Examkin

All practice questions

1542 questions

All types1,542Multiple choice782Multiple select746Ordering14
Question 241Question →

A developer is running a containerized Python application in Amazon ECS on AWS Fargate. The container needs to read messages from an Amazon SQS queue. The ECS Task Definition has an ECS Task Role assigned with the necessary SQS permissions. During deployment, the developer accidentally leaves the environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY set to developer-specific credentials that do not have permission to access SQS. When the application initializes the Boto3 client, which of the following describes the credential resolution behavior and the result of the API calls?

Show answer & explanation

Answer: The application uses the credentials defined in the environment variables because environment variables take precedence over ECS container credentials in the default credential provider chain, causing the SQS API calls to fail.

Answer

The application uses the credentials defined in the environment variables because environment variables take precedence over ECS container credentials in the default credential provider chain, causing the SQS API calls to fail.
The default credential provider chain checks for credentials in a specific order: first environment variables, then system properties (if applicable), then web identity token credentials, then shared credentials profiles, and finally ECS container credentials (Task Roles) and EC2 instance metadata. Because environment variables are checked first, any set environment variables will override the Task Role credentials, causing the application to use the unauthorized credentials and fail.

Step-by-Step Solution

1
Analyze the execution environment and configured credential sources.
The application has two credential sources available: environment variables (developer keys) and ECS container credentials (ECS Task Role).
To determine which credentials the SDK uses, we must identify all present credentials.
2
Evaluate the order of precedence in the AWS SDK Default Credential Provider Chain.
Environment variables are evaluated first, while ECS container credentials are evaluated later in the chain.
The SDK uses the first available credentials in the default chain order.
3
Determine the outcome of the API calls based on the resolved credentials.
The application uses the developer-specific credentials from the environment variables, which lack SQS permissions, leading to an Access Denied error.
Since the environment variable credentials take precedence, they are used, and their lack of permissions causes the API calls to fail.

Key Concept

AWS SDK Default Credential Provider Chain precedence
Question 242Question →

A developer is writing an AWS Lambda function that retrieves data from a database. To optimize performance and reduce latency, the developer wants to reuse the database connection client across multiple function executions. In which part of the code should the database connection client be initialized to achieve this goal?

Show answer & explanation

Answer: Outside the main handler function in the global initialization code

Answer

The database connection client should be initialized outside the main handler function in the global initialization code.
Initializing the database connection client outside the main handler function in the global initialization code executes the initialization once during the initialization (INIT) phase. Warm invocations reuse the same execution environment, which caches the client and reduces connection latency and resource load.

Step-by-Step Solution

1
Analyze the AWS Lambda execution environment lifecycle.
The execution environment goes through an initialization phase (INIT phase) that runs global code, followed by the invocation phase (INVOKE phase) that runs the handler code.
Understanding the lifecycle allows a developer to identify where static configurations should reside for caching.
2
Determine the resource initialization scope.
Declaring the database connection client in the global scope (outside the handler) executes it during the INIT phase once, and subsequent warm invocations within the same execution context reuse this initialized client.
Declaring resources inside the handler forces initialization on every invocation, causing unnecessary overhead and database connection exhaustion.

Key Concept

Execution Context Reuse in AWS Lambda
Estimated Time:45s
Question 243Question →

A developer is creating a serverless microservice. The developer wants to expose an endpoint using Amazon API Gateway that passes the raw incoming HTTP request details, such as headers, query parameters, and request body, directly to a backend AWS Lambda function as a single JSON object. The solution must not require any request mapping templates. Which integration type should the developer configure in API Gateway?

Show answer & explanation

Answer: Lambda Proxy Integration

Answer

Lambda Proxy Integration
Lambda Proxy Integration is the correct choice because it automatically sends the raw HTTP request details (headers, query parameters, stage variables, and body) directly to the Lambda function in a predefined JSON format. This setup removes the need for configuring integration request or response mapping templates.

Step-by-Step Solution

1
Identify the developer's core requirement: passing the entire raw HTTP request (headers, query parameters, body) to AWS Lambda without using mapping templates.
The requirement specifies zero request mapping templates and direct forwarding of request details as a structured JSON object.
Knowing the integration constraints helps narrow down the appropriate integration type in API Gateway.
2
Evaluate the available integration types for Lambda backends.
Lambda Proxy integration automatically wraps the raw request in a standardized JSON event format, whereas Lambda Custom integration requires configuring mapping templates.
Comparing Lambda Proxy and Lambda Custom integration highlights how payload parsing and routing are handled.
3
Select the option that meets the requirements without template configuration.
Lambda Proxy Integration satisfies all criteria.
It eliminates configuration overhead by delegating request and response mapping logic directly to the code running inside the Lambda function.

Key Concept

The core differences between Amazon API Gateway integration types for AWS Lambda backend services.
Estimated Time:45s
Question 244Question →

A developer is configuring a Java-based backend service that uses the AWS SDK to read objects from an Amazon S3 bucket. The service will be deployed to Amazon Elastic Container Service (ECS) on Amazon EC2 container instances. During testing, the developer wants to ensure that the SDK retrieves credentials securely using the default credential provider chain.

Which two credential sources are checked by the default credential provider chain before it attempts to retrieve credentials from the Amazon EC2 Instance Metadata Service (IMDS)?

Select all that apply

Show answer & explanation

Answer: Environment variables such as `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`; The shared credentials file (typically located at `~/.aws/credentials` on the host)

Answer

The default credential provider chain resolves environment variables and the shared credentials file before checking the Amazon EC2 Instance Metadata Service.
The default credential provider chain checks environment variables (like `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`) first, and subsequently checks the shared credentials file (usually at `~/.aws/credentials`). Both of these checks occur before the SDK attempts to query the Amazon EC2 Instance Metadata Service (IMDS) for instance profile credentials.

Step-by-Step Solution

1
Analyze client initialization
The client is created using default settings
Allows the default credential provider chain to resolve credentials automatically
2
Trace the default credential provider chain precedence
The chain searches environment variables, system properties, web identity tokens, and the shared credentials file before instance metadata
Determines which sources are checked before the EC2 Instance Metadata Service
3
Match correct locations to the options
Environment variables and the shared credentials file are correct
Identifies the correct choices from the five options

Key Concept

AWS SDK Default Credential Provider Chain Order of Precedence
Estimated Time:1m 30s
Question 245Question →

A developer has deployed an AWS Lambda function that performs CPU-intensive image resizing. During testing, the function successfully processes small image files, but frequently times out when processing larger image files. The developer wants to increase the processing speed of the function to prevent these timeouts. Which configuration change should the developer make?

Show answer & explanation

Answer: Increase the memory allocation for the Lambda function.

Answer

Increase the memory allocation for the Lambda function.
Increasing the memory allocation is the correct solution because AWS Lambda allocates CPU power proportionally to the configured memory. By allocating more memory, the function automatically receives more CPU capacity, which directly speeds up CPU-intensive processing tasks like image resizing.

Step-by-Step Solution

1
Analyze the cause of the timeout.
The function is performing CPU-intensive work (image resizing) and timing out on larger files.
Identifying that the workload is CPU-bound is critical to selecting the correct optimization strategy.
2
Identify how AWS Lambda allocates CPU resources.
AWS Lambda allocates CPU power proportionally to the configured memory size.
Understanding that increasing memory is the mechanism for increasing CPU power allows for performance optimization.
3
Select the configuration change that increases CPU resource allocation.
Increasing the memory allocation of the function.
Increasing memory will provide more CPU power, speeding up the execution and preventing the timeout.

Key Concept

AWS Lambda resource allocation and scaling behavior (memory and CPU relationship)
Question 246Question →

A developer has configured an AWS Lambda function to run inside a private subnet of a custom VPC to query an Amazon RDS PostgreSQL database. The function must also retrieve API keys from AWS Secrets Manager and call an external third-party payment gateway over the internet. During testing, the function consistently times out when attempting to call the Secrets Manager service and the payment gateway. Which combination of network and code configurations will resolve these timeouts while maintaining access to the RDS database?

Show answer & explanation

Answer: Configure a NAT Gateway in a public subnet of the VPC, update the private subnet's route table to route non-VPC traffic (0.0.0.0/00.0.0.0/0) to the NAT Gateway, and retrieve the API keys dynamically in the function handler using the AWS SDK.

Answer

Configure a NAT Gateway in a public subnet of the VPC, update the private subnet's route table to route non-VPC traffic (0.0.0.0/00.0.0.0/0) to the NAT Gateway, and retrieve the API keys dynamically in the function handler using the AWS SDK.
To allow a Lambda function inside a private subnet of a VPC to access both internet-facing resources (the external payment gateway) and public AWS service endpoints (like AWS Secrets Manager), you must route outbound internet traffic through a NAT Gateway. The NAT Gateway must be placed in a public subnet that has a route to an Internet Gateway. The private subnet's route table is then updated to forward all outbound traffic (0.0.0.0/00.0.0.0/0) to the NAT Gateway. This configuration preserves the function's ability to communicate with the RDS database in the private subnet while resolving the connectivity timeouts to external services.

Step-by-Step Solution

1
Identify the cause of the connection timeout.
The Lambda function inside the private subnet cannot reach public endpoints because it lacks a route to the internet.
By default, a private VPC subnet does not have access to public AWS services or external endpoints unless routed through a NAT Gateway or VPC Endpoint.
2
Configure outbound internet access for the private subnet.
A NAT Gateway is deployed in a public subnet, and the private subnet's route table is updated to forward 0.0.0.0/00.0.0.0/0 traffic to the NAT Gateway.
This establishes a route for the Lambda function to communicate with both the public AWS Secrets Manager service and the external third-party gateway.
3
Ensure secure credentials management and local access.
The Lambda function remains in the private VPC subnet to access the RDS database securely, and API keys are retrieved dynamically at runtime.
This conforms to the AWS Shared Responsibility Model and security best practices by avoiding hardcoded credentials and keeping the database isolated.

Key Concept

VPC Networking and Outbound Routing for AWS Lambda Functions
Question 247Question →

A company wants to connect a serverless microservice to an Amazon ElastiCache cluster located in a private VPC subnet. The microservice is implemented as an AWS Lambda function that must also call a public third-party weather API over the internet.

Which two configurations are required to establish this network connectivity? (Select two.)

Select all that apply

Show answer & explanation

Answer: Associate the Lambda function with the private subnets of the VPC where the Amazon ElastiCache cluster is located.; Configure a NAT Gateway in a public subnet, and update the private subnets' route tables to route outbound internet traffic to the NAT Gateway.

Answer

Associate the Lambda function with the private subnets of the VPC where the Amazon ElastiCache cluster is located, and configure a NAT Gateway in a public subnet to route outbound internet traffic from those private subnets.
To access private VPC resources such as an Amazon ElastiCache cluster, the Lambda function must be configured to run inside the VPC's private subnets. However, doing so removes its default internet access. To restore internet access (necessary for calling the external weather API), a NAT Gateway must be deployed in a public subnet, and the private subnets' route tables must direct 0.0.0.0/0 traffic through that NAT Gateway.

Step-by-Step Solution

1
Configure the Lambda function's VPC settings with private subnets.
The Lambda function is allocated Elastic Network Interfaces (ENIs) inside the private subnets, enabling it to communicate with local resources like ElastiCache.
VPC-enabled Lambda functions must be assigned to subnets where target resources are accessible.
2
Set up a NAT Gateway in a public subnet and update route tables.
Outbound traffic originating from the private subnets is directed to the NAT Gateway, which routes it through the Internet Gateway to the public weather API.
Lambda functions in private subnets require a NAT Gateway (or NAT instance) to access public internet endpoints, as they do not receive public IP addresses.

Key Concept

AWS Lambda VPC networking and outbound internet connectivity
Question 248Question →

An e-commerce application's user onboarding workflow relies on an AWS Lambda function. The function is placed inside a private subnet of a custom VPC to securely query an Amazon Aurora PostgreSQL database. During a high-traffic promotional campaign, the application experiences two issues: the function fails to establish database connections because the database's maximum connection limit is exceeded, and it cannot connect to an external third-party identity verification API, resulting in network connection timeouts. Which two configuration modifications will resolve these issues?

Select all that apply

Show answer & explanation

Answer: Configure the route table of the private subnets where the Lambda function is deployed to route outbound traffic (0.0.0.0/00.0.0.0/0) to a NAT Gateway located in a public subnet.; Create an Amazon RDS Proxy for the Aurora database and update the Lambda function's database connection string to use the proxy endpoint.

Answer

To resolve the issues, the developer must configure the route table of the private subnets to route outbound traffic through a NAT Gateway located in a public subnet, and create an Amazon RDS Proxy for the database while updating the function's connection string to use the proxy endpoint.
Configuring a NAT Gateway in a public subnet and routing all outbound internet traffic from the private subnets to it allows the Lambda function to securely reach external APIs. Creating an Amazon RDS Proxy pools database connections, preventing the function from exhausting Aurora's connection pool as it scales horizontally.

Step-by-Step Solution

1
Analyze the database connection limit issue.
Identify that the Lambda function's rapid scaling creates a new database connection for each concurrent execution, exhausting database connection limits.
AWS Lambda functions scale out horizontally in response to traffic, making traditional database connection pools difficult to manage directly.
2
Resolve database connection limit exhaustion.
Choose to use Amazon RDS Proxy to pool and share database connections across concurrent executions.
RDS Proxy acts as an intermediary database proxy that pools connections, reducing CPU and memory overhead on the database and allowing more concurrent Lambda invocations.
3
Analyze the network timeout issue when connecting to the external API.
Determine that the Lambda function is in private VPC subnets and lacks internet connectivity because there is no route to the internet.
By default, Lambda functions attached to a private subnet in a custom VPC cannot access the public internet without a NAT Gateway or similar NAT device.
4
Resolve the external API connectivity issue.
Configure a NAT Gateway in a public subnet and add a route in the private subnet's route table directing all outbound traffic (0.0.0.0/00.0.0.0/0) to the NAT Gateway.
The NAT Gateway translates private IP addresses to public IPs, allowing secure outbound-only communication from the private subnets to the external API.

Key Concept

AWS Lambda VPC networking configuration and RDS database connection management
Estimated Time:2m 30s
Question 249Question →

A developer is deploying a Go application to Amazon ECS on AWS Fargate. The application needs to retrieve objects from an Amazon S3 bucket. During local testing, the developer initialized the AWS SDK client using static AWS access keys. For the production environment, the application must use the IAM permissions granted by the ECS task role. Which configuration change should the developer make to satisfy these requirements?

Show answer & explanation

Answer: Modify the application code to initialize the SDK client using the default configuration loader without specifying static credentials, and assign the required IAM policy to the ECS task role.

Answer

Modify the application code to initialize the SDK client using the default configuration loader without specifying static credentials, and assign the required IAM policy to the ECS task role.
Initializing the AWS SDK client using the default configuration loader without passing static credentials allows the SDK's credentials chain to resolve the credentials automatically. When the application runs within an Amazon ECS container, the SDK detects the ECS container environment variables and queries the local ECS agent for temporary credentials associated with the task's assigned IAM task role. This avoids hardcoding keys and ensures security compliance.

Step-by-Step Solution

1
Remove the static credentials provider configuration from the Go SDK client initialization code.
The Go SDK is configured to use the default configuration loader (config.LoadDefaultConfig).
This allows the default credentials provider chain to look for credentials in the standard locations, including the ECS container agent.
2
Define an IAM policy with the necessary S3 permissions and attach it to the ECS task role (not the task execution role).
The ECS task has permissions to access the S3 bucket.
The task role provides the application container with temporary credentials containing the required permissions.
3
Deploy the container to AWS Fargate with the task role configured in the task definition.
The ECS container agent injects the AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment variable, which the SDK uses to query for temporary credentials.
The SDK automatically assumes the role and obtains credentials, establishing secure access to S3 without code-level credentials management.

Key Concept

Using the default SDK credentials chain to automatically resolve temporary credentials via the ECS task role.
Estimated Time:1m 30s
Question 250Question →

A company is deploying a REST API using Amazon API Gateway. The API routes client requests to a backend AWS Lambda function. The function needs to read the incoming HTTP request headers and query parameters, and it must also specify the response status code and response headers directly within its execution code. What configuration should the company choose to ensure that the raw request is passed intact to the function, and that the function's output determines the client's HTTP response?

Show answer & explanation

Answer: Enable the proxy integration option for the Lambda function backend.

Answer

Enable the proxy integration option for the Lambda function backend.
The option to enable the proxy integration option for the Lambda function backend is correct because proxy integration automatically maps the raw client request into an event object for Lambda, and directly interprets Lambda's JSON output (which includes statusCode, headers, and body) to construct the HTTP response.

Step-by-Step Solution

1
Identify the application requirements.
The Lambda function needs to receive all headers and query parameters, and dynamically control the response status code and headers.
This determines whether a custom mapping (non-proxy) or a transparent pass-through (proxy) integration is needed.
2
Compare integration types in Amazon API Gateway.
Proxy integration passes the client request as a standardized event object to the Lambda function and parses a structured JSON output from the Lambda function to formulate the HTTP response.
This avoids having to define Velocity Template Language (VTL) mapping templates inside API Gateway.
3
Select the correct configuration.
Choose the option to enable the proxy integration for the Lambda backend.
This satisfies all requirements with minimal administrative overhead.

Key Concept

API Gateway Proxy Integration vs. Custom/Non-Proxy Integration

Alternative Method

Instead of using the AWS Management Console, the proxy integration can be configured programmatically using an AWS SAM or CloudFormation template by setting the integration Type to 'AWS_PROXY'.
Estimated Time:45s
Question 251Question →

A developer is packaging a serverless microservice to run on AWS Lambda. The developer wants to optimize the function's startup performance by reducing cold start latency. Which two actions should the developer take? (Select two.)

Select all that apply

Show answer & explanation

Answer: Initialize AWS SDK clients and database connection pools outside the handler function to allow reuse across invocations; Reduce the deployment package size by packaging only the code and dependencies required for execution

Answer

Initialize AWS SDK clients and database connection pools outside the handler function, and reduce the deployment package size by packaging only the required code and dependencies.
The correct options represent two standard AWS practices for reducing Lambda latency: utilizing the global execution scope for client initialization to enable context reuse, and minimizing the package size to decrease download and extraction times.

Step-by-Step Solution

1
Identify the factors that contribute to cold start latency in AWS Lambda.
Cold start duration consists of downloading the deployment package, starting the execution environment container, and running the initialization code (code outside the handler).
Understanding the components of a cold start allows the developer to isolate where optimizations can be made.
2
Evaluate the impact of initialization scope.
By declaring SDK clients and connection pools outside the handler function, they are executed during the initialization phase and reused in subsequent hot invocations.
This takes advantage of execution context reuse, avoiding the overhead of establishing new connections on every function invocation.
3
Evaluate deployment package size optimization.
Excluding unnecessary files, development dependencies, and large unused libraries minimizes the size of the ZIP archive.
AWS Lambda downloads and unpacks smaller deployment packages much faster, directly reducing the container provisioning phase of a cold start.

Key Concept

AWS Lambda cold start optimization and execution context reuse
Question 252Question →

A developer is troubleshooting an application that uses the AWS SDK to access Amazon S3. The application is running on an Amazon EC2 instance that has an IAM instance profile attached. However, the developer notices that the application is using outdated, static credentials instead of the temporary credentials provided by the instance profile. Which of the following could be the root causes of this behavior? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables are defined in the operating system environment of the EC2 instance.; A shared credentials file located at ~/.aws/credentials contains a [default] profile with static credentials.

Answer

The application could be using static credentials because environment variables are defined on the EC2 instance, or because a shared credentials file with a default profile is present. Both of these sources take precedence over the EC2 instance profile in the AWS SDK default credential provider chain.
The AWS SDK default credential provider chain resolves credentials in a specific order of precedence. Environment variables (such as AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) and the shared credentials file (such as the default profile in ~/.aws/credentials) are both evaluated before the Amazon EC2 Instance Metadata Service (IMDS). If either of these sources contains static credentials, the SDK will use them instead of the temporary credentials provided by the EC2 instance profile.

Step-by-Step Solution

1
Analyze the AWS SDK default credential provider chain order of precedence.
The chain evaluates credentials in the following order: 1. Environment variables, 2. Shared credentials file, 3. ECS task role credentials (if applicable), 4. EC2 instance profile credentials (via IMDS).
To determine which credential sources take precedence over the EC2 instance profile.
2
Evaluate the scenario where the application uses static credentials instead of the instance profile credentials.
Any credential source higher in the chain containing static credentials will prevent the SDK from querying the EC2 instance profile.
To identify potential sources of static credentials that override the instance profile.
3
Identify the correct options based on the chain evaluation.
Environment variables and the shared credentials file default profile both reside higher in the chain than instance profile credentials, making them the correct root causes.
To choose the two options that explain the observed behavior.

Key Concept

AWS SDK Default Credential Provider Chain Order of Precedence
Question 253Question →

A developer is designing a serverless application that integrates with a third-party billing API. The application uses an AWS Lambda function to send requests. The API key for the billing provider is stored in AWS Secrets Manager and is automatically rotated every 1212 hours. During initial load testing, retrieving the key from Secrets Manager on every function invocation significantly increases the execution latency and Secrets Manager API costs. The developer wants to optimize the retrieval process while ensuring the function always uses a valid, unexpired API key. Which approach meets these requirements with the lowest latency and cost?

Show answer & explanation

Answer: Configure the AWS Parameters and Secrets Lambda Extension in the Lambda function, and retrieve the API key via a local HTTP request with a time-to-live (TTL) of 300300 seconds.

Answer

Configure the AWS Parameters and Secrets Lambda Extension in the Lambda function, and retrieve the API key via a local HTTP request with a time-to-live (TTL) of 300300 seconds.
The correct approach is to configure the AWS Parameters and Secrets Lambda Extension. This extension runs alongside the Lambda function container and caches secrets locally, exposing a localhost endpoint. When the handler queries the local HTTP endpoint, the extension returns the cached key. If the key has expired based on the configured Time-to-Live (TTL), the extension calls AWS Secrets Manager to retrieve the new key. A short TTL like 300300 seconds ensures that when the key is rotated every 1212 hours, the cached value is refreshed within minutes, preventing authentication failures while still providing low latency and low Secrets Manager API costs.

Step-by-Step Solution

1
Enable the AWS Parameters and Secrets Lambda Extension by adding its layer to the Lambda function configuration.
The extension runs in a separate process within the Lambda execution environment, exposing a local HTTP server at localhost.
This allows the Lambda function to make fast, in-memory HTTP calls to retrieve configuration values and secrets instead of making external SDK requests on every invocation.
2
Configure environment variables for the extension, such as SECRETS_MANAGER_TTL, or specify a TTL of 300300 seconds in the local HTTP headers when making the request.
The extension caches the secret for the specified duration (300300 seconds) before fetching it again from the Secrets Manager service.
By setting a TTL that is significantly shorter than the 1212-hour rotation window, we ensure that the key is refreshed regularly and does not become stale, while still caching it to optimize latency and minimize costs.
3
Update the Lambda function's handler code to make a local GET request to the extension's localhost port to retrieve the API key.
The Lambda function receives the API key with sub-millisecond local latency on cache hits.
This avoids the overhead of invoking the full Secrets Manager API via the AWS SDK during every execution, which reduces costs and transaction latency.

Key Concept

Caching secrets using the AWS Parameters and Secrets Lambda Extension is the recommended best practice for optimizing performance and cost when Lambda functions consume secrets that undergo periodic rotation.
Question 254Question →

A developer is running a Python script on a local workstation to test integration with Amazon S3. The workstation's shared credentials file (`~/.aws/credentials`) contains a profile named `test-profile` with valid access keys. Before executing the script, the developer sets the `AWS_PROFILE` environment variable to `test-profile` in the terminal. However, the environment variables `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` are also set in the same terminal session from a previous task. The script initializes the S3 client using the default constructor `boto3.client('s3')`. Which credentials will the AWS SDK use to authenticate the S3 requests?

Show answer & explanation

Answer: The credentials provided by the environment variables `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`

Answer

The credentials provided by the environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY
The Default Credential Provider Chain resolves credentials in a specific order. Direct environment variables (specifically AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) are evaluated first, before checking shared credential files or profiles specified by the AWS_PROFILE environment variable. Therefore, the SDK uses the direct environment credentials.

Step-by-Step Solution

1
Evaluate the order of precedence in the AWS SDK Default Credential Provider Chain.
The SDK checks environment variables (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) before checking shared credentials files or profiles (AWS_PROFILE).
To determine which credentials the default constructor will resolve first.
2
Identify the active environment variables and file configurations.
Both direct credential environment variables and the AWS_PROFILE variable are set.
To verify if multiple conflicting configurations are active.
3
Select the source with the highest precedence.
The direct credential environment variables win, and their values are used by the SDK.
Since environment variables are checked first, the SDK uses them and stops searching the chain.

Key Concept

AWS SDK Default Credential Provider Chain Precedence
Estimated Time:1m 30s
Question 255Question →

A developer is designing a REST API using Amazon API Gateway. The API must restrict access to authenticated users who log in using an Amazon Cognito user pool. The developer wants to validate the JSON Web Tokens (JWTs) sent in the request authorization header with the minimum amount of custom code and maintenance overhead. Which of the following is the most appropriate method to authorize these requests?

Show answer & explanation

Answer: Configure a built-in Amazon Cognito user pool authorizer in API Gateway to validate the incoming tokens.

Answer

Configure a built-in Amazon Cognito user pool authorizer in API Gateway to validate the incoming tokens.
Configuring a built-in Amazon Cognito user pool authorizer allows API Gateway to natively decode and validate JSON Web Tokens (JWTs) provided by Cognito User Pools. This approach is highly efficient, requires no custom code, and rejects unauthorized requests before invoking any backend integrations.

Step-by-Step Solution

1
Identify the key authorization requirement: validating tokens from an Amazon Cognito user pool in API Gateway REST API with minimal custom code.
The solution must use built-in configuration rather than custom code.
This minimizes the developer's maintenance overhead and development time.
2
Evaluate the native integration options of API Gateway with Amazon Cognito.
API Gateway REST APIs support a built-in Cognito user pool authorizer.
This authorizer validates the JWT signatures automatically at the API Gateway layer.
3
Contrast built-in options with custom Lambda authorizers or backend validation.
Custom Lambda authorizers or backend Lambda validation require custom code and trigger execution billing, whereas Cognito user pool authorizers are zero-code configurations.
Selecting the built-in option aligns with AWS best practices for simplicity and efficiency.

Key Concept

API Gateway built-in Cognito User Pool Authorizers
Question 256Question →

An application uses an AWS Lambda function to process incoming messages. The function is configured to connect to an Amazon Aurora PostgreSQL database inside a private subnet of a VPC. The function also needs to call an external partner API on the public internet to validate user information. During load testing, the developer observes two issues: the Lambda function fails to connect to the external partner API, resulting in network connection timeouts, and the Aurora database frequently runs out of database connections during concurrent invocation spikes.

Which combination of actions should the developer take to resolve these issues? (Select two.)

Select all that apply

Show answer & explanation

Answer: Deploy the Lambda function in the private subnet, configure a NAT Gateway in a public subnet, and route external traffic (0.0.0.0/00.0.0.0/0) from the private subnet to the NAT Gateway.; Initialize the database connection pool outside the Lambda handler function to reuse connection contexts across warm invocations.

Answer

Deploy the Lambda function in the private subnet, route outbound internet traffic through a NAT Gateway, and initialize the database connection pool outside the handler function to allow reuse.
Deploying the Lambda function in private subnets with a NAT Gateway in a public subnet provides the necessary path to the public internet using static public IPs from the NAT Gateway. Additionally, initializing the database connection pool outside the handler ensures that the connection pool is persisted and reused across sequential warm invocations, preventing connection exhaustion.

Step-by-Step Solution

1
Analyze the network failure to the external API.
The Lambda function is associated with a VPC subnet but has no path to the public internet because VPC Lambdas do not get public IPs directly.
Resolving this requires placing the Lambda in private subnets and routing public traffic through a NAT Gateway in a public subnet.
2
Analyze the database connection exhaustion.
Creating database connections within the handler creates new connection instances for every execution, which does not leverage execution context reuse and overwhelms the database.
By moving connection initialization outside the handler, we reuse existing connections for subsequent warm invocations, reducing the overall connection count.

Key Concept

AWS Lambda VPC networking configuration and execution context reuse for database connection pooling.
Question 257Question →

A developer is configuring a REST API using Amazon API Gateway with a backend AWS Lambda function using custom (non-proxy) integration. The Lambda function throws an error containing the string 'InvalidParameter' when the input is malformed, but the client receives an HTTP 200 OK status response with the error message in the payload. What configuration change is required in API Gateway to ensure the client receives an HTTP 400 Bad Request status code?

Show answer & explanation

Answer: Configure an integration response in API Gateway with a regular expression pattern matching '.*InvalidParameter.*', and map it to a 400 method response.

Answer

Configure an integration response in API Gateway with a regular expression pattern matching '.*InvalidParameter.*', and map it to a 400 method response.
In custom (non-proxy) integrations with API Gateway, the backend response is processed through integration responses. If the backend function throws an error, API Gateway maps it to an HTTP status code using regular expressions matched against the 'errorMessage' field in the Lambda response. Therefore, configuring an integration response with a regex matching the error pattern and mapping it to a 400 method response is the correct approach.

Step-by-Step Solution

1
Define the Method Response in API Gateway.
Add an HTTP 400 status code to the Method Response settings for the resource's method.
Before API Gateway can return a 400 status code to the client, the status code must be declared in the Method Response configuration.
2
Configure the Integration Response mapping in API Gateway.
Create a new Integration Response, set the Lambda Error Regex to match the error pattern (e.g., '.*InvalidParameter.*'), and map it to the 400 Method Response.
This tells API Gateway to inspect the error message returned by Lambda and, if it matches the pattern, return the 400 status code instead of the default 200 OK.
3
Deploy the API to a stage.
The configuration changes are pushed live.
Changes to API Gateway configurations only take effect after deploying the API to a stage.

Key Concept

API Gateway Custom Integration Error Handling
Estimated Time:1m 30s
Question 258Question →

A developer is building a Go application that will run in local Docker containers during development and will eventually be deployed to Amazon ECS on AWS Fargate. The application needs to retrieve objects from an Amazon S3 bucket. The developer wants to ensure that the application uses a specific local AWS CLI profile named 'dev-profile' when running locally, but seamlessly falls back to the container's task role when deployed to AWS Fargate, without requiring any code changes.

Which two actions must the developer take to achieve this configuration? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Initialize the AWS SDK client using config.LoadDefaultConfig without specifying any static credentials in the source code.; Set the AWS_PROFILE environment variable to dev-profile in the local container's environment.

Answer

Initialize the AWS SDK client using config.LoadDefaultConfig without specifying any static credentials in the source code, and set the AWS_PROFILE environment variable to dev-profile in the local container's environment.
The correct options represent the standard AWS best practice for local development and containerized deployment. By loading the configuration via the SDK's default configuration loader without hardcoding any credentials, the application is set up to automatically look at the default credential provider chain. On a local development machine, setting the AWS_PROFILE environment variable to the desired local profile name instructs the SDK to fetch the credentials from the shared AWS config or credentials file (~/.aws/config or ~/.aws/credentials). When the same code is compiled and deployed to Amazon ECS, the AWS_PROFILE variable is not set, which allows the default chain to continue looking down the precedence list until it finds the ECS container credentials provider, thus utilizing the assigned ECS Task Role seamlessly and without any code modifications.

Step-by-Step Solution

1
Use the SDK's default configuration loading mechanism (such as config.LoadDefaultConfig in the Go SDK v2) during client initialization.
The application is configured to search the default AWS credential provider chain automatically.
This avoids hardcoding static credentials in the source code, making the application portable across environments.
2
Set the AWS_PROFILE environment variable to dev-profile in the local container environment.
The SDK client automatically reads the credentials associated with the specified profile from the shared AWS configuration/credentials files during local execution.
This allows the application to authenticate using the developer's local profile credentials without modifications to the code.
3
Deploy the application container to ECS on AWS Fargate without setting the AWS_PROFILE environment variable.
The SDK's default credential provider chain falls back to using ECS container credentials provided by the Task Role.
This ensures the application securely assumes the Task Role permissions when running on AWS.

Key Concept

The AWS SDK default credential provider chain automatically searches several sources in order, including environment variables, shared configuration files, and ECS container task roles, enabling seamless environment transitions when credentials are not hardcoded.
Estimated Time:2m 0s
Question 259Question →

A developer is configuring an AWS Lambda function that reads data from an Amazon DynamoDB table. Currently, the function initializes the AWS SDK client inside the handler function on every invocation, and the DynamoDB table name is hardcoded in the function code. Which two actions should the developer take to improve performance and adhere to AWS development best practices? (Select two.)

Select all that apply

Show answer & explanation

Answer: Initialize the AWS SDK client outside of the Lambda handler function; Store the DynamoDB table name as a Lambda environment variable and retrieve it in the code

Answer

Initialize the AWS SDK client outside the handler function and store the DynamoDB table name in a Lambda environment variable.
Moving the client instantiation outside of the handler function takes advantage of execution context reuse, so subsequent requests do not pay the penalty of initializing the SDK. Storing configuration details in environment variables allows changes without modifying source code.

Step-by-Step Solution

1
Analyze the impact of client initialization placement
Moving the SDK initialization logic to the global scope (outside the handler) enables execution context reuse.
Code outside the handler runs during the initialization phase (cold start) and is kept in memory for subsequent warm starts, avoiding redundant connections.
2
Analyze code portability and decoupling options
Migrate hardcoded configuration strings to Lambda environment variables.
This isolates configuration changes from application logic, aligning with standard DevOps and security practices.

Key Concept

AWS Lambda execution context reuse and environment variables
Estimated Time:1m 0s
Question 260Question →

A developer is building a mobile application that stores user profile information in an Amazon DynamoDB table. The table uses UserId as the partition key. The developer needs to retrieve the profile details of a specific user with a known UserId in the most cost-effective and low-latency way possible.

Which two API operations or practices should the developer use to achieve this?

Select all that apply

Show answer & explanation

Answer: Perform a GetItem API call specifying the UserId primary key to retrieve the exact user profile.; Perform a Query API call using a key condition expression to search for the specific UserId.

Answer

Retrieve the item using either the GetItem operation targeting the primary key, or the Query operation with a key condition expression matching the partition key.
The correct approach involves retrieving data directly by the partition key to minimize read capacity consumption and latency. The GetItem operation retrieves a single item based on its primary key and is the most efficient way to access a single record. Alternatively, the Query operation uses a key condition expression to retrieve items that share the same partition key, which is also highly efficient because it only reads the partition containing the matching partition key.

Step-by-Step Solution

1
Identify the primary key structure of the table.
The table partition key is UserId.
Understanding the key schema helps determine which API operations can perform key-based lookups rather than full table scans.
2
Select operations that perform direct lookups on the partition key.
GetItem and Query operations are selected.
GetItem retrieves a specific item by its primary key. Query allows searching items matching a key condition expression on the partition key. Both operations target specific partitions directly.
3
Avoid operations that scan the entire table.
Scan operations are rejected.
Scan operations read all items in the table, which is inefficient, costly, and leads to high latency.

Key Concept

Efficient DynamoDB retrieval using primary keys (GetItem and Query) versus inefficient scans.
PreviousPage 13 / 78Next
All practice questions — AWS Certified Developer - Associate | Examkin