CCNA Dev AWS Services Questions

Option D is correct because increasing DynamoDB provisioned read/write capacity reduces throttling and latency. Option A is wrong because Lambda reserved concurrency limits throughput. Option B is wrong because DynamoDB Accelerator (DAX) is for read-heavy workloads, but the function writes metadata.

Option C is wrong because moving to a VPC adds network latency.

Option A is correct because the Task token (.waitForTaskToken) allows the Lambda function to run asynchronously and call back with the token upon completion, enabling long-running operations. Option B is wrong because it's synchronous and tied to Lambda's timeout. Option C is wrong because it's for parallel execution.

Option D is wrong because it doesn't involve Lambda.

AWS Secrets Manager is designed for storing secrets with automatic rotation. Option B is correct. Option A (SSM Parameter Store) can store secrets but does not offer automatic rotation by default.

Option C (KMS) is for encryption keys. Option D (S3) is not suitable for secrets without additional complexity.

Options B and D are correct. AWS Secrets Manager can automatically rotate secrets, and the Lambda function retrieves them at runtime via API. Option A is wrong because environment variables are visible in the console and logs.

Option C is wrong because storing secrets in source code is insecure. Option E is wrong because S3 is not designed for secret management and would require encryption and access control.

Option B is correct because the condition requires s3:x-amz-server-side-encryption to be AES256; if not specified, the condition fails and the request is denied. Option A is wrong because S3 default encryption would apply but the policy condition is not met. Option C is wrong because the condition does not require the header to be set; it requires it to be AES256 if present.

Option D is wrong because the policy does not specify any encryption key.

Option A is correct because Step Functions has a built-in 'Wait for Callback' pattern with .taskToken and activity tasks that can integrate with SQS to wait for manual approval. Option B is wrong because an SNS topic does not provide a callback mechanism. Option C is wrong because CloudWatch Events is for scheduling and events, not for manual approval workflows.

Option D is wrong because Cognito is for user authentication, not workflow approval.

Option C is correct because configuring a CloudWatch Events rule to detect CodeCommit repository changes and trigger the pipeline is the standard method. Option A is wrong because CodePipeline does not poll repositories directly. Option B is wrong because webhooks are not supported by CodeCommit.

Option D is wrong because SNS notifications do not trigger pipelines directly.

Correct: B. Amazon Cognito with an Application Load Balancer can authenticate users before requests reach the backend. Option A is wrong because IAM is for AWS service access, not end-user authentication.

Option C is wrong because API Gateway is not used here; the backend is EC2/ALB. Option D is wrong because CloudFront is a CDN, not an authentication service.

Option A is correct because setting the 'redrive policy' with a dead-letter queue (DLQ) allows messages to be retried up to maxReceiveCount, and then moved to DLQ. Option B is wrong because delay queues delay all messages, not retry failures. Option C is wrong because FIFO queues still need redrive policy.

Option D is wrong because visibility timeout alone does not retry on failure.

Option D is correct because increasing the Lambda timeout allows the function to wait longer. Option A is wrong because reducing memory may increase execution time. Option B is wrong because VPC does not affect timeout.

Option C is wrong because reserved concurrency does not affect timeout.

Option B is correct because SQS FIFO queues support exactly-once processing through deduplication based on message deduplication ID. Option A is wrong because standard queues guarantee at-least-once delivery. Option C is wrong because visibility timeout prevents other consumers from processing the same message, but does not prevent duplicates if the message is delivered again.

Option D is wrong because dead-letter queues store messages that could not be processed, they do not prevent duplicates.

Option B is correct. CodeBuild compiles and packages the application, then CodeDeploy performs the blue/green deployment. Option A is wrong because CodeDeploy does not build.

Option C is wrong because CodeCommit is for source control, not building. Option D is wrong because Elastic Beanstalk is a platform-as-a-service, not a CI/CD service.

Option A is correct because CloudWatch Logs captures Lambda logs. Option B is wrong because X-Ray is for tracing. Option C is wrong because CloudTrail is for API calls.

Option D is wrong because S3 can store logs but not in real-time.

Option C is correct because it defines a Retry with a 1-second interval, backoff rate of 2, and max attempts of 3. Option A is wrong because it uses 'ErrorEquals' with 'Lambda.ServiceException' which is not the timeout error; the error is 'States.Timeout'. Option B is wrong because it has 'MaxAttempts' as 5, not 3.

Option D is wrong because it has only 2 max attempts.

For large files, the aws s3 cp command automatically uses multipart upload, but increasing the part size can reduce the number of parts and improve throughput. Using aws s3api put-object is single-part and not suitable for large files. Disabling multipart upload would slow it down.

S3 Transfer Acceleration reduces latency over long distances, but does not necessarily improve throughput for a single upload.

The correct answers are A and D. Amazon Kinesis Data Streams ingests streaming data, and Amazon Kinesis Data Firehose delivers that data to S3. Option B is wrong because Lambda is not a streaming ingestion service.

Option C is wrong because SQS is for message queues, not real-time streaming. Option E is wrong because S3 is the destination, not the processing service.

The correct answer is D. Configuring a longer health check grace period allows the application to start and stabilize before the load balancer checks its health. Option A is wrong because deregistering the instance during deployment is not a standard practice and may cause traffic loss.

Option B is wrong because a blue/green deployment is a different strategy, not a fix for in-place deployment. Option C is wrong because increasing the interval alone does not provide a grace period.

Option B is correct because SQS decouples processing and provides a buffer. Option D is correct because DynamoDB auto scaling handles capacity. Option A is wrong because Lambda concurrency limit would throttle.

Option C is not directly related. Option E is wrong because Provisioned IOPS is for EBS.

Options B and D are correct. 'Bool' condition with 'aws:MultiFactorAuthPresent' checks if MFA was used. 'Null' condition can check if the MFA key is absent. Option A is wrong because it checks the user's path. Option C is wrong because it checks the MFA device type.

Option E is wrong because it checks the caller identity.

Option C is correct because creating a Global Secondary Index (GSI) on CustomerID allows efficient queries without scanning. Option A is wrong because increasing read capacity units doesn't apply to on-demand mode. Option B is wrong because on-demand mode already handles spikes, but throttling can still occur if a partition's throughput is exceeded.

Option D is wrong because DAX is an in-memory cache that can reduce read load, but it doesn't fix the inefficient query pattern.

The DynamoDB Query API returns paginated results, with a maximum of 1 MB of data per page. The `LastEvaluatedKey` in the response indicates that more items exist. To retrieve all items, the application must check for `LastEvaluatedKey` and, if present, issue a subsequent Query request with the `ExclusiveStartKey` parameter set to that value, repeating until `LastEvaluatedKey` is no longer returned.

This is the standard pagination pattern for DynamoDB.

Options A and D are correct. A: Using separate IAM roles for each function enforces least privilege. D: Scoping IAM policies to specific DynamoDB tables using ARN ensures functions can only access their own table.

Option B is wrong because using a single IAM role violates least privilege. Option C is wrong because using wildcard for all tables grants too much access. Option E is wrong because attaching policies at the account level is too broad.

Option B is correct because the Lambda function's execution role must have permissions to access S3. If the role lacks the necessary IAM policy, the SDK cannot retrieve credentials to make the S3 API call. Option A is wrong because Lambda functions use a temporary credentials provider via the execution role, not the environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY.

Option C is wrong because Lambda's execution environment sets its own credentials; setting them manually is not recommended. Option D is wrong because the error is about credentials, not the function's runtime.

Option C is correct because the ServerSideEncryption parameter set to 'aws:kms' tells S3 to use SSE-KMS. Option A is wrong because SSEAlgorithm is not a valid parameter. Option B is wrong because SSE-S3 uses 'AES256'.

Option D is wrong because the key ID is not required if using the default KMS key.

Option C is correct because AWS AppConfig is designed for application configuration and supports frequent updates. Option A is wrong because S3 is object storage, not ideal for small frequently changing configs. Option B is wrong because Parameter Store can store configs but is better for less frequent changes; AppConfig is optimized for frequent changes.

Option D is wrong because DynamoDB is a database, overkill for simple config.

Options A, C, and D are correct. Option A: AWS Systems Manager Parameter Store or AWS Secrets Manager can store credentials. Option C: Task execution role allows ECS to retrieve secrets.

Option D: Secrets can be injected as environment variables. Option B is wrong because database credentials are not stored in ECR. Option E is wrong because Secrets Manager cannot be directly accessed by the application without proper IAM permissions.

Option B is correct because DynamoDB Accelerator (DAX) is a fully managed, highly available, in-memory cache that reduces read latency from single-digit milliseconds to microseconds. Option A is wrong because increasing RCUs increases cost and does not use caching. Option C is wrong because DynamoDB Streams are for change data capture, not caching.

Option D is wrong because Global Tables are for multi-region replication, not read performance.

Option B is correct because CodePipeline can be configured to use Amazon CloudWatch Events (now Amazon EventBridge) to detect S3 events and start the pipeline. Option A is incorrect because SQS does not trigger CodePipeline. Option C is incorrect because SNS can be used but is not a direct trigger; EventBridge is the recommended approach.

Option D is incorrect because polling is not efficient; EventBridge provides real-time events.

Option A is correct because ElastiCache (Redis or Memcached) is designed for session state and is cost-effective. Option B is wrong because DynamoDB is more expensive for simple session state. Option C is wrong because S3 is slow for session state.

Option D is wrong because EBS cannot be shared across instances.

The correct answer is C. Amazon EFS provides a scalable, POSIX-compliant file system that can be mounted by multiple ECS tasks. Option A is wrong because S3 is object storage, not POSIX-compliant.

Option B is wrong because EBS volumes can only be attached to one instance at a time. Option D is wrong because FSx for Windows File Server is not POSIX-compliant.

A, B, and D are correct. You must enable caching in API Gateway (A), specify a cache size (B), and set a TTL (D). Option C is wrong because the Lambda function does not need changes.

Option E is wrong because IAM permissions are not directly required for caching.

Option B is correct because an IAM task role is the recommended way to grant permissions to ECS tasks. Option A is wrong because instance roles are for EC2, not Fargate. Option C is wrong because storing credentials in the container is insecure.

Option D is wrong because EFS is for file storage, not for granting S3 permissions.

Options B and D are correct. Option B ensures that if a file is processed again, it checks for a marker. Option D ensures updates are idempotent.

Option A is wrong because increasing timeout does not prevent duplicate processing. Option C is wrong because batch size is for SQS, not S3 triggers. Option E is wrong because it does not prevent reprocessing.

Option A is correct because CodeBuild supports installing dependencies in the pre_build phase. Option B is wrong because phases are already defined. Option C is wrong because the tool may not be available in all environments.

Option D is wrong because CodeBuild environments are not customizable via console.

Option D is correct. The application likely needs to retrieve the secret at runtime, but the code may be incorrect. However, the 'Host not found' error suggests the database hostname is not being resolved.

Option A is wrong because the instance profile has permission. Option B is wrong because Secrets Manager does not automatically inject into environment; the app must fetch it. Option C is wrong because the secret can be stored as plaintext or JSON; format is not the issue.

Options A, B, and D are correct. Using CodeDeploy (A) with an in-place deployment can manage the lifecycle. The AppSpec file (B) can define hooks to stop the application before install and start it after.

Auto Scaling group (D) with a rolling update can ensure instances are replaced without downtime. Option C is wrong because CodeBuild is for building, not deployment. Option E is wrong because Amazon Inspector is for security scanning.

AWS App Mesh provides service mesh capabilities including mTLS for encryption and service discovery using virtual services. AWS Cloud Map is used for service discovery with logical names. Together, they enable encrypted service-to-service communication.

Route 53 is for DNS but not mTLS. ELB is for load balancing, not service discovery. Systems Manager is for configuration management, not networking.

Direct Connect is a dedicated network connection.

Option A is correct because S3 event notifications might not be delivered if the bucket is in a different region than the Lambda function; the Lambda function must be in the same region as the S3 bucket for S3 event notifications. Option B is wrong because the Lambda function's IAM role does not affect invocation; it affects execution. Option C is wrong because S3 event notifications are not asynchronous; they are delivered synchronously.

Option D is wrong because the destination bucket's permissions are not relevant to the invocation trigger.

Option C is correct because Lambda concurrency limits control scaling, and provisioned concurrency prevents cold starts. Option A is wrong because API Gateway throttling would reject requests. Option B is wrong because increasing timeout doesn't help scaling.

Option D is wrong because reserved concurrency sets a limit, not a guarantee.

Option D is correct because RDS Proxy is designed to manage database connection pooling for serverless applications, reducing connection exhaustion. Option A is incorrect because increasing Lambda concurrency would make the problem worse. Option B is incorrect because storing connections in ElastiCache does not help with database connections.

Option C is incorrect because using DynamoDB would change the database, not solve the connection management issue.

Option A is correct because increasing the compute type provides more memory. Option B is wrong because CodeBuild does not support custom JVM options in buildspec. Option C is wrong because changing the image may not help.

Option D is wrong because CodeBuild doesn't have a memory setting separate from compute type.

Option D is correct because S3 bucket policies can explicitly deny access even if IAM allows it. Option A is wrong because the function role has permissions. Option B is wrong because S3 does not require VPC endpoints.

Option C is wrong because KMS encryption requires additional permissions, but access denied could be due to bucket policy deny.

Options A and D are correct. Amazon Kinesis Data Streams can ingest high-volume streaming data, and AWS Lambda can process the stream in near real-time. Option B is wrong because SQS is for message queues, not streaming.

Option C is wrong because SNS is for pub/sub, not streaming. Option E is wrong because EC2 is not serverless and requires management.

Option A is correct because Kinesis Data Streams can ingest large volumes of streaming data. Option C is correct because Lambda can process the data in real-time. Option E is correct because DynamoDB is a scalable, durable data store suitable for IoT data.

Option B is wrong because SQS is not a streaming service. Option D is wrong because RDS is not as scalable for high-throughput streaming data.

Option A is correct because the Lambda execution role can be attached to the function and include an IAM policy granting access to the S3 bucket. This follows the principle of least privilege and avoids hardcoding credentials. Option B is wrong because bucket policies are resource-based and not attached to functions.

Option C is wrong because environment variables would expose credentials. Option D is wrong because Lambda does not have an inline policy property - policies are attached via roles.

Option A is correct because a Lambda reservation ensures concurrency for the function. Option C is correct because specifying a batch size of 1 processes each record individually, ensuring order. Option B is wrong because DynamoDB Streams is already ordered by default; no need for FIFO.

Option D is wrong because increasing concurrency is unnecessary. Option E is wrong because batch window is not needed.

Option C is correct because using SQS decouples the EC2 instances from Lambda, provides buffering, and reduces throttling. Option A is incorrect because increasing Lambda concurrency may not solve the loss of requests; requests can still be dropped if Lambda is overwhelmed. Option B is incorrect because API Gateway still requires synchronous invocation and may still cause throttling.

Option D is incorrect because Kinesis is for real-time streaming, not ideal for simple request queuing.

Option A is correct because the Auto Scaling group must associate with the ALB target group for health checks. Option B is correct because creation policies allow CloudFormation to wait for a signal of success. Option D is correct because a CloudFormation signal (cfn-signal) is used to report success/failure.

Option C is wrong because UpdatePolicy is used for rolling updates, not for signaling health checks. Option E is wrong because AWS::CloudFormation::Init is for software configuration, not health check signaling.

B and D are correct. AWS Lambda can be triggered by S3 events to process data, and AWS Step Functions can orchestrate the workflow. Option A (Amazon Kinesis) is for streaming data, not S3 events.

Option C (Amazon EC2) is server-based. Option E (Amazon EMR) is for big data processing.

The correct answer is C. Using DynamoDB Accelerator (DAX) provides an in-memory cache that reduces latency for frequently accessed data. Option A is wrong because API Gateway caching caches the entire API response, which may not be efficient for all requests.

Option B is wrong because increasing Lambda memory does not directly reduce latency for DynamoDB queries. Option D is wrong because CloudFront is for content delivery, not for reducing database latency.

Option A is correct because ECS service auto scaling can set a maximum number of tasks; if the desired count is already at max, the deployment cannot add new tasks. Option B is wrong because deployment type does not affect task count limits. Option C is wrong because ECS service quota is a hard limit, but the error specifically mentions 'maximum number of running tasks' which aligns with auto scaling settings.

Option D is wrong because a misconfigured task definition would cause task start failures, not a max task count error.

Option A is correct. DynamoDB is a scalable, low-latency database that can store connection IDs and allow Lambda to query all connections for broadcasting. Option B is wrong because an in-memory list in a single Lambda instance does not scale across multiple instances.

Option C is wrong because ElastiCache is more expensive and complex than DynamoDB for this use case. Option D is wrong because SQS is not designed for real-time broadcasting and would require polling.

Option B is correct because the lifecycle rule will delete noncurrent versions after 30 days. Option A is wrong because versioning is enabled, so old versions are kept. Option C is wrong because the rule only applies to noncurrent versions.

Option D is wrong because the action is expiration, not transition.

Correct: C. S3 can be configured to send events to Lambda, SQS, or SNS when objects are created. Option A is wrong because SQS is a queue service, not a direct trigger source for S3 events.

Option B is wrong because SNS is a notification service, but S3 can directly invoke Lambda without SNS. Option D is wrong because CloudWatch Events is used for scheduled or pattern-based events, not S3 object creation.

Option B is correct because enabling DynamoDB acceleration and Lambda concurrency limits address both performance and throttling. Option A is wrong because increasing memory reduces duration but not concurrency issues. Option C is wrong because DAX is not for API Gateway.

Option D is wrong because SQS adds latency for real-time APIs.

Option B is correct because when MFA Delete is enabled, permanent deletion of object versions requires MFA authentication. Without MFA, the request fails. Option A is wrong because the delete marker is not created; the request is denied.

Option C is wrong because the request does not succeed. Option D is wrong because a delete marker is not created when trying to delete a specific version.