All practice questions

1542 questions

All types1,542 Multiple choice782 Multiple select746 Ordering14

A developer is implementing a logistics microservice using an AWS Lambda function to process shipment status updates. To ensure idempotency and prevent processing duplicate updates within a short timeframe, the developer initializes a mutable Set outside the handler function to store processed update IDs. During load testing, two issues are observed: concurrent invocations occasionally process duplicate updates, and subsequent sequential invocations reject valid updates. Which explanation accurately describes the root cause of these issues, and what is the recommended solution?

The Lambda execution context is shared across all concurrent executions but is completely destroyed immediately after a sequential execution finishes. The duplicates are caused by a race condition within the shared context, and the sequential failures are due to the Lambda function exceeding its default concurrency limit. The recommended solution is to enable Provisioned Concurrency.

The Lambda function is running in a private VPC subnet without a NAT Gateway, which prevents the global Set from communicating with the underlying AWS Lambda service state manager to synchronize across invocations. The recommended solution is to move the Lambda function to a public subnet or configure a NAT Gateway for internet access.

Lambda reuses the execution context for sequential invocations, which preserves the global Set across executions and causes valid sequential updates to be rejected. However, concurrent invocations run in separate execution contexts, meaning they do not share the Set and can process duplicates. The recommended solution is to store the processed update IDs in Amazon DynamoDB and use conditional writes.

The issue is caused by the Lambda function's execution timeout being set lower than the SQS visibility timeout, which causes the messages to be returned to the queue and processed multiple times concurrently while the global Set is cleared. The recommended solution is to increase the SQS visibility timeout to at least six times the Lambda function timeout.

Show answer & explanation

Answer: Lambda reuses the execution context for sequential invocations, which preserves the global Set across executions and causes valid sequential updates to be rejected. However, concurrent invocations run in separate execution contexts, meaning they do not share the Set and can process duplicates. The recommended solution is to store the processed update IDs in Amazon DynamoDB and use conditional writes.

Answer

The correct answer explains that Lambda reuses the execution context for sequential invocations, preserving the global state (the Set) and causing valid sequential updates to be rejected, while concurrent invocations run in separate execution contexts and do not share state, resulting in duplicates. The solution is to store the processed update IDs in Amazon DynamoDB and use conditional writes.

The correct answer identifies that AWS Lambda reuses the execution context (including the global memory state) for subsequent sequential requests, which causes the list of processed updates to persist and reject valid requests. For concurrent requests, separate execution contexts are initialized, which prevents them from sharing the in-memory Set and allows duplicate updates to proceed. Storing these IDs in an external, centralized datastore like Amazon DynamoDB using conditional writes solves both issues by ensuring atomic, shared state checks.

Step-by-Step Solution

Evaluate the AWS Lambda execution model and context reuse behavior.

Variables in the global scope (outside the handler) are preserved across sequential invocations that reuse the same execution context, but are isolated between separate concurrent executions.

Lambda optimizes performance by keeping the container warm for subsequent requests, but it does not share memory across concurrent containers.

Correlate the observed testing behaviors with the execution context lifecycle.

Sequential invocations reject valid updates because the Set retains IDs from previous runs. Concurrent invocations process duplicates because they run in isolated environments with empty Sets.

This explains why local in-memory caching is insufficient for global idempotency.

Identify the AWS best practice for distributed state and idempotency.

Using a persistent, shared datastore like Amazon DynamoDB with conditional writes allows checking and updating the state of an update ID atomically.

This ensures a single source of truth that is accessible by all concurrent Lambda containers.

Key Concept

AWS Lambda execution context reuse and stateless design patterns

Question 262Question →

A team is creating several independent Python microservices using AWS Lambda. To ensure consistent logging across all services, they want to share a custom utility module and several heavy external dependencies without bundling them directly in each function's deployment zip file. What AWS Lambda feature should they use to manage and share these dependencies?

AWS Lambda layers

AWS Lambda environment variables

AWS Lambda execution context reuse

AWS Lambda handler VPC configuration

Show answer & explanation

Answer: AWS Lambda layers

Answer

AWS Lambda layers should be used because they allow sharing custom modules and dependencies across multiple Lambda functions, reducing individual deployment package sizes.

AWS Lambda layers allow you to package libraries, custom runtimes, and other dependencies separately from your function code. By deploying these files to a layer, multiple Lambda functions can reference and use them, which keeps the deployment zip packages small and ensures consistency across microservices.

Step-by-Step Solution

Analyze the requirement to share a custom logging utility and dependencies across multiple Lambda functions without bundling them in each zip file.

Identify the need for a mechanism to externalize common dependencies.

This establishes the core technical requirement for the serverless application architecture.

Evaluate AWS Lambda features for dependency management.

Identify AWS Lambda layers as a feature specifically built to package, share, and promote code reuse.

Layers allow you to pull in dependencies at runtime, reducing deployment archive sizes.

Verify that alternative configuration options do not address code sharing.

Confirm that environment variables, execution context reuse, and VPC configurations do not distribute dependency packages.

Ensures that options related to configuration, state management, and network placement are correctly excluded.

Key Concept

AWS Lambda Layers for dependency management and code sharing

Estimated Time:45s

Question 263Question →

A developer is writing a Java application that will use the AWS SDK for Java to write data to an Amazon DynamoDB table. During local development, the application must run on the developer's workstation and connect to a development DynamoDB table. In production, the application will run on an Amazon EC2 instance and must connect to a production DynamoDB table. The developer wants to use the default credential provider chain so that the application can automatically discover and use the appropriate credentials in each environment without any code changes.

Which two configuration steps should the developer perform to meet these requirements?

Select all that apply

Attach an IAM role with the required DynamoDB permissions to the EC2 instance as an instance profile.

Create a shared credentials file on the local workstation at ~/.aws/credentials containing the development AWS credentials.

Initialize the SDK client by passing the development AWS access keys directly into the client constructor.

Store the development AWS credentials as a plaintext parameter in Systems Manager Parameter Store and configure the SDK client to fetch them.

Add the required DynamoDB API actions directly to the trust policy of the EC2 instance's IAM role.

Show answer & explanation

Answer: Attach an IAM role with the required DynamoDB permissions to the EC2 instance as an instance profile.; Create a shared credentials file on the local workstation at ~/.aws/credentials containing the development AWS credentials.

Answer

Attach an IAM role with the required DynamoDB permissions to the EC2 instance as an instance profile, and create a shared credentials file on the local workstation at ~/.aws/credentials containing the development AWS credentials.

The standard approach for environment-agnostic SDK client initialization is to rely on the default credential provider chain. Locally, the developer configures a shared credentials file at ~/.aws/credentials, which is automatically read by the chain. In the EC2 production environment, the developer attaches an IAM role with the correct permissions to the instance profile, which the chain resolves via the Instance Metadata Service (IMDS). Together, these steps satisfy the credential requirements without hardcoding or code alterations.

Step-by-Step Solution

Configure local credentials by creating the ~/.aws/credentials file containing the development access keys.

The local Java application resolves these credentials via the default credential provider chain during development.

The default credential provider chain checks the shared credentials file when environment variables are not set.

Create an IAM role with a policy allowing DynamoDB actions and attach it as an instance profile to the EC2 instance.

The EC2 instance gains authorization to access DynamoDB.

The EC2 Instance Metadata Service (IMDS) hosts the credentials associated with the instance profile.

Initialize the DynamoDB client in the application code without specifying credentials in the builder or constructor.

The application code remains environment-agnostic.

The default credential provider chain resolves the ~/.aws/credentials file locally and the instance profile on EC2 automatically.

Key Concept

The AWS SDK default credential provider chain automatically discovers credentials in a defined order of precedence, enabling environment-agnostic code deployment.

Estimated Time:1m 30s

Question 264Question →

A developer is writing a backend application to retrieve a specific customer's order history from an Amazon DynamoDB table. The table uses CustomerId as the partition key and OrderId as the sort key. The application needs to fetch all orders for a single customer in the most efficient and cost-effective manner. Which API operation should the developer use to retrieve this data?

Perform a Scan operation and use a filter expression to filter the results by CustomerId.

Initialize the DynamoDB client by embedding AWS access keys in the code to perform multiple parallel GetItem requests.

Perform a Query operation specifying the CustomerId in the key condition expression.

Increase the table's provisioned read capacity units (RCUs) to prevent throttling and perform a Scan operation.

Show answer & explanation

Answer: Perform a Query operation specifying the CustomerId in the key condition expression.

Answer

Perform a Query operation specifying the CustomerId in the key condition expression.

Performing a Query operation specifying the CustomerId in the key condition expression is the most efficient and cost-effective approach. DynamoDB Query operations search only the partition matching the partition key, returning all matching items while consuming only the RCUs required for the returned dataset.

Step-by-Step Solution

Identify the table's primary key structure.

The partition key is CustomerId and the sort key is OrderId.

Understanding the key schema helps determine which DynamoDB operations can target specific items directly.

Evaluate the retrieval requirement.

We need to fetch all orders for a single CustomerId.

Since the search is filtered by the partition key, we can retrieve all items under that partition without scanning the rest of the table.

Select the most efficient DynamoDB API operation.

Choose the Query API, passing the CustomerId in the key condition expression.

A Query operation retrieves items directly from the partition associated with the specified partition key, consuming minimal Read Capacity Units (RCUs) compared to a Scan.

Key Concept

Using Query instead of Scan to efficiently retrieve items with a shared partition key.

Question 265Question →

A developer is migrating a REST API endpoint in Amazon API Gateway that currently uses a Lambda custom integration to a Lambda proxy integration. Which of the following actions must the developer perform to ensure the API and backend Lambda function work correctly with the new integration? (Select TWO.)

Select all that apply

Modify the Lambda function response to return a JSON object containing the keys

statusCode

headers

, and

body

Configure an integration request mapping template in API Gateway to map the incoming JSON payload to the Lambda event structure.

Remove any configured integration responses and method response mappings from the API Gateway resource.

Define explicit method responses in API Gateway for each HTTP status code (

200

400

, and

500

) to map backend errors to client responses.

Deploy a custom Lambda authorizer to validate the Amazon Cognito JSON Web Token (JWT) in the request header.

Show answer & explanation

Answer: Modify the Lambda function response to return a JSON object containing the keys $statusCode$ , $headers$ , and $body$ .; Remove any configured integration responses and method response mappings from the API Gateway resource.

Answer

Modify the Lambda function response to return a JSON object containing the keys

statusCode

headers

, and

body

, and remove any configured integration responses and method response mappings from the API Gateway resource.

The correct actions are to modify the Lambda function response format and remove configured integration/method responses. In a Lambda proxy integration, API Gateway bypasses integration and method response configurations, passing the backend response directly to the client. This requires the Lambda function to return a structured JSON response containing the HTTP status code, headers, and stringified body.

Step-by-Step Solution

Identify the response requirements for API Gateway Lambda Proxy integration.

The backend Lambda function must return a JSON payload with

statusCode

headers

, and

body

fields.

API Gateway expects this specific structure to parse and build the HTTP response in proxy mode.

Determine the configuration changes needed in the API Gateway console for proxy integration.

Remove custom integration responses, method responses, and mapping templates.

Proxy integration routes the request and response directly without using API Gateway mapping templates or custom integration response configurations.

Key Concept

Understanding request and response handling differences between API Gateway Lambda Proxy and Lambda Custom integrations.

Estimated Time:2m 0s

Question 266Question →

A developer has deployed a containerized Node.js application to Amazon ECS on AWS Fargate. The application uses the AWS SDK for JavaScript (v3) to read from an Amazon DynamoDB table. The ECS task is configured with an IAM Task Role that has the required DynamoDB permissions. However, the application fails to query the table, and the developer receives an authentication error from DynamoDB. During debugging, the developer notices that the container definition still includes the environment variables `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` set to mock values used during local testing.

Which of the following explains why the application is failing to access DynamoDB, and what is the correct resolution?

The application fails because permissions to access DynamoDB must be attached to the ECS Task Execution Role rather than the ECS Task Role. To resolve this, attach the required IAM policy to the Task Execution Role and remove the environment variables.

The default credential provider chain does not automatically resolve ECS container credentials unless explicitly configured in code. To resolve this, modify the SDK client initialization to instantiate the DynamoDB client using the container credentials provider class.

The AWS SDK default credential provider chain evaluates environment variables before checking for ECS container credentials. The SDK signed requests using the mock environment variables, leading to authentication failures. To resolve this, remove the mock environment variables from the container definition.

The ECS Task Role is missing a custom policy mapping the environment variables to the container agent's IAM role. To resolve this, update the IAM trust policy to trust the ECS service principal and set the container's environment variables to read-only.

Show answer & explanation

Answer: The AWS SDK default credential provider chain evaluates environment variables before checking for ECS container credentials. The SDK signed requests using the mock environment variables, leading to authentication failures. To resolve this, remove the mock environment variables from the container definition.

Answer

The correct answer explains that the AWS SDK's default credential provider chain searches environment variables before any other credential sources. If mock or placeholder credentials exist in the environment, the SDK selects them immediately and attempts to use them to sign requests, resulting in authentication failures. Removing the mock variables allows the default provider chain to evaluate subsequent options and retrieve the ECS Task Role credentials.

Step-by-Step Solution

Analyze the SDK default credential provider chain resolution order.

The chain evaluates environment variables first, then system properties, then local configuration files, then ECS container credentials (if available), and finally EC2 instance metadata.

This establishes which credential source is selected when multiple sources are present in the environment.

Identify the cause of the authentication failure based on the presence of mock credentials.

Since `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` are present in the environment variables, the SDK uses them immediately and stops searching the chain. It signs API requests with these invalid mock credentials, leading to authentication errors.

This explains why the assigned ECS Task Role is being bypassed.

Determine the corrective action to force the SDK to use the ECS Task Role.

Removing the mock environment variables causes the environment provider to be skipped, allowing the SDK to fall back to the ECS container credentials provider which retrieves the temporary credentials linked to the Task Role.

This ensures the default provider chain operates correctly in the Fargate environment.

Key Concept

AWS SDK default credential provider chain precedence

Question 267Question →

A developer is building a backend service for an IoT-based fleet tracking application. Telemetry data is stored in an Amazon DynamoDB table designed with VehicleId as the partition key and LogTimestamp as the sort key. The developer needs to retrieve all telemetry events recorded for a specific vehicle over a specific 24-hour period. Which two actions should the developer take to retrieve this data with the lowest latency and minimal Read Capacity Unit (RCU) consumption? (Select TWO.)

Select all that apply

Perform a Query operation specifying the VehicleId in the KeyConditionExpression

Use a KeyConditionExpression to restrict the LogTimestamp values using a comparison operator

Perform a Scan operation and apply a FilterExpression to isolate the specific VehicleId and LogTimestamp range

Perform a GetItem operation by providing the VehicleId and a list of target timestamps

Initialize the AWS SDK client inside the application code using hardcoded access keys to speed up API authorization

Show answer & explanation

Answer: Perform a Query operation specifying the VehicleId in the KeyConditionExpression; Use a KeyConditionExpression to restrict the LogTimestamp values using a comparison operator

Answer

To retrieve the telemetry events efficiently, the developer must perform a Query operation specifying the vehicle identifier in the key condition expression, and restrict the timestamp values within the target 24-hour range in the key condition expression.

Performing a Query operation specifying the partition key in the key condition expression, and using the sort key in the key condition expression to filter by the timestamp range, allows DynamoDB to efficiently locate and return only the requested items from a single partition without reading unrelated data.

Step-by-Step Solution

Identify the primary key structure of the DynamoDB table.

The table uses a composite primary key consisting of a partition key (VehicleId) and a sort key (LogTimestamp).

Understanding the key structure is necessary to choose the correct read API operation.

Determine the most efficient API operation for retrieving a range of items sharing a partition key.

A Query operation is selected because it targets a single partition key and allows sorting/filtering on the sort key.

Using Query instead of Scan avoids reading the entire table, minimizing latency and RCU usage.

Configure the key condition expression for the Query operation.

The expression specifies the exact VehicleId and applies a range condition on the LogTimestamp.

This retrieves only the items matching both criteria directly from the partition.

Key Concept

Querying DynamoDB tables with composite primary keys using partition and sort keys

Question 268Question →

A developer is writing an AWS Lambda function that must download a static reference file from Amazon S3 and reuse it across multiple invocations. The developer wants to minimize execution time and reduce the number of calls to Amazon S3.

Which two actions should the developer take to accomplish this?

Select all that apply

Declare the Amazon S3 client and configuration variables outside of the handler function.

Store the downloaded reference file in the local /tmp directory of the execution environment.

Update the Lambda function's environment variables dynamically at runtime to store the file's content.

Embed the AWS access key and secret key directly in the Amazon S3 client initialization code to speed up authentication.

Deploy the Lambda function within a private VPC subnet with no NAT gateway to enable faster access to local storage.

Show answer & explanation

Answer: Declare the Amazon S3 client and configuration variables outside of the handler function.; Store the downloaded reference file in the local /tmp directory of the execution environment.

Answer

To optimize execution time and reuse files across invocations, declare the client and variables outside of the handler function, and store the downloaded file in the local /tmp directory.

Declaring the Amazon S3 client outside of the handler ensures it is initialized once during cold start, and storing the downloaded file in the /tmp directory leverages ephemeral storage that persists across warm starts. Together, these steps significantly reduce execution time and avoid redundant calls to S3.

Step-by-Step Solution

Leverage execution context reuse.

Declaring initialization code and S3 clients outside the handler ensures they are executed once during the initialization phase (cold start), making them available for all warm starts.

This reduces the overhead of re-creating the client on every function execution.

Use ephemeral local storage for caching.

Download the static reference file to the /tmp directory, which provides writeable disk space that persists as long as the execution context is kept alive.

This allows subsequent invocations to read the file from local storage instead of making expensive network calls to S3.

Key Concept

AWS Lambda execution context lifecycle, initialization phase, and local ephemeral storage usage.

Question 269Question →

An organization has deployed a retail transaction processing system. The core component is a serverless function that handles purchase validation. This function runs inside private subnets of an Amazon VPC to connect to a secure backend database cluster. To finalize transactions, the function must also perform an outbound HTTPS call to an external payment processor.

During high-traffic periods, two issues are observed:
1. The function fails to connect to the external payment processor, resulting in network connection timeouts.
2. The backend database cluster runs out of available database connections, causing transaction failures.

Which combination of architectural and code modifications should the developer implement to resolve these issues? (Select TWO.)

Select all that apply

Deploy a NAT Gateway in a public subnet, and add a route in the private subnets' route table directing destination

0.0.0.0/0

to the NAT Gateway.

Declare and initialize the database connection client outside of the Lambda handler method, enabling reuse across warm execution contexts.

Associate the Lambda function with public subnets in the VPC and enable the Assign Public IP configuration option in the function's network settings.

Attach an Internet Gateway directly to the private subnets where the function is deployed and configure a route for

0.0.0.0/0

to point to the Internet Gateway.

Create and destroy the database connection pool inside the Lambda handler function on each invocation to ensure connections do not remain open during idle times.

Show answer & explanation

Answer: Deploy a NAT Gateway in a public subnet, and add a route in the private subnets' route table directing destination $0.0.0.0/0$ to the NAT Gateway.; Declare and initialize the database connection client outside of the Lambda handler method, enabling reuse across warm execution contexts.

Answer

Configure a NAT Gateway in a public subnet to route outbound traffic from the private subnets, and declare the database connection client outside the Lambda handler method to reuse connections across execution context instances.

To resolve the network connectivity issues, the Lambda function needs outbound internet access. Since it runs in a private VPC subnet, a NAT Gateway must be deployed in a public subnet, and the private subnet's route table must route all outbound traffic (

0.0.0.0/0

) to the NAT Gateway. To resolve database connection exhaustion, the database connection pool must be declared outside the handler function. This ensures that the connection pool persists across warm starts of the Lambda execution context, reducing the total number of connections opened to the database.

Step-by-Step Solution

Analyze the network timeout issue.

Since the Lambda function is deployed within private subnets of a VPC, it lacks direct access to the public internet. It cannot reach the external payment processor's HTTPS endpoint without a network address translation device.

Identifying that resources in a private VPC subnet require a NAT Gateway or similar NAT device placed in a public subnet with an attached Internet Gateway to initiate outbound connections.

Formulate the network resolution.

Provision a NAT Gateway in a public subnet, attach an Internet Gateway to the VPC, and add a route in the private subnets' route table directing

0.0.0.0/0

to the NAT Gateway.

This establishes a secure, outbound path to the public internet for the Lambda function.

Analyze the database connection exhaustion issue.

If connection establishment is performed inside the handler function, every single invocation creates a new connection, which exhausts the database's connection limits under heavy concurrency.

Understanding Lambda execution context lifecycle and cold/warm starts.

Formulate the code optimization resolution.

Move the database connection pool initialization outside the handler function to the initialization phase of the container.

The execution context is reused for subsequent invocations, keeping the database connection alive and shared, preventing the overhead of re-establishing connections on every invocation.

Key Concept

VPC networking for outbound Lambda traffic and execution context reuse for connection management.

Estimated Time:2m 0s

Question 270Question →

A developer is configuring a REST API in Amazon API Gateway that integrates with a backend AWS Lambda function. The API currently uses a Lambda proxy integration. The developer wants to modify the structure of the incoming client JSON payload before it is passed to the backend Lambda function. The developer attempts to configure a mapping template in API Gateway but finds that it has no effect on the payload received by the Lambda function. Which of the following actions should the developer take to resolve this issue?

Change the integration type to a Lambda custom integration, and define an integration request mapping template in API Gateway to transform the payload.

Keep the Lambda proxy integration, and configure a mapping template in the Integration Request section of API Gateway to transform the payload.

Implement a custom Lambda authorizer to intercept the incoming request, modify its structure, and pass the updated payload to the integration.

Keep the Lambda proxy integration, configure an API Gateway Model, and map the properties directly within the Method Request configuration.

Show answer & explanation

Answer: Change the integration type to a Lambda custom integration, and define an integration request mapping template in API Gateway to transform the payload.

Answer

Change the integration type to a Lambda custom integration, and define an integration request mapping template in API Gateway to transform the payload.

The correct action is to change the integration type to a Lambda custom integration. In Amazon API Gateway, a Lambda proxy integration passes the raw request directly to the backend function without processing mapping templates. To utilize API Gateway's native request transformation capabilities, such as defining Velocity Template Language (VTL) mapping templates in the Integration Request, a Lambda custom integration must be used.

Step-by-Step Solution

Analyze the integration type configuration.

Identify that the API is using a Lambda proxy integration.

Lambda proxy integration bypasses API Gateway request and response mapping templates entirely, forwarding the raw request structure directly to Lambda.

Determine the requirement for payload transformation.

Realize that transformation needs to happen at the API Gateway layer before reaching the backend.

To modify the payload structure before it hits the backend Lambda function, mapping templates must be evaluated by API Gateway.

Select the correct integration and mapping configuration.

Change the integration to a Lambda custom integration and configure the VTL mapping template.

Only Lambda custom (non-proxy) integrations support using Velocity Template Language (VTL) mapping templates to transform client request payloads.

Key Concept

API Gateway Lambda Custom vs Proxy Integration request mapping capabilities

Estimated Time:1m 30s

Question 271Question →

A developer is building a school administration web portal. The portal needs to retrieve a student's list of registered courses from an Amazon DynamoDB table. The table is designed with `StudentId` as the partition key and `CourseId` as the sort key. Which DynamoDB operation is the most efficient and cost-effective way to retrieve all courses for a specific student?

Perform a `Scan` operation and use a filter expression to return only items matching the `StudentId`.

Perform a `Scan` operation to retrieve all items and filter the courses on the client side in application memory.

Perform a `Query` operation specifying the `StudentId` in the key condition expression.

Perform a `Scan` operation and increase the provisioned Read Capacity Units (RCUs) of the table to prevent read throughput throttling.

Show answer & explanation

Answer: Perform a `Query` operation specifying the `StudentId` in the key condition expression.

Answer

Perform a `Query` operation specifying the `StudentId` in the key condition expression.

The correct answer is the option proposing a `Query` operation because a `Query` operation allows direct retrieval of items that share the same partition key (`StudentId`). This is highly efficient and consumes Read Capacity Units (RCUs) only for the items returned.

Step-by-Step Solution

Analyze the table schema and the query requirements.

The table schema has a composite primary key consisting of a partition key (`StudentId`) and a sort key (`CourseId`). The requirement is to retrieve all courses for a single student.

Understanding the key structure helps determine which DynamoDB operations are supported and most efficient.

Evaluate the difference between Query and Scan operations for partition key lookup.

A `Query` operation directly targets the partition key, retrieving only matching items. A `Scan` operation reads the entire table and then filters the results.

Choosing `Query` over `Scan` minimizes the data read from disk, saving performance overhead and cost.

Select the optimal DynamoDB API call.

The `Query` API call with a key condition expression for `StudentId` retrieves all courses for that student in a single, efficient request.

This matches best practices for querying composite primary key tables.

Key Concept

Query vs Scan operations in Amazon DynamoDB

Estimated Time:45s

Question 272Question →

A developer is designing a REST API using Amazon API Gateway to ingest tracking events. To minimize latency and operating costs, the API must write incoming payloads directly to an Amazon SQS queue without using an intermediate AWS Lambda function. Which two configuration steps must the developer perform in API Gateway to successfully establish this integration? (Select TWO.)

Select all that apply

Configure the integration type as AWS Service, select Simple Queue Service (SQS) as the AWS Service, and set the integration HTTP method to POST.

Create an IAM role that grants sqs:SendMessage permissions and specify this role's ARN in the Execution Role field of the integration settings.

Enable Lambda Proxy Integration on the integration settings and specify the target SQS queue ARN.

Configure a Cognito User Pool authorizer on the API method to authorize API Gateway to publish to SQS.

Configure the SQS queue policy to allow CORS requests originating from the API Gateway endpoint.

Show answer & explanation

Answer: Configure the integration type as AWS Service, select Simple Queue Service (SQS) as the AWS Service, and set the integration HTTP method to POST.; Create an IAM role that grants sqs:SendMessage permissions and specify this role's ARN in the Execution Role field of the integration settings.

Answer

The correct configurations are setting the integration type to AWS Service targeting SQS with the POST method, and creating an IAM execution role with the sqs:SendMessage permission for API Gateway.

To integrate API Gateway directly with SQS, you must use the AWS Service integration type with the POST method. Additionally, API Gateway requires an IAM execution role to authorize the sqs:SendMessage action on the SQS queue.

Step-by-Step Solution

Define the backend integration type.

Choose AWS Service integration, specify SQS, and set the HTTP method to POST to use the SendMessage action.

This establishes a direct API Gateway-to-AWS service communication bypass without using a Lambda function.

Configure the IAM permissions.

Provide an IAM Execution Role with sqs:SendMessage permission in the integration setup.

API Gateway needs to assume an IAM role that has authorization to write to the specified SQS queue.

Key Concept

API Gateway direct integration with AWS Services bypassing Lambda

Question 273Question →

A developer is configuring a serverless workflow where an Amazon SQS queue triggers an AWS Lambda function to process inventory updates. The Lambda function has its timeout set to 2 minutes. During testing, the developer notices that some messages are being processed multiple times by different Lambda invocations. Which configuration change will resolve this issue?

Decrease the Lambda function's timeout to 10 seconds to ensure the function finishes before the SQS visibility timeout.

Configure the SQS queue's visibility timeout to be at least 12 minutes (six times the Lambda function's timeout).

Enable long polling on the SQS queue by setting the ReceiveMessageWaitTimeSeconds parameter to 20 seconds.

Increase the DelaySeconds configuration on the SQS queue to match the Lambda function's execution time.

Show answer & explanation

Answer: Configure the SQS queue's visibility timeout to be at least 12 minutes (six times the Lambda function's timeout).

Answer

Configure the SQS queue's visibility timeout to be at least 12 minutes (six times the Lambda function's timeout).

The correct option proposes configuring the SQS queue's visibility timeout to be at least 12 minutes (six times the Lambda function's timeout of 2 minutes). AWS best practices dictate that the visibility timeout of the source queue must be set to at least 6 times the timeout of the Lambda function to prevent messages from reappearing in the queue and being processed again while the current Lambda invocation is still running or retrying.

Step-by-Step Solution

Analyze the relationship between the Lambda execution duration and SQS visibility timeout.

The Lambda function is configured to run for up to 2 minutes, but the SQS visibility timeout determines how long a message is hidden from other consumers after being polled.

If the visibility timeout is shorter than the Lambda execution time (or not sufficiently long to account for retries and batches), the message will reappear in the queue and be polled by another execution thread before the first one finishes.

Apply the AWS-recommended formula for SQS visibility timeout with Lambda.

The visibility timeout should be at least 6 times the Lambda function's timeout (

6 \times 2 \text{ minutes} = 12 \text{ minutes}

Setting the visibility timeout to at least six times the function's timeout allows the Lambda service to handle retries, batch processing, and potential throttling events without exposing the messages to other consumers too early.

Key Concept

SQS visibility timeout integration with AWS Lambda

Question 274Question →

A developer is implementing an AWS Lambda function that needs to query an Amazon RDS PostgreSQL database located in a private VPC subnet. The function must also make outbound HTTP POST requests to an external API on the public internet, and trace all downstream database queries using AWS X-Ray.

Which two configurations are required to meet these requirements? (Select two.)

Select all that apply

Configure the Lambda function to run inside the private subnets of the VPC, and route internet-bound traffic through a NAT Gateway located in a public subnet.

Enable active tracing on the Lambda function configuration, and use the AWS X-Ray SDK to instrument the database client in the function code.

Deploy the Lambda function in the public subnets of the VPC to allow both direct access to the database via local routing and direct public internet access through the Internet Gateway.

Modify the Lambda function's IAM execution role trust policy to allow the RDS database service principal to assume the role.

Enable active tracing on the Lambda function to automatically trace database queries without codebase modifications.

Show answer & explanation

Answer: Configure the Lambda function to run inside the private subnets of the VPC, and route internet-bound traffic through a NAT Gateway located in a public subnet.; Enable active tracing on the Lambda function configuration, and use the AWS X-Ray SDK to instrument the database client in the function code.

Answer

The Lambda function must be configured to run in the private subnets of the VPC, routing outbound internet traffic through a NAT Gateway. In addition, the developer must enable active tracing on the Lambda function and use the AWS X-Ray SDK within the code to instrument the database client.

To satisfy both database access in a private subnet and public internet connectivity for external APIs, the Lambda function must be configured inside the private subnets of the VPC, with the private subnets routing outbound traffic to a NAT Gateway in a public subnet. Additionally, active tracing must be enabled on the Lambda function, and the database client within the codebase must be instrumented using the AWS X-Ray SDK to record downstream database queries.

Step-by-Step Solution

Configure the Lambda function VPC settings.

The Lambda function is associated with the private subnets of the VPC where the RDS database is located.

This allows the Lambda function to gain network connectivity to the private database via local VPC routing.

Configure outbound routing for the private subnets.

A NAT Gateway is deployed in a public subnet, and the route table for the private subnets is configured to route 0.0.0.0/0 traffic to the NAT Gateway.

Since Lambda ENIs in a VPC do not have public IP addresses, they must route through a NAT Gateway in a public subnet to make outbound calls to the public internet.

Configure and instrument AWS X-Ray tracing.

Active tracing is enabled on the Lambda function, and the database client in the function code is wrapped or patched with the AWS X-Ray SDK.

Enabling active tracing captures Lambda execution segments, while SDK client patching propagates the tracing context to capture downstream database queries.

Key Concept

AWS Lambda VPC networking and downstream AWS X-Ray SDK database instrumentation.

Question 275Question →

A developer is migrating a Python application that processes images in Amazon S3 from a local development workstation to an AWS Lambda function. In the local environment, the developer initialized the SDK session using `session = boto3.Session(profile_name='dev-profile')`. After deploying the code to Lambda, the function execution fails with a `ProfileNotFound: The config profile (dev-profile) could not be found` error.

Which of the following is the most secure and recommended configuration to resolve this error?

Initialize the client using `boto3.client('s3')` without specifying a session or profile, allowing the SDK to retrieve credentials from the Lambda execution role via the default credential provider chain.

Extract the access keys for 'dev-profile' from the local workstation, configure them as custom Lambda environment variables, and initialize the client using `boto3.client('s3', aws_access_key_id=os.environ['ACCESS_KEY'], aws_secret_access_key=os.environ['SECRET_KEY'])`.

Package the local `.aws/credentials` file containing the 'dev-profile' keys inside the Lambda deployment package, and set the `AWS_SHARED_CREDENTIALS_FILE` environment variable to point to its path.

Modify the trust policy of the Lambda execution role to allow the role to assume itself, and configure the code to pass the execution role ARN directly to the `boto3.Session` initialization.

Show answer & explanation

Answer: Initialize the client using `boto3.client('s3')` without specifying a session or profile, allowing the SDK to retrieve credentials from the Lambda execution role via the default credential provider chain.

Answer

The correct approach is to initialize the client using `boto3.client('s3')` without specifying a session or profile. When no explicit configuration profile is requested, the AWS SDK default credential provider chain resolves credentials from the environment. In AWS Lambda, the service automatically populates the environment variables `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and `AWS_SESSION_TOKEN` with temporary credentials from the execution role, which the SDK automatically reads.

Step-by-Step Solution

Modify the code to remove the explicit `profile_name` argument from the Boto3 session initialization.

The SDK client is initialized using default parameters: `s3 = boto3.client('s3')`.

This allows the AWS SDK default credential provider chain to execute instead of looking for a specific local profile.

Deploy the updated application to AWS Lambda.

The Lambda function runtime receives the execution command.

AWS Lambda injects temporary, rotated credentials associated with the function's execution role into the environment variables.

Verify that the SDK automatically retrieves the injected credentials.

The application successfully authenticates and accesses the S3 bucket without throwing credential or profile errors.

The SDK default credential provider chain checks environment variables first, resolving the Lambda execution role credentials automatically.

Key Concept

AWS SDK Default Credential Provider Chain and Lambda Execution Roles

Estimated Time:1m 0s

Question 276Question →

A developer is building a serverless application using Amazon API Gateway and AWS Lambda. The application needs to access the client's source IP address and the incoming request headers within the Lambda function. The developer wants to achieve this with the least amount of operational effort and without writing manual mapping templates.

Which configuration should the developer choose for the API Gateway integration to meet these requirements?

Configure a Lambda proxy integration for the API method.

Configure a Lambda custom integration and write a Velocity Template Language (VTL) mapping template to pass the request context parameters.

Configure an Amazon Cognito User Pool authorizer to forward the request metadata in the authorization context.

Configure a mock integration in API Gateway that maps the headers and source IP address into the integration request path parameters.

Show answer & explanation

Answer: Configure a Lambda proxy integration for the API method.

Answer

Configure a Lambda proxy integration for the API method.

Configuring a Lambda proxy integration is the most efficient approach because API Gateway automatically passes the entire raw request—including headers, query parameters, and the request context containing the client source IP—to the backend Lambda function as the input event object. This configuration requires no manual integration mapping templates, minimizing development and operational effort.

Step-by-Step Solution

Analyze the requirements for metadata mapping.

The client's source IP address and request headers must be sent to the Lambda function.

This establishes the data contract needed by the Lambda function.

Evaluate the integration options to minimize manual mapping effort.

Lambda proxy integration automatically formats the incoming request data as a JSON object containing headers and request context (with source IP), passing it directly to the Lambda function.

This avoids the need to write Velocity Template Language (VTL) mapping templates, satisfying the requirement to minimize operational overhead.

Key Concept

API Gateway Lambda Proxy Integration

Estimated Time:1m 30s

Question 277Question →

A developer is implementing a microservice for a digital library system. The system needs to retrieve a specific book's metadata using its ISBN (which is the primary key) and retrieve a list of all reviews for a specific book, sorted by the review date.

Which two DynamoDB operations should the developer use to retrieve this data most efficiently with the lowest Read Capacity Unit (RCU) consumption?

Select all that apply

Use the GetItem operation to retrieve the book's metadata by its ISBN.

Use the Query operation to retrieve the reviews for a specific book using its partition key.

Use the Scan operation with a filter expression on the ISBN to retrieve the book's metadata.

Use the Scan operation to retrieve all reviews in the table and filter them on the client side.

Hardcode the AWS credentials in the SDK client configuration to speed up authentication for DynamoDB calls.

Show answer & explanation

Answer: Use the GetItem operation to retrieve the book's metadata by its ISBN.; Use the Query operation to retrieve the reviews for a specific book using its partition key.

Answer

The developer should use the GetItem operation to retrieve the book's metadata and the Query operation to retrieve the reviews.

To retrieve a single item by its primary key (ISBN), the GetItem operation is the most direct and efficient option. To retrieve multiple related items (reviews for a book) that share a partition key, the Query operation reads only the matching items, optimizing performance and RCU usage.

Step-by-Step Solution

Analyze the requirements for retrieving the book's metadata.

The book metadata is identified by a unique ISBN (primary key). The most efficient operation to read a single item by its primary key is GetItem.

GetItem directly targets the specific partition key value and avoids reading any other items in the table.

Analyze the requirements for retrieving the reviews.

Reviews are associated with a specific book. Using the book's partition key, the Query operation can retrieve all matching review items efficiently.

Query reads only the items that match the specified partition key and can sort them by the sort key, minimizing the amount of data read.

Evaluate and eliminate inefficient operations.

Scan operations must be avoided as they examine every item in the table. Hardcoding credentials must be avoided for security compliance.

Scan operations waste Read Capacity Units (RCUs) and increase latency, while hardcoded credentials violate IAM security principles.

Key Concept

Retrieving items from Amazon DynamoDB efficiently using GetItem and Query operations instead of Scan operations.

Question 278Question →

A developer is deploying a Node.js application to Amazon ECS on AWS Fargate. The application needs to read messages from an Amazon SQS queue. The developer has created an IAM Task Role with the necessary permissions and associated it with the ECS Task. However, when the application runs in ECS, it throws a credentials error stating that it cannot load credentials. The developer discovers that the application task definition has residual `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` environment variables set to empty values, which were used during local Docker container testing.

Which of the following actions should the developer take to resolve this issue and follow AWS security best practices? (Select TWO.)

Select all that apply

Remove the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables from the ECS task definition.

Verify that the application's SDK client initialization relies on the default credential provider chain.

Attach the SQS permissions to the ECS Task Execution Role instead of the ECS Task Role.

Configure the ECS container to query the EC2 Instance Metadata Service (IMDSv2) to retrieve credentials.

Package the developer's local AWS credentials file inside the Docker image under the ~/.aws/credentials path.

Show answer & explanation

Answer: Remove the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables from the ECS task definition.; Verify that the application's SDK client initialization relies on the default credential provider chain.

Answer

The developer should remove the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables from the task definition, and ensure the SDK client utilizes the default credential provider chain.

Removing the empty environment variables from the task definition allows the SDK default credentials provider chain to proceed past the environment variable stage. Because the application is running in an ECS task, the SDK then queries the container credentials endpoint to assume the IAM Task Role. The client initialization must also rely on the default provider chain, which automatically supports this resolution.

Step-by-Step Solution

Analyze the credentials error and the task configuration.

Identify that the presence of empty AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables interrupts the default credentials provider chain before it checks container credentials.

The SDK's default credentials provider chain evaluates environment variables before container credentials. When key variables are present but empty or invalid, the SDK fails instead of falling back.

Remove the invalid environment variables from the ECS task definition.

Allows the default credentials provider chain to bypass the environment variable stage and move to the ECS container credentials stage.

This exposes the container credentials relative URI, which is used by the default credentials provider to assume the IAM Task Role.

Ensure the application code initializes clients using the default chain.

The SDK will correctly locate the credentials automatically from the ECS container metadata environment.

Hardcoding credentials or credentials file configurations in containerized applications violates security and configuration best practices.

Key Concept

Default Credential Provider Chain Precedence

Estimated Time:1m 30s

Question 279Question →

An application developer is designing a new serverless microservice using Amazon API Gateway. The microservice must ingest JSON payloads from client applications, perform minimal transformations using Velocity Mapping Templates (VTL) directly in API Gateway to format the payloads for a downstream service, and authenticate users using standard JSON Web Tokens (JWT) generated by an Amazon Cognito User Pool. The developer wants to minimize latency, custom code overhead, and management complexity.

Which of the following actions should the developer perform to meet these requirements? (Select TWO.)

Select all that apply

Configure a Lambda custom integration for the integration request and define a Velocity Mapping Template (VTL) to transform the payload.

Configure an Amazon Cognito user pool authorizer on the API Gateway method to validate the client JWTs.

Configure a Lambda proxy integration and define a Velocity Mapping Template (VTL) in the integration request to transform the payload.

Create a custom Lambda authorizer that imports the AWS SDK to validate and decode the Cognito JWT for each request.

Configure a Lambda proxy integration and use a method response mapping template to parse the incoming payload format.

Show answer & explanation

Answer: Configure a Lambda custom integration for the integration request and define a Velocity Mapping Template (VTL) to transform the payload.; Configure an Amazon Cognito user pool authorizer on the API Gateway method to validate the client JWTs.

Answer

Configure a Lambda custom integration for the integration request and define a Velocity Mapping Template (VTL) to transform the payload, and configure an Amazon Cognito user pool authorizer on the API Gateway method to validate the client JWTs.

To transform payloads using Velocity Mapping Templates (VTL) before they reach the backend service, the developer must use a Lambda custom (non-proxy) integration because proxy integrations pass the raw event payload directly without allowing mapping templates. Additionally, to validate JWTs from Cognito with the lowest management overhead and custom code, the developer should configure the native Amazon Cognito user pool authorizer.

Step-by-Step Solution

Determine the required integration type for payload transformation.

Since the scenario requires transforming the request payload directly in API Gateway using Velocity Mapping Templates (VTL) before passing it to the backend, a Lambda custom integration (non-proxy) must be selected.

Velocity Mapping Templates (VTL) are only supported in custom integrations (non-proxy integrations). Lambda proxy integration bypasses mapping templates completely.

Select the optimal authentication mechanism for Cognito JWT validation.

To validate standard JSON Web Tokens (JWT) generated by Amazon Cognito with minimal custom code and complexity, choose the native Amazon Cognito user pool authorizer.

Cognito user pool authorizers are built-in features that handle validation automatically, whereas custom Lambda authorizers require writing, deploying, and maintaining custom code.

Key Concept

API Gateway Integrations and Authorizers

Estimated Time:2m 0s

Question 280Question →

A developer is building a backend for a recipe sharing application. The application needs to retrieve a single recipe's details from an Amazon DynamoDB table by providing the exact `RecipeId` (which is the table's partition key). Which approach should the developer use to retrieve this item most efficiently with the lowest latency and read capacity unit (RCU) consumption?

Perform a Scan operation with a filter expression matching the RecipeId.

Perform a GetItem operation using the specific RecipeId.

Perform a GetItem operation, but hardcode the AWS access keys in the client initialization to bypass default IAM credential lookup.

Perform a Query operation and scale up the table's overall provisioned read capacity to avoid hot partition throttling.

Show answer & explanation

Answer: Perform a GetItem operation using the specific RecipeId.

Answer

Perform a GetItem operation using the specific RecipeId.

The correct approach is to perform a GetItem operation using the specific RecipeId. In Amazon DynamoDB, GetItem is the most efficient method for retrieving a single item when the full primary key (the partition key in this case) is known. It directly retrieves the item without scanning other data, minimizing latency and RCU consumption.

Step-by-Step Solution

Identify the primary key structure and request details.

The application needs to retrieve a single item using its partition key (RecipeId).

Understanding the key structure helps choose the most specific and optimized API operation.

Compare candidate operations (GetItem, Query, Scan).

GetItem is designed for single-item lookups, Query is for multiple items with the same partition key, and Scan evaluates all items in the table.

Choosing the operation that accesses the fewest items minimizes latency and cost.

Select GetItem as the optimal API call.

GetItem retrieves the exact item directly using the primary key, consuming 1 strongly consistent read or 0.5 eventually consistent read capacity units.

This achieves the lowest latency and resource consumption.

Key Concept

Selecting the most efficient DynamoDB operation for single-item retrieval using a primary key.

PreviousPage 14 / 78Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept