Courseiva

CCNA Dva Troubleshooting Optimization Questions

75 of 101 questions · Page 1/2 · Dva Troubleshooting Optimization topic · Answers revealed

Practice these questionsExam hubAll questions
1
Multi-Selecthard

A company is running a serverless application using AWS Lambda and Amazon API Gateway. The application experiences increased latency during peak hours. CloudWatch metrics show that Lambda function duration remains stable, but API Gateway latency spikes. Which THREE actions should the developer take to reduce API Gateway latency?

Select 3 answers
A.Increase the Lambda function timeout.
B.Enable compression for API responses.
C.Increase the API Gateway throttling limits.
D.Enable API Gateway caching for the endpoints.
E.Switch API Gateway endpoint type from Edge-optimized to Regional.
AnswersB, D, E

Enabling compression in API Gateway allows it to gzip response bodies when the client sends an Accept-Encoding: gzip header, shrinking the payload before transmission over the wire. Because the largest components of a JSON API response are often whitespace and repeated field names, gzip can reduce the transfer size by 70–80%, cutting network round-trip time significantly. This directly targets the latency component caused by response transfer time without altering Lambda execution or API Gateway routing.

Why this answer

Options B, D, and E are correct. Enabling compression reduces payload size, decreasing response time. API Gateway caching reduces backend calls by serving cached responses, lowering latency.

Switching to Regional endpoint reduces network latency by eliminating the global edge network hop. Option A is wrong because increasing Lambda timeout does not reduce API Gateway latency; it only allows functions to run longer. Option C is wrong because throttling limits cap request rates but do not reduce latency for individual requests.

Practice this question →
2
MCQhard

An application running on Amazon ECS Fargate is experiencing intermittent connection timeouts when calling an external API. The task has a public IP and a security group that allows outbound HTTPS. What is the most likely cause?

A.The ECS service is not configured to auto-assign public IP.
B.The task's security group does not allow inbound traffic.
C.The security group outbound rules are misconfigured.
D.The task is running in a private subnet without a NAT gateway.
AnswerD

ECS Fargate tasks deployed into a private subnet require a NAT Gateway to establish outbound connections to the internet. Private subnets are intentionally isolated from direct internet routing, meaning tasks within them cannot directly access external services or pull container images without an intermediary. A NAT Gateway, placed in a public subnet and configured with a route table entry for the private subnet, translates private IP addresses to its public IP, enabling secure and managed outbound internet access. This is the standard and necessary architecture for internet connectivity from private subnets.

Why this answer

ECS Fargate tasks running in a private subnet do not have direct internet access. Without a NAT gateway, outbound traffic to the external API is routed to the subnet’s route table, which lacks an internet gateway target, causing connection timeouts. The task’s public IP assignment is irrelevant in a private subnet, as the subnet itself has no route to the internet.

Exam trap

The trap here is that candidates assume a public IP on the task guarantees internet access, overlooking that the subnet’s route table determines whether traffic can reach the internet, and a private subnet without a NAT gateway blocks all outbound internet traffic regardless of the task’s public IP assignment.

How to eliminate wrong answers

Option A is wrong because the task already has a public IP assigned (as stated in the question), so the ECS service configuration for auto-assigning public IP is not the issue. Option B is wrong because inbound traffic rules are irrelevant for outbound HTTPS connections; the security group only needs to allow outbound traffic, which it does. Option C is wrong because the security group outbound rules are correctly configured to allow HTTPS (port 443), so misconfiguration is not the cause.

Practice this question →
3
MCQeasy

A developer is troubleshooting an AWS Lambda function that times out when processing large files from Amazon S3. The function has a 15-minute timeout and 512 MB memory. What should the developer do to resolve this issue?

A.Use Amazon S3 batch operations to split the files before processing.
B.Add an S3 Event Notification to trigger the function asynchronously.
C.Reduce the Lambda timeout to 5 minutes to force faster processing.
D.Increase the Lambda function memory to 3008 MB.
AnswerD

Increasing the Lambda function memory to 3008 MB is a highly effective strategy for resolving timeout issues. In the AWS Lambda execution environment, the amount of allocated memory directly correlates with the proportional share of CPU power and network bandwidth provided to the function. By increasing memory, the function gains access to more computational resources, enabling it to process data faster, complete its tasks within the allowed timeout period, and improve overall performance for compute- or I/O-intensive workloads.

Why this answer

Increasing the Lambda function memory to 3008 MB is correct because Lambda allocates CPU proportionally to memory, and more CPU reduces processing time for CPU-bound tasks like file parsing. The 15-minute timeout is already the maximum, so the issue is insufficient compute resources, not timeout duration. With 512 MB, the function lacks the CPU throughput to process large files within the timeout, so boosting memory (and thus CPU) directly addresses the root cause.

Exam trap

The trap here is that candidates assume the 15-minute timeout is the problem and try to reduce it (Option C) or change invocation patterns (Option B), when the real issue is that Lambda's CPU allocation scales with memory, and insufficient memory leads to insufficient CPU for large file processing.

How to eliminate wrong answers

Option A is wrong because Amazon S3 Batch Operations are designed for bulk actions on existing objects (e.g., tagging, copying) and cannot split files before processing; splitting would require a separate preprocessing step, not a batch operation. Option B is wrong because adding an S3 Event Notification to trigger the function asynchronously does not change the function's execution environment or resource limits; it only changes invocation mode, and the function will still time out if it cannot process the file within the timeout. Option C is wrong because reducing the Lambda timeout to 5 minutes would make the problem worse—it would force the function to fail even faster, as it already times out at 15 minutes due to insufficient CPU.

Practice this question →
4
Multi-Selectmedium

A company's application runs on Amazon EC2 instances in an Auto Scaling group. The application experiences intermittent failures, and the developer suspects the application is not properly handling termination notifications. Which TWO steps should the developer take to diagnose the issue?

Select 2 answers
A.Enable detailed monitoring on the Auto Scaling group.
B.Configure a CloudWatch Events rule to capture Auto Scaling termination events.
C.Install the CloudWatch Logs agent on the instances to capture application logs.
D.Add a lifecycle hook to the Auto Scaling group to pause termination.
E.Use an Elastic Load Balancer to replace instances automatically.
AnswersB, D

A CloudWatch Events (now Amazon EventBridge) rule can match Auto Scaling lifecycle events such as EC2 Instance-terminate or EC2 Instance Launch. When a termination event occurs, the rule can trigger a Lambda function, SNS topic, or SQS queue to log, alert, or execute remediation. This directly captures termination signals and is the appropriate fully managed way to react to Auto Scaling terminations without modifying the group's behavior.

Why this answer

Options B and D are correct. B: CloudWatch Events can capture termination events, which can be used to trigger notifications. D: Lifecycle hooks allow the instance to perform actions before termination.

Option A is wrong because detailed monitoring does not capture termination signals. Option C is wrong because CloudWatch Logs agent is for logs, not for termination notifications. Option E is wrong because replacing instances does not diagnose the issue.

Practice this question →
5
MCQmedium

A developer is troubleshooting an AWS Lambda function that processes records from an Amazon Kinesis Data Stream. The function is configured with a batch size of 100 and a parallelization factor of 1. The developer notices that the function is processing records slowly, and the iterator age is increasing. CloudWatch Logs show that the function is not experiencing errors or throttling, but the execution time per invocation is close to the 5-minute timeout. The stream has 10 shards. What is the most cost-effective way to increase processing throughput?

A.Increase the batch size to 1000
B.Increase the parallelization factor to 10
C.Increase the memory of the Lambda function
D.Split the stream into more shards
AnswerB

The parallelization factor determines the number of concurrent Lambda invocations per shard. Increasing it allows multiple invocations to process records from the same shard simultaneously, dramatically increasing throughput without additional shard costs.

Why this answer

Increasing the parallelization factor to 10 allows each shard to be processed by up to 10 concurrent Lambda invocations, which directly increases throughput without additional shard costs. Since the function is not throttled or erroring, the bottleneck is the per-invocation processing time; parallelization reduces the iterator age by processing multiple batches per shard simultaneously.

Exam trap

The trap here is that candidates often assume increasing shards is the only way to scale Kinesis processing, but the parallelization factor is a cost-effective Lambda-specific tuning knob that increases concurrency without additional shard costs.

How to eliminate wrong answers

Option A is wrong because the batch size is already 100, and increasing it to 1000 would likely cause the function to exceed the 5-minute timeout even more, as it would need to process more records per invocation, worsening the iterator age. Option C is wrong because increasing memory may reduce execution time for CPU-bound tasks, but the logs show the function is close to timeout, not CPU-bound, and memory increases cost without guaranteed throughput improvement for I/O-bound Kinesis processing. Option D is wrong because splitting the stream into more shards increases AWS costs and complexity, and the existing 10 shards are not fully utilized due to the parallelization factor of 1; adding shards does not address the per-shard concurrency bottleneck.

Practice this question →
6
MCQeasy

A developer is using Amazon DynamoDB for a new application. The developer wants to reduce read latency. Which design pattern should the developer use?

A.Create a global secondary index (GSI) for the table.
B.Increase the provisioned read capacity units (RCUs) for the table.
C.Use DynamoDB Global Tables to replicate data to multiple regions.
D.Use DynamoDB Accelerator (DAX) as a cache for frequently read items.
AnswerD

DynamoDB Accelerator (DAX) is a fully managed, in-memory cache specifically designed to sit in front of DynamoDB tables, providing microsecond read latency for frequently accessed items. By caching read-heavy workloads, DAX significantly reduces the response time for repeated requests, offloading the DynamoDB table and improving application performance for read-intensive operations.

Why this answer

DynamoDB Accelerator (DAX) is an in-memory cache designed specifically for DynamoDB, providing microsecond read latency for frequently accessed items. By caching read-heavy workloads, DAX offloads requests from the DynamoDB table, reducing read latency without requiring application-level caching logic. This directly addresses the developer's goal of reducing read latency.

Exam trap

The trap here is that candidates often confuse increasing provisioned capacity (Option B) with reducing latency, when in fact it only increases throughput, while DAX (Option D) directly addresses latency by caching reads in memory.

How to eliminate wrong answers

Option A is wrong because a Global Secondary Index (GSI) provides an alternative query pattern or sort key, but does not inherently reduce read latency; it may even add latency due to asynchronous replication. Option B is wrong because increasing provisioned read capacity units (RCUs) improves throughput (handling more requests per second) but does not reduce per-request latency, as DynamoDB's read latency is already low and consistent regardless of RCU level. Option C is wrong because DynamoDB Global Tables replicate data across regions for disaster recovery and low-latency reads in remote regions, but for a single-region application, it adds complexity and cost without reducing local read latency.

Practice this question →
7
MCQmedium

A developer is deploying a serverless application using AWS CloudFormation. The stack creation fails with the error 'CREATE_FAILED: The following resource(s) failed to create: [MyLambdaFunction]'. The developer checks the CloudFormation events and sees 'Resource creation cancelled'. What is the most likely cause?

A.The Lambda function code is too large and exceeds the deployment limit.
B.The Lambda function creation timed out due to a network issue.
C.Another resource in the stack failed, triggering a rollback and cancelling the Lambda creation.
D.The Lambda function's execution role is missing permissions.
AnswerC

When deploying resources using AWS CloudFormation, the deployment process is atomic. If any single resource within a CloudFormation stack fails to create, update, or delete, CloudFormation initiates an automatic rollback of the entire stack to its last stable state. In this scenario, if the Lambda function was pending creation or in the process of being created when another resource in the same stack encountered a failure, its creation would be explicitly cancelled as part of this rollback mechanism, resulting in the 'Resource creation cancelled' status.

Why this answer

The error 'Resource creation cancelled' indicates that the creation of the Lambda function was aborted because another resource in the stack failed. CloudFormation by default rolls back the stack on failure, cancelling any in-progress resource creations. Thus, option C is correct.

Option A is incorrect because large code would cause a different error (e.g., 'RequestEntityTooLargeException'). Option B is incorrect because a timeout would show 'CREATE_FAILED' with a timeout message, not 'cancelled'. Option D is incorrect because missing permissions would result in a different error (e.g., 'AccessDeniedException') during invocation, not creation.

Practice this question →
8
MCQmedium

A web application running on EC2 instances behind an Application Load Balancer (ALB) is experiencing intermittent 503 errors. The ALB target group health checks are succeeding. Which step should the developer take FIRST to diagnose the issue?

A.Increase the number of EC2 instances in the target group.
B.Examine the ALB access logs for 503 responses.
C.Check the Route 53 record for the ALB.
D.Verify that the EC2 instances are in a running state.
AnswerB

Examining ALB access logs is the most effective diagnostic step because these logs capture detailed information about every request processed by the load balancer, including the HTTP status code returned to the client and the target status code from the EC2 instance. Filtering for 503 responses ("HTTP 503" or "target_status_code:503") allows identification of specific request patterns, source IPs, or target groups that are experiencing issues. This data helps pinpoint whether the 503s are due to application errors, target connection issues, or other load balancer-related problems.

Why this answer

The correct first step is to examine the ALB access logs for 503 responses. Since health checks are succeeding, the EC2 instances are considered healthy by the target group, but the ALB itself may be returning 503 errors due to issues like request rate limits, connection limits, or backend response timeouts. Access logs provide detailed HTTP response codes and timestamps, allowing you to identify the pattern and cause of the 503 errors without making assumptions about instance count or state.

Exam trap

The trap here is that candidates assume 503 errors always mean unhealthy instances, so they jump to checking instance state or scaling, ignoring that health checks are passing and that ALB-level issues (like connection limits or timeouts) are the actual cause.

How to eliminate wrong answers

Option A is wrong because increasing the number of EC2 instances does not address the root cause of 503 errors when health checks are passing; it may mask the issue but does not diagnose it. Option C is wrong because Route 53 records only affect DNS resolution, not the ALB's ability to forward requests to healthy targets; a misconfigured Route 53 record would cause different errors (e.g., 503 or connection failures) but checking it first is premature when the ALB itself is reachable. Option D is wrong because the health checks are succeeding, which already confirms the EC2 instances are in a running state and responding to health check pings; verifying instance state again is redundant and does not explain the intermittent 503 errors.

Practice this question →
9
Multi-Selecthard

A Lambda function reading from Kinesis is falling behind. Which two metrics/settings should be reviewed first?

Select 2 answers
A.IteratorAge for the event source mapping
B.S3 bucket public access settings
C.Route 53 hosted zone count
D.Batch size, parallelization factor, and shard count
AnswersA, D

IteratorAge is a critical Amazon Kinesis Streams metric, reported by the Event Source Mapping, that measures the age of the last record successfully processed by the Lambda function. A consistently high or increasing IteratorAge directly indicates that the Lambda function is falling behind in processing records from the Kinesis stream. This metric provides a real-time, direct measurement of the processing lag, making it the primary indicator for diagnosing such issues.

Why this answer

The IteratorAge metric measures how far behind the Lambda function is in processing records from the Kinesis stream. A high IteratorAge indicates the function is falling behind, making it the primary metric to review. The batch size, parallelization factor, and shard count directly control the concurrency and throughput of the event source mapping, so adjusting these settings can help catch up.

Exam trap

The trap here is that candidates may overlook the direct performance-tuning metrics (IteratorAge, batch size, parallelization factor) and instead focus on unrelated AWS services like S3 or Route 53, which are red herrings in this troubleshooting context.

Practice this question →
10
MCQeasy

An application running on Amazon ECS with Fargate is unable to pull an image from Amazon ECR. The task definition uses the 'default' task execution role. What is the most likely cause?

A.The task role does not have permissions to access ECR.
B.The ECS cluster does not have permissions to access ECR.
C.The ECS service role does not have permissions to access ECR.
D.The task execution role does not have permissions to pull from ECR.
AnswerD

The Amazon ECS task execution role grants permissions to the ECS agent or the Fargate infrastructure to perform essential actions on your behalf, *before* your application code even starts. This includes crucial operations such as pulling container images from Amazon ECR, pushing container logs to Amazon CloudWatch Logs, and retrieving sensitive data from AWS Secrets Manager or Parameter Store for image pull authentication. For successful image retrieval, this role specifically requires permissions like `ecr:GetDownloadUrlForLayer`, `ecr:BatchGetImage`, and `ecr:BatchCheckLayerAvailability` to authenticate and download image layers, without which the task launch will fail.

Why this answer

When using Amazon ECS with Fargate, the task execution role (not the task role) is responsible for pulling container images from Amazon ECR. The 'default' task execution role is created automatically but lacks the necessary permissions (e.g., ecr:GetDownloadUrlForLayer, ecr:BatchGetImage, and ecr:BatchCheckLayerAvailability) unless explicitly attached via an IAM policy. Since the question states the task definition uses the 'default' task execution role, the most likely cause is that this role does not have the required ECR permissions.

Exam trap

The trap here is that candidates often confuse the task execution role with the task role, assuming the task role handles all permissions including image pulling, when in fact the task execution role is a separate IAM role specifically required for ECR image pulls and CloudWatch Logs.

How to eliminate wrong answers

Option A is wrong because the task role is used by the application code running inside the container to interact with AWS services (e.g., DynamoDB, S3), not for pulling images from ECR; image pulling is handled by the ECS agent using the task execution role. Option B is wrong because an ECS cluster itself does not have an IAM role or permissions; permissions are assigned to the task execution role or the ECS service role, not to the cluster resource. Option C is wrong because the ECS service role (formerly ecsServiceRole) is used for actions like registering/deregistering targets with a load balancer, not for pulling container images from ECR; image pulling is exclusively the responsibility of the task execution role.

Practice this question →
11
MCQmedium

A developer is troubleshooting an AWS Lambda function that is triggered by an Amazon SQS queue. The function processes messages but occasionally fails. The failed messages are not being sent to the dead-letter queue (DLQ). What is the most likely reason?

A.The Lambda function's execution role does not have permission to send messages to the DLQ.
B.The SQS queue's redrive policy is not configured.
C.The Lambda function's reserved concurrency is set to 0.
D.The Lambda function does not have a dead-letter queue configured.
AnswerB

When an AWS Lambda function processes messages from an SQS queue, and an invocation fails (e.g., due to an error in the function code or a timeout), SQS will return the message to the queue after its visibility timeout expires. If the message processing continues to fail and the SQS queue does not have a redrive policy configured, the message will eventually be discarded by SQS after its maximum receive count is exceeded, rather than being moved to a Dead-Letter Queue (DLQ). Therefore, a missing redrive policy directly prevents failed messages from being captured in a DLQ associated with the source queue.

Why this answer

When Lambda is triggered by SQS, the recommended approach is to configure a dead-letter queue (DLQ) on the SQS queue itself using a redrive policy. This ensures that messages that fail processing after reaching the maximum receive count are automatically moved to the DLQ. Option B is correct because the absence of a redrive policy means failed messages remain in the main queue or are discarded, not sent to a DLQ.

Option D is incorrect; configuring a DLQ on the Lambda function is intended for asynchronous invocations, not SQS-triggered Lambda. Option A is incorrect because the redrive policy does not rely on Lambda's IAM role; it is a configuration on the SQS queue. Option C is incorrect because reserved concurrency set to 0 would prevent all invocations, but the issue described is about occasional failures, not complete lack of invocation.

Exam trap

Candidates often confuse the two types of DLQs: Lambda function DLQ (for asynchronous invocations) and SQS queue DLQ (redrive policy). For SQS-triggered Lambda, the correct DLQ is on the SQS queue, not on the Lambda function.

Practice this question →
12
MCQmedium

A developer monitors an AWS Lambda function that processes messages from an Amazon SQS queue. CloudWatch logs show that the function's execution time has increased significantly over the past week. The function's code has not been changed recently. The function makes calls to an Amazon DynamoDB table. CloudWatch metrics show a high rate of DynamoDBProvisionedThroughputExceededException errors. The DynamoDB table has 5 read and 5 write capacity units (RCU/WCU). What is the most effective action to reduce the function's execution time?

A.Increase the Lambda function's memory allocation.
B.Increase the Lambda function's reserved concurrency.
C.Increase the DynamoDB table's read and write capacity units.
D.Increase the Lambda function's timeout.
AnswerC

Raising the provisioned capacity reduces the frequency of throttling exceptions. With fewer throttles, the function's retries decrease, leading to faster execution and lower overall latency.

Why this answer

The high rate of DynamoDBProvisionedThroughputExceededException errors indicates that the Lambda function is being throttled by DynamoDB due to insufficient read and write capacity units. This throttling causes the function to retry operations, significantly increasing execution time. Increasing the RCU/WCU from 5 to a higher value directly addresses the bottleneck, allowing operations to complete without retries and reducing overall execution time.

Exam trap

The trap here is that candidates often confuse performance issues caused by Lambda resource limits (memory, concurrency, timeout) with downstream service throttling, leading them to adjust Lambda settings instead of addressing the root cause in DynamoDB capacity.

How to eliminate wrong answers

Option A is wrong because increasing memory allocation improves CPU performance and execution speed for compute-bound tasks, but the issue here is a DynamoDB throughput limitation, not a lack of compute resources. Option B is wrong because reserved concurrency controls how many concurrent Lambda invocations are allowed, which does not affect the per-invocation execution time or resolve DynamoDB throttling errors. Option D is wrong because increasing the timeout only allows the function to run longer before being terminated, but it does not reduce the actual time taken to process each message; the function will still be delayed by DynamoDB retries.

Practice this question →
13
MCQeasy

A developer reports that an AWS Lambda function is timing out after 3 seconds. The function reads from an Amazon SQS queue. What is the most likely cause?

A.The Lambda function memory is set too low, causing slow execution.
B.The Lambda function timeout is set to 3 seconds, which is too low.
C.The Lambda execution role lacks permissions to poll SQS.
D.The SQS queue is empty, causing the function to wait indefinitely.
AnswerB

AWS Lambda functions have a configurable timeout setting, with a default value of 3 seconds. If the function's execution logic, including any external API calls or complex processing, exceeds this configured duration, Lambda will forcibly terminate the invocation and report a timeout error. This is a common and direct cause for consistent timeouts occurring at a specific, short duration.

Why this answer

The Lambda function is timing out after exactly 3 seconds because its configured timeout is set to 3 seconds, which is too low for the workload. Lambda has a maximum execution timeout of 15 minutes (900 seconds), but the default timeout is 3 seconds. Since the function reads from an SQS queue, it likely needs more time to process messages, and increasing the timeout value will resolve the issue.

Exam trap

The trap here is that candidates often confuse timeout with memory or permissions issues, but the exact 3-second timeout is a direct indicator of the default Lambda timeout being too low, not a resource or authorization problem.

How to eliminate wrong answers

Option A is wrong because low memory can cause slower execution, but it would not cause a hard timeout at exactly 3 seconds; memory affects performance, not the timeout limit. Option C is wrong because if the execution role lacked permissions to poll SQS, the function would fail with an access denied error (e.g., 403 or 500), not a timeout. Option D is wrong because an empty SQS queue does not cause a Lambda function to wait indefinitely; Lambda polls the queue and returns immediately if no messages are available, and the function would complete quickly without timing out.

Practice this question →
14
MCQhard

A web application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). During peak hours, users report receiving HTTP 503 (Service Unavailable) errors. The developer checks Amazon CloudWatch metrics and finds that the ALB's request count is high but below the limit, and the target group's healthy host count drops to zero intermittently. The Auto Scaling group for the instances is configured with a minimum of 2, maximum of 10, and a simple scaling policy to add 2 instances when CPU utilization exceeds 70% for 5 consecutive minutes. What is the most likely cause of the 503 errors?

A.The Auto Scaling group's cooldown period prevents new instances from being added quickly enough during rapid traffic spikes
B.The ALB's idle timeout is set too low, causing dropped connections
C.The Auto Scaling group's maximum capacity of 10 is insufficient
D.The health check grace period is preventing instances from being marked healthy
AnswerA

During a rapid traffic spike, an Auto Scaling group's cooldown period, typically 300 seconds by default, prevents additional scaling activities from initiating immediately after a previous one. This delay means that even if the scaling policy is triggered multiple times, new instances cannot launch quickly enough to meet the escalating demand. Consequently, existing instances become overloaded and unhealthy, leading to 503 Service Unavailable errors as the application cannot process requests.

Why this answer

The 503 errors occur because the simple scaling policy has a cooldown period (default 300 seconds) that prevents the Auto Scaling group from launching new instances during rapid traffic spikes. When CPU exceeds 70% for 5 minutes, the policy adds 2 instances, but the cooldown blocks further scaling actions until it expires, even if the newly launched instances are still initializing and the healthy host count drops to zero. This mismatch between traffic demand and scaling responsiveness causes the ALB to have no healthy targets, resulting in 503 errors.

Exam trap

The trap here is that candidates often assume 503 errors are always due to capacity limits (Option C) or misconfigured health checks (Option D), but the real issue is the cooldown period's impact on scaling responsiveness during rapid traffic spikes.

How to eliminate wrong answers

Option B is wrong because the ALB's idle timeout (default 60 seconds) controls how long the ALB keeps a connection open without data transfer; it does not cause 503 errors or affect target health status. Option C is wrong because the maximum capacity of 10 is not the issue—the healthy host count drops to zero intermittently, indicating a scaling responsiveness problem, not a capacity ceiling. Option D is wrong because the health check grace period (default 300 seconds) delays the start of health checks for newly launched instances, but it does not cause healthy hosts to drop to zero; it only postpones marking them healthy, which would not explain intermittent drops in an already-running group.

Practice this question →
15
MCQhard

An application running on EC2 instances behind an Application Load Balancer (ALB) occasionally returns HTTP 503 errors. The instances are in an Auto Scaling group. Which action should be taken to resolve this issue?

A.Enable cross-zone load balancing on the ALB.
B.Review the ALB access logs to identify the target response codes.
C.Increase the ALB idle timeout setting.
D.Increase the size of the EC2 instances.
AnswerB

Access logs show whether the 503 is from targets or the ALB, guiding further action.

Why this answer

HTTP 503 errors from an ALB indicate that the targets (EC2 instances) are not responding successfully. Reviewing ALB access logs reveals the specific target response codes (e.g., 503 from the target itself or connection timeouts), which helps pinpoint whether the issue is due to overloaded instances, application errors, or health check failures. This diagnostic step is essential before making any configuration changes.

Exam trap

The trap here is that candidates often jump to scaling or instance size changes (Option D) without first using access logs to diagnose whether the 503s originate from the ALB or the targets, leading to ineffective fixes.

How to eliminate wrong answers

Option A is wrong because cross-zone load balancing is enabled by default on ALBs and affects traffic distribution across Availability Zones, not the root cause of 503 errors from unresponsive targets. Option C is wrong because the ALB idle timeout setting controls how long the ALB keeps a connection open without data transfer; increasing it does not resolve 503 errors caused by target failures or overload. Option D is wrong because simply increasing EC2 instance size may mask the problem but does not address the underlying cause (e.g., application bugs, scaling policies, or health check misconfigurations) and could lead to unnecessary cost.

Practice this question →
16
MCQmedium

A developer notices that an AWS Lambda function configured with a VPC is timing out when trying to access an Amazon S3 bucket. The function has the necessary IAM permissions. What is the most likely cause?

A.Lambda functions cannot be configured inside a VPC.
B.The Lambda function's execution role lacks S3 permissions.
C.The Lambda function does not have a route to the internet or a VPC endpoint for S3.
D.The security group attached to the Lambda function does not allow outbound traffic to S3.
AnswerC

This is correct. When a Lambda function is configured inside a VPC, it loses internet access by default. To access S3, the function needs either a VPC endpoint for S3 or a route to the internet via a NAT Gateway/Instance. Without this, the function times out.

Why this answer

The function times out because it cannot reach S3. Since the function is in a VPC, it does not have internet access by default. To access S3, it requires either a NAT gateway/instance and an internet gateway, or a VPC endpoint for S3.

Option A is incorrect because Lambda functions can be configured inside a VPC; they just need proper networking. Option B is incorrect because the question states the function has the necessary IAM permissions, so the execution role is not the issue. Option D is incorrect because security groups are stateful and typically allow outbound traffic; the more likely cause is missing routing to S3.

Option C correctly identifies the missing route or endpoint.

Practice this question →
17
Multi-Selecteasy

A developer is troubleshooting a slow RDS MySQL instance. Which TWO metrics in Amazon CloudWatch should the developer examine first?

Select 2 answers
A.NetworkReceiveThroughput
B.SwapUsage
C.CPUUtilization
D.FreeStorageSpace
E.ReadLatency
AnswersC, E

CPUUtilization shows the percentage of allocated compute capacity being consumed on the RDS instance. For a slow MySQL instance, high and sustained CPU utilization is a classic indicator that the database is working too hard, often due to inefficient queries, missing indexes, or a burst of concurrent traffic. When CPU is saturated, query execution queues build up, directly increasing response times, so this is the most direct metric to investigate first for a slow instance.

Why this answer

The correct metrics to examine first for a slow RDS MySQL instance are CPUUtilization and ReadLatency. High CPUUtilization indicates that the instance is under heavy load, possibly from inefficient queries or inadequate compute capacity. High ReadLatency suggests slow I/O, which could be due to disk contention or suboptimal queries.

NetworkReceiveThroughput (A) is related to network traffic, not database performance. SwapUsage (B) is not typically a primary metric for RDS performance. FreeStorageSpace (D) indicates storage capacity but does not directly measure performance.

Therefore, options C and E are the correct choices.

Practice this question →
18
MCQmedium

An application running on Amazon ECS with Fargate is experiencing high latency. The application writes logs to Amazon CloudWatch Logs. Which AWS service can be used to analyze the logs to pinpoint the cause of the latency?

A.Amazon CloudWatch Logs
B.Amazon CloudWatch Logs Insights
C.AWS X-Ray
D.Amazon S3
AnswerB

Amazon CloudWatch Logs Insights is specifically designed for interactively searching, analyzing, and visualizing log data to troubleshoot operational problems and identify performance bottlenecks. It allows users to run powerful queries using a purpose-built query language to filter, aggregate, and extract specific information from log events, making it ideal for pinpointing the root causes of latency within application logs. This direct analytical capability is crucial for diagnosing issues.

Why this answer

Amazon CloudWatch Logs Insights is the correct choice because it is purpose-built for interactively querying and analyzing log data stored in CloudWatch Logs. It allows you to run SQL-like queries (using a query language) to filter, aggregate, and visualize log events, which is essential for pinpointing latency patterns, such as slow API calls or database queries, without needing to export logs to another service.

Exam trap

The trap here is that candidates confuse CloudWatch Logs (storage/monitoring) with CloudWatch Logs Insights (query/analysis), assuming the former can perform deep log analysis, when in fact it only supports basic metric filters and real-time monitoring.

How to eliminate wrong answers

Option A is wrong because Amazon CloudWatch Logs itself is a log storage and monitoring service, not a query engine; it can only view raw log streams or set metric filters, not perform ad-hoc analytical queries to diagnose latency. Option C is wrong because AWS X-Ray is a distributed tracing service that traces requests through microservices, but it does not analyze CloudWatch Logs; it uses its own trace data and segments, not log files. Option D is wrong because Amazon S3 is an object storage service; while logs can be exported to S3, it provides no built-in querying capability for log analysis without additional services like Athena.

Practice this question →
19
MCQhard

An application running on Amazon ECS (Fargate) uses an Application Load Balancer (ALB) with connection draining enabled. The application is experiencing intermittent 502 (Bad Gateway) errors during rolling updates of the ECS service. The developer notices that the ALB is routing requests to tasks that are in the 'Draining' state. The ECS service is configured with a deployment circuit breaker that automatically rolls back a failed deployment. What is the most likely cause of the 502 errors?

A.The ALB's idle timeout is too short, causing connections to be dropped before the application responds.
B.The ALB's connection draining timeout is set to 0 seconds, causing connections to be dropped immediately when deregistering targets.
C.The ECS deployment circuit breaker is incorrectly configured to roll back on health check failures.
D.The application is not handling the SIGTERM signal from ECS, causing it to terminate abruptly while the ALB still routes traffic to it.
AnswerD

When ECS stops a task, it sends a SIGTERM signal to allow the application to gracefully shut down. If the application does not catch this signal and stop accepting new connections or complete in-flight requests before exiting, the ALB may still send traffic to the task after it stops, resulting in 502 errors. This is a common issue during rolling updates.

Why this answer

When ECS sends a SIGTERM signal to a Fargate task during a rolling update, the task is expected to gracefully shut down. If the application does not handle SIGTERM, it terminates immediately, but the ALB may still have the task registered as a target and continue routing requests to it. Since the task is already dead or unresponsive, the ALB receives no valid HTTP response and returns a 502 Bad Gateway error.

Connection draining is enabled, but it only works if the task signals the ALB that it is deregistering; without proper SIGTERM handling, the task dies before the draining process completes.

Exam trap

The trap here is that candidates often assume connection draining is a silver bullet that prevents all errors during rolling updates, but they overlook that the application must handle SIGTERM to allow the draining process to work as intended.

How to eliminate wrong answers

Option A is wrong because the ALB's idle timeout (default 60 seconds) controls how long the ALB keeps a connection open without data transfer; it does not cause 502 errors during rolling updates, as 502s stem from the target not responding, not from idle timeouts. Option B is wrong because setting connection draining timeout to 0 seconds would cause immediate deregistration, which would prevent routing to draining tasks, not cause 502 errors; the problem here is that tasks are still receiving traffic while draining, which is the opposite scenario. Option C is wrong because the deployment circuit breaker rolls back the entire deployment on health check failures, but it does not cause 502 errors during the update; it is a recovery mechanism, not a root cause of the errors.

Practice this question →
20
MCQmedium

A developer monitors an AWS Lambda function that processes messages from an Amazon SQS queue. CloudWatch logs show that the function's execution time has increased significantly over the past week, and it now frequently times out at the 5-minute timeout. The function's code has not been changed recently. The function makes calls to an Amazon DynamoDB table. What is the most likely cause of the increased execution time?

A.The DynamoDB table's read capacity units are underprovisioned, causing throttling.
B.The SQS queue's visibility timeout is too short, causing duplicate processing.
C.The Lambda function's memory is too low, causing CPU throttling.
D.The DynamoDB table's indexes are missing, causing full table scans.
AnswerA

When a Lambda function attempts to read from a DynamoDB table with insufficient Read Capacity Units (RCUs), DynamoDB will throttle the requests. This throttling results in ProvisionedThroughputExceededException errors, forcing the Lambda function to implement retry logic, which significantly prolongs its execution time. Repeated retries against a persistently throttled table can cause the function to approach or exceed its configured timeout, indicating a clear resource bottleneck.

Why this answer

The most likely cause is that the DynamoDB table's read capacity units are underprovisioned, leading to throttling (ProvisionedThroughputExceededException). When DynamoDB throttles requests, the Lambda function must retry them, which adds latency and can cause the function to exceed its 5-minute timeout. Since the code hasn't changed, this points to a scaling or capacity issue on the DynamoDB side.

Exam trap

The trap here is that candidates may confuse DynamoDB throttling with Lambda timeout configuration, overlooking that gradual performance degradation often points to downstream resource contention rather than function configuration.

How to eliminate wrong answers

Option B is wrong because a short SQS visibility timeout would cause duplicate processing, not increased execution time; duplicates would result in more invocations, not slower individual runs. Option C is wrong because low memory in Lambda causes CPU throttling only if the function is CPU-bound; memory allocation affects CPU proportionally, but the described symptom (increased execution time without code changes) is not typically caused by memory alone. Option D is wrong because missing indexes would cause full table scans, which would increase execution time from the start, not gradually over a week; this would be a code or schema issue, not a gradual degradation.

Practice this question →
21
MCQhard

A developer deployed a new version of an AWS Lambda function that is part of a serverless application. The function uses an Amazon DynamoDB table as a data store. After deployment, the developer notices that the function's latency has increased significantly for some requests. CloudWatch traces show that the increase is due to DynamoDB throttle events. The function is configured with a reserved concurrency of 100 and the DynamoDB table has 5 read capacity units (RCUs) and 5 write capacity units (WCUs). What is the most effective way to reduce the throttling while maintaining application performance?

A.Decrease the reserved concurrency of the Lambda function to 10
B.Increase the read and write capacity units on the DynamoDB table
C.Enable DynamoDB Accelerator (DAX) for caching reads
D.Enable auto scaling on the DynamoDB table
AnswerB

Increasing the read and write capacity units (RCU/WCU) on the DynamoDB table directly raises its maximum sustained throughput. These units define the number of strongly consistent reads and 1KB writes the table can handle per second. By provisioning more capacity, the table can accommodate a higher volume of operations, directly mitigating throttling errors that occur when request rates exceed the current limits.

Why this answer

The primary cause of the throttling is insufficient DynamoDB capacity to handle the request volume from the Lambda function. Increasing the read and write capacity units (RCUs/WCUs) directly addresses the throttle events by providing more throughput to match the function's concurrency of 100. This is the most effective solution because it resolves the bottleneck at the data store level without reducing the application's ability to process requests concurrently.

Exam trap

The trap here is that candidates may choose auto scaling (Option D) thinking it dynamically handles spikes, but they overlook that auto scaling has a significant lag and cannot prevent immediate throttling, whereas increasing the base capacity is the immediate and effective solution.

How to eliminate wrong answers

Option A is wrong because decreasing reserved concurrency to 10 would reduce the number of concurrent Lambda invocations, which would lower the request rate to DynamoDB and potentially reduce throttling, but it would also severely degrade application performance by limiting throughput and increasing latency for legitimate traffic. Option C is wrong because DynamoDB Accelerator (DAX) is an in-memory cache that only accelerates read operations (GetItem, Query, Scan) and does not help with write throttling or reduce write capacity consumption; the question does not specify that the throttling is read-only, and DAX cannot mitigate write capacity throttling. Option D is wrong because enabling auto scaling on the DynamoDB table would adjust capacity over time based on traffic patterns, but it cannot react instantly to sudden spikes in demand; auto scaling has a lag of several minutes, so it would not prevent the immediate throttle events that are already occurring, and it does not address the need for a higher baseline capacity to match the Lambda's concurrency.

Practice this question →
22
MCQmedium

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). Users report intermittent 503 errors. The ALB health checks are failing for a few instances, but the instances themselves are running and have healthy application processes. What is the MOST likely cause?

A.The ALB is not scaled to handle the traffic.
B.The security group for the EC2 instances is not allowing traffic from the ALB.
C.The DNS resolution via Route53 is misconfigured.
D.Sticky sessions are not enabled on the ALB.
AnswerB

The security group associated with the EC2 instances acts as a virtual firewall, controlling inbound and outbound traffic. For ALB health checks to succeed, the EC2 instance's security group must have an inbound rule that explicitly permits traffic from the ALB's security group or its private IP range on the health check port. If this rule is missing or misconfigured, the ALB's health check probes will be blocked at the network level, preventing a successful connection and causing the ALB to mark the instance as unhealthy.

Why this answer

The ALB health checks are failing despite the instances and application processes being healthy, which indicates a network-level issue. The most likely cause is that the EC2 instances' security group is not allowing inbound traffic from the ALB's security group on the health check port (e.g., HTTP/HTTPS). Without this rule, the ALB cannot reach the health check endpoint, marking the instances as unhealthy and causing intermittent 503 errors when traffic is routed to those instances.

Exam trap

The trap here is that candidates often assume health check failures are always due to application issues (e.g., process crashes) rather than network-layer misconfigurations like security group rules, especially when the instance appears healthy from within the OS.

How to eliminate wrong answers

Option A is wrong because the ALB scales automatically based on traffic patterns and does not require manual scaling; 503 errors from insufficient capacity would be persistent, not intermittent, and would affect all instances. Option C is wrong because DNS misconfiguration via Route53 would cause resolution failures (e.g., NXDOMAIN) or routing to the wrong endpoint, not intermittent 503 errors from healthy instances behind an ALB. Option D is wrong because sticky sessions (session affinity) do not affect health checks or 503 errors; they only control how requests are distributed to the same target, and their absence would not cause health check failures.

Practice this question →
23
MCQhard

A developer is troubleshooting an AWS Lambda function that experiences high latency for the first few invocations after being idle. The function is written in Python and uses a large library (e.g., Pandas). The function connects to an RDS database in a VPC. What is the most effective way to reduce the latency for the first invocation after idle?

A.Increase the function's memory allocation to 3008 MB.
B.Enable provisioned concurrency on the function.
C.Move the large library to a Lambda layer.
D.Replace the RDS database with Amazon DynamoDB.
AnswerB

Provisioned concurrency pre-initializes a specified number of execution environments for a Lambda function, ensuring they are ready to process requests immediately. This effectively eliminates cold start latency for invocations routed to these pre-warmed instances, as the entire initialization phase (including code download, runtime bootstrapping, and `init` code execution) has already completed. It guarantees consistently low latency for critical, latency-sensitive applications by maintaining a pool of ready-to-go containers.

Why this answer

Provisioned concurrency keeps a specified number of execution environments initialized and ready to respond immediately, eliminating the cold start latency that occurs after a period of idle time. This is the most direct solution for reducing latency on the first invocation after idle, especially for functions with large libraries like Pandas that take significant time to load.

Exam trap

The trap here is that candidates often confuse cold start mitigation strategies like increasing memory or using layers with the only AWS feature that truly eliminates cold starts for idle functions: provisioned concurrency.

How to eliminate wrong answers

Option A is wrong because increasing memory allocation can improve CPU performance and reduce cold start time slightly, but it does not eliminate the cold start itself; the function still needs to load the large library and establish the VPC connection from scratch after idle. Option C is wrong because moving the library to a Lambda layer does not reduce cold start latency; layers are simply a packaging mechanism and the library still must be loaded into memory during initialization. Option D is wrong because replacing RDS with DynamoDB addresses database connection latency, not the cold start latency caused by loading the large Python library and initializing the function runtime.

Practice this question →
24
MCQmedium

A developer notices that an AWS Lambda function processing S3 events is being retried frequently due to throttling errors from Amazon DynamoDB. The function writes records to a DynamoDB table and has reserved concurrency set to 100. The DynamoDB table uses on-demand capacity mode. What should the developer do to reduce retries and improve overall throughput?

A.Increase the Lambda function's reserved concurrency to 500.
B.Implement exponential backoff and retry in the Lambda function code for DynamoDB API calls.
C.Disable the Lambda function's S3 event source mapping and use Amazon SQS to buffer events.
D.Switch the DynamoDB table to provisioned capacity with a high write capacity unit setting.
AnswerB

Implementing exponential backoff and retry in the Lambda function code for DynamoDB API calls is the most effective solution. This pattern automatically handles transient errors like throttling by retrying failed requests with progressively longer delays between attempts. This approach allows DynamoDB time to recover from temporary capacity constraints, significantly increasing the success rate of API calls without overwhelming the database, thus making the Lambda function more resilient.

Why this answer

Implementing exponential backoff and retry in the Lambda function code for DynamoDB API calls directly addresses the throttling errors. Even with on-demand capacity, DynamoDB can throttle requests if they exceed the table's burst capacity or if there are hot partitions. Exponential backoff reduces the retry rate, allowing DynamoDB to recover and improving overall throughput without changing the Lambda concurrency or capacity mode.

Exam trap

The trap here is that candidates assume increasing Lambda concurrency or switching to provisioned capacity will solve throttling, but the real issue is the retry strategy at the application layer, not the infrastructure scaling.

How to eliminate wrong answers

Option A is wrong because increasing reserved concurrency to 500 would only increase the number of concurrent Lambda invocations, which would exacerbate DynamoDB throttling by sending more requests simultaneously. Option C is wrong because disabling the S3 event source mapping and using SQS to buffer events would add latency and complexity but does not address the root cause of DynamoDB throttling; it only decouples the invocation, not the write errors. Option D is wrong because switching to provisioned capacity with a high write capacity unit setting does not guarantee elimination of throttling; on-demand mode already scales automatically, and the issue is likely due to request patterns or hot partitions, not capacity mode.

Practice this question →
25
MCQhard

A developer notices that an AWS Lambda function, which processes messages from an SQS queue, is taking longer than expected. The function has a reserved concurrency of 5 and a batch size of 10. The SQS queue has a large backlog. CloudWatch metrics show that the function's throttles are high. The function is idempotent and can process up to 100 messages per invocation. What is the most effective way to increase throughput without increasing reserved concurrency?

A.Increase the batch size to 100.
B.Increase reserved concurrency to 10.
C.Change the function timeout to 15 minutes.
D.Enable SQS short polling to reduce latency.
AnswerA

By increasing the SQS batch size to 100, the Lambda function processes up to 100 messages in a single invocation. Since the function is capable of handling this volume, this optimization significantly reduces the total number of Lambda invocations required to process a given message backlog. Fewer invocations directly translate to a lower invocation rate, effectively alleviating the throttling issues experienced by the function and optimizing resource utilization.

Why this answer

Increasing the batch size to 100 directly reduces the number of Lambda invocations required to process the backlog, thereby decreasing throttling without increasing reserved concurrency. The function's capacity to handle up to 100 messages per invocation makes this alignment optimal. SQS event source mappings support batch sizes up to 10,000 for standard queues, so a batch size of 100 is feasible.

Short polling (option D) would not improve throughput; it causes frequent empty responses and does not reduce throttling. Increasing reserved concurrency violates the constraint, and changing timeout (option C) does not address throttling.

Exam trap

A common pitfall is assuming that Lambda's SQS batch size is limited to 10. In fact, for standard queues the maximum is 10,000. Since the function can process up to 100 messages per invocation, increasing the batch size to 100 directly increases throughput without increasing reserved concurrency.

Candidates may also incorrectly consider increasing reserved concurrency, which is explicitly outside the scope of the question.

How to eliminate wrong answers

Option B is wrong because increasing reserved concurrency would increase the number of concurrent executions, which directly contradicts the requirement to not increase reserved concurrency. Option C is wrong because increasing the function timeout does not increase throughput; it only allows longer processing time per invocation, but the bottleneck is throttling due to concurrency limits, not execution duration. Option D is wrong because enabling SQS short polling reduces latency for message retrieval but does not increase the number of messages processed per invocation or reduce throttling; it may even increase the number of empty responses.

Practice this question →
26
MCQeasy

A developer notices that an S3 bucket used for static website hosting returns 403 Forbidden for anonymous requests. The bucket policy allows s3:GetObject for Principal "*". What is the most likely issue?

A.The bucket does not have server access logging enabled.
B.The bucket ACL does not allow public read.
C.The bucket policy is not attached to the correct bucket.
D.The S3 Block Public Access settings are enabled.
AnswerD

Amazon S3 Block Public Access settings provide a crucial security control designed to prevent unintended public exposure of S3 buckets and objects. These settings, configurable at both the account and bucket level, explicitly override all other access control mechanisms, including permissive bucket policies and object ACLs, that would otherwise grant public access. If these Block Public Access settings are enabled, they will effectively block all public access to the static website, regardless of any correctly configured bucket policies or ACLs intended to allow public reads.

Why this answer

D is correct because S3 Block Public Access settings, when enabled at the account or bucket level, override any bucket policy or ACL that grants public access. Even though the bucket policy allows s3:GetObject for Principal "*", the Block Public Access settings explicitly deny all public requests, resulting in a 403 Forbidden error for anonymous users.

Exam trap

The trap here is that candidates often assume a bucket policy granting public access is sufficient, overlooking the S3 Block Public Access settings which silently override such policies and cause 403 errors.

How to eliminate wrong answers

Option A is wrong because server access logging is a feature for logging requests to the bucket, not a permission control; it does not affect whether requests are allowed or denied. Option B is wrong because the bucket policy already grants public read access via Principal "*", and while ACLs can also grant public read, the bucket policy takes precedence; the issue is not the ACL but an overriding deny. Option C is wrong because the question states the bucket policy is attached and allows s3:GetObject, so the policy is correctly associated; the problem lies with a separate security mechanism.

Practice this question →
27
MCQhard

A company runs a monolithic application on EC2 Behind an Application Load Balancer. They want to migrate to a microservices architecture using ECS Fargate. What is the most important optimization to ensure minimal downtime during the migration?

A.Use a blue/green deployment strategy with weighted target groups.
B.Increase the EC2 instance size to handle the microservices load.
C.Deploy all microservices in a single ECS service for simplicity.
D.Scale horizontally by adding more EC2 instances.
AnswerA

A blue/green deployment strategy is ideal for migrating a monolithic application to microservices with minimal downtime. It involves running two identical environments: the existing 'blue' version and the new 'green' version with microservices. Weighted target groups, typically configured on an Application Load Balancer (ALB) or Route 53, allow for a controlled, gradual shift of traffic from the blue to the green environment, enabling real-time testing and easy rollback if issues occur.

Why this answer

A blue/green deployment strategy with weighted target groups allows you to gradually shift traffic from the existing monolithic EC2 application (blue) to the new microservices on ECS Fargate (green) while monitoring for errors. This minimizes downtime by enabling instant rollback if issues arise, and it leverages Application Load Balancer (ALB) features like stickiness and health checks to ensure a seamless transition without disrupting active connections.

Exam trap

The trap here is that candidates confuse scaling strategies (horizontal/vertical) with deployment strategies, assuming that adding more capacity or consolidating services will inherently reduce downtime, when in fact only a controlled traffic-shifting method like blue/green with weighted routing ensures minimal disruption during a live migration.

How to eliminate wrong answers

Option B is wrong because increasing EC2 instance size does not address the migration to microservices or ECS Fargate; it only scales the monolithic application vertically, which contradicts the goal of moving to a serverless container architecture and does not reduce downtime during migration. Option C is wrong because deploying all microservices in a single ECS service defeats the purpose of microservices isolation, scaling, and independent deployment; it introduces tight coupling and increases the blast radius of failures, leading to higher downtime risk. Option D is wrong because scaling horizontally by adding more EC2 instances only scales the monolithic application, not the microservices on Fargate, and does not provide a controlled traffic-shifting mechanism to minimize downtime during migration.

Practice this question →
28
MCQmedium

A developer configured an S3 bucket to trigger a Lambda function on object creation. The Lambda function processes the object and then deletes it. Some objects are not being processed. What should the developer do to ensure all objects are processed?

A.Assign a new IAM role to the Lambda function with S3 permissions.
B.Enable S3 versioning on the bucket.
C.Send S3 events to an SQS queue and configure the Lambda function to poll the queue.
D.Increase the Lambda function timeout.
AnswerC

Direct S3-to-Lambda invocations are 'at-least-once' but can occasionally miss events under specific conditions or if the Lambda invocation fails without successful retry. By sending S3 events to an SQS queue first, SQS acts as a durable buffer, ensuring messages are reliably stored and can be retried if the Lambda function fails to process them. The Lambda function then polls the SQS queue, pulling messages and processing them, leveraging SQS's built-in retry mechanisms and dead-letter queue capabilities for robust event handling and guaranteed delivery.

Why this answer

Sending S3 events to an SQS queue decouples event delivery from Lambda invocation. If the Lambda function fails or throttles, the event remains in the queue and can be retried, ensuring no objects are missed. Without a queue, S3 events that fail to invoke Lambda (e.g., due to concurrency limits) are lost, leading to unprocessed objects.

Exam trap

The trap here is that candidates assume the issue is a permission or timeout problem, when in fact the root cause is the loss of S3 event notifications due to Lambda throttling or transient failures, which a queue-based architecture resolves.

How to eliminate wrong answers

Option A is wrong because the Lambda function already processes and deletes objects, so it must already have S3 permissions; assigning a new IAM role would not fix lost events. Option B is wrong because enabling S3 versioning preserves object versions but does not affect event delivery reliability or retry behavior. Option D is wrong because increasing the Lambda function timeout addresses execution duration, not the loss of events due to throttling or invocation failures.

Practice this question →
29
MCQmedium

A developer is troubleshooting an AWS Lambda function that returns timeout errors when calling an external HTTPS API. The function is configured with a 30-second timeout and runs in a VPC with a public subnet and NAT Gateway. The developer checks CloudWatch logs and sees that the function is timing out at exactly 30 seconds. What is the most likely cause?

A.The NAT Gateway is not configured with a route to the internet.
B.The Lambda function's security group does not allow outbound traffic.
C.The external API's response time exceeds 30 seconds.
D.The Lambda function's VPC does not have an internet gateway.
AnswerB

This is the correct explanation. When a Lambda function is configured within a VPC, its network interfaces are subject to the associated security group rules. If the egress (outbound) rules of the security group do not explicitly permit traffic on the required port (e.g., HTTPS on port 443) to the external API's IP range or `0.0.0.0/0`, the connection attempt will be blocked. This blockage prevents the TCP handshake from completing, causing the function to wait indefinitely until its configured execution timeout is reached.

Why this answer

Lambda functions running in a VPC do not automatically get internet access; they require a route to a NAT Gateway or NAT instance. Even with a NAT Gateway, the Lambda function's security group must allow outbound traffic (e.g., HTTPS on port 443) to reach the external API. Without this rule, outbound packets are dropped, causing the function to hang until the configured timeout (30 seconds) expires, resulting in a timeout error.

Exam trap

The trap here is that candidates assume a NAT Gateway alone provides internet access to Lambda, overlooking that security group egress rules must explicitly allow outbound traffic to the destination.

How to eliminate wrong answers

Option A is wrong because the NAT Gateway is explicitly stated to be present, and a NAT Gateway requires a route to the internet (via an Internet Gateway) to function; if it were misconfigured, the function would likely fail immediately or at a different timeout, not exactly at 30 seconds. Option C is wrong because the function times out at exactly 30 seconds, matching its configured timeout, not at a variable time based on API response; if the API exceeded 30 seconds, the timeout would still occur at 30 seconds, but the question asks for the most likely cause given the VPC setup. Option D is wrong because the VPC does not need an Internet Gateway for outbound traffic through a NAT Gateway; the NAT Gateway itself resides in a public subnet and uses an Internet Gateway, but the Lambda function's VPC configuration is separate—the issue is security group egress rules, not the presence of an Internet Gateway.

Practice this question →
30
MCQhard

A developer is troubleshooting performance issues in an application that uses Amazon DynamoDB as the primary data store. The application reads a large set of items using a Query operation on a Global Secondary Index (GSI). The developer notices high read latency and throttled requests on the GSI. The base table has sufficient read capacity. The GSI is projected with KEYS_ONLY. Which action would most likely reduce the latency and throttling?

A.Increase the read capacity units (RCU) of the base table.
B.Change the GSI projection to ALL.
C.Increase the read capacity units (RCU) of the GSI.
D.Create a Local Secondary Index instead.
AnswerC

Throttling on a Global Secondary Index (GSI) is a direct indication that its provisioned read capacity units (RCU) are insufficient to handle the current read request volume. Since GSIs have their own distinct capacity settings, increasing the RCU specifically for the GSI directly addresses this bottleneck. This action allows the index to process more read operations per second, thereby alleviating throttling and improving application performance and latency.

Why this answer

A Global Secondary Index (GSI) has its own provisioned read capacity, separate from the base table. When a Query operation reads from a GSI, it consumes RCUs from the GSI's capacity, not the base table's. Since the base table has sufficient read capacity but the GSI is experiencing throttling and high latency, increasing the GSI's RCU directly addresses the bottleneck by allowing more read requests per second against the index.

Exam trap

The trap here is that candidates often assume increasing the base table's capacity will resolve all read performance issues, failing to recognize that GSIs have independent capacity allocations and that throttling on a GSI requires adjusting the index's RCU, not the base table's.

How to eliminate wrong answers

Option A is wrong because increasing the base table's RCU does not affect the GSI's throughput; the GSI has its own independent capacity settings, and throttling on the GSI is caused by insufficient RCU on the index itself. Option B is wrong because changing the GSI projection to ALL would increase the size of each item returned, consuming more RCUs per query and potentially worsening latency and throttling, not reducing it. Option D is wrong because a Local Secondary Index (LSI) shares the base table's partition key and RCU/WCU, but it does not solve the issue of insufficient read capacity on the index; additionally, LSIs cannot be created after table creation if not initially defined, and they have different partition key constraints that do not address the GSI-specific throttling.

Practice this question →
31
Multi-Selectmedium

A company is using Amazon S3 to store large objects. Users report that uploads are slow. Which THREE actions should the developer take to optimize upload performance?

Select 3 answers
A.Use multipart upload for objects over 100 MB.
B.Use S3 Select to upload only specific parts of the object.
C.Enable S3 Transfer Acceleration.
D.Transition objects to S3 Glacier after upload.
E.Use multiple S3 prefixes to increase request rate.
AnswersA, C, E

Multipart upload splits a large object into independent parts that are uploaded in parallel, which dramatically increases throughput and enables efficient retries for individual failed parts. The AWS SDKs automatically apply multipart upload when an object exceeds the 100 MB threshold, and it is the recommended approach for objects over 100 MB because it also allows you to pause and resume uploads, reducing the impact of network interruptions.

Why this answer

Multipart upload improves throughput for large objects over 100 MB by uploading parts in parallel. Option C is correct because S3 Transfer Acceleration uses CloudFront edge locations to reduce latency for uploads over long distances. Option E is correct because using multiple S3 prefixes (i.e., parallelizing requests across different key prefixes) can increase the request rate and overall throughput.

Option B is incorrect because S3 Select is used to retrieve subsets of data from an object, not to upload. Option D is incorrect because transitioning to S3 Glacier is for data lifecycle management, not for improving upload performance.

Practice this question →
32
MCQeasy

Refer to the exhibit. A developer created this CloudFormation template. After deployment, the stack creation fails with 'Bucket name already exists'. What should the developer do to fix the issue?

A.Change the BucketName to include a random suffix.
B.Remove the MyQueue resource.
C.Remove the VersioningConfiguration from the bucket.
D.Set SqsManagedSseEnabled to false.
AnswerA

A hard-coded S3 BucketName such as MyBucket is not guaranteed to be globally unique; S3 bucket names are shared across all AWS accounts and regions, so the name may already be registered by another account. Changing the value to include a random suffix, for example by appending the AWS::AccountId or AWS::StackName pseudo parameter through Fn::Join or Fn::Sub, ensures a unique bucket name and allows the stack to create successfully.

Why this answer

The error 'Bucket name already exists' indicates that the S3 bucket name is not unique. Adding a random suffix to the BucketName (e.g., using AWS::StackName or a random string) ensures uniqueness. Option B is incorrect because removing the queue does not address the bucket naming conflict.

Option C is incorrect because disabling versioning does not affect the bucket name. Option D is incorrect because disabling SSE is unrelated to the bucket name conflict.

Practice this question →
33
MCQmedium

A developer is troubleshooting an AWS Lambda function that is triggered by an S3 event. The function occasionally fails with a timeout error. CloudWatch logs show that the timeout occurs during the processing of large files. The function has a memory setting of 128 MB and a timeout of 3 seconds. The developer wants to process large files without modifying the code. Which parameter should the developer adjust first?

A.Increase the function's memory
B.Increase the function's timeout
C.Increase the function's reserved concurrency
D.Increase the S3 event notification batch size
AnswerA

In AWS Lambda, memory allocation directly correlates with the amount of CPU power provisioned to the function. Increasing the function's memory provides more vCPUs, which can significantly speed up compute-intensive operations and data processing within the function's execution environment. This optimization can reduce the overall execution duration, thereby preventing timeouts and improving performance without requiring any changes to the underlying application code. It's often the first and most effective step for resolving performance bottlenecks.

Why this answer

Increasing the function's memory is the correct first step because Lambda allocates CPU proportionally to memory, and more CPU reduces processing time for CPU-bound tasks like decompressing or parsing large files. This directly addresses the timeout by making the function complete faster, without requiring code changes. The current 128 MB setting is the minimum, which provides the least CPU, so even a modest increase can significantly reduce execution time.

Exam trap

The trap here is that candidates often assume a timeout error must be fixed by increasing the timeout, but the question explicitly states the timeout occurs during processing of large files, indicating a performance bottleneck that memory (and thus CPU) increase can resolve without code changes.

How to eliminate wrong answers

Option B is wrong because increasing the timeout alone does not speed up processing; it only allows the function to run longer, which may mask the underlying performance issue but does not prevent future timeouts on even larger files. Option C is wrong because reserved concurrency controls the number of concurrent executions, not the execution duration of a single invocation; it would not resolve a timeout caused by slow processing. Option D is wrong because the S3 event notification batch size controls how many events are sent per invocation, not the processing speed of a single file; increasing it would only make the function handle more files per invocation, worsening the timeout.

Practice this question →
34
MCQmedium

A developer needs to trace a request across API Gateway, Lambda, and downstream AWS service calls. Which service should be enabled?

A.AWS X-Ray
B.AWS Budgets
C.AWS Artifact
D.AWS License Manager
AnswerA

AWS X-Ray is the correct service for tracing requests across distributed applications, such as those involving API Gateway, Lambda functions, and other downstream AWS services. It provides an end-to-end view of requests as they travel through various components, helping identify performance bottlenecks and operational issues. X-Ray generates a service map that visualizes the application's architecture and shows latency data for each node and connection, enabling detailed analysis of request flow and performance. This capability is precisely what's needed to "trace a request" through the specified AWS services.

Why this answer

AWS X-Ray is the correct service because it provides end-to-end tracing for requests flowing through distributed applications, including API Gateway, Lambda functions, and downstream AWS services like DynamoDB or S3. It captures trace data as the request traverses each component, allowing developers to identify performance bottlenecks and errors across the entire request path. X-Ray integrates natively with API Gateway and Lambda via the X-Ray SDK or active tracing configuration, requiring no code changes for basic tracing.

Exam trap

The trap here is that candidates may confuse AWS X-Ray with CloudWatch Logs or CloudTrail, thinking those services provide the same distributed tracing capability, but X-Ray is the only service that correlates trace data across multiple components in a single request.

How to eliminate wrong answers

Option B (AWS Budgets) is wrong because it is a cost management service that monitors AWS spending and sends alerts when usage exceeds thresholds, not a tracing or observability tool. Option C (AWS Artifact) is wrong because it provides access to AWS compliance reports, security documentation, and agreements, such as SOC and PCI reports, not request tracing capabilities. Option D (AWS License Manager) is wrong because it manages software licenses (e.g., Microsoft, Oracle) to prevent license violations, and has no role in tracing API requests or debugging distributed applications.

Practice this question →
35
MCQmedium

A developer is optimizing a Node.js Lambda function that processes CSV files from S3. The function reads the entire file into memory, processes it, and writes results to DynamoDB. For large files, the function runs out of memory. What is the MOST effective optimization?

A.Increase the Lambda timeout to allow more processing time.
B.Increase the Lambda function memory to 3008 MB.
C.Use the AWS SDK's S3 GetObject with a stream and process in chunks.
D.Use S3 Select to retrieve only necessary columns.
AnswerC

Using the AWS SDK's S3 GetObject with a stream allows the Node.js Lambda function to read the large CSV file incrementally, rather than loading the entire object into memory at once. By processing data in small, manageable chunks as it arrives, the function significantly reduces its peak memory footprint. This approach directly addresses memory exhaustion by avoiding the need to hold the entire file in RAM, making it highly efficient for large file processing.

Why this answer

Using the AWS SDK's S3 GetObject with a stream allows the function to process the CSV file in chunks, avoiding loading the entire file into memory. This directly addresses the memory issue for large files. Option A is incorrect because increasing timeout does not reduce memory usage.

Option B is incorrect because while increasing memory might help, it does not solve the root cause and may increase costs; streaming is more efficient. Option D is incorrect because S3 Select is used to filter columns from S3 objects using SQL, but it does not solve the problem of loading the entire file into memory; it could reduce the data transferred but the function still needs to handle streaming or chunking.

Practice this question →
36
MCQmedium

A developer is deploying a new version of an AWS Lambda function using the AWS CLI. The deployment fails with a 'ResourceConflictException' error. What is the MOST likely cause?

A.Another deployment is currently in progress for the same Lambda function.
B.The Lambda function code exceeds the maximum allowed size.
C.The Lambda function has an alias that conflicts with the version number.
D.The IAM role associated with the Lambda function does not have sufficient permissions.
AnswerA

AWS Lambda enforces serialization of updates to a function's code or configuration to maintain consistency. If an API call like `UpdateFunctionCode` or `UpdateFunctionConfiguration` is initiated while another update operation is already in progress for the same function, the subsequent call will fail. This contention for the resource's state results in a `ResourceConflictException`, preventing race conditions and ensuring the function's configuration remains coherent.

Why this answer

The 'ResourceConflictException' error in AWS Lambda occurs when you attempt to update a Lambda function while another update operation is already in progress. Lambda enforces a single in-flight update per function to prevent race conditions and ensure state consistency. The AWS CLI command (e.g., update-function-code) will fail immediately if a previous deployment has not completed, even if the previous deployment was triggered by the same or a different client.

Exam trap

The trap here is that candidates confuse 'ResourceConflictException' with permission errors or code size limits, but AWS specifically uses this exception to signal a concurrent update conflict, not a validation or authorization issue.

How to eliminate wrong answers

Option B is wrong because exceeding the maximum code size (250 MB for zip, 50 MB for direct upload) results in a 'RequestEntityTooLargeException' or 'InvalidParameterValueException', not a 'ResourceConflictException'. Option C is wrong because alias names and version numbers are separate namespaces; an alias cannot conflict with a version number, and such a conflict would cause a 'ResourceNotFoundException' or 'InvalidParameterValueException' if you tried to reference a non-existent version. Option D is wrong because insufficient IAM permissions would result in an 'AccessDeniedException' or 'AuthorizationError', not a 'ResourceConflictException'.

Practice this question →
37
MCQmedium

A Lambda function processing SQS messages is failing with concurrency errors. The function is configured with reserved concurrency of 5. The SQS queue has a batch size of 10. What is the most effective way to prevent throttling?

A.Reduce the batch size to 1 to spread out invocations.
B.Increase the Lambda function memory to get more concurrency.
C.Increase the reserved concurrency to a higher value.
D.Set the SQS queue's concurrency limit to match the Lambda reserved concurrency.
AnswerC

Increasing the reserved concurrency for the Lambda function dedicates a specific number of concurrent execution slots exclusively to that function. This guarantees that the function will always have that many concurrent instances available, preventing it from being throttled by the overall account-level concurrency limit or by other functions consuming available capacity. By reserving more concurrency, the function can process a higher parallel load from SQS without interruption, directly addressing throttling issues.

Why this answer

The function is throttling due to insufficient reserved concurrency. With a batch size of 10, each SQS batch triggers one invocation, but the function's reserved concurrency of 5 limits concurrent executions to 5. Increasing reserved concurrency allows more concurrent invocations to handle the SQS messages without throttling.

Exam trap

The trap here is that candidates often confuse batch size with concurrency, thinking reducing batch size reduces load, but it actually increases invocation count and worsens throttling.

How to eliminate wrong answers

Option A is wrong because reducing the batch size to 1 would increase the number of invocations per message, worsening concurrency pressure and potentially increasing throttling. Option B is wrong because increasing Lambda memory does not affect concurrency limits; memory and concurrency are independent settings. Option D is wrong because SQS queues do not have a configurable concurrency limit; Lambda's event source mapping manages polling, and setting a non-existent queue concurrency limit is not a valid action.

Practice this question →
38
MCQeasy

A developer is using Amazon DynamoDB with provisioned throughput. The application is receiving ProvisionedThroughputExceededException errors. What is the BEST way to handle this error?

A.Contact AWS Support to increase the DynamoDB service limits.
B.Reduce the read and write capacity units.
C.Implement exponential backoff and retry in the application code.
D.Switch the table to on-demand capacity mode.
AnswerC

Implementing exponential backoff and retry logic in the application code is a standard best practice for gracefully handling transient errors like `ProvisionedThroughputExceededException` in DynamoDB. This mechanism automatically retries failed requests after progressively longer delays, allowing the throttled table time to recover or for its burst capacity to replenish. It prevents a flood of immediate retries from overwhelming the table further, enabling the application to adapt to temporary capacity limitations.

Why this answer

The ProvisionedThroughputExceededException indicates that the application has exceeded the provisioned read/write capacity units for the DynamoDB table. The best practice to handle this error is to implement exponential backoff and retry logic in the application code, which progressively increases the wait time between retries to reduce request volume and allow the throttling to subside. This approach is recommended by AWS for handling throttling errors gracefully without manual intervention.

Exam trap

The trap here is that candidates often confuse 'handling the error' with 'preventing the error' and choose to switch to on-demand mode (Option D) instead of implementing proper retry logic, which is the immediate and correct response to a throttling exception.

How to eliminate wrong answers

Option A is wrong because contacting AWS Support to increase DynamoDB service limits does not address the root cause of exceeding provisioned throughput; service limits are separate from provisioned capacity and increasing them does not resolve throttling. Option B is wrong because reducing read and write capacity units would decrease the table's throughput, making throttling more likely, not less. Option D is wrong because switching to on-demand capacity mode is a valid long-term solution for unpredictable workloads but is not the best immediate fix for handling the exception in existing code; it also incurs higher costs and does not teach the application to handle throttling programmatically.

Practice this question →
39
MCQeasy

A developer deploys a new version of an AWS Lambda function using the AWS CLI. After deployment, the function returns stale results. What is the most likely cause?

A.The function's environment variables are cached and not updated.
B.The Lambda function alias is still pointing to the previous version.
C.The Amazon CloudFront distribution is caching the old response.
D.The Lambda function's code is cached by the Lambda service.
AnswerB

Lambda aliases provide a stable endpoint for invoking a function, but they are explicitly configured to point to a specific function version. If a developer deploys a new version of the Lambda function but fails to update the associated alias to reference this new version, any invocations made through that alias will continue to execute the code and configuration of the older version it still references. This is a common operational oversight leading to unexpected behavior where new code doesn't appear to be running.

Why this answer

When a developer deploys a new version of a Lambda function using the AWS CLI without updating the function alias, the alias continues to point to the previous version. Invoking the function via the alias (e.g., via an API Gateway endpoint or a CloudFront origin) will execute the old code, returning stale results. The `$LATEST` version is updated, but unless the alias is repointed, it does not automatically use the new code.

Exam trap

The trap here is that candidates may assume deploying new code automatically updates the invoked version, overlooking that aliases must be explicitly repointed to the new version to change which code is executed.

How to eliminate wrong answers

Option A is wrong because environment variables are not cached; they are read from the function's configuration at invocation time and are updated immediately when the function is deployed with new environment variables. Option C is wrong because CloudFront caching is a separate concern; while it can serve stale responses, the question states the function itself returns stale results, and CloudFront would only cache the HTTP response, not the Lambda execution output directly. Option D is wrong because the Lambda service does not cache the function's code in a way that persists across deployments; the new code is immediately available when the function version is updated, and the issue is about which version is being invoked, not code caching.

Practice this question →
40
MCQmedium

A developer is debugging an issue where an Amazon S3 bucket policy is not allowing cross-account access for a user from another AWS account. The bucket policy grants access to the other account's root user. The IAM user in the other account has an IAM policy that allows s3:GetObject on the bucket. When the user tries to download an object, they get an Access Denied error. What is the most likely cause?

A.The bucket is encrypted with SSE-KMS and the user does not have kms:Decrypt permission
B.The bucket policy does not specify the user's ARN
C.The object's ACL is set to private
D.The IAM policy does not include s3:ListBucket
AnswerA

When an S3 object is encrypted with Server-Side Encryption using AWS Key Management Service (SSE-KMS), the requesting principal requires two distinct permissions for GetObject operations. Beyond the s3:GetObject permission on the bucket, an explicit kms:Decrypt permission on the specific AWS KMS key used for encryption is mandatory. Without this crucial KMS permission, even a valid S3 bucket policy allowing s3:GetObject will result in an Access Denied error, as S3 cannot decrypt the object for the user.

Why this answer

The most likely cause is that the bucket is encrypted with SSE-KMS. When an S3 bucket uses AWS KMS customer master keys (CMKs) for server-side encryption, the bucket policy granting access to the root user of the other account is not sufficient. The IAM user in the other account must also have explicit kms:Decrypt permission on the KMS key, because S3 GetObject calls require decrypting the object before returning it.

Without this KMS permission, the request fails with Access Denied even though the S3 bucket policy and IAM policy appear correct.

Exam trap

The trap here is that candidates assume a valid S3 bucket policy and IAM policy are sufficient, forgetting that KMS encryption adds an independent authorization layer that requires explicit kms:Decrypt permissions, which is a common oversight in cross-account S3 access scenarios.

How to eliminate wrong answers

Option B is wrong because the bucket policy grants access to the other account's root user, which covers all IAM users and roles in that account by default; specifying the individual user's ARN is not required. Option C is wrong because object ACLs are evaluated after bucket policies, and if the bucket policy explicitly grants access, a private object ACL would be overridden (unless the bucket policy has a condition denying access). Option D is wrong because s3:ListBucket is only needed for listing objects (e.g., GET Bucket (List Objects) requests), not for downloading a specific object using s3:GetObject.

Practice this question →
41
Matchingmedium

Match each AWS storage class to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Frequent access, low latency

Automatic cost optimization

Long-term archival

Infrequent access, single AZ

Lowest cost retrieval

Why these pairings

The correct matches are S3 Standard with frequently accessed data, S3 Intelligent-Tiering with automatic cost optimization, S3 Glacier Instant Retrieval with archive and fast retrieval, and S3 One Zone-IA with infrequent data in one AZ. Common confusions include mixing up storage class descriptions.

Practice this question →
42
MCQhard

A developer is troubleshooting an AWS Lambda function that is invoked from an Amazon S3 bucket via event notifications. The function processes images and stores metadata in Amazon DynamoDB. The developer notices that some images are being processed multiple times, resulting in duplicate entries in DynamoDB. The S3 event notification is configured to send events to the Lambda function with the 's3:ObjectCreated:*' event type. The function uses the 'uuid' library to generate a unique ID for each image upon processing. What is the most likely cause of the duplicate processing?

A.S3 event notifications are delivered at least once, and the Lambda function is not idempotent.
B.The Lambda function's concurrency is set too high, causing race conditions.
C.The DynamoDB table does not have a primary key that prevents duplicates.
D.The S3 bucket is configured with versioning, causing multiple object creation events.
AnswerA

S3 event notifications operate on an "at least once" delivery model, meaning that a single S3 event, such as an object creation, might trigger the associated Lambda function multiple times. If the Lambda function's logic is not designed to be idempotent, each duplicate invocation will independently process the event and perform its side effects, leading to duplicate data entries or actions. Implementing idempotency, often by using a unique identifier from the S3 event (like the object key) as a check, is crucial to prevent these redundant operations.

Why this answer

Amazon S3 event notifications are delivered on an 'at least once' basis, meaning the same event can be sent to Lambda multiple times. If the Lambda function is not idempotent—i.e., processing the same event multiple times produces duplicate side effects—then duplicate DynamoDB entries will occur. The use of a 'uuid' library inside the function does not help because a new UUID is generated on each invocation, so the same image gets different IDs and is stored as a separate item each time.

Exam trap

The trap here is that candidates assume generating a unique ID inside the function solves duplication, but they miss that idempotency requires using a stable, external identifier (like the S3 object key) to detect and skip already-processed events.

How to eliminate wrong answers

Option B is wrong because high concurrency can cause race conditions, but the core issue here is duplicate event delivery, not concurrent writes; even with low concurrency, duplicate events would still be processed. Option C is wrong because the DynamoDB table's primary key design does not cause duplicate processing; it only affects whether duplicate writes are rejected or overwritten—the problem is that the function is invoked multiple times for the same image. Option D is wrong because S3 versioning generates separate object versions, each with a unique version ID, and the 's3:ObjectCreated:*' event fires once per version; versioning does not cause multiple events for the same object version.

Practice this question →
43
Multi-Selecthard

An API backed by Lambda returns high p95 latency after deployment. Which two telemetry sources are most useful first?

Select 2 answers
A.AWS Billing console only
B.CloudWatch Lambda duration/init duration/logs
C.S3 Inventory reports
D.X-Ray traces across API Gateway and Lambda
AnswersB, D

CloudWatch provides critical metrics like `Duration` and `Init Duration` for Lambda functions, directly revealing execution and cold start times. Analyzing the p95 percentile of these metrics pinpoints specific latency bottlenecks. Furthermore, detailed CloudWatch Logs offer granular insights into the function's internal execution flow, external service calls, and potential code-level inefficiencies contributing to high latency.

Why this answer

CloudWatch Lambda duration and init duration metrics directly measure the time your function spends executing and initializing, which are the primary drivers of p95 latency. Logs can reveal cold starts, timeouts, or inefficient code paths that cause high latency. These are the most immediate telemetry sources to identify performance bottlenecks in the Lambda function itself.

Exam trap

The trap here is that candidates often overlook the combination of CloudWatch metrics and X-Ray traces, mistakenly thinking that only one telemetry source (like CloudWatch logs) is sufficient, or they confuse billing data with performance monitoring.

Practice this question →
44
Multi-Selectmedium

A DynamoDB table shows throttling on one partition key value. Which two signs point to a hot partition problem?

Select 2 answers
A.Most traffic targets the same partition key
B.The table has point-in-time recovery enabled
C.Consumed capacity is uneven despite total table capacity being available
D.CloudTrail is enabled in all regions
AnswersA, C

DynamoDB distributes data across partitions based on the partition key. When a disproportionate amount of read or write traffic targets a small subset of partition key values, those specific partitions become 'hot.' Each partition has a maximum throughput limit, typically 3000 RCU and 1000 WCU. Exceeding this limit on a single partition, even if the overall table capacity is sufficient, results in throttling requests directed at that hot partition.

Why this answer

A hot partition occurs when a single partition key value receives a disproportionate share of read/write traffic, causing throttling on that partition even if the table's total provisioned capacity is not fully utilized. This imbalance means the partition's capacity is exhausted while other partitions remain underutilized, leading to request throttling for that specific key.

Exam trap

The trap here is that candidates confuse overall table capacity with partition-level capacity, assuming throttling only happens when total consumed capacity exceeds provisioned capacity, rather than recognizing that uneven key distribution can cause throttling on a single partition.

Practice this question →
45
MCQmedium

A developer is monitoring an AWS Lambda function that is triggered by an Amazon SQS queue. The function's CloudWatch metrics show a high number of throttles. The function has a reserved concurrency of 10 and the SQS queue has a large backlog of messages. The function processes each message in about 2 seconds and has a timeout of 60 seconds. Which action will most effectively reduce the throttles and increase throughput?

A.Increase the reserved concurrency of the Lambda function to 50
B.Increase the batch size in the SQS event source mapping to 100
C.Increase the function timeout to 120 seconds
D.Decrease the reserved concurrency to 5
AnswerA

Increasing the reserved concurrency for a Lambda function dedicates a specific number of concurrent execution slots exclusively to that function. This action guarantees that the function can scale up to 50 simultaneous invocations, preventing it from being throttled by the account's general unreserved concurrency pool. For an SQS-triggered Lambda, this directly enables more parallel processing of messages, significantly improving throughput and reducing the backlog in the queue.

Why this answer

The high throttles indicate that the Lambda function's reserved concurrency of 10 is insufficient to handle the incoming messages from the SQS queue. By increasing reserved concurrency to 50, you allow more concurrent executions, which reduces throttling and increases throughput. The function's 2-second processing time and 60-second timeout are not the bottleneck; the concurrency limit is.

Exam trap

The trap here is that candidates may think increasing batch size or timeout will help, but they overlook that the root cause is the reserved concurrency cap, which directly limits the number of concurrent executions and is the primary driver of throttles.

How to eliminate wrong answers

Option B is wrong because increasing the batch size to 100 would cause the function to receive more messages per invocation, but with a reserved concurrency of 10, the function can only process 10 batches concurrently, so throttles would persist and latency could increase due to longer processing per batch. Option C is wrong because increasing the timeout to 120 seconds does not address the concurrency limit; the function already completes in 2 seconds, so a longer timeout has no effect on throttles. Option D is wrong because decreasing reserved concurrency to 5 would reduce the number of concurrent executions, worsening throttles and decreasing throughput.

Practice this question →
46
MCQhard

A developer notices that an AWS Lambda function, which uses Amazon RDS Proxy to connect to an Aurora MySQL database, is experiencing increased latency and occasional connection timeouts. The function is configured with a reserved concurrency of 100 and is deployed in a VPC. The RDS Proxy's maximum connections is set to 1000. CloudWatch metrics show that the DatabaseConnections metric for the proxy is consistently at 1000. What is the most likely cause of the increased latency and timeouts?

A.The Lambda function is not reusing database connections properly, exhausting the proxy connection pool
B.The RDS Proxy target group is not configured with the correct DB instance
C.The Lambda function's execution role is missing the rds-db:connect permission
D.The VPC does not have a NAT Gateway for outbound traffic
AnswerA

Lambda functions are inherently stateless and often short-lived. Without explicit connection pooling implemented within the Lambda function's code (e.g., by declaring the connection object in a global scope), each new invocation will attempt to establish a fresh connection to the RDS Proxy. This rapid creation of new client connections, especially under high concurrency, quickly exhausts the limited connection pool managed by the RDS Proxy, leading to connection failures and increased latency as requests wait for available connections.

Why this answer

The RDS Proxy's DatabaseConnections metric is consistently at 1000, which equals the proxy's maximum connections setting. This indicates the proxy connection pool is fully saturated. When all connections are in use, new connection requests from Lambda invocations must wait, causing increased latency, and if the wait exceeds the timeout, connection timeouts occur.

The most likely cause is that the Lambda function is not reusing database connections (e.g., not using connection pooling or keeping connections open across invocations), exhausting the pool.

Exam trap

The trap here is that candidates may focus on the reserved concurrency (100) versus proxy max connections (1000) and assume the numbers are fine, missing that the real issue is connection reuse per invocation, not the total count.

How to eliminate wrong answers

Option B is wrong because if the target group were misconfigured, the proxy would fail to connect to the database entirely, not just experience latency and timeouts while the connection pool is full. Option C is wrong because missing the rds-db:connect permission would cause immediate authentication failures (e.g., 'Access denied') for all connection attempts, not gradual pool exhaustion. Option D is wrong because Lambda functions in a VPC use Elastic Network Interfaces (ENIs) for outbound traffic to RDS Proxy within the same VPC; a NAT Gateway is only needed for internet-bound traffic, not for connecting to RDS Proxy in the same VPC.

Practice this question →
47
MCQmedium

An AWS Lambda function processes messages from an Amazon SQS queue and writes results to an Amazon DynamoDB table. The function is configured with a reserved concurrency of 5 and a batch size of 10. CloudWatch metrics show high throttling and a growing queue backlog. The function's execution time averages 1 second per message. What is the MOST effective action to reduce throttling while improving throughput?

A.Increase the reserved concurrency to 20.
B.Increase the batch size to 100.
C.Decrease the reserved concurrency to 2.
D.Increase the provisioned write capacity of the DynamoDB table.
AnswerA

Increasing reserved concurrency allows Lambda to scale and invoke more function instances concurrently. This directly reduces throttling and allows the function to process more messages from the SQS queue simultaneously, improving throughput and reducing backlog.

Why this answer

The Lambda function is throttling because its reserved concurrency of 5 limits it to 5 concurrent executions. With a batch size of 10 and 1-second execution time, the function can process at most 5 * 10 = 50 messages per second. Increasing reserved concurrency to 20 allows 20 concurrent executions, raising throughput to 200 messages per second, which directly reduces throttling and clears the backlog.

Exam trap

The trap here is that candidates may confuse Lambda throttling with downstream resource throttling (like DynamoDB) and choose to increase write capacity, or they may think increasing batch size alone will solve the problem without considering the concurrency bottleneck.

How to eliminate wrong answers

Option B is wrong because increasing batch size to 100 would cause each invocation to process more messages, but with only 5 concurrent executions, the function would still be limited to 5 invocations at a time, and the 1-second execution time per message would scale linearly, likely causing timeouts or increased latency without addressing the root cause of throttling. Option C is wrong because decreasing reserved concurrency to 2 would reduce throughput to 20 messages per second, worsening throttling and backlog. Option D is wrong because increasing DynamoDB write capacity addresses potential write throttling from DynamoDB, but the CloudWatch metrics show Lambda throttling, not DynamoDB throttling; the bottleneck is Lambda concurrency, not the database.

Practice this question →
48
MCQmedium

A developer is troubleshooting an application that uses Amazon ElastiCache for Redis to improve performance. The application periodically experiences high latency during peak hours. The developer checks the ElastiCache metrics and sees that the 'Evictions' metric is consistently high and the 'CacheHitRate' metric is low. The cluster has a single node with a cache.t3.small instance type. Which action will most likely improve the cache hit rate and reduce latency?

A.Scale up to a larger node type (e.g., cache.t3.medium) to increase available memory.
B.Enable cluster mode and distribute data across multiple shards to reduce memory pressure.
C.Change the eviction policy to 'allkeys-lfu' to better manage which keys are evicted.
D.Add a read replica for the Redis cluster to offload read traffic.
AnswerA

Scaling up to a larger node type directly increases the available RAM for the Redis instance. This additional memory allows the cache to store more data, significantly reducing the frequency of key evictions caused by memory pressure. Consequently, the cache hit rate improves, as more requested data is found in cache, leading to lower latency and better application performance by minimizing database lookups.

Why this answer

The high 'Evictions' and low 'CacheHitRate' metrics indicate that the Redis node is running out of memory, forcing it to evict keys to make room for new data. Scaling up to a larger node type (cache.t3.medium) increases the available memory, allowing more data to be cached and reducing evictions, which directly improves the cache hit rate and reduces latency.

Exam trap

The trap here is that candidates may focus on optimizing eviction policies or adding replicas, but the core issue is insufficient memory capacity, which only scaling up can resolve.

How to eliminate wrong answers

Option B is wrong because enabling cluster mode and distributing data across multiple shards does not increase the total memory per node; it only partitions data, and if the total memory across shards is insufficient, evictions will still occur. Option C is wrong because changing the eviction policy to 'allkeys-lfu' only changes which keys are evicted (least frequently used) but does not address the root cause of insufficient memory; evictions will continue at the same rate. Option D is wrong because adding a read replica offloads read traffic but does not increase the primary node's memory, so evictions and low cache hit rate will persist on the primary node.

Practice this question →
49
Multi-Selecteasy

A developer is using AWS X-Ray to trace requests through a microservices application. The developer notices that some traces are incomplete. Which TWO actions can help ensure complete traces?

Select 2 answers
A.Use the X-Ray SDK to instrument the application code.
B.Open port 2000 on the security groups for TCP traffic.
C.Deploy the X-Ray daemon as a centralized service in a separate instance.
D.Install the CloudWatch agent on all instances.
E.Ensure the X-Ray daemon is running on all EC2 instances.
AnswersA, E

The X-Ray SDK must be integrated directly into the application code because it is what creates trace data in the first place. For supported web frameworks, middleware or interceptors automatically capture incoming HTTP requests, generate a trace ID, manage segments and subsegments, and propagate the X-Amzn-Trace-Id header to downstream services. The SDK then sends completed segments to the local X-Ray daemon over UDP port 2000 for eventual upload to the X-Ray API. Without this code-level instrumentation, a request never becomes a trace, regardless of daemon status or network configuration.

Why this answer

The X-Ray SDK instruments application code to generate trace segments and sends them to the X-Ray daemon. Option E is correct because the X-Ray daemon must be running on each EC2 instance to receive trace data from the SDK and forward it to the X-Ray service. Without both, traces may be incomplete.

Option B is incorrect because the X-Ray daemon communicates over UDP, not TCP, and port 2000 is UDP; opening TCP 2000 does not help. Option C is incorrect because the X-Ray daemon is designed to run locally on each instance, not as a centralized service. Option D is incorrect because the CloudWatch agent does not handle X-Ray traces; it is used for CloudWatch metrics and logs.

Practice this question →
50
MCQhard

A Lambda function using a Kinesis event source repeatedly retries one bad record and blocks progress in the shard. Which feature helps isolate failed records after retry limits?

A.Increase memory to 10 GB only
B.Disable batch processing
C.Configure failure handling with bisect batch on error and an on-failure destination where supported
D.Convert the stream to an S3 bucket
AnswerC

Configuring `ReportBatchItemFailures` (often referred to as "bisect batch on error" in the console) for a Kinesis event source allows the Lambda function to return a partial success, indicating which specific records within a batch failed. Lambda then automatically retries only the failed records, potentially splitting the batch further to isolate the problematic items. Combining this with an on-failure destination, such as an SQS queue or SNS topic, ensures that records that ultimately cannot be processed are sent to a dead-letter queue for analysis and manual intervention, preventing them from indefinitely blocking the stream processing.

Why this answer

Lambda's Kinesis event source mapping supports a 'bisect batch on error' feature that splits a failed batch into two smaller batches, allowing the bad record to be isolated and retried separately. Additionally, configuring an on-failure destination (e.g., an SQS queue or SNS topic) sends the record to a dead-letter destination after the retry limit is exhausted, preventing the shard from blocking progress.

Exam trap

The trap here is that candidates often think increasing memory or disabling batch processing will solve the blocking issue, but they fail to recognize that only explicit failure handling with bisect and a dead-letter destination can isolate and remove the bad record without manual intervention.

How to eliminate wrong answers

Option A is wrong because increasing memory to 10 GB only allocates more CPU and memory to the function, but does not address the root cause of a single bad record blocking the shard; it does not provide any mechanism to isolate or skip failed records. Option B is wrong because disabling batch processing (setting batch size to 1) would still cause the same blocking behavior—each record would be processed individually, but a persistent bad record would still be retried indefinitely, blocking the shard. Option D is wrong because converting the stream to an S3 bucket is not a direct replacement for Kinesis event processing; S3 does not support the same record-level retry and failure handling semantics, and this would require a complete architectural change, not a simple configuration fix.

Practice this question →
51
MCQhard

A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application experiences intermittent errors where some requests return HTTP 503 (Service Unavailable) errors. The developers have verified that the application code is healthy and the EC2 instances pass health checks. The ALB health check is configured to hit a specific endpoint (/health) with a healthy threshold of 2 and an unhealthy threshold of 2. The health check interval is 30 seconds, and the timeout is 5 seconds. The application's /health endpoint sometimes takes up to 6 seconds to respond due to a dependency on a third-party service. The developers want to minimize the 503 errors without changing the application code. Which action should the developer take?

A.Increase the health check timeout to 10 seconds to accommodate the slow /health endpoint.
B.Decrease the unhealthy threshold to 1 so that instances are marked unhealthy after one failed health check.
C.Increase the deregistration delay to 300 seconds to allow connections to drain.
D.Decrease the health check interval to 10 seconds to detect health changes faster.
AnswerA

Prevents false negatives due to slow responses.

Why this answer

The correct action is to increase the health check timeout from 5 seconds to 10 seconds. Since the /health endpoint sometimes takes up to 6 seconds to respond, the current timeout of 5 seconds causes the ALB to consider the instance unhealthy, leading to 503 errors. By increasing the timeout, the ALB will wait longer for a response, reducing unnecessary health check failures.

Option B is wrong because decreasing the unhealthy threshold would make instances even more sensitive, increasing 503 errors. Option C is wrong because deregistration delay affects connection draining during instance termination, not health check behavior. Option D is wrong because decreasing the health check interval does not help; the issue is timeout, not frequency.

Practice this question →
52
MCQeasy

A developer is troubleshooting a web application that intermittently returns HTTP 504 errors. The application runs on EC2 instances behind an Application Load Balancer. What is the most likely cause of these errors?

A.The target group is using an HTTPS health check but the instances only support HTTP.
B.The load balancer's cross-zone load balancing is disabled.
C.The load balancer idle timeout is set too low, and the application takes longer than the timeout to respond.
D.The security group for the EC2 instances is missing an inbound rule for the load balancer.
AnswerC

The load balancer idle timeout specifies the maximum duration the load balancer will wait for a response from a registered target before closing the connection. If the backend application takes longer to process a request and send a response than this configured timeout, the load balancer will terminate the connection. This action directly results in an HTTP 504 Gateway Timeout error being returned to the client, indicating a lack of timely response.

Why this answer

HTTP 504 (Gateway Timeout) errors from an Application Load Balancer indicate that the load balancer successfully connected to the target (EC2 instance) but the target did not respond within the configured idle timeout period. The default idle timeout is 60 seconds, and if the application's processing time exceeds this value, the load balancer terminates the connection and returns a 504. Option C directly addresses this mismatch between the load balancer timeout and the application response time.

Exam trap

The trap here is that candidates often confuse HTTP 504 (Gateway Timeout) with HTTP 502 (Bad Gateway) or health check failures, leading them to select options related to security groups or health check mismatches instead of the correct idle timeout configuration.

How to eliminate wrong answers

Option A is wrong because HTTPS health checks require the target to support HTTPS; if the instances only support HTTP, the health check would fail and the instances would be marked unhealthy, leading to 503 errors (not 504). Option B is wrong because disabling cross-zone load balancing affects traffic distribution across Availability Zones, not the timeout behavior that causes 504 errors. Option D is wrong because a missing inbound security group rule for the load balancer would prevent the load balancer from establishing connections to the instances, resulting in 502 errors or health check failures, not intermittent 504 timeouts.

Practice this question →
53
MCQhard

A developer is trying to decrypt an S3 object using an AWS KMS key. The decryption fails with an 'AccessDenied' error. The IAM policy attached to the developer's user includes the statement in the exhibit. The KMS key policy includes the following statement: { "Sid": "Enable IAM User Permissions", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::123456789012:root" }, "Action": "kms:*", "Resource": "*" } What is the most likely reason for the failure?

A.The KMS key policy does not grant access to the developer's IAM user.
B.The KMS key policy specifies 'kms:*' which is too broad and causes a conflict.
C.The developer's IAM policy does not include 'kms:Decrypt' permission.
D.The developer's IAM policy uses 'Resource' with the full key ARN but the key policy requires a different format.
AnswerC

Ly identifies `kms:GenerateDataKey` as the missing permission. For decryption, `kms:Decrypt` is required, not `kms:GenerateDataKey`. However, it is the closest option because it points out a missing KMS action in the IAM policy.

Why this answer

To decrypt an S3 object encrypted with SSE-KMS, the principal needs kms:Decrypt permission on the KMS key. The key policy's default root statement enables IAM policies in the account, so the most likely cause of AccessDenied is that the developer's IAM policy lacks kms:Decrypt.

Exam trap

Candidates often confuse the required KMS actions for decryption vs. encryption. `kms:GenerateDataKey` is needed to encrypt new objects, while `kms:Decrypt` is needed to decrypt. The key policy default allows root, so it is not the issue.

Practice this question →
54
MCQeasy

An application running on Amazon EC2 instances behind an Application Load Balancer (ALB) is experiencing intermittent 503 errors. The EC2 instances are in an Auto Scaling group. What is the MOST likely cause?

A.The SSL certificate on the ALB has expired.
B.The target group health checks are failing.
C.The ALB DNS name is not resolving.
D.The security group for the ALB is blocking traffic.
AnswerB

When all registered instances within an Application Load Balancer (ALB) target group fail their configured health checks, the ALB marks them as unhealthy and stops routing traffic to them. If there are no healthy targets remaining in any associated target group, the ALB cannot fulfill incoming client requests. Consequently, the ALB returns an HTTP 503 Service Unavailable error, indicating that while the load balancer itself is operational, it has no available backend resources to process the request.

Why this answer

The intermittent 503 errors indicate that the ALB temporarily has no healthy targets to forward requests to. When target group health checks fail, the ALB marks instances as unhealthy and stops routing traffic to them, causing a 503 response if all instances are unhealthy. This aligns with the Auto Scaling group potentially launching new instances that haven't passed health checks yet, or existing instances failing health checks due to application overload or misconfiguration.

Exam trap

The trap here is that candidates often confuse 503 errors with SSL or DNS issues, but 503 specifically indicates the ALB is reachable and functioning but has no healthy targets to serve the request.

How to eliminate wrong answers

Option A is wrong because an expired SSL certificate on the ALB would cause TLS handshake failures (e.g., 502 Bad Gateway or connection errors), not intermittent 503 errors; the ALB would still route traffic to healthy targets. Option C is wrong because if the ALB DNS name were not resolving, clients would receive a DNS resolution failure (NXDOMAIN) or timeout, not an HTTP 503 error from the ALB. Option D is wrong because if the security group for the ALB were blocking traffic, clients would receive a timeout or connection refused error, not an HTTP 503 response; the ALB would not be reachable at all.

Practice this question →
55
Multi-Selectmedium

A company is using Amazon S3 to store log files. The logs are rarely accessed after 30 days but must be retained for 7 years for compliance. Which THREE actions should the company take to optimize storage costs?

Select 3 answers
A.Use S3 Lifecycle policy to delete objects after 30 days.
B.Store objects in S3 One Zone-IA from the start.
C.Use S3 Lifecycle policy to transition objects to S3 Glacier after 1 year.
D.Enable S3 Lifecycle policy to expire objects after 7 years.
E.Use S3 Lifecycle policy to transition objects to S3 Standard-IA after 30 days.
AnswersC, D, E

Transitioning logs to S3 Glacier after one year is correct because it aligns cost with access patterns: logs older than a year are rarely retrieved but must still be retained. Glacier provides secure, durable, long-term archival at much lower storage cost than Standard or Standard-IA, while still allowing retrieval within minutes for audits. This lifecycle transition does not delete the objects, so it preserves all logs until the eventual expiration date.

Why this answer

Transitioning objects to S3 Glacier after 1 year reduces storage costs for long-term retention while maintaining compliance. Option D is correct because lifecycle policies can expire objects after 7 years, meeting the retention requirement. Option E is correct because transitioning to S3 Standard-IA after 30 days optimizes costs for infrequently accessed logs.

Option A is wrong because deleting objects after 30 days violates the 7-year retention requirement. Option B is wrong because S3 One Zone-IA lacks the durability needed for compliance data and is not cost-effective if logs are accessed frequently in the first 30 days.

Practice this question →
56
Multi-Selecthard

Which TWO actions can help reduce the cold start time for an AWS Lambda function? (Choose 2)

Select 2 answers
A.Place the Lambda function in a VPC
B.Increase the function's memory allocation
C.Use a larger deployment package with all dependencies included
D.Implement a scheduled CloudWatch Event to invoke the function every 5 minutes
E.Use provisioned concurrency to pre-warm the function
AnswersB, D

More memory provides more CPU, reducing initialization time.

Why this answer

Options B and D are correct. Increasing the function's memory allocation also increases CPU and network throughput, which can speed up initialization and reduce cold start time. Implementing a scheduled CloudWatch Event to invoke the function every 5 minutes keeps the function warm by preventing the container from being reclaimed, minimizing cold starts.

Option A is incorrect because placing the function in a VPC adds latency due to ENI creation, increasing cold start time. Option C is incorrect because a larger deployment package increases download time, worsening cold starts. Option E is incorrect because provisioned concurrency eliminates cold starts entirely, but it's a different solution that requires additional cost; the question asks for actions that reduce cold start time, and provisioned concurrency is a separate feature.

Practice this question →
57
MCQhard

A developer is troubleshooting an AWS Elastic Beanstalk environment that is failing health checks. The environment runs a web application on Tomcat. The developer checks the logs and finds no errors. What is the most likely cause of the health check failure?

A.The application's health check URL is returning a non-200 status code.
B.The security group for the instances does not allow traffic from the load balancer.
C.The application is throwing exceptions that are not logged.
D.The application is listening on a port other than 80.
AnswerA

Elastic Beanstalk environments rely on health checks, typically performed by the associated Load Balancer, to determine the operational status of application instances. If the configured health check URL, often the root path "/", consistently returns a non-200 HTTP status code, the Load Balancer will mark the instance as unhealthy. This leads to the instance being removed from the target group, preventing traffic, and can cause Elastic Beanstalk to report a "Degraded" or "Severe" environment health status, triggering instance replacement or environment instability.

Why this answer

The most likely cause is that the application's health check URL is returning a non-200 status code. Elastic Beanstalk uses the load balancer to perform health checks against a configurable path (default: /). If the application responds with any status other than 200 OK, the load balancer marks the instance as unhealthy, even if the application logs show no errors.

This is a common misconfiguration where the health check endpoint is not implemented or returns an unexpected status.

Exam trap

The trap here is that candidates assume health check failures are always due to network or infrastructure issues (security groups, ports) rather than application-level misconfigurations like a missing or incorrect health check endpoint.

How to eliminate wrong answers

Option B is wrong because if the security group blocked traffic from the load balancer, the instances would be unreachable entirely, not just failing health checks, and the logs would likely show connection timeouts or refused connections. Option C is wrong because unlogged exceptions would still typically result in a non-200 response or an error page, which would be reflected in the health check status; the question states logs show no errors, making this unlikely. Option D is wrong because Elastic Beanstalk configures the load balancer to forward traffic to the correct port (e.g., 8080 for Tomcat), and the health check is sent to that same port; listening on a different port would cause a connection failure, not a health check failure with no errors in logs.

Practice this question →
58
MCQhard

A company runs a stateful web application on EC2 instances in an Auto Scaling group. Users report that their session data is lost when instances are replaced during scaling events. What is the best solution to preserve session state?

A.Use ElastiCache as a centralized session store.
B.Enable sticky sessions on the Application Load Balancer.
C.Store sessions in the Application Load Balancer.
D.Use an S3 bucket to store session data.
AnswerA

ElastiCache, particularly Redis, provides an extremely fast, in-memory data store that is ideal for managing user session data. By centralizing sessions here, any EC2 instance can retrieve or update a user's session state with very low latency, ensuring a consistent experience even if the user's subsequent requests are routed to a different application instance. This approach effectively decouples the session state from individual application servers, making the web application highly scalable, resilient to instance failures, and easier to manage in an auto-scaling environment.

Why this answer

ElastiCache provides a centralized, in-memory session store that is external to the EC2 instances. This ensures session data persists independently of the instance lifecycle, so when an instance is replaced during a scaling event, the new instance can retrieve the session from ElastiCache, preserving user state. This is the best solution because it decouples session state from compute resources, aligning with the stateless application pattern recommended for Auto Scaling groups.

Exam trap

The trap here is that candidates often confuse sticky sessions (option B) with session persistence, not realizing that sticky sessions only maintain request routing to the same instance, not the session data itself when the instance is replaced.

How to eliminate wrong answers

Option B is wrong because sticky sessions (session affinity) only route a user to the same instance, but they do not preserve session data when that instance is terminated and replaced; the session is still lost. Option C is wrong because the Application Load Balancer does not store session data; it only forwards requests and can manage cookies for stickiness, but the session state itself must be stored elsewhere. Option D is wrong because S3 is an object store with higher latency and is not designed for low-latency, frequent read/write operations required for session management; it would introduce unacceptable performance overhead and is not a session store.

Practice this question →
59
MCQmedium

A developer is optimizing a DynamoDB table for a gaming leaderboard. The table stores player scores and is read-heavy. Queries often fetch the top 10 scores. Which indexing strategy best reduces RCU consumption?

A.Create a sparse index on player ID.
B.Use a local secondary index on score.
C.Enable DynamoDB Accelerator (DAX) for caching.
D.Create a global secondary index with score as the sort key.
AnswerD

A Global Secondary Index (GSI) has its own independent partition key and sort key, allowing for different access patterns than the base table. By creating a GSI with a common partition key (e.g., a static value like "LEADERBOARD") and 'score' as the sort key, all player scores can be grouped and efficiently queried. This enables a `Query` operation on the GSI, ordered by 'score' in descending order, to retrieve the top N results with minimal RCU consumption, scaling independently from the base table.

Why this answer

A global secondary index (GSI) with score as the sort key allows efficient retrieval of the top 10 scores by querying the index in descending order, reading only the required items. This minimizes read capacity unit (RCU) consumption compared to scanning the base table, as each query reads exactly 10 items (or fewer) rather than consuming RCUs for a full table scan or filtering large result sets.

Exam trap

The trap here is that candidates often confuse local secondary indexes (LSIs) with global secondary indexes (GSIs), not realizing that LSIs are tied to the base table's partition key and cannot efficiently retrieve global top scores across all partitions.

How to eliminate wrong answers

Option A is wrong because a sparse index on player ID would not help retrieve top scores; it only indexes items where player ID is present, and querying by player ID does not sort by score. Option B is wrong because a local secondary index (LSI) on score is constrained to the same partition key as the base table, requiring a full partition scan to get top scores across all partitions, which consumes more RCUs. Option C is wrong because DynamoDB Accelerator (DAX) is an in-memory cache that reduces latency and read load, but it does not change the underlying query pattern or RCU consumption for fetching top scores; the base table or index still needs to be queried, and DAX caches results after the first read, not reducing RCUs for the initial query.

Practice this question →
60
MCQhard

A developer is troubleshooting performance issues in an application that uses Amazon ElastiCache for Redis. The application experiences periodic latency spikes during peak hours. The developer checks CloudWatch metrics and sees that the 'Evictions' metric is consistently high and the 'CacheHitRate' metric is low. The cluster uses a single cache.t3.small node. Which action will most likely improve the cache hit rate and reduce latency?

A.Increase the number of replicas
B.Enable cluster mode and add more shards
C.Increase the TTL of cached items
D.Use a larger instance type
AnswerD

Upgrading to a larger instance type directly addresses memory constraints by providing a substantial increase in the node's available RAM. This vertical scaling approach immediately expands the cache's capacity, allowing more items to be stored without triggering eviction policies. It is a straightforward, non-disruptive operational change for ElastiCache, often involving a brief failover, and effectively resolves memory-related performance issues without requiring any application code modifications.

Why this answer

The symptoms—high evictions and low cache hit rate—indicate that the single cache.t3.small node is running out of memory. Using a larger instance type increases the available memory, allowing more data to be cached, reducing evictions, and improving the cache hit rate. This directly addresses the root cause of memory pressure without changing the cluster architecture or data expiration behavior.

Exam trap

The trap here is that candidates often confuse scaling out (adding replicas or shards) with scaling up (increasing instance size), but for a single-node cluster suffering from memory exhaustion, the most direct and effective solution is to increase memory capacity, not to add replicas or change the cluster mode.

How to eliminate wrong answers

Option A is wrong because increasing the number of replicas does not increase the total memory capacity of the cluster; replicas are read-only copies that improve read scalability and fault tolerance, but they share the same memory limit as the primary node, so evictions and cache hit rate remain unchanged. Option B is wrong because enabling cluster mode and adding more shards distributes data across multiple nodes, which can increase total memory, but it requires application changes to support sharding and is more complex than simply scaling up the instance size; the immediate, simplest fix for a single-node cluster under memory pressure is to increase memory. Option C is wrong because increasing the TTL of cached items only delays their expiration, but if the cache is already full and evicting items due to memory pressure, longer TTLs will not prevent evictions—they may even worsen the problem by keeping stale data in memory longer.

Practice this question →
61
MCQmedium

A company's application uses Amazon DynamoDB as its database. The application reads the same item multiple times per second and occasionally sees stale data. The DynamoDB table uses the default eventually consistent reads. What should the developer change to ensure strongly consistent reads?

A.Increase the read capacity units of the table.
B.Use DynamoDB Accelerator (DAX) to cache the item.
C.Set the ConsistentRead parameter to true in the GetItem call.
D.Use DynamoDB transactions for all read operations.
AnswerC

Setting the ConsistentRead parameter to true in a GetItem API call explicitly instructs DynamoDB to perform a strongly consistent read. This ensures that the data returned reflects all successful write operations that completed before the read request was initiated, providing the most up-to-date version of the item. While this guarantees data freshness, it may incur slightly higher latency and consume more Read Capacity Units compared to an eventually consistent read.

Why this answer

DynamoDB's default read consistency model is eventually consistent, which can return stale data if an item is updated shortly before the read. By setting the `ConsistentRead` parameter to `true` in the `GetItem` call, the developer forces a strongly consistent read, ensuring the response reflects the most recent write. This directly addresses the stale data issue without changing throughput or adding caching.

Exam trap

The trap here is that candidates often confuse throughput scaling (Option A) or caching (Option B) with consistency guarantees, or mistakenly think transactions (Option D) are required for strong consistency, when in fact a simple parameter change on the read operation is the correct and minimal fix.

How to eliminate wrong answers

Option A is wrong because increasing read capacity units (RCUs) only affects throughput and cost, not the consistency model; eventually consistent reads still return stale data regardless of RCU count. Option B is wrong because DynamoDB Accelerator (DAX) is an in-memory cache that improves read performance but does not guarantee strong consistency; it can serve stale data from its cache. Option D is wrong because DynamoDB transactions are designed for atomic, isolated multi-item operations (using `TransactGetItems` or `TransactWriteItems`), not for ensuring single-item strong consistency; using transactions for simple reads adds unnecessary overhead and cost.

Practice this question →
62
Multi-Selectmedium

Users receive AccessDenied when downloading SSE-KMS encrypted S3 objects cross-account. Which two policies may need changes?

Select 2 answers
A.CloudFront cache policy
B.S3 bucket/object access policy or IAM policy
C.KMS key policy allowing decrypt to the caller
D.Route 53 resolver rule policy
AnswersB, C

Correct for the stated requirement.

Why this answer

When accessing SSE-KMS encrypted S3 objects cross-account, the S3 bucket policy or the IAM policy must explicitly grant the s3:GetObject permission to the caller. Additionally, the KMS key policy must allow the kms:Decrypt action for the caller's AWS account or IAM role, because SSE-KMS uses a customer master key (CMK) to encrypt the object, and decryption requires KMS permissions. Without both policies, the request fails with AccessDenied even if the S3 permissions are correct.

Exam trap

The trap here is that candidates often assume only the S3 bucket policy needs updating, forgetting that SSE-KMS adds a second authorization layer via KMS key policies, which must explicitly allow the decrypt action for the cross-account caller.

Practice this question →
63
MCQmedium

A DynamoDB application receives ProvisionedThroughputExceededException during predictable daily peaks. The workload is not cacheable. What should be changed?

A.Enable S3 Transfer Acceleration
B.Use on-demand capacity or configure autoscaling/scheduled scaling for the table
C.Disable CloudWatch metrics
D.Move all reads to strongly consistent mode
AnswerB

Utilizing DynamoDB's on-demand capacity mode automatically scales read and write throughput to accommodate varying workloads without requiring capacity planning. Alternatively, configuring autoscaling for the table dynamically adjusts provisioned read and write capacity units (RCUs/WCUs) based on actual traffic patterns or target utilization, preventing throttling errors during peak loads. Scheduled scaling further allows for pre-planned capacity adjustments for predictable traffic spikes, ensuring the application always has sufficient resources.

Why this answer

The ProvisionedThroughputExceededException indicates that the table's read/write capacity is insufficient during peak loads. Since the workload is predictable but not cacheable, the correct solution is to either switch to on-demand capacity mode, which automatically scales to handle any traffic level, or configure auto scaling with scheduled scaling to match the predictable peaks. This directly addresses the capacity shortfall without requiring application changes.

Exam trap

The trap here is that candidates may think disabling CloudWatch metrics reduces overhead or that strongly consistent reads improve reliability, but both actions either remove monitoring or increase capacity consumption, making the throttling worse.

How to eliminate wrong answers

Option A is wrong because S3 Transfer Acceleration is a feature for speeding up uploads to S3 over long distances, not for DynamoDB throughput issues. Option C is wrong because disabling CloudWatch metrics would remove visibility into table performance and prevent monitoring of throttling events, making troubleshooting harder. Option D is wrong because strongly consistent reads consume more read capacity units than eventually consistent reads, which would worsen the throughput problem instead of solving it.

Practice this question →
64
Multi-Selecthard

A developer is troubleshooting a slow-running Amazon RDS for PostgreSQL instance. Which TWO metrics should the developer examine in Amazon CloudWatch to identify a possible resource bottleneck?

Select 2 answers
A.CPUUtilization
B.ReadIOPS and WriteIOPS with high Average Queue Depth
C.FreeableMemory
D.NetworkThroughput
E.DatabaseConnections
AnswersA, B

When CPUUtilization is high, the database engine is busy executing queries, parsing SQL, and managing internal tasks, leaving little processing headroom for new operations. On an undersized RDS instance, consistent CPU saturation translates directly into slower query response times and even connection timeouts during peak load. This metric is the most direct signal that the instance's compute capacity is a limiting factor.

Why this answer

High CPU utilization indicates a CPU bottleneck, which can slow down query processing. Option B is correct because high ReadIOPS and WriteIOPS accompanied by a high Average Queue Depth signal an I/O bottleneck, where the storage subsystem cannot keep up with requests. Option C is incorrect because FreeableMemory alone does not directly indicate a performance bottleneck; while low memory can cause issues, it is not a primary metric for resource bottlenecks.

Option D is incorrect because NetworkThroughput is rarely a limiting factor for RDS performance; the database typically processes requests faster than network bandwidth constraints. Option E is incorrect because DatabaseConnections only indicates the number of connections, not a direct resource bottleneck; performance problems are better captured by CPU or I/O metrics.

Practice this question →
65
MCQhard

A developer notices that an Amazon RDS for MySQL DB instance's CPU utilization is consistently above 90% during peak hours. The application uses read-heavy workloads. Which action would MOST effectively reduce CPU load without major architectural changes?

A.Implement an in-memory cache layer with Amazon ElastiCache.
B.Migrate the database to Amazon Aurora with auto-scaling.
C.Increase the DB instance size to a larger instance type.
D.Create a Multi-AZ deployment and use the standby for read queries.
AnswerA

Implementing an in-memory cache layer with Amazon ElastiCache (e.g., Redis or Memcached) is an effective strategy for reducing CPU load on a read-heavy database. By caching frequently accessed data, ElastiCache intercepts read requests before they reach the database, serving them much faster from memory. This significantly decreases the number of queries the RDS instance needs to process, directly lowering its CPU utilization and improving overall application responsiveness. It requires application-level changes to interact with the cache, but these are typically manageable.

Why this answer

The most effective solution without major architectural changes. Amazon ElastiCache provides an in-memory cache that offloads read traffic from the RDS instance, reducing CPU utilization. While it requires application modifications to integrate the cache, this is a standard practice and does not involve a full database migration or architectural overhaul.

Option B (migrate to Aurora) involves significant migration effort. Option C (increase instance size) may temporarily help but is less cost-effective and does not address the read-heavy nature. Option D is incorrect because Multi-AZ standby instances are for failover only and cannot serve read queries.

Exam trap

A common trap is assuming that a Multi-AZ standby can be used for read traffic. In AWS RDS, Multi-AZ standby is strictly for high availability and cannot serve reads. Read replicas are needed for offloading read queries.

Practice this question →
66
Multi-Selecthard

A developer is using AWS X-Ray to trace a Lambda function that calls DynamoDB and SQS. Some traces show errors. Which TWO actions should the developer take to diagnose the issue?

Select 2 answers
A.Examine the trace details for exception messages.
B.Verify that the Lambda function's IAM role has permissions for X-Ray.
C.Check the X-Ray service map for error edges.
D.Disable X-Ray sampling to capture all requests.
E.Enable CloudFront to cache responses.
AnswersA, C

Examining X-Ray trace details is the most direct and effective method to diagnose errors within a Lambda function. Each trace provides granular information for segments and subsegments, including full stack traces, precise exception messages, error codes, and specific HTTP status codes for downstream calls. This allows a developer to pinpoint the exact failure point, whether it's within the Lambda's code logic or an issue with an external service call, such as a DynamoDB throttling exception or a permission denied error.

Why this answer

To diagnose errors in existing X-Ray traces, the developer should examine trace details (Option A) to see exception messages and stack traces for each segment, and check the service map (Option C) for error edges that indicate which service interactions failed. Option B is about enabling X-Ray permissions, which is a prerequisite for tracing but does not help diagnose errors in traces that are already captured. Option D (disabling sampling) is unnecessary because X-Ray captures errors by default regardless of sampling.

Option E (CloudFront caching) is unrelated to trace diagnostics.

Exam trap

A common trap is selecting Option B, thinking that ensuring X-Ray permissions is a diagnostic step. However, missing permissions would prevent traces from being sent at all; since traces are present, the focus should be on analyzing the existing trace data (details and service map) to find error causes.

Practice this question →
67
Drag & Dropmedium

Drag and drop the steps to authenticate a user using Amazon Cognito User Pools in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First create the user pool and app client, then authenticate to receive tokens, and use tokens for authorization.

Practice this question →
68
MCQmedium

A developer notices that an AWS Lambda function is timing out after 3 seconds. The function processes messages from an SQS queue. What is the MOST likely cause of the timeout?

A.The SQS dead-letter queue is not configured.
B.The SQS queue visibility timeout is too short.
C.The Lambda function timeout is set too low.
D.The Lambda function's reserved concurrency is set to zero.
AnswerC

The default timeout is 3 seconds; increasing it resolves the timeout.

Why this answer

The Lambda function is timing out after 3 seconds, which matches the default Lambda timeout. The most likely cause is that the function timeout is set too low (3 seconds) and needs to be increased to accommodate processing time. Option B (SQS visibility timeout) affects message redelivery but not the Lambda execution timeout.

Option D (reserved concurrency set to zero) would prevent any invocations, not cause a timeout after 3 seconds. Option A (dead-letter queue not configured) does not cause timeouts; it only affects where failed messages go.

Practice this question →
69
MCQhard

A developer is troubleshooting an Amazon API Gateway REST API that returns 504 Gateway Timeout errors for certain requests. The backend is a Lambda function that performs a resource-intensive operation that occasionally takes up to 30 seconds. API Gateway has a default integration timeout of 29 seconds. The developer cannot reduce the execution time. What should the developer do to resolve the timeout issue?

A.Increase the API Gateway integration timeout to 30 seconds.
B.Refactor the Lambda function to use asynchronous invocation, return a 202 immediately, and have the client poll for results.
C.Enable API Gateway caching to avoid repeated calls.
D.Use multiple Lambda functions to parallelize processing.
AnswerB

Refactoring the Lambda function to use asynchronous invocation, returning a 202 immediately, and having the client poll for results is the correct approach for long-running operations. This pattern decouples the synchronous API Gateway request from the extended backend processing, allowing API Gateway to respond promptly with a 202 Accepted status. The Lambda function can then trigger an asynchronous workflow (e.g., via SQS, SNS, or directly invoking another Lambda asynchronously) and store results for the client to retrieve later through a separate polling mechanism, effectively bypassing the 29-second timeout.

Why this answer

It decouples the client from the long-running Lambda execution. By invoking the Lambda asynchronously, the API Gateway can return a 202 Accepted response immediately, well within the 29-second integration timeout. The client then polls a separate endpoint (e.g., using a presigned S3 URL or a DynamoDB status record) to retrieve the final result, completely sidestepping the timeout limitation.

Exam trap

The trap here is that candidates assume the integration timeout is configurable to any value, but AWS enforces a hard 29-second limit for REST APIs, making Option A technically impossible.

How to eliminate wrong answers

Option A is wrong because Amazon API Gateway has a hard maximum integration timeout of 29 seconds for REST APIs (and 30 seconds for HTTP APIs). You cannot increase it beyond that limit, so setting it to 30 seconds is not possible. Option C is wrong because caching only serves previously computed responses for identical requests; it does not reduce the execution time of a new, uncached request that still takes up to 30 seconds.

Option D is wrong because parallelizing the Lambda function does not reduce the total execution time of a single resource-intensive operation; the request still waits for all parallel tasks to complete, which can still exceed the 29-second timeout.

Practice this question →
70
MCQmedium

A developer receives an AccessDenied error when trying to put an object into an S3 bucket using the AWS SDK. The IAM user has an attached policy that grants s3:PutObject on the bucket. What is the MOST likely cause of the error?

A.The request is being throttled by S3.
B.The object key is too long.
C.The AWS SDK version is outdated.
D.The bucket policy explicitly denies the action.
AnswerD

When evaluating permissions, AWS IAM follows a strict order of precedence where an explicit Deny statement always overrides any Allow statement. If a bucket policy contains an explicit Deny for a specific action or principal, that denial takes precedence over any Allow statement present in the requesting IAM user's or role's identity-based policy. This ensures that even if an identity policy grants permission, a resource-based policy can still block access, resulting in an AccessDenied error (HTTP 403).

Why this answer

The most likely cause is that the bucket policy explicitly denies the s3:PutObject action. IAM policies grant permissions, but S3 bucket policies can override them with an explicit deny, which takes precedence over any allow. Since the IAM user already has an attached policy allowing s3:PutObject, the only way to get an AccessDenied error is if a bucket policy explicitly denies the action.

Exam trap

The trap here is that candidates assume an IAM allow is sufficient, forgetting that S3 bucket policies can explicitly deny actions, and that explicit deny always wins over allow.

How to eliminate wrong answers

Option A is wrong because S3 throttling returns a 503 SlowDown error, not an AccessDenied error. Option B is wrong because an overly long object key would cause a 400 Bad Request error, not an AccessDenied error. Option C is wrong because an outdated SDK version might cause compatibility issues or missing features, but it would not result in an AccessDenied error; the error is a permissions issue, not a client version issue.

Practice this question →
71
MCQmedium

A developer monitors an AWS Lambda function that processes records from an Amazon SQS queue and writes results to an Amazon DynamoDB table. CloudWatch Logs show that execution time has increased over the past week, and the function frequently times out at the 5-minute timeout. The function's code has not been changed recently. CloudWatch metrics show a high rate of DynamoDBProvisionedThroughputExceededException errors. The DynamoDB table has 5 write capacity units (WCUs). What action will MOST effectively reduce the function's execution time?

A.Increase the Lambda function's timeout to 10 minutes.
B.Increase the write capacity units (WCUs) on the DynamoDB table.
C.Increase the Lambda function's memory allocation to 3008 MB.
D.Use an Amazon SQS FIFO queue instead of a standard queue for the Lambda trigger.
AnswerB

The `DynamoDBProvisionedThroughputExceededException` directly signifies that the DynamoDB table's allocated write capacity units (WCUs) are insufficient to handle the incoming write requests. Increasing the WCUs directly addresses this bottleneck by provisioning more throughput for the table. This action allows DynamoDB to process more writes per second, eliminating throttling, reducing Lambda retries, and consequently speeding up the Lambda function's overall execution time.

Why this answer

The high rate of DynamoDBProvisionedThroughputExceededException errors indicates that the Lambda function is being throttled by DynamoDB due to insufficient write capacity. When writes are throttled, the Lambda function must retry, which increases execution time and can lead to timeouts. Increasing the WCUs on the DynamoDB table directly addresses the root cause by allowing the function to write without throttling, thereby reducing execution time.

Exam trap

The trap here is that candidates often assume increasing Lambda timeout or memory will fix performance issues, but the real bottleneck is the DynamoDB write capacity, which directly causes the throttling errors and increased execution time.

How to eliminate wrong answers

Option A is wrong because increasing the timeout to 10 minutes does not resolve the underlying throttling issue; it only masks the symptom by allowing the function to run longer while still being throttled. Option C is wrong because increasing memory allocation (up to 3008 MB) primarily improves CPU performance and network throughput, but does not fix DynamoDB throttling caused by insufficient WCUs. Option D is wrong because switching to an SQS FIFO queue does not affect DynamoDB write capacity; FIFO queues enforce message ordering and deduplication but do not reduce the throttling rate from DynamoDB.

Practice this question →
72
Multi-Selectmedium

A developer is troubleshooting a slow-running query on an Amazon RDS for MySQL database. The query is used by a reporting application and takes over 30 seconds to complete. The database is a db.r5.large instance with 200 GB of gp2 storage. Which TWO actions should the developer take to improve query performance?

Select 2 answers
A.Terminate idle connections to free up resources.
B.Review the slow query log to identify the query and its execution plan.
C.Increase the allocated storage to 500 GB to improve I/O performance.
D.Add appropriate indexes to the tables involved in the query.
E.Enable Multi-AZ deployment for better read performance.
AnswersB, D

Reviewing the slow query log is the first diagnostic step because it captures queries that exceed a specified duration, along with their execution time and connection metadata. Once identified, use EXPLAIN to analyze the execution plan, exposing table scans, missing indexes, or poor join ordering. This evidence-based approach tells you exactly which query to optimize and whether to add indexes or rewrite the query.

Why this answer

Reviewing the slow query log helps identify the query and its execution plan, which is essential for diagnosing performance issues. Option D is correct: adding appropriate indexes can speed up query execution by reducing the number of rows scanned. Option A is incorrect: terminating idle connections frees up resources but does not directly improve query performance for a slow-running query.

Option C is incorrect: increasing storage to gp2 does not improve I/O performance; gp2 performance scales with size only up to a point, but the primary bottleneck is likely query optimization, not storage. Option E is incorrect: Multi-AZ is for high availability and failover, not for enhancing read performance.

Practice this question →
73
MCQeasy

A developer notices that an S3 bucket policy allows public read access to all objects. The bucket contains sensitive data that should only be accessible by authorized IAM users. What is the BEST way to remediate this?

A.Enable default encryption on the bucket.
B.Modify the bucket policy to remove the public statement and use IAM policies for access.
C.Enable S3 Block Public Access at the account level.
D.Enable S3 Object Ownership and use ACLs.
AnswerB

The most direct and secure solution is to modify the S3 bucket policy to remove any statements that grant public access, typically identified by "Principal: "*". Concurrently, implement specific IAM policies attached to users, groups, or roles to grant precise, least-privilege access to authorized principals. This approach directly addresses the misconfiguration, ensures granular control, and aligns with AWS security best practices for managing access to S3 resources.

Why this answer

The bucket policy currently grants public read access, which overrides any IAM-based restrictions. By removing the public statement from the bucket policy and relying solely on IAM policies, access is controlled at the user level, ensuring only authorized IAM users can read objects. This aligns with the principle of least privilege and follows AWS best practices for securing S3 data.

Exam trap

The trap here is that candidates often confuse encryption with access control, thinking that enabling encryption (Option A) will prevent unauthorized access, when in fact encryption only protects data at rest and does not affect public read permissions.

How to eliminate wrong answers

Option A is wrong because enabling default encryption only encrypts data at rest; it does not restrict access, so public read access would still be allowed. Option C is wrong because S3 Block Public Access at the account level would prevent all public access, but it is a broad, account-wide setting that may inadvertently block legitimate public access for other buckets; the question asks for the best remediation for this specific bucket, not a blanket account-level change. Option D is wrong because S3 Object Ownership and ACLs are legacy access control mechanisms that are less secure and more complex to manage than IAM policies, and they do not directly address the public read access granted by the bucket policy.

Practice this question →
74
MCQeasy

A developer is deploying a new version of a Lambda function using an alias for blue/green deployment. Traffic is gradually shifted to the new version. During the shift, a high error rate is observed. What should the developer do to minimize impact?

A.Use the Lambda function's provisioned concurrency to pre-warm the new version.
B.Manually revert the alias to point back to the old version.
C.Configure the alias with a canary deployment and an error rate alarm for automatic rollback.
D.Delete the new version and redeploy after fixing the issue.
AnswerC

Configuring a Lambda alias with a canary deployment allows for gradual shifting of traffic to the new function version, starting with a small percentage. Integrating this with an Amazon CloudWatch error rate alarm enables automatic rollback: if the new version's error rate exceeds a predefined threshold during the canary phase, the alias automatically reverts all traffic to the stable old version. This strategy minimizes the impact of potential issues by detecting them early and automating recovery.

Why this answer

It automates the rollback process using AWS CodeDeploy's canary deployment with an Amazon CloudWatch alarm on the error rate. When the alarm triggers, CodeDeploy automatically shifts traffic back to the previous version, minimizing impact without manual intervention. This is the recommended approach for safe blue/green deployments with Lambda aliases.

Exam trap

The trap here is that candidates may think manual reversion (Option B) is the simplest fix, but the exam emphasizes automated rollback strategies (like canary deployments with alarms) as the best practice for minimizing impact during blue/green deployments.

How to eliminate wrong answers

Option A is wrong because provisioned concurrency pre-warms execution environments to reduce cold starts, but it does not address a high error rate during traffic shifting; errors are typically caused by code defects, not cold starts. Option B is wrong because manually reverting the alias is a valid fallback but is slower and error-prone compared to an automated rollback; the question asks to minimize impact, and manual reversion introduces delay and potential for human error. Option D is wrong because deleting the new version and redeploying after fixing the issue is a reactive approach that does not minimize impact during the shift; it requires manual intervention and does not provide automatic recovery.

Practice this question →
75
MCQmedium

A developer is managing an application running on Amazon EC2 instances behind an Application Load Balancer. Users report that the application becomes unresponsive after several hours, and restarting the instance temporarily fixes the issue. The developer suspects a memory leak but cannot add custom instrumentation. Which AWS service can collect memory utilization metrics and help identify the memory leak with minimal configuration?

A.Use Amazon CloudWatch Logs agent to capture application logs.
B.Use the EC2 instance metadata service to query memory usage.
C.Install the CloudWatch agent on the EC2 instances to collect memory metrics and emit them to CloudWatch.
D.Use AWS X-Ray to trace memory allocation.
AnswerC

The unified CloudWatch agent is the correct and recommended solution for collecting detailed operating system-level metrics, including memory utilization, from EC2 instances. This agent can be configured to gather various custom metrics, such as used memory percentage, free memory, and swap usage, directly from the instance's operating system. These collected metrics are then reliably published to CloudWatch, enabling comprehensive monitoring, alarming, and dashboarding capabilities.

Why this answer

The CloudWatch agent can collect custom metrics, including memory utilization, from EC2 instances and publish them to Amazon CloudWatch. This allows the developer to monitor memory usage over time and identify a memory leak without modifying the application code. The default EC2 metrics do not include memory utilization, so the CloudWatch agent is the minimal-configuration solution for this requirement.

Exam trap

The trap here is that candidates assume EC2 automatically provides memory metrics in CloudWatch, but in reality, only CPU, network, and disk metrics are available by default; memory requires the CloudWatch agent.

How to eliminate wrong answers

Option A is wrong because the CloudWatch Logs agent captures application logs, not memory utilization metrics; logs could indirectly indicate issues but do not provide direct memory metrics needed to identify a leak. Option B is wrong because the EC2 instance metadata service provides information about the instance itself (e.g., instance ID, AMI ID) but does not expose memory utilization data; it is not a monitoring service for OS-level metrics. Option D is wrong because AWS X-Ray traces requests and identifies performance bottlenecks in distributed applications, not memory allocation or utilization; it is designed for tracing, not OS-level resource monitoring.

Practice this question →
Page 1 of 2 · 101 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Dva Troubleshooting Optimization questions.

Start 20-question session