publish object creation events directly to Amazon EventBridge (formerly CloudWatch Events). An EventBridge rule can then be configured to filter these specific S3 events and directly invoke an AWS CodePipeline as its target. This establishes an efficient, event-driven mechanism to automatically start the CI/CD pipeline whenever new source artifacts are uploaded to the designated S3 bucket.

Why this answer

Amazon CloudWatch Events (now Amazon EventBridge) can directly target an AWS CodePipeline pipeline as a rule target. By creating a rule that matches S3 object creation events (e.g., `s3:ObjectCreated:*`), the pipeline is automatically triggered without any intermediate polling, custom code, or additional services. This is the native, serverless integration recommended by AWS.

Exam trap

The trap here is that candidates often confuse SNS or SQS as valid CodePipeline triggers, but AWS CodePipeline only supports CloudWatch Events/EventBridge, webhooks (for GitHub), and manual or scheduled triggers—not direct SNS subscriptions or SQS polling.

How to eliminate wrong answers

Option A is wrong because CodePipeline does not poll SQS queues; it relies on event-driven triggers via CloudWatch Events or webhooks, not queue-based polling. Option C is wrong because using a periodic Lambda function to check for new files introduces unnecessary latency, cost, and complexity; it is an anti-pattern when a native event-driven trigger exists. Option D is wrong because CodePipeline cannot be directly subscribed to an SNS topic; SNS can send notifications but cannot invoke a pipeline—only CloudWatch Events/EventBridge can target CodePipeline directly.

251
MCQmedium

A developer is building a serverless application using AWS Step Functions to orchestrate multiple AWS Lambda functions. One of the Lambda functions occasionally fails due to a transient error. The developer wants the Step Functions execution to automatically retry the failed task up to three times with exponential backoff. Which configuration should the developer set in the Step Functions state machine definition?

A.Add a Retry clause in the Lambda function's configuration with a maximum retry count of 3.
B.Use the Amazon States Language (ASL) Retry field in the Task state definition.
C.Wrap the Lambda function invocation in a custom while loop within the function code.
D.Use the Amazon States Language Catch field in the Task state to redirect to a retry logic.
AnswerB

The Amazon States Language (ASL) Retry field is the definitive and recommended mechanism within AWS Step Functions for handling transient failures in Task states. This declarative approach allows developers to specify which error types to retry, the maximum number of attempts, the initial delay, and an exponential backoff rate. Implementing retries directly in the state machine definition ensures robust error handling without modifying the underlying Lambda function code.

Why this answer

The Amazon States Language (ASL) provides a native Retry field within a Task state definition that allows you to specify retry policies, including a maximum retry count and exponential backoff. This is the intended mechanism for handling transient failures in Step Functions without requiring custom code or external retry logic.

Exam trap

The trap here is that candidates confuse the Retry field (for retries) with the Catch field (for error handling) or mistakenly think retry logic belongs in the Lambda function code rather than in the state machine definition.

How to eliminate wrong answers

Option A is wrong because the Retry clause in a Lambda function's configuration (e.g., in the function's reserved concurrency or event source mapping) does not control Step Functions retries; Step Functions retries are defined in the state machine definition, not in the Lambda function itself. Option C is wrong because wrapping the Lambda invocation in a custom while loop within the function code would not integrate with Step Functions' retry mechanism and would violate the serverless orchestration pattern, as Step Functions manages retries at the state machine level. Option D is wrong because the Catch field is used to handle errors by redirecting to a different state (e.g., a fallback or error-handling state), not to implement retry logic; retries are handled exclusively by the Retry field.

252
Multi-Selecthard

A developer is building a serverless application that uses Amazon Cognito user pools for authentication and an Amazon API Gateway REST API with a Lambda authorizer. The developer needs to ensure that the Lambda authorizer can validate tokens and return an IAM policy that allows access to specific API methods. The developer also wants to cache the authorizer result to reduce latency and cost. Which TWO actions must the developer take to meet these requirements? (Choose two.)

Select 2 answers
A.Use an AWS Lambda function that returns a boolean value indicating whether the token is valid.
B.Configure the Lambda authorizer with a token source header, such as Authorization, and set the authorizer type to TOKEN.
C.Configure the API Gateway method to use AWS_IAM authorization instead of the Lambda authorizer.
D.Attach an IAM execution role to the Lambda authorizer that grants apigateway:Invoke permissions.
E.Enable authorization caching on the API Gateway authorizer and specify a time-to-live (TTL) in seconds.
AnswersB, E

A TOKEN authorizer expects a single identity source header, typically Authorization. Configuring the token source correctly allows API Gateway to extract the token and pass it to the Lambda authorizer. Without specifying a valid token source, the authorizer cannot retrieve the token, and requests will fail authorization.

Why this answer

To use a Lambda authorizer with a token source, the authorizer must be configured with the correct token source header and type TOKEN. Enabling authorization caching with a TTL reduces repeated Lambda invocations and latency. These two configurations together satisfy the validation and caching requirements.

The authorizer must return a valid IAM policy, not a boolean, and does not require apigateway:Invoke permissions.

Exam trap

The trap here is confusing the authorizer's response requirements, assuming a boolean or an execution role with API Gateway permissions is needed, when a full IAM policy and caching configuration are what matter.

253
MCQhard

A company runs a containerized application on Amazon ECS using Fargate launch type. The application needs to read and write files to a shared file system across multiple tasks. The development team wants a solution that provides high throughput and is POSIX-compliant. Which storage solution should the team use?

A.Amazon S3 with mountpoint-s3
B.Amazon EFS
C.Amazon EBS with multi-attach enabled
D.Amazon FSx for Windows File Server
AnswerB

Amazon EFS provides a fully managed, scalable, and highly available network file system (NFS) that offers full POSIX compliance. This enables multiple Amazon ECS tasks, even those running on different EC2 instances or Fargate across various Availability Zones, to concurrently read and write to the same shared file system. EFS is an ideal solution for containerized applications requiring persistent, consistent, and shared file storage that behaves like a traditional file system.

Why this answer

Amazon EFS is the correct choice because it provides a fully managed, POSIX-compliant shared file system that can be mounted concurrently by multiple Amazon ECS tasks using the Fargate launch type. EFS uses the NFSv4.1 protocol, supports high throughput (up to 10 GB/s with Bursting or Provisioned Throughput modes), and automatically scales storage capacity as files are added or removed, making it ideal for shared read/write workloads across containers.

Exam trap

The trap here is that candidates often confuse Amazon EBS Multi-Attach with a shared file system, but EBS Multi-Attach is limited to EC2 instances in the same AZ and does not support Fargate, while EFS is the only POSIX-compliant, fully managed file system that works natively with Fargate tasks across multiple Availability Zones.

How to eliminate wrong answers

Option A is wrong because Amazon S3 with mountpoint-s3 is an object storage service that uses a custom FUSE-based mount, which is not POSIX-compliant (e.g., it does not support file locking, hard links, or atomic renames) and is designed for high-latency, throughput-oriented workloads rather than low-latency shared file system access. Option C is wrong because Amazon EBS with multi-attach enabled supports only up to 16 Nitro-based EC2 instances, not Fargate tasks, and requires the volume to be attached to instances in the same Availability Zone, making it unsuitable for a serverless container environment. Option D is wrong because Amazon FSx for Windows File Server uses the SMB protocol and is not POSIX-compliant; it is designed for Windows-based workloads and does not natively support Linux containers without additional translation layers.

254
Multi-Selectmedium

A company is using Amazon API Gateway to expose a REST API. The API is integrated with an AWS Lambda function. The developer wants to implement caching to improve performance. Which THREE steps are necessary to enable caching for a specific stage? (Choose THREE.)

Select 3 answers
A.Attach an IAM policy to the API Gateway role for cache access.
B.Modify the Lambda function to store responses in ElastiCache.
C.Enable API caching in the stage settings.
D.Set a cache time-to-live (TTL) value.
E.Specify a cache cluster size (e.g., 0.5 GB).
AnswersC, D, E

Enabling API caching in the stage settings is the fundamental first step to activate API Gateway's managed caching feature for a specific deployment stage. This action provisions a dedicated cache cluster for that stage, allowing API Gateway to store and retrieve responses for subsequent identical requests without invoking the backend integration. Without explicitly enabling caching at the stage level, no other caching configurations will have any effect.

Why this answer

API Gateway provides built-in caching at the stage level, which can be enabled directly in the stage settings without modifying the Lambda function or adding external services. This caching reduces the number of calls made to the backend Lambda function by serving cached responses for identical requests, improving performance and reducing latency.

Exam trap

The trap here is that candidates may think caching requires modifying the Lambda function (Option B) or adding IAM policies (Option A), when in fact API Gateway's stage-level caching is a simple toggle with configurable cluster size and TTL, and no backend changes are needed.

255
MCQhard

A company is running a containerized application on Amazon ECS with Fargate launch type. The application needs to access an Amazon S3 bucket. The company wants to follow the principle of least privilege. How should the developer provide the necessary permissions?

A.Use Amazon EFS to store access keys.
B.Assign an IAM instance profile to the Fargate tasks.
C.Create an IAM task role with S3 permissions and associate it with the ECS task definition.
D.Store AWS credentials in the container image.
AnswerC

Creating an IAM task role with S3 permissions and associating it with the ECS task definition is the recommended and most secure approach. This method grants temporary, specific permissions directly to the containers within an ECS task, allowing them to interact with AWS services like S3 without embedding static credentials. It adheres to the principle of least privilege, ensuring the application only has the necessary permissions and that credentials are automatically managed and rotated by AWS.

Why this answer

Amazon ECS with Fargate launch type uses IAM task roles to grant permissions to containers at the task level. The task role is an IAM role that the ECS task assumes, allowing the application to securely access S3 without hardcoding credentials. This follows the principle of least privilege by scoping permissions to the specific task and using temporary credentials via the AWS STS service.

Exam trap

The trap here is that candidates confuse instance profiles (used with EC2 launch type) with task roles (used with Fargate), leading them to select Option B, but Fargate tasks cannot assume an instance profile because there is no underlying EC2 instance.

How to eliminate wrong answers

Option A is wrong because Amazon EFS is a file storage service, not a credential store; it cannot be used to store or provide access keys for IAM permissions. Option B is wrong because Fargate tasks do not use instance profiles; instance profiles are used with EC2 launch type to grant permissions to the underlying EC2 instance, not to the containers. Option D is wrong because storing AWS credentials in the container image violates security best practices, as credentials would be exposed in the image layers and cannot be rotated or scoped to least privilege.

256
Multi-Selectmedium

A developer is using AWS Lambda to process files uploaded to an S3 bucket. The Lambda function is triggered by S3 events. The developer notices that the function sometimes processes the same file multiple times. Which TWO steps should the developer take to make the processing idempotent? (Choose TWO.)

Select 2 answers
A.Check if the file has already been processed by storing a marker in DynamoDB.
B.Use conditional writes in DynamoDB to ensure that updates are idempotent.
C.Reduce the S3 event batch size in the Lambda trigger.
D.Increase the Lambda function's timeout.
E.Enable S3 versioning on the bucket.
AnswersA, B

This strategy involves using a unique identifier for each file, such as its S3 object key or ETag, as a primary key in a DynamoDB table. Before processing a file, the Lambda function attempts to write this identifier to DynamoDB. If the write succeeds (e.g., using a conditional write `attribute_not_exists`), the file is processed; otherwise, if the item already exists, it indicates prior processing, and the function can safely exit, ensuring idempotent execution.

Why this answer

Storing a marker in DynamoDB (e.g., a record with the S3 object key as the partition key) allows the Lambda function to check if a file has already been processed before performing the work. This ensures that even if the same S3 event is delivered multiple times (due to retries or duplicate notifications), the function will skip reprocessing, making the operation idempotent.

Exam trap

The trap here is that candidates often confuse reducing batch size or increasing timeout with solving duplicate processing, when in fact idempotency requires a stateful check (like DynamoDB) to track what has already been processed.

257
Drag & Dropmedium

Drag and drop the steps to encrypt an EBS volume using AWS KMS in the correct order.

Drag or tap steps into the slots.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First create a KMS key, then snapshot the unencrypted volume, copy with encryption, and create the encrypted volume.

258
MCQmedium

A developer is deploying a web application using AWS Elastic Beanstalk. The application uses an Amazon RDS MySQL database. The developer wants to ensure that database credentials are not stored in the application code or environment variables. The solution must automatically rotate credentials every 90 days. The developer has created a secret in AWS Secrets Manager containing the database credentials. The Elastic Beanstalk environment is configured with an IAM instance profile that has permission to read the secret. However, when the application is deployed, it fails to connect to the database. The developer checks the application logs and sees a 'Host not found' error. The RDS instance is in a private subnet, and the Elastic Beanstalk environment is in the same VPC. What is the MOST likely cause of the connection failure?

A.The secret is not correctly referenced in the Elastic Beanstalk environment properties.
B.The application code is not retrieving the secret from Secrets Manager at startup.
C.The IAM instance profile does not have the necessary permissions to access the secret.
D.The secret is stored in a different region than the Elastic Beanstalk environment.
AnswerB

For an application running on Elastic Beanstalk to utilize a secret stored in AWS Secrets Manager, its code must contain specific logic to programmatically fetch that secret. This involves using an AWS SDK to instantiate a Secrets Manager client and then calling the GetSecretValue API operation, passing the secret's ARN or name. If this retrieval step is missing or improperly implemented, the application will attempt to connect to the database with undefined or placeholder credentials, inevitably leading to authentication failures.

Why this answer

The correct option is B: the application code is not retrieving the secret from Secrets Manager at startup. Since the credentials are no longer in code or environment variables, the app must call the Secrets Manager API (e.g., GetSecretValue) at runtime to obtain the DB host, username, and password; if it never does so, it has no host to resolve, producing the 'Host not found' error. Option A is wrong because environment properties are explicitly not used for credentials here, and the failure is a missing hostname, not a misreferenced property.

Option C is wrong because the instance profile already has read permission to the secret, so an access-denied error would occur instead. Option D is wrong because a cross-region secret would cause an access/not-found error for the secret, not a 'Host not found' database connection error.

259
Multi-Selectmedium

A company uses AWS CodePipeline to deploy a web application to an EC2 instance. The deployment often fails because the application is still running when new files are copied. Which THREE actions can be combined to achieve zero-downtime deployments?

Select 3 answers
A.Use AWS CodeDeploy with an in-place deployment configuration.
B.Configure the EC2 instances behind an Auto Scaling group and use a rolling update.
C.Define an AppSpec file that includes 'BeforeInstall' and 'AfterInstall' hooks to stop and start the application.
D.Use AWS CodeBuild to build and deploy the application.
E.Use Amazon Inspector to check the application before deployment.
AnswersA, B, C

AWS CodeDeploy is purpose-built for orchestrating application deployments to various compute services, including EC2 instances. An in-place deployment configuration updates the application directly on existing instances, leveraging lifecycle hooks to manage the application's state during the update. This ensures the new version is installed correctly and the application's availability is maintained, making it a direct solution for deploying a web application.

Why this answer

AWS CodeDeploy with an in-place deployment configuration can be combined with lifecycle hooks (such as BeforeInstall and AfterInstall) to stop the application before new files are copied and start it afterward, enabling zero-downtime deployments when properly orchestrated with a load balancer to drain traffic. Option B is correct because configuring EC2 instances behind an Auto Scaling group with a rolling update allows new instances to be launched with the updated application while old instances are terminated, ensuring continuous service availability. Option C is correct because defining an AppSpec file with BeforeInstall and AfterInstall hooks provides the mechanism to gracefully stop and start the application, preventing file conflicts and downtime.

Exam trap

The trap here is that candidates often confuse CodeBuild (a build service) with a deployment tool, or assume Amazon Inspector (a security scanner) can manage deployment workflows, when in fact only CodeDeploy and Auto Scaling groups provide the necessary lifecycle hooks and traffic management for zero-downtime updates.

260
MCQhard

A developer is building a REST API using Amazon API Gateway and AWS Lambda. The API receives a large number of requests with duplicate payloads from the same client within a short time window. To reduce Lambda invocations and improve performance, the developer wants to return the previously computed response for identical requests based on a unique client ID in the header. How can the developer achieve this using API Gateway features?

A.Enable API Gateway caching on the stage and configure the client ID header as a cache key parameter. Set a cache TTL of 5 minutes.
B.Configure a usage plan with a quota and throttle settings to limit requests per client ID.
C.Use request validation to reject requests that have the same client ID within 5 minutes.
D.Reduce the Lambda function's batch size to 1 and implement caching logic inside the function using an external cache like ElastiCache.
AnswerA

API Gateway caching uses cache key parameters to index responses. By including the client ID header in the cache key, different clients get separate cached responses. The TTL controls how long the response is cached.

Why this answer

API Gateway caching allows you to store responses for a configurable TTL and use the client ID header as a cache key parameter. This means that when a request with the same client ID arrives within the TTL window, API Gateway returns the cached response directly without invoking the Lambda function, reducing invocations and improving performance.

Exam trap

The trap here is that candidates may confuse API Gateway caching (which returns cached responses for identical cache keys) with usage plans or throttling (which only limit request rates) or with Lambda-level caching (which still incurs invocation costs).

How to eliminate wrong answers

Option B is wrong because usage plans with quota and throttle settings limit the rate or total number of requests, but they do not return previously computed responses for duplicate payloads; they simply reject or delay requests. Option C is wrong because request validation in API Gateway only checks the structure and presence of required headers or body fields, not the content or duplication of payloads; it cannot reject requests based on a client ID being repeated. Option D is wrong because reducing the Lambda batch size to 1 is irrelevant (Lambda functions process one event at a time by default) and implementing caching inside the function with ElastiCache would still invoke Lambda for every request, missing the goal of reducing invocations; API Gateway caching avoids Lambda invocation entirely for cached responses.

261
MCQhard

A developer is deploying a microservices application using Amazon ECS with Fargate. The application consists of multiple services that need to communicate with each other over HTTP. The developer wants to ensure that service-to-service communication is encrypted in transit and that the services can discover each other by logical service names instead of IP addresses. Which combination of AWS services should the developer use?

A.Elastic Load Balancing with AWS Systems Manager
B.Amazon Route 53 with AWS Direct Connect
C.AWS Lambda with Amazon API Gateway
D.AWS App Mesh with AWS Cloud Map
AnswerD

AWS App Mesh is a service mesh that provides application-level networking to make it easy to run microservices, offering capabilities like mutual TLS (mTLS) for secure communication, traffic routing, and observability. AWS Cloud Map is a cloud resource discovery service that allows developers to register and discover application resources, such as microservices, using custom names. Together, App Mesh leverages Cloud Map for dynamic service discovery, enabling secure, observable, and resilient inter-service communication within a microservices architecture, directly addressing the requirements for mTLS and service discovery.

Why this answer

AWS App Mesh provides a service mesh that handles service-to-service communication with encryption in transit using TLS, while AWS Cloud Map enables service discovery by logical names, allowing ECS services to resolve each other via DNS or API calls. Together, they meet the requirements for encrypted HTTP communication and logical name resolution without exposing IP addresses.

Exam trap

The trap here is that candidates often confuse service discovery with load balancing or serverless APIs, overlooking that App Mesh provides both encrypted service mesh and Cloud Map for logical name resolution, which is the exact combination needed for secure, discoverable inter-service communication.

How to eliminate wrong answers

Option A is wrong because Elastic Load Balancing handles traffic distribution but does not provide service discovery by logical names or built-in encryption for service-to-service communication, and AWS Systems Manager is for operational management, not service mesh. Option B is wrong because Amazon Route 53 can provide DNS-based service discovery, but AWS Direct Connect is a dedicated network connection to on-premises, not relevant for service-to-service encryption or discovery within ECS. Option C is wrong because AWS Lambda and Amazon API Gateway are for serverless API backends, not for managing inter-service communication and discovery in a microservices architecture on ECS.

262
MCQhard

A developer is designing a serverless application that uses Amazon API Gateway and AWS Lambda. The application needs to handle a sudden spike in traffic. The Lambda function performs CPU-intensive operations. What should the developer do to ensure the application scales without errors?

A.Set the API Gateway throttling limits to a high value.
B.Use an Amazon SQS queue to buffer requests before processing.
C.Configure the Lambda function with reserved concurrency and provisioned concurrency.
D.Increase the Lambda function timeout to the maximum value.
AnswerC

Configuring a Lambda function with reserved concurrency guarantees a specific number of concurrent executions are always available for that function, preventing other functions from consuming its capacity and ensuring it can scale. Provisioned concurrency goes further by pre-initializing a specified number of execution environments, ensuring that invocations within this limit experience significantly reduced latency by eliminating cold starts. Together, these settings provide dedicated capacity and optimize startup performance.

Why this answer

Reserved concurrency guarantees that the Lambda function has a dedicated pool of concurrency available to handle traffic spikes without being throttled by other functions in the account, while provisioned concurrency pre-warms execution environments to eliminate cold starts for CPU-intensive operations. This combination ensures that the application scales smoothly under sudden load without encountering Lambda throttling errors (HTTP 429) or latency spikes from cold starts.

Exam trap

The trap here is that candidates often confuse API Gateway throttling (which controls request rate at the API level) with Lambda concurrency management, leading them to pick Option A, when the real bottleneck is Lambda's concurrency limits and cold starts for CPU-intensive functions.

How to eliminate wrong answers

Option A is wrong because setting API Gateway throttling limits to a high value only controls the request rate at the API layer, not the Lambda concurrency; if Lambda concurrency limits are exceeded, requests will still be throttled with 429 errors regardless of API Gateway settings. Option B is wrong because using an SQS queue to buffer requests introduces asynchronous processing, which is unsuitable for a synchronous API Gateway integration that expects immediate responses; the queue would decouple the request-response cycle and cause timeouts or lost responses. Option D is wrong because increasing the Lambda function timeout to the maximum value (900 seconds) does not address concurrency limits or cold starts; it only allows the function to run longer, which does not prevent throttling errors when traffic spikes exceed the available concurrency.

263
MCQeasy

A developer is building a microservice that needs to invoke another AWS Lambda function and wait for the result to continue processing. Which Lambda invocation type must the developer use to achieve synchronous invocation?

A.RequestResponse
B.Event
C.DryRun
D.None of the above
AnswerA

When a microservice needs to invoke another AWS Lambda function synchronously, the RequestResponse invocation type is used. This causes the invoking client to pause its execution and wait for the target Lambda function to fully execute and return its response payload. The client receives the function's output, including any errors, directly, enabling real-time processing and decision-making based on the invoked function's result.

Why this answer

The RequestResponse invocation type is the correct choice for synchronous invocation of a Lambda function, where the caller waits for the function to execute and receive a response. This is the default invocation type when using the Invoke API with InvocationType set to 'RequestResponse', and it is required for microservices that need to block until the downstream Lambda returns a result.

Exam trap

The trap here is that candidates may confuse the Event invocation type (asynchronous) with synchronous behavior, or mistakenly think DryRun is a valid Lambda invocation type, leading them to select 'None of the above' when they don't recognize RequestResponse as the correct term.

How to eliminate wrong answers

Option B is wrong because the Event invocation type is asynchronous; it queues the invocation and returns immediately with an HTTP status code of 202, without waiting for the function to execute or return a result. Option C is wrong because DryRun is not a valid Lambda invocation type; it is a parameter used with other AWS services (e.g., EC2) to test permissions without executing the action. Option D is wrong because 'None of the above' is incorrect since RequestResponse is a valid and correct invocation type for synchronous invocation.

264
MCQmedium

A developer is using Amazon API Gateway to expose a Lambda function as a REST API. The Lambda function queries an Amazon RDS database. Under heavy load, the database connection pool is exhausted, causing errors. What is the BEST way to manage database connections in this serverless architecture?

A.Migrate the database to Amazon DynamoDB.
B.Increase the concurrency limit of the Lambda function.
C.Use Amazon RDS Proxy to pool and share database connections.
D.Use Amazon ElastiCache to cache database connections.
AnswerC

Amazon RDS Proxy is specifically designed to manage and pool database connections for Amazon RDS. It acts as an intermediary, maintaining a pool of established connections to the RDS database and reusing them across multiple Lambda function invocations. This significantly reduces the overhead of opening and closing connections, preventing connection exhaustion and improving application scalability and responsiveness.

Why this answer

Amazon RDS Proxy sits between Lambda and RDS, managing a pool of database connections that can be reused across multiple concurrent Lambda invocations. This prevents connection exhaustion under heavy load without requiring code changes, as the proxy handles connection multiplexing and keeps idle connections warm.

Exam trap

The trap here is that candidates confuse connection pooling with caching (ElastiCache) or assume scaling Lambda concurrency will solve the issue, when in fact it exacerbates the connection exhaustion problem.

How to eliminate wrong answers

Option A is wrong because migrating to DynamoDB changes the database paradigm entirely, which is not a connection management solution and may not be feasible for existing relational workloads. Option B is wrong because increasing Lambda concurrency would actually worsen the problem by allowing more concurrent invocations to compete for the same limited pool of database connections. Option D is wrong because ElastiCache caches data, not database connections; it cannot pool or share TCP connections to RDS.

265
MCQhard

An application stores session data in DynamoDB and must expire sessions automatically after a timestamp. Which feature should be used?

A.DynamoDB global tables
B.DynamoDB transactions
C.DynamoDB export to S3
D.DynamoDB Time to Live
AnswerD

DynamoDB Time to Live (TTL) is the correct solution as it enables automatic, cost-effective deletion of items from a table after a specified timestamp. By designating a numeric attribute (e.g., `expirationTime`) as the TTL attribute, DynamoDB asynchronously removes items once their timestamp value is in the past. This directly fulfills the requirement for expiring session data, reducing storage costs and simplifying application logic by offloading cleanup tasks.

Why this answer

DynamoDB Time to Live (TTL) allows you to define a timestamp attribute per item, and DynamoDB automatically deletes items once that timestamp is reached. This is the ideal feature for expiring session data without requiring custom scan-and-delete logic, reducing cost and operational overhead.

Exam trap

The trap here is that candidates may confuse DynamoDB TTL with DynamoDB Streams or Lambda triggers for cleanup, but TTL is the native, serverless mechanism that requires no custom code for expiration.

How to eliminate wrong answers

Option A is wrong because DynamoDB global tables replicate data across regions for low-latency access and disaster recovery, not for automatic expiration of items. Option B is wrong because DynamoDB transactions provide ACID guarantees for multi-item operations, not scheduled deletion based on time. Option C is wrong because DynamoDB export to S3 is used for point-in-time backups or data lake integration, not for expiring items within the table.

266
MCQhard

A developer is using AWS CodeBuild to build a Java application. The build fails with 'OutOfMemoryError: Java heap space'. How can the developer fix this without changing the source code?

A.Add -Xmx1024m to the buildspec commands
B.Change the build image to a smaller one
C.Set the memory parameter in the build project
D.Increase the compute type of the build project
AnswerD

Increasing the compute type of the CodeBuild project is the correct solution for a Java application encountering a heap space error. CodeBuild compute types, such as BUILD_GENERAL1_MEDIUM or BUILD_GENERAL1_LARGE, provide progressively more CPU and, crucially, more memory to the build environment. By selecting a higher compute type, the underlying container running the build will have access to a larger pool of RAM, directly addressing the "out of heap space" issue by allowing the Java Virtual Machine to allocate more memory for the build process.

Why this answer

AWS CodeBuild allows you to increase the compute type (e.g., from BUILD_GENERAL1_SMALL to BUILD_GENERAL1_MEDIUM or LARGE), which provides more memory and CPU resources. This directly addresses the 'OutOfMemoryError: Java heap space' by giving the JVM more physical memory to work with, without requiring any source code changes.

Exam trap

The trap here is that candidates confuse the JVM's -Xmx flag (a code-level fix) with the infrastructure-level memory allocation controlled by the CodeBuild compute type, and incorrectly assume a 'memory parameter' exists as a separate setting in CodeBuild.

How to eliminate wrong answers

Option A is wrong because adding -Xmx1024m to the buildspec commands modifies the build process (a command-line change), which violates the constraint of not changing the source code; also, it only adjusts the JVM heap limit, not the underlying compute resources. Option B is wrong because changing the build image to a smaller one would reduce available memory, worsening the out-of-memory error. Option C is wrong because CodeBuild does not have a configurable 'memory parameter' in the build project settings; memory is tied directly to the compute type selection.

267
MCQhard

A company has a Lambda function that writes to an S3 bucket. The IAM role used by the function has an inline policy allowing s3:PutObject on the bucket. However, writes fail with an access denied error. What is the MOST likely cause?

A.The S3 bucket is in a different region.
B.The S3 bucket uses SSE-KMS encryption and the function lacks kms:Decrypt permissions.
C.The Lambda function does not have the correct execution role.
D.The S3 bucket has a bucket policy that denies the request.
AnswerD

This is the correct explanation because AWS IAM policy evaluation logic dictates that an explicit Deny in any applicable policy always overrides an Allow. Even if the Lambda function's execution role has an Allow statement for s3:PutObject, an explicit Deny statement within the S3 bucket policy will take precedence, resulting in an "Access Denied" error for the request. This mechanism allows resource owners to enforce strict access controls.

Why this answer

Even if the Lambda function's IAM role grants s3:PutObject, an explicit deny in the S3 bucket policy takes precedence over any allow. The access denied error indicates that the request is being evaluated and denied by the bucket policy, which overrides the IAM permission due to AWS's policy evaluation logic (explicit deny > allow).

Exam trap

The trap here is that candidates often assume IAM permissions alone are sufficient and overlook that S3 bucket policies can explicitly deny access, which overrides any IAM allow due to AWS's explicit deny precedence.

How to eliminate wrong answers

Option A is wrong because S3 operations work across regions; a bucket in a different region does not cause an access denied error—it would instead result in a redirect or a different error. Option B is wrong because if SSE-KMS were used, the function would need kms:GenerateDataKey or kms:Encrypt, not kms:Decrypt, and the error would typically be a 403 Forbidden with a KMS-specific message, not a generic access denied. Option C is wrong because the question states the IAM role has an inline policy allowing s3:PutObject, so the execution role is correctly assigned; the error is not due to a missing role but due to a conflicting bucket policy.

268
Multi-Selectmedium

A developer is designing a system that ingests high-volume data from IoT devices. The data must be processed in near real-time and then stored in Amazon S3 for analytics. Which TWO AWS services should the developer use together to meet these requirements? (Choose TWO.)

Select 2 answers
A.Amazon SQS
B.Amazon SNS
C.Amazon Kinesis Data Streams
D.Amazon EC2
E.AWS Lambda
AnswersC, E

Amazon Kinesis Data Streams is a fully managed, scalable service specifically designed for ingesting and processing large streams of data records in real time. It provides durable storage for up to 7 days, allowing multiple consumers to process the same data concurrently and independently. This makes it ideal for applications requiring real-time analytics, log aggregation, and continuous data ingestion from various sources at high throughput.

Why this answer

Amazon Kinesis Data Streams is designed for real-time ingestion of large data streams, such as IoT telemetry, and can capture and store data in shards for up to 365 days. AWS Lambda can be configured as a consumer of the Kinesis stream to process records in near real-time and then write the results to Amazon S3 for analytics. Together, they provide a serverless, scalable pipeline for high-volume IoT data.

Exam trap

The trap here is that candidates often confuse Amazon SQS or SNS as suitable for real-time streaming, but they lack the ordered, replayable, and parallel-consumer capabilities that Kinesis Data Streams provides for high-volume IoT ingestion.

269
Multi-Selecthard

A developer is designing a serverless application that processes streaming data from IoT devices. The application must be able to handle data from millions of devices and store the data in a durable, scalable data store. Which AWS services should the developer use? (Choose THREE.)

Select 3 answers
A.Amazon Kinesis Data Streams
B.Amazon RDS
C.Amazon DynamoDB
D.AWS Lambda
E.Amazon SQS
AnswersA, C, D

Amazon Kinesis Data Streams is purpose-built for ingesting and processing large streams of data records in real time. It can continuously capture gigabytes of data per second from hundreds of thousands of sources, making it ideal for high-velocity IoT data ingestion. Its ability to order records within a shard and provide replayability is crucial for reliable real-time analytics and further processing by downstream services.

Why this answer

Amazon Kinesis Data Streams is designed for real-time streaming of large volumes of data, such as from millions of IoT devices. It can ingest and store data durably for up to 365 days, making it ideal for the ingestion layer of this serverless application.

Exam trap

The trap here is that candidates often confuse Amazon SQS as a streaming ingestion service, but SQS is a message queue for decoupling, not a streaming data store with replay capabilities like Kinesis Data Streams.

270
MCQeasy

A developer is building a serverless application using AWS Lambda. The function needs to access a private S3 bucket in the same AWS account. What is the BEST way to grant the Lambda function access to the bucket?

A.Create an IAM execution role with an S3 access policy and attach it to the Lambda function.
B.Store AWS credentials in environment variables and use them in the function code.
C.Attach an inline IAM policy directly to the Lambda function.
D.Add a bucket policy to the S3 bucket allowing the Lambda function's ARN.
AnswerA

Creating an IAM execution role with an S3 access policy and attaching it to the Lambda function is the standard and most secure method. This role provides the Lambda function with temporary, scoped credentials to interact with other AWS services like S3, adhering to the principle of least privilege. It ensures that the function only has the necessary permissions without exposing sensitive, long-lived credentials.

Why this answer

The correct answer. The best practice for granting an AWS Lambda function access to an S3 bucket in the same account is to create an IAM execution role with a policy that allows the necessary S3 actions, and then attach that role to the Lambda function. This provides temporary credentials via STS, follows the principle of least privilege, and avoids hardcoding credentials.

Option B is incorrect because storing AWS credentials in environment variables is insecure and can lead to accidental exposure. AWS recommends using IAM roles for temporary credentials.

Option C is incorrect because Lambda functions do not support attaching IAM policies directly. Policies must be attached to an IAM role, and that role is assigned to the function.

Option D is incorrect because while a bucket policy could grant access based on the function's ARN, it is not the best approach for same-account access. Using an execution role is more scalable, easier to manage, and follows the principle of least privilege.

271
MCQmedium

A company runs a production application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application receives high traffic and needs to process incoming HTTP requests, store the request payload in an S3 bucket for auditing, and return a response. The development team uses AWS Lambda to process the payload. The team wants to ensure that the solution is scalable, fault-tolerant, and decoupled. The current approach is to have the EC2 instances send requests directly to the Lambda function via the AWS SDK. However, the team notices that during traffic spikes, some requests are lost and the Lambda function throttles. What should the team do to improve the architecture?

A.Increase the Lambda function's reserved concurrency to the maximum allowed.
B.Place API Gateway in front of Lambda and have EC2 send requests to API Gateway.
C.Use Amazon Kinesis Data Streams instead of Lambda to process the payload.
D.Have the EC2 instances send messages to an Amazon SQS queue, and configure the SQS queue as an event source for the Lambda function.
AnswerD

This solution effectively decouples the EC2 instances (producers) from the Lambda function (consumer) using Amazon SQS as an intermediary buffer. EC2 instances can asynchronously send messages to the SQS queue without waiting for Lambda's immediate response, ensuring messages are not lost even if Lambda is temporarily unavailable or experiencing high load. Lambda can then poll the SQS queue at its own pace, processing messages in batches and automatically scaling its concurrency based on the queue's backlog, which significantly reduces the likelihood of throttling and improves overall system resilience and fault tolerance.

Why this answer

Using Amazon SQS decouples the EC2 instances from the Lambda function, providing a buffer that absorbs traffic spikes and prevents request loss. The SQS queue acts as an event source for Lambda, allowing the function to process messages at its own pace, reducing throttling. Option A is incorrect because increasing reserved concurrency may reduce throttling but does not buffer requests; if the function is still overwhelmed, requests can be dropped.

Option B is incorrect because API Gateway still invokes Lambda synchronously, and throttling can still occur. Option C is incorrect because Kinesis Data Streams is designed for real-time streaming and analytics, not for simple request queuing, and introduces unnecessary complexity.

272
MCQmedium

A developer is implementing an e-commerce application where a purchase operation must deduct inventory and create an order atomically. The inventory and orders are stored in separate DynamoDB tables. Which DynamoDB feature should the developer use to execute these operations as a single, all-or-nothing transaction?

A.DynamoDB Streams
B.DynamoDB Transactions
C.DynamoDB Accelerator (DAX)
D.DynamoDB Global Tables
AnswerB

DynamoDB Transactions, specifically using `TransactWriteItems` or `TransactGetItems`, provide full ACID (Atomicity, Consistency, Isolation, Durability) guarantees for operations involving multiple items within a single table or across multiple tables. For an e-commerce purchase, this ensures that critical related operations, such as deducting inventory from one item and simultaneously creating a new order record, are treated as a single, indivisible unit. If any part of the transaction fails, all changes are rolled back, preventing data inconsistencies.

Why this answer

DynamoDB Transactions provide ACID (Atomicity, Consistency, Isolation, Durability) guarantees across one or more tables within a single AWS account and region. This allows the developer to combine the deduct-inventory and create-order operations into a single all-or-nothing transaction, ensuring that both succeed or both fail without partial updates.

Exam trap

The trap here is that candidates often confuse DynamoDB Streams with transactional capabilities, assuming that capturing changes in order guarantees atomicity, but Streams are asynchronous and cannot enforce all-or-nothing semantics across multiple tables.

How to eliminate wrong answers

Option A is wrong because DynamoDB Streams capture a time-ordered sequence of item-level changes in a table, but they do not provide atomicity or transactional coordination across multiple tables. Option C is wrong because DynamoDB Accelerator (DAX) is an in-memory caching layer that improves read performance but does not offer transactional write capabilities. Option D is wrong because DynamoDB Global Tables provide multi-region replication for disaster recovery and low-latency reads, but they do not enable atomic multi-table transactions within a single region.

273
Multi-Selectmedium

Which TWO AWS services can be used to build a serverless event-driven application that processes data from Amazon S3 and stores results in Amazon DynamoDB? (Choose 2.)

Select 2 answers
A.AWS Lambda
B.Amazon Kinesis Data Streams
C.Amazon EC2
D.AWS Step Functions
E.Amazon EMR
AnswersA, D

AWS Lambda is a core serverless compute service that executes code in response to events, such as objects being uploaded to an Amazon S3 bucket. It automatically scales and manages the underlying infrastructure, making it ideal for event-driven architectures where functions are invoked only when needed. This allows developers to build highly scalable and cost-effective solutions without provisioning or managing servers, directly addressing the requirements for a serverless event-driven architecture.

Why this answer

AWS Lambda is correct because it can be triggered directly by S3 events (e.g., ObjectCreated) to process data as soon as it arrives, and it can write the processed results to DynamoDB via the AWS SDK. This creates a fully serverless, event-driven pipeline without provisioning any servers.

Exam trap

The trap here is that candidates often confuse Amazon Kinesis Data Streams as a direct S3 event target, but Kinesis cannot be triggered directly by S3 events and requires an intermediary like Lambda, making it an incorrect choice for a simple serverless event-driven application.

274
MCQmedium

A developer is building a web application that uses Amazon DynamoDB as the database. The application needs to store user session data and must support eventual consistency reads for most use cases, but strongly consistent reads for critical operations. The developer wants to minimize costs. Which read capacity unit (RCU) configuration should the developer use?

A.Use on-demand capacity mode to pay per request, avoiding provisioned capacity costs.
B.Use provisioned capacity with 1 RCU per item, since eventually consistent reads consume half the RCUs.
C.Use provisioned capacity with sufficient RCUs to handle strongly consistent reads, as they consume the same as eventually consistent.
D.Use provisioned capacity with enough RCUs for peak traffic, and use DynamoDB Accelerator (DAX) for caching.
AnswerA

On-demand capacity mode is optimal for web applications with unpredictable or spiky traffic patterns because it automatically scales capacity up or down based on actual request volume. This pay-per-request model eliminates the need for capacity planning and avoids the costs associated with over-provisioning RCUs and WCUs that sit idle during low traffic periods. Consequently, it often results in significant cost savings for variable workloads, as you only pay for the reads and writes your application actually performs.

Why this answer

On-demand capacity mode charges per request (read/write), eliminating the need to provision fixed RCUs. For a session store with mixed consistency requirements, on-demand is cost-effective when traffic is unpredictable or low, as you only pay for actual reads and writes. Eventually consistent reads consume half the RCUs of strongly consistent reads, but on-demand pricing automatically accounts for this difference without manual configuration.

Exam trap

The trap here is that candidates assume provisioned capacity is always cheaper, but for variable workloads like session stores, on-demand can minimize costs by eliminating unused capacity, especially when mixed consistency models are needed.

How to eliminate wrong answers

Option B is wrong because 1 RCU per item is not a fixed rule; RCU consumption depends on item size (1 RCU = one strongly consistent read of up to 4 KB per second) and eventually consistent reads consume 0.5 RCUs, not a fixed 1 RCU per item. Option C is wrong because strongly consistent reads and eventually consistent reads do not consume the same RCUs; eventually consistent reads use half the RCUs (0.5 RCU per 4 KB item) compared to strongly consistent reads (1 RCU per 4 KB item). Option D is wrong because provisioning for peak traffic with DAX adds cost and complexity; DAX is a caching layer that reduces read load but incurs additional charges, contradicting the goal to minimize costs.

275
MCQmedium

A service needs loosely coupled asynchronous communication where one producer sends events to many different AWS service targets using rules. Which service fits best?

A.Amazon EFS
B.AWS CloudHSM
C.Amazon EventBridge
D.AWS DataSync
AnswerC

Amazon EventBridge is a serverless event bus service that enables building event-driven architectures by routing events from various sources to targets. It inherently supports loosely coupled asynchronous communication by allowing event producers to publish events without direct knowledge of their consumers, and consumers to subscribe to events without knowing the producers. This abstraction ensures that services can evolve independently, enhancing resilience and scalability as events are processed asynchronously.

Why this answer

Amazon EventBridge is a serverless event bus service that enables loosely coupled asynchronous communication. It allows a single producer to publish events, and then uses rules to route those events to multiple AWS service targets (e.g., Lambda, SQS, Step Functions) simultaneously, fulfilling the requirement exactly.

Exam trap

The trap here is that candidates may confuse Amazon EventBridge with Amazon SNS (Simple Notification Service), but the question explicitly mentions 'rules' to filter events, which is a core EventBridge feature, whereas SNS uses topic subscriptions without rule-based filtering.

How to eliminate wrong answers

Option A is wrong because Amazon EFS is a file storage service for EC2 instances, not an event-driven communication service; it cannot route events or support producer-to-multiple-target patterns. Option B is wrong because AWS CloudHSM provides hardware security modules for cryptographic key storage, not event routing or asynchronous messaging. Option D is wrong because AWS DataSync is a data transfer service for moving large datasets between on-premises and AWS storage, not for event-driven, loosely coupled communication with rules.

276
MCQhard

A developer is building a real-time chat application using WebSockets via API Gateway. The backend uses AWS Lambda functions to handle connect, disconnect, and message events. The application needs to broadcast messages to all connected clients. What is the most scalable and cost-effective way to maintain the list of connection IDs and broadcast messages?

A.Use an SQS FIFO queue to store connection IDs and have a Lambda function poll the queue to broadcast.
B.Store connection IDs in a DynamoDB table. Use a Lambda function to query all connection IDs and send messages using the API Gateway Management API.
C.Maintain an in-memory list of connection IDs in a global variable of a single Lambda function.
D.Use Amazon ElastiCache Redis to store connection IDs and use Redis Pub/Sub for broadcasting.
AnswerB

Storing connection IDs in a DynamoDB table is the robust and scalable solution for managing WebSocket connections with API Gateway. DynamoDB provides a highly available, low-latency, and persistent store for these IDs. When a message needs to be broadcast, a Lambda function can efficiently query the DynamoDB table to retrieve all active connection IDs. It then uses the API Gateway Management API's `PostToConnection` action to send the message to each client, ensuring reliable and scalable real-time communication.

Why this answer

DynamoDB is the canonical serverless store for WebSocket connection IDs in API Gateway WebSocket APIs. Each Lambda handler writes or deletes the connection ID on connect/disconnect, and to broadcast, a Lambda scans or queries the table and calls the API Gateway Management API's PostToConnection for each ID. This scales horizontally and is pay-per-use.

Exam trap

DVA-C02 often tests the misconception that Lambda global variables or in-memory state persist across invocations — candidates pick C, not realizing each concurrent execution gets its own isolated container.

How to eliminate wrong answers

Option A is wrong because SQS FIFO is a queue, not a connection registry — it cannot store the current set of active connections, and polling introduces latency and duplicate-delivery complexity unsuitable for real-time broadcast. Option C is wrong because Lambda execution environments are ephemeral and not shared across concurrent invocations; a global variable only persists within a single warm container and cannot represent all connected clients. Option D is wrong because ElastiCache Redis requires a VPC-attached cluster, adds fixed hourly cost, and is overkill for a simple connection registry — it is not the most cost-effective serverless choice, and Redis Pub/Sub does not integrate natively with API Gateway Management API.

277
MCQeasy

Refer to the exhibit. A developer created this CloudFormation template for an S3 bucket. What is the expected behavior?

A.Noncurrent versions of objects are deleted 30 days after they become noncurrent.
B.The bucket will have versioning disabled because the rule conflicts.
C.Current versions are transitioned to another storage class after 30 days.
D.Objects are automatically deleted after 30 days.
AnswerA

This statement is correct because an S3 Lifecycle Rule with NoncurrentVersionExpiration configured for 30 days will automatically delete noncurrent object versions. Once a new version of an object is uploaded, the previous version becomes noncurrent, and this rule ensures it is permanently removed from the bucket after 30 days from that point. This helps manage storage costs by cleaning up obsolete data while maintaining version history for a defined period.

Why this answer

The CloudFormation template defines an S3 Lifecycle rule with `NoncurrentVersionExpiration` set to 30 `NoncurrentDays`. This rule specifically targets noncurrent versions of objects, meaning that after an object version becomes noncurrent (e.g., due to a PUT or DELETE of the current version), that noncurrent version will be permanently deleted 30 days later. The `Status: Enabled` ensures the rule is active, and versioning is enabled via the `VersioningConfiguration` property.

Exam trap

The trap here is that candidates confuse `NoncurrentVersionExpirationInDays` with `ExpirationInDays` or `Transition`, leading them to think the rule deletes current versions or transitions objects, when in fact it only applies to noncurrent versions in a versioned bucket.

How to eliminate wrong answers

Option B is wrong because the template includes `VersioningConfiguration: Status: Enabled`, which explicitly enables versioning, and the lifecycle rule does not conflict with versioning—it complements it by managing noncurrent versions. Option C is wrong because the template uses `NoncurrentVersionExpirationInDays`, not `Transition` or `CurrentVersionExpirationInDays`, so it does not transition current versions to another storage class; it only expires noncurrent versions. Option D is wrong because the rule does not delete current versions or all objects after 30 days; it only deletes noncurrent versions after they become noncurrent, and the expiration count starts from when the version becomes noncurrent, not from object creation.

278
MCQeasy

A developer is building a serverless application using AWS Lambda that processes files uploaded to an S3 bucket. The function needs to read the file content and store metadata in DynamoDB. Which AWS service should be used to trigger the Lambda function when a new object is created in S3?

A.Amazon CloudWatch Events
B.Amazon SQS
C.Amazon SNS
D.Amazon S3 Event Notifications
AnswerD

Amazon S3 Event Notifications provide a native, direct, and highly efficient mechanism for triggering AWS Lambda functions in response to specific object-level events, such as object creation, deletion, or restoration. When configured, S3 directly invokes the specified Lambda function asynchronously, passing event details like the bucket name, object key, and event time. This direct integration eliminates the need for intermediary services, making it the most straightforward and performant solution for reacting to S3 object changes.

Why this answer

Amazon S3 Event Notifications (Option D) are the native mechanism for S3 to publish events (e.g., s3:ObjectCreated:*) directly to AWS Lambda, SQS, or SNS when an object is created. This is the simplest and most direct way to trigger a Lambda function for file processing without needing additional services.

Exam trap

The trap here is that candidates may overcomplicate the solution by choosing SQS or SNS, thinking they need a decoupling layer, but the question asks for the service that directly triggers the Lambda when an object is created — which is S3 Event Notifications, not a message broker.

How to eliminate wrong answers

Option A is wrong because Amazon CloudWatch Events (now Amazon EventBridge) is used for scheduling or reacting to AWS service events via a rule, but it is not the direct trigger for S3 object creation; you would need S3 to send events to EventBridge, which adds unnecessary complexity. Option B is wrong because Amazon SQS is a message queue that can receive S3 notifications, but it cannot directly invoke a Lambda function; you would need an additional SQS trigger on the Lambda, making it an indirect and less efficient solution. Option C is wrong because Amazon SNS is a pub/sub messaging service that can receive S3 notifications and fan out to subscribers, but it cannot directly invoke Lambda; you would need to subscribe Lambda to the SNS topic, which is an extra hop and not the native integration.

279
MCQeasy

An S3 bucket has versioning enabled with MFA Delete. A developer tries to permanently delete a specific version of an object using the AWS CLI without providing MFA. What is the result?

A.A delete marker is created for the object version.
B.The object version is permanently deleted.
C.The request is denied with an AccessDenied error.
D.The object version is marked with a delete marker.
AnswerC

Since MFA Delete is configured for the S3 bucket, any operation that results in the permanent deletion of an object version, such as deleting a specific version ID, necessitates the inclusion of a valid MFA token in the request. If the DELETE request targeting a specific version ID lacks this required MFA authentication, Amazon S3 will strictly enforce the MFA Delete policy. Consequently, the request will be rejected, and an AccessDenied error will be returned to the caller.

Why this answer

When MFA Delete is enabled on an S3 bucket, any request to permanently delete an object version must include multi-factor authentication. Without MFA, the AWS CLI request is denied with an AccessDenied error, as S3 enforces this security requirement at the API level. The developer cannot bypass this by omitting the MFA token.

Exam trap

The trap here is that candidates often confuse MFA Delete with standard versioning behavior, assuming a delete marker is created as a fallback, but MFA Delete strictly denies any permanent deletion request without the required authentication.

How to eliminate wrong answers

Option A is wrong because a delete marker is created only when deleting the latest version of an object without specifying a version ID, not when attempting to permanently delete a specific version with MFA Delete enabled. Option B is wrong because permanent deletion of a specific version requires MFA authentication when MFA Delete is enabled; without it, the operation fails. Option D is wrong because marking an object version with a delete marker is not a valid S3 operation; delete markers are only applied to the current version of an object, not to specific versions.

280
MCQeasy

A developer wants to store session state for a web application running on multiple EC2 instances. Which AWS service provides a fully managed, in-memory data store that is ideal for this use case?

A.Amazon ElastiCache for Redis
B.Amazon S3
C.Amazon DynamoDB
D.Amazon RDS for MySQL
AnswerA

Amazon ElastiCache for Redis is an excellent choice for storing web application session state due to its in-memory, high-performance nature. It provides extremely low-latency read and write operations, essential for a responsive user experience. As a fully managed service, it simplifies deployment and scaling, offering robust support for various data structures that efficiently manage session attributes and expiration.

Why this answer

Amazon ElastiCache for Redis is the correct choice because it provides a fully managed, in-memory data store that is ideal for storing session state across multiple EC2 instances. Redis supports atomic operations, TTL-based key expiration, and high-speed reads/writes, making it perfect for session management where low-latency access and automatic data eviction are critical. Unlike disk-based stores, ElastiCache for Redis keeps session data in memory, ensuring sub-millisecond response times and seamless scaling as the web application grows.

Exam trap

The trap here is that candidates often choose DynamoDB because it is fully managed and supports TTL, but they overlook the fact that the question specifically asks for an 'in-memory data store,' which DynamoDB is not—it uses SSD storage and has higher latency than an in-memory cache like Redis.

How to eliminate wrong answers

Option B is wrong because Amazon S3 is an object storage service designed for durable, long-term storage of static assets (e.g., images, backups), not for low-latency, in-memory session state; its read/write latency and lack of native TTL or atomic operations make it unsuitable for session management. Option C is wrong because Amazon DynamoDB is a fully managed NoSQL database that can store session data, but it is not an in-memory data store—it uses SSD-backed storage and has higher latency than an in-memory cache, and while it supports TTL, it is not optimized for the sub-millisecond access patterns required for session state in a high-traffic web app. Option D is wrong because Amazon RDS for MySQL is a relational database that stores data on disk, introducing significant latency for session reads/writes and requiring schema management; it is not designed for ephemeral, high-throughput session state and would create unnecessary overhead and performance bottlenecks.

281
Multi-Selecthard

A company is running a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses Amazon ElastiCache for session state. Recently, users are experiencing intermittent session timeouts and slow page loads. The developer suspects the issue is related to the ElastiCache cluster. Which THREE actions should the developer take to troubleshoot and resolve the issue? (Choose THREE.)

Select 3 answers
A.Monitor the ElastiCache cluster's CPU utilization and cache hit ratio in CloudWatch.
B.Enable Encryption in transit for the ElastiCache cluster.
C.Scale the ElastiCache cluster by adding more nodes or using a larger node type.
D.Review the application's cache key design and ensure that data is evenly distributed across shards.
E.Enable Multi-AZ replication for the ElastiCache cluster.
AnswersA, C, D

Monitoring ElastiCache CPU utilization in CloudWatch helps identify if the cluster is under-provisioned or experiencing heavy processing load, indicating a need for scaling. Concurrently, tracking the cache hit ratio is vital; a low hit ratio suggests that the application is frequently missing cached data, leading to increased latency as requests fall back to the origin database. These metrics collectively provide actionable insights into cache efficiency and potential performance bottlenecks.

Why this answer

Option A is correct because CloudWatch metrics such as CPUUtilization and CacheHits/CacheMisses (cache hit ratio) directly reveal whether the ElastiCache cluster is saturated or failing to serve cached session data, which would cause the intermittent timeouts and slow loads. Option C is correct because if monitoring shows sustained high CPU or memory pressure, vertically scaling to a larger node type or horizontally adding nodes/shards increases capacity and restores consistent session-state performance. Option D is correct because uneven key distribution or poor cache key design can create hot shards/keys, leading to throttling and latency spikes even when overall cluster capacity looks adequate, so reviewing key design and shard balance addresses the root cause.

Option B does not belong because enabling encryption in transit is a security hardening measure and does not resolve performance or session-timeout issues. Option E does not belong because Multi-AZ replication improves availability/failover, not the intermittent latency and timeout symptoms described.

Exam trap

The trap here is that candidates often confuse high-availability features like Multi-AZ replication or encryption with performance fixes, when in fact they address durability and security, not throughput or latency.

282
MCQhard

A company is using AWS Lambda to process messages from an Amazon SQS queue. The Lambda function is configured with a reserved concurrency of 10. The SQS queue receives a burst of 1000 messages. The Lambda function processes each message in about 5 seconds. What is the most likely behavior of the system?

A.Lambda rejects the messages and sends them to the dead-letter queue.
B.Lambda automatically scales up to 1000 concurrent executions to process all messages quickly.
C.Lambda increases the reserved concurrency to accommodate the burst.
D.Lambda processes up to 10 messages concurrently, and the rest remain in the queue until processing capacity is available.
AnswerD

When a Lambda function has a reserved concurrency of 10, it means that at any given moment, a maximum of 10 instances of that function can be executing simultaneously. If there's a sudden influx of messages from the SQS queue, Lambda will invoke up to 10 functions to process them. Any additional messages beyond what these 10 concurrent invocations can handle will remain in the SQS queue, awaiting an available function instance to process them.

Why this answer

Lambda's reserved concurrency of 10 caps the maximum number of concurrent executions. When the SQS queue receives 1000 messages, Lambda polls the queue and invokes the function with up to 10 messages at a time (based on batch size, default 1). The remaining messages stay in the queue and are retried after the visibility timeout expires, as Lambda processes messages in batches limited by the reserved concurrency.

Exam trap

The trap here is that candidates assume Lambda automatically scales to handle any burst, but reserved concurrency explicitly limits scaling, and the exam tests understanding that this limit is enforced regardless of queue depth.

How to eliminate wrong answers

Option A is wrong because Lambda does not reject messages due to concurrency limits; messages remain in the queue and are retried, and a dead-letter queue is only used after the maximum retry count is exceeded. Option B is wrong because Lambda cannot scale beyond the reserved concurrency of 10, which is a hard limit set by the user, not an automatic scaling target. Option C is wrong because reserved concurrency is a static configuration that cannot be dynamically increased by Lambda in response to a burst; it must be changed manually or via an auto-scaling mechanism like Application Auto Scaling.

283
MCQmedium

A developer is using AWS Elastic Beanstalk to deploy a web application. The application experiences high latency during peak hours. The developer wants to scale the application automatically based on CPU utilization. Which configuration should the developer use?

A.Configure an Auto Scaling step scaling policy based on MemoryReservation metric.
B.Use AWS CloudFront to cache responses and reduce load on the application.
C.Configure an Auto Scaling simple scaling policy based on Average CPU Utilization > 70% for scale-out and < 30% for scale-in.
D.Configure an Auto Scaling target tracking policy based on NetworkIn metric.
AnswerC

Configuring an Auto Scaling simple scaling policy based on Average CPU Utilization with thresholds of > 70% for scale-out and < 30% for scale-in is the correct and most common approach for horizontally scaling web applications in Elastic Beanstalk. High CPU utilization directly indicates that the existing instances are struggling to process requests, necessitating more compute capacity. Conversely, low CPU utilization suggests instances are underutilized, allowing for cost-efficient scale-in.

Why this answer

AWS Elastic Beanstalk integrates with Auto Scaling to automatically adjust the number of EC2 instances based on a simple scaling policy that uses the Average CPU Utilization metric. By setting a scale-out threshold at >70% and a scale-in threshold at <30%, the application can dynamically handle peak-hour traffic while reducing costs during low usage. This directly addresses the developer's requirement to scale based on CPU utilization.

Exam trap

The trap here is that candidates may confuse the metric used for scaling (CPU utilization) with other metrics like MemoryReservation or NetworkIn, or assume that caching solutions like CloudFront can replace the need for compute scaling, when the question explicitly requires scaling based on CPU utilization.

How to eliminate wrong answers

Option A is wrong because the MemoryReservation metric is specific to Amazon ECS and Fargate tasks, not to EC2 instances managed by Elastic Beanstalk, and step scaling policies are not the recommended approach for CPU-based scaling in this context. Option B is wrong because while CloudFront can reduce latency by caching responses at edge locations, it does not automatically scale the application's compute capacity based on CPU utilization; it only offloads requests for cached content. Option D is wrong because a target tracking policy based on NetworkIn metric would scale based on network traffic rather than CPU utilization, which does not meet the developer's explicit requirement to scale based on CPU utilization.

284
Multi-Selecteasy

Which TWO of the following are valid use cases for Amazon S3 event notifications?

Select 2 answers
A.Automatically replicate objects to another bucket
B.Automatically delete objects after 30 days
C.Encrypt objects automatically with KMS
D.Send a notification to an SQS queue when a new object is created
E.Trigger a Lambda function to process an image after upload
AnswersD, E

This is a valid and common use case for Amazon S3 event notifications. S3 can be configured to publish messages to an Amazon SQS queue whenever specific object-level events occur, such as s3:ObjectCreated:Put or s3:ObjectCreated:Post. This enables decoupled architectures where other services can asynchronously consume these messages to react to new object uploads, facilitating further processing or logging.

Why this answer

Amazon S3 event notifications can be configured to publish events to an SQS queue when a new object is created (s3:ObjectCreated:*). This allows decoupled, asynchronous processing of object creation events without polling, making it ideal for workflows like log aggregation or data ingestion pipelines.

Exam trap

The trap here is that candidates confuse S3 event notifications with S3 lifecycle policies or replication features, mistakenly thinking notifications can directly perform actions like deletion or replication, when in fact they only trigger notifications to specified destinations.

285
MCQmedium

A developer is building a serverless application using AWS Lambda and Amazon API Gateway. The API requires that the same Lambda function handle different HTTP methods (GET, POST, DELETE) for the same resource. The developer wants to minimize code and configuration. Which integration type should the developer use?

A.Lambda proxy integration
B.Lambda custom integration
C.HTTP integration
D.Mock integration
AnswerA

Lambda proxy integration simplifies API Gateway configuration by passing the entire client request, including headers, query string parameters, path parameters, and body, directly to the Lambda function as a single event object. This allows the Lambda function to parse the request and handle different HTTP methods and paths dynamically, significantly reducing the need for explicit mapping templates within API Gateway and streamlining serverless application development.

Why this answer

Lambda proxy integration (option A) is correct because it automatically passes the entire HTTP request (method, headers, query parameters, path parameters) to the Lambda function as a single event object, allowing the same function to inspect the `httpMethod` field and branch logic for GET, POST, DELETE without any additional API Gateway mapping or transformation configuration. This minimizes both code (the function handles routing internally) and configuration (no need to define separate integration requests/responses per method).

Exam trap

The trap here is that candidates often confuse 'custom integration' (option B) with 'proxy integration' (option A), mistakenly thinking custom integration offers more flexibility when in fact it requires more configuration and does not automatically pass the full request context.

How to eliminate wrong answers

Option B (Lambda custom integration) is wrong because it requires you to explicitly define request/response mapping templates for each HTTP method, increasing configuration complexity and defeating the goal of minimizing code and configuration. Option C (HTTP integration) is wrong because it proxies requests to an HTTP endpoint, not to a Lambda function, so it cannot directly invoke the same Lambda for multiple methods without an intermediate HTTP service. Option D (Mock integration) is wrong because it returns a static response defined in API Gateway without invoking any backend, so it cannot handle dynamic business logic for different HTTP methods.

286
MCQeasy

A developer needs to store application logs from multiple EC2 instances in a centralized location for analysis. The logs should be retained for 90 days. Which AWS service should be used to collect and store the logs?

A.Amazon Kinesis Data Firehose
B.Amazon CloudWatch Logs
C.AWS CloudTrail
D.Amazon S3 with S3 Server Access Logs
AnswerB

Amazon CloudWatch Logs is specifically designed for centralizing logs from various sources, including EC2 instances, AWS Lambda functions, and other AWS services. It provides a dedicated agent for easy installation on EC2 instances to collect application logs, offers configurable retention policies, and allows for real-time monitoring, searching, and analysis of log data. This makes it the most straightforward and cost-effective solution for collecting, storing, and managing application logs with integrated viewing capabilities.

Why this answer

Amazon CloudWatch Logs is the correct service for collecting, monitoring, and storing application logs from EC2 instances in a centralized location. It integrates directly with the CloudWatch Logs agent (or unified CloudWatch agent) installed on EC2 instances to stream log data, and it supports configurable retention policies, including a 90-day retention period. This makes it the ideal choice for centralized log storage and analysis without requiring additional infrastructure.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (which logs API calls) with CloudWatch Logs (which collects application logs), leading them to select CloudTrail for application-level logging needs.

How to eliminate wrong answers

Option A is wrong because Amazon Kinesis Data Firehose is a real-time data streaming service designed to load data into destinations like S3, Redshift, or Elasticsearch, not a native log storage and retention service; it lacks built-in log retention policies and is not optimized for storing logs directly for 90 days. Option C is wrong because AWS CloudTrail records API activity and governance events across AWS services, not application-level logs from EC2 instances; it is focused on auditing, not application log collection. Option D is wrong because Amazon S3 with S3 Server Access Logs captures detailed records about requests made to an S3 bucket, not application logs from EC2 instances; it is a bucket-level logging feature, not a centralized log collection service for EC2.

287
MCQmedium

A developer is building a serverless application that processes images uploaded to an S3 bucket. The processing includes generating thumbnails and storing metadata in DynamoDB. The developer wants to ensure that the processing function is triggered only when new objects are created, not when existing objects are updated. Which S3 event notification configuration should be used?

A.Use s3:ObjectCreated:*
B.Use s3:ObjectCreated:Post
C.Use s3:ObjectCreated:Put
D.Use s3:ObjectCreated:Copy
AnswerA

Correct. s3:ObjectCreated:* captures all creation events, allowing the developer to filter updates in the processing function. While it does not exclusively trigger on new objects, it is the most comprehensive event type and is the intended answer given the limitations of S3 event notifications.

Why this answer

The `s3:ObjectCreated:*` event type is a wildcard that covers all object creation APIs, including `s3:ObjectCreated:Put`, `s3:ObjectCreated:Post`, `s3:ObjectCreated:Copy`, and `s3:ObjectCreated:CompleteMultipartUpload`. Using `s3:ObjectCreated:*` ensures that the Lambda function is triggered regardless of how the image was uploaded or created in the bucket. If the developer only configured `s3:ObjectCreated:Put`, then images uploaded via multipart uploads (which trigger `CompleteMultipartUpload`) or POST requests would not trigger the function.

Exam trap

The exam tests your knowledge of S3 event types. Candidates often mistakenly choose `s3:ObjectCreated:Put` thinking it covers all uploads. However, large files are often uploaded using multipart upload, which triggers `s3:ObjectCreated:CompleteMultipartUpload`, not `Put`.

To capture all creation methods, `s3:ObjectCreated:*` must be used.

How to eliminate wrong answers

Option A is wrong because s3:ObjectCreated:* is a wildcard that matches all object creation events, including PUT, POST, COPY, and multipart upload completions, which would trigger the function for both new and updated objects. Option B is wrong because s3:ObjectCreated:Post is specific to objects uploaded via HTTP POST (typically used for browser-based uploads via HTML forms) and does not cover PUT operations, which are the most common method for uploading new objects programmatically. Option D is wrong because s3:ObjectCreated:Copy triggers only when an object is copied within S3 (via PUT Object - Copy), which is not the primary method for uploading new images; it would miss direct uploads and also trigger on copies of existing objects.

288
MCQmedium

A developer is working on an application that uses Amazon SQS as a message queue. The application polls the queue using long polling with a wait time of 20 seconds. Recently, the team noticed that messages are being processed multiple times. The application is idempotent, but duplicate processing is causing unnecessary costs. What should the developer do to reduce duplicate message processing?

A.Use a DynamoDB table to track processed message IDs and ignore duplicates.
B.Switch to a FIFO queue to enable exactly-once processing.
C.Increase the visibility timeout to a value greater than the maximum processing time.
AnswerA

Using a DynamoDB table to store unique message identifiers (e.g., SQS MessageId or a business transaction ID) allows the consumer to check if a message has already been processed before executing its logic. By performing a conditional write (e.g., PutItem with ConditionExpression attribute_not_exists(id)) to the DynamoDB table, the application ensures that the processing logic for a specific message ID is executed only once, effectively achieving idempotency and eliminating duplicate processing even with SQS's at-least-once delivery.

Why this answer

SQS standard queues provide at-least-once delivery, so duplicates are expected. Since the application is already idempotent, the developer should track processed message IDs in a DynamoDB table (with conditional writes or TTL) and skip messages already processed. This reduces redundant processing and cost without changing the queue type.

Exam trap

DVA-C02 often tests the misconception that FIFO queues guarantee exactly-once processing universally — candidates pick FIFO without realizing the 5-minute deduplication window and the architectural changes required, when idempotency with DynamoDB is the more practical answer.

How to eliminate wrong answers

Option B is wrong because FIFO queues provide exactly-once processing only within a 5-minute deduplication window and require a .fifo queue name, message group IDs, and deduplication IDs — switching queue types is a larger architectural change and does not guarantee exactly-once for all scenarios (e.g., retries after visibility timeout). Option C is wrong because increasing the visibility timeout only reduces duplicates caused by messages becoming visible again before processing completes; it does not address duplicates from at-least-once delivery or retries, and the question implies duplicates are already occurring.

289
MCQhard

A developer is creating an AWS Lambda function that processes events from an Amazon S3 bucket. The function writes logs to Amazon CloudWatch Logs. The developer wants to ensure that the Lambda function has the minimum required permissions. Which IAM policy should be attached to the Lambda execution role?

A.A policy that includes 'logs:CreateLogStream', 'logs:PutLogEvents', and 's3:*' on the bucket.
B.A policy that includes 'logs:*' and 's3:*' on the bucket.
C.A policy that includes 'logs:PutLogEvents' and 's3:ListBucket' on the bucket.
D.A policy that includes 'logs:CreateLogGroup', 'logs:CreateLogStream', 'logs:PutLogEvents', and 's3:GetObject' on the specific bucket.
AnswerD

This policy correctly adheres to the principle of least privilege by granting only the necessary permissions for a Lambda function to process an S3 object and log its execution. 'logs:CreateLogGroup' allows the function to create its dedicated log group, 'logs:CreateLogStream' enables the creation of log streams within that group, and 'logs:PutLogEvents' permits writing runtime logs to CloudWatch. 's3:GetObject' is the precise permission required to retrieve the S3 object's content, ensuring the function can perform its core task securely.

Why this answer

It grants the minimum required permissions for the Lambda function to read objects from the specific S3 bucket (s3:GetObject) and to write logs to CloudWatch Logs (logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents). The s3:GetObject action is necessary to process events from S3, and the three logs actions are the minimum needed for the Lambda runtime to create a log group, create a log stream, and write log events. This policy follows the principle of least privilege by scoping permissions to the specific bucket and avoiding wildcards.

Exam trap

The trap here is that candidates often forget that 'logs:CreateLogGroup' is required for the first invocation of a Lambda function, and they mistakenly choose a policy with only 'logs:PutLogEvents' or overly broad S3 permissions like 's3:*'.

How to eliminate wrong answers

Option A is wrong because it includes 's3:*' on the bucket, which grants all S3 actions (e.g., delete, put) far beyond the required 's3:GetObject', violating least privilege. Option B is wrong because it includes 'logs:*' (all CloudWatch Logs actions) and 's3:*' on the bucket, both overly permissive and not minimal. Option C is wrong because it omits 'logs:CreateLogGroup' and 'logs:CreateLogStream', which are required for the Lambda runtime to initialize logging, and includes 's3:ListBucket' instead of the necessary 's3:GetObject' for reading objects.

290
MCQmedium

A developer is using AWS Lambda to process records from an Amazon Kinesis Data Stream. The Lambda function is invoked with a batch of records. The function processes each record and then returns a response. The developer notices that some records are being processed multiple times. The function's execution time is within the Lambda timeout. The Kinesis stream has 10 shards. The developer wants to ensure that each record is processed exactly once. What should the developer do?

A.Reduce the number of shards to minimize the chance of duplicates.
B.Modify the Lambda function to use the sequence number of each record to deduplicate processing.
C.Configure the Lambda function's error handling to retry only failed records.
D.Increase the batch size to process more records per invocation.
AnswerB

Modifying the Lambda function to use the sequence number of each record is the correct approach for deduplication. Each record in a Kinesis stream has a unique sequence number within its shard, which, when combined with the shard ID, forms a globally unique identifier. By storing the last successfully processed sequence number (and shard ID) in a durable external data store, such as Amazon DynamoDB, the Lambda function can check if a record has already been processed before executing its business logic, effectively achieving idempotency.

Why this answer

The correct option is B: modify the Lambda function to use the sequence number of each record to deduplicate processing. AWS Lambda's Kinesis event source mapping provides at-least-once delivery, so a batch or individual records can be retried after a failure or timeout, causing duplicates; Kinesis sequence numbers uniquely identify each record within a shard, so the function can track processed sequence numbers (for example in DynamoDB) and skip records already handled. Option A is wrong because reducing shards does not change Lambda's at-least-once semantics and would only lower throughput.

Option C is wrong because retry configuration cannot prevent duplicates from Lambda's own retries or checkpointing behavior. Option D is wrong because a larger batch size does not provide exactly-once processing and can actually increase the number of records reprocessed after a failure.

291
Multi-Selecthard

A developer is designing a serverless application that uses Amazon DynamoDB as the data store. The application must handle sudden spikes in read traffic without throttling. Which THREE actions should the developer take?

Select 3 answers
A.Configure DynamoDB auto scaling for the table
B.Implement exponential backoff and retry in the application code
C.Use a global secondary index with a different partition key
D.Use strongly consistent reads for all queries
E.Enable DynamoDB Accelerator (DAX) for caching
AnswersA, B, E

DynamoDB auto scaling dynamically adjusts the provisioned read and write capacity units (RCUs/WCUs) for a table or global secondary index based on actual traffic patterns. By automatically increasing capacity during peak loads and decreasing it during lulls, auto scaling ensures that the table has sufficient throughput to handle incoming requests, effectively preventing throttling errors caused by exceeding provisioned limits.

Why this answer

DynamoDB auto scaling (option A) dynamically adjusts the provisioned read and write capacity based on actual traffic patterns, using CloudWatch alarms and the Application Auto Scaling service. This ensures the table can handle sudden spikes in read traffic without manual intervention, preventing throttling exceptions.

Exam trap

The trap here is that candidates often confuse throttling prevention mechanisms (auto scaling, caching) with throttling mitigation techniques (exponential backoff) or unrelated features (GSIs, consistency models), leading them to select options that do not actually prevent throttling.

292
MCQhard

A developer wants exactly-once processing semantics for commands submitted to a queue where duplicate command IDs must be rejected within five minutes. Which SQS feature is most directly relevant?

A.Standard queue delay seconds
B.Dead-letter queue redrive policy
C.FIFO queue deduplication ID
D.Visibility timeout extension
AnswerC

The "MessageDeduplicationId" in an Amazon SQS FIFO queue is the primary mechanism for achieving exactly-once processing semantics by preventing duplicate messages from being added to the queue. When a producer sends a message with a specific deduplication ID, SQS ensures that any subsequent message sent with the same ID within a 5-minute deduplication interval is treated as a duplicate and not delivered to the queue. This directly guarantees that a command is enqueued and thus processed only once, even if the producer attempts to send it multiple times.

Why this answer

FIFO queues support exactly-once processing by using a deduplication ID. When a message with a given deduplication ID is sent, SQS automatically rejects any duplicate within a 5-minute deduplication interval. This directly meets the requirement to reject duplicate command IDs within five minutes.

Exam trap

The trap here is that candidates confuse visibility timeout (which controls reprocessing) with deduplication (which prevents duplicate submissions), leading them to select option D instead of the correct FIFO deduplication ID feature.

How to eliminate wrong answers

Option A is wrong because standard queue delay seconds only postpone message delivery, they do not provide deduplication or exactly-once semantics. Option B is wrong because a dead-letter queue redrive policy moves messages after repeated processing failures, it does not prevent duplicate submissions. Option D is wrong because visibility timeout extension only prevents other consumers from processing a message while it is being handled, it does not reject duplicates.

293
MCQmedium

A developer is building a REST API using Amazon API Gateway that will serve static content from an Amazon S3 bucket. The API should cache responses for frequently accessed objects to reduce latency. Which API Gateway feature should the developer enable?

A.API Gateway caching with TTL set per method.
B.Amazon CloudFront as a custom domain.
C.Lambda@Edge for caching.
D.S3 Transfer Acceleration.
AnswerA

API Gateway offers built-in caching capabilities that can be enabled per stage or per method. This feature stores responses from your backend integrations, reducing the number of requests sent to your backend and significantly improving API response times for repeat requests. You can configure a Time To Live (TTL) for cached responses, allowing precise control over how long data remains in the cache before being refreshed, which is crucial for managing data freshness and reducing backend load.

Why this answer

API Gateway caching allows you to cache responses from your backend (e.g., an S3 bucket) for a specified Time-to-Live (TTL) per method, reducing the number of calls to the backend and lowering latency for frequently accessed objects. This feature is natively integrated with API Gateway and requires no additional services or complex configurations, making it the most direct solution for caching static content served through a REST API.

Exam trap

The trap here is that candidates often confuse API Gateway caching with CloudFront, assuming that a CDN is required for caching, when in fact API Gateway has its own built-in caching feature that is simpler to enable for REST APIs serving static content.

How to eliminate wrong answers

Option B is wrong because Amazon CloudFront as a custom domain is a content delivery network (CDN) that can cache content at edge locations, but it is not an API Gateway feature; it is a separate service that would be placed in front of API Gateway, not enabled within API Gateway itself. Option C is wrong because Lambda@Edge is used for customizing CloudFront behavior (e.g., modifying requests/responses) and is not a caching mechanism; it runs code at edge locations but does not provide built-in response caching like API Gateway caching. Option D is wrong because S3 Transfer Acceleration is designed to speed up uploads to S3 over long distances using AWS edge locations, but it does not cache responses or reduce latency for GET requests served through API Gateway.

294
MCQeasy

A developer is building a serverless application using AWS Lambda that needs to connect to an Amazon RDS MySQL database. The function will be deployed in a VPC. Which resource should the developer use to ensure secure and efficient database connections?

B.RDS Proxy
C.VPC Endpoint
D.AWS PrivateLink
AnswerB

RDS Proxy is specifically designed to manage and pool database connections for applications like AWS Lambda, which often create many short-lived connections. It sits between your Lambda function and the RDS database, maintaining a pool of established connections to the database. This significantly reduces the overhead of establishing new connections, improves scalability, and enhances security by integrating with AWS Secrets Manager for credential management and IAM for authentication.

Why this answer

RDS Proxy is the correct choice because it manages a pool of database connections, allowing Lambda functions to reuse them efficiently and avoid exhausting MySQL connection limits under high concurrency. It also enforces IAM authentication and securely stores credentials in AWS Secrets Manager, eliminating the need to hardcode database passwords in the function code.

Exam trap

The trap here is that candidates often confuse VPC Endpoints or PrivateLink with database connectivity, not realizing that RDS Proxy is the only service designed specifically to solve connection management and security for Lambda functions accessing RDS in a VPC.

How to eliminate wrong answers

Option A is wrong because a NAT Gateway provides outbound internet access for private subnets but does not manage or secure database connections; it would not help with connection pooling or credential management. Option C is wrong because a VPC Endpoint (Gateway or Interface) enables private connectivity to AWS services like S3 or DynamoDB, not to RDS databases; it does not handle connection pooling or authentication for MySQL. Option D is wrong because AWS PrivateLink is used to expose services privately across VPCs or accounts via Network Load Balancers and interface endpoints, but it does not provide the connection pooling, IAM integration, or failover capabilities that RDS Proxy offers for Lambda-to-RDS connections.

295
Multi-Selecthard

A developer is building a CI/CD pipeline using AWS CodePipeline. The pipeline has a source stage from Amazon S3, a build stage using AWS CodeBuild, and a deploy stage using AWS CodeDeploy. The developer wants to ensure that a manual approval step is required before deploying to production. Which THREE components must be configured? (Choose THREE.)

Select 3 answers
A.Create an AWS Lambda function to process approval logic.
B.Set up an Amazon SNS topic to notify approvers of pending approval.
C.Add an approval action in the pipeline before the deploy stage.
D.Attach an IAM policy to the approver group that allows codepipeline:PutApprovalResult.
E.Configure Amazon CloudWatch Events to trigger the approval step.
AnswersB, C, D

Setting up an Amazon SNS topic is a fundamental step when configuring a manual approval action in AWS CodePipeline. This SNS topic serves as the primary mechanism for automatically notifying designated approvers, typically via email or other subscribed endpoints, that a pipeline execution has reached a manual approval gate and is awaiting their intervention. Without an associated SNS topic, approvers would lack timely, automated alerts regarding pending approvals, potentially causing significant delays in the deployment process.

Why this answer

Amazon SNS is used to send notifications to approvers when a manual approval action is pending in the pipeline. The approval action in CodePipeline can be configured with an SNS topic ARN, and when the pipeline reaches that stage, it publishes a notification to the topic, alerting approvers to review and approve or reject the deployment.

Exam trap

The trap here is that candidates might think a custom Lambda function or CloudWatch Events is needed to implement the approval logic, but CodePipeline provides a native approval action that handles both the pause and notification via SNS, requiring only the IAM permission to submit the result.

296
MCQhard

A company runs a containerized application on Amazon ECS Fargate. The application writes logs to stdout. The operations team wants to centralize log monitoring and set up alarms for error patterns. What should a developer do to meet these requirements with minimal operational overhead?

A.Use Amazon Kinesis Data Firehose to stream logs to Amazon S3 and then to CloudWatch Logs.
B.Modify the application code to use the AWS SDK for CloudWatch Logs to put log events.
C.Install the CloudWatch agent in the container and configure it to send logs.
D.Configure the ECS task definition to use the awslogs log driver and set the log group.
AnswerD

Configuring the ECS task definition to utilize the `awslogs` log driver is the recommended and most efficient method for sending container logs from Fargate tasks to Amazon CloudWatch Logs. This native integration automatically captures `stdout` and `stderr` streams from your containers and delivers them to a specified CloudWatch Logs log group. It simplifies log management, centralizes monitoring, and requires no application code changes or agent deployments within the container.

Why this answer

The awslogs log driver is the native, zero-configuration way to send container stdout/stderr to Amazon CloudWatch Logs from ECS Fargate. By specifying the awslogs log driver and a log group in the task definition, logs are automatically forwarded without any additional agents, code changes, or infrastructure, meeting the requirement for minimal operational overhead.

Exam trap

The trap here is that candidates often overthink the solution and choose Option C (installing the CloudWatch agent) because they are familiar with it from EC2, forgetting that Fargate does not support host-level agents and that the awslogs driver is the built-in, agentless alternative.

How to eliminate wrong answers

Option A is wrong because Amazon Kinesis Data Firehose streams logs to S3, but then sending them to CloudWatch Logs requires an additional Lambda or subscription filter, adding unnecessary complexity and cost; the goal is minimal overhead, not a multi-hop pipeline. Option B is wrong because modifying application code to use the AWS SDK for CloudWatch Logs tightly couples the application to AWS APIs, increases development effort, and violates the principle of keeping logging infrastructure separate from application logic. Option C is wrong because installing the CloudWatch agent inside a Fargate container is not supported—Fargate does not allow running sidecar agents that require host-level access; the awslogs driver handles this at the container runtime level without any agent.

297
MCQmedium

A company is building a serverless application using AWS Lambda. The application processes messages from an Amazon SQS queue. The Lambda function is idempotent and handles duplicate messages correctly. The company needs to ensure that messages are processed in the order they were sent. Which solution should the company use?

A.Use Amazon SNS to fan out messages to Lambda.
B.Use Amazon Kinesis Data Streams as the event source for Lambda.
C.Configure the Lambda function to poll an SQS standard queue with a batch size of 10.
D.Configure the Lambda function to poll an SQS FIFO queue with a batch size of 1.
AnswerD

Amazon SQS FIFO (First-In, First-Out) queues are specifically engineered to guarantee strict message ordering and exactly-once processing. By configuring the Lambda function to poll a FIFO queue with a batch size of 1, each message is retrieved and processed individually and sequentially. This combination ensures that the processing order by the Lambda function precisely matches the order in which messages were originally sent to the queue, reliably meeting both ordering and exactly-once requirements.

Why this answer

Amazon SQS FIFO queues guarantee first-in, first-out delivery and exactly-once processing, which ensures messages are processed in the order they were sent. By configuring the Lambda function to poll the FIFO queue with a batch size of 1, each message is processed individually, preserving strict ordering without concurrency issues. The Lambda function's idempotency further ensures that any duplicate messages are handled safely, but the FIFO queue's inherent ordering is the key mechanism for maintaining sequence.

Exam trap

The trap here is that candidates often assume a standard SQS queue with a small batch size can maintain order, but standard queues only provide best-effort ordering and can still reorder messages due to retries or distributed processing.

How to eliminate wrong answers

Option A is wrong because Amazon SNS fans out messages to multiple subscribers asynchronously and does not guarantee any ordering; messages can arrive at Lambda in a different order than they were published. Option B is wrong because Amazon Kinesis Data Streams provides ordering within a shard but does not guarantee global ordering across shards, and it is designed for real-time streaming analytics, not for simple message queue processing with strict FIFO semantics. Option C is wrong because an SQS standard queue does not preserve message order; it uses best-effort ordering and can deliver messages out of sequence, even with a batch size of 10, making it unsuitable for ordered processing.

298
MCQmedium

A developer is building a serverless application using AWS Lambda functions that process events from Amazon SQS. The developer notices that some messages are being processed multiple times. What is the MOST likely cause of this issue?

A.The Lambda function's reserved concurrency is set too high.
B.The SQS visibility timeout is too short for the Lambda function's execution time.
C.The SQS queue has a dead-letter queue configured.
D.The Lambda function's batch size is set to more than 1.
AnswerB

When an SQS message is received by a Lambda function, it becomes temporarily invisible to other consumers for the duration of the visibility timeout. If the Lambda function's processing time exceeds this timeout, the message will reappear in the queue, becoming available for another Lambda invocation to pick up and process again. This scenario directly leads to duplicate message processing, as the original invocation might still be working on the message while a new one begins.

Why this answer

When an SQS message is processed by a Lambda function, the message becomes invisible to other consumers for the duration of the visibility timeout. If the Lambda function takes longer to process the message than the visibility timeout, SQS makes the message visible again and can deliver it to another consumer (or the same Lambda function in a new invocation), causing duplicate processing. This is the most likely cause of messages being processed multiple times.

Exam trap

The trap here is that candidates may confuse the visibility timeout with the Lambda function timeout or think that increasing concurrency or batch size causes duplicates, when in fact the visibility timeout directly controls the window for duplicate processing.

How to eliminate wrong answers

Option A is wrong because reserved concurrency limits the number of concurrent Lambda executions but does not cause duplicate message processing; it may actually throttle invocations. Option C is wrong because a dead-letter queue is used to capture messages that fail processing after a maximum number of retries, not to cause duplicate processing. Option D is wrong because setting the batch size to more than 1 allows Lambda to process multiple messages in a single invocation, which reduces the chance of duplicates by processing them together, not causing duplicates.

299
Multi-Selectmedium

A developer is configuring an Amazon S3 bucket for static website hosting. The website includes JavaScript that makes AJAX calls to an API Gateway endpoint. Which TWO actions should the developer take to allow cross-origin requests?

Select 2 answers
A.Use Amazon CloudFront to serve the website and set CORS headers.
B.Add a CORS configuration to the S3 bucket.
C.Enable CORS on the API Gateway API.
D.Configure the S3 bucket policy to allow cross-origin access.
E.Modify the Lambda function to include CORS headers in the response.
AnswersC, E

Correct: Enabling CORS on API Gateway configures the API to respond to preflight OPTIONS requests with the necessary CORS headers.

Why this answer

The API Gateway API must have CORS enabled to accept cross-origin requests from the S3-hosted static website. For an API Gateway endpoint backed by a Lambda proxy integration, enabling CORS in API Gateway alone is not enough — the Lambda function must also include the appropriate CORS headers (such as Access-Control-Allow-Origin) in its response. Therefore, the developer should both enable CORS on the API and modify the Lambda function to return CORS headers.

Exam trap

The trap is to think that enabling CORS on API Gateway alone is sufficient or that the S3 bucket policy/CORS is involved. In cross-origin calls to an API Gateway endpoint from an S3-hosted site, the browser enforces CORS based on the API Gateway/Lambda response; for Lambda proxy integrations, both the API Gateway CORS setting and the Lambda response headers are required.

300
MCQmedium

A developer has an AWS Lambda function that processes messages from an Amazon SQS queue. The function is configured with a batch size of 10, reserved concurrency of 5, and a timeout of 5 minutes. The SQS queue has a large backlog, and CloudWatch metrics show high throttling (Throttles) for the Lambda function. The function is idempotent and can process up to 100 messages in a single invocation. What is the MOST effective way to increase throughput without increasing the reserved concurrency?

A.Increase the batch size to 100.
B.Increase the reserved concurrency to 10.
C.Reduce the batch size to 1.
D.Enable the SQS queue to use long polling.
AnswerA

Increasing the batch size for an SQS event source mapping allows each AWS Lambda invocation to process a larger number of messages simultaneously. This significantly reduces the total number of Lambda invocations required to process a given volume of messages, thereby lowering the demand for concurrent executions. By processing more work per invocation, the function is less likely to hit its concurrency limit and experience throttling, effectively optimizing resource utilization without increasing reserved concurrency.

Why this answer

Increasing the batch size to 100 allows each Lambda invocation to process up to 100 messages from the SQS queue instead of the current 10. Since the function is idempotent and can handle 100 messages per invocation, this change maximizes the number of messages processed per invocation without altering the reserved concurrency of 5. With a batch size of 100, each of the 5 concurrent invocations can process up to 100 messages, yielding a potential throughput of 500 messages per invocation cycle, which directly reduces the backlog and throttling by consuming messages faster.

Exam trap

The trap here is that candidates may think increasing reserved concurrency is the only way to improve throughput, but the question explicitly forbids that, and they overlook that increasing the batch size can achieve the same goal by processing more messages per invocation without adding more concurrent executions.

How to eliminate wrong answers

Option B is wrong because increasing reserved concurrency to 10 would increase throughput but directly violates the constraint of not increasing reserved concurrency, and it would also increase the risk of throttling other functions sharing the account concurrency limit. Option C is wrong because reducing the batch size to 1 would drastically decrease throughput, as each invocation would process only one message, requiring more invocations to handle the same backlog and potentially increasing throttling due to more concurrent executions. Option D is wrong because enabling long polling for the SQS queue reduces the number of empty responses and improves efficiency in message retrieval, but it does not increase the number of messages processed per invocation or reduce throttling caused by the Lambda function's concurrency limit.

← PreviousPage 4 of 6 · 388 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Dev AWS Services questions.