All practice questions

1542 questions

All types1,542 Multiple choice782 Multiple select746 Ordering14

A developer is writing an AWS Lambda function that retrieves data from an Amazon RDS database. To optimize the function's performance and minimize connection overhead, the developer wants to reuse the database connection across multiple function invocations. How should the developer structure the function code to achieve this?

Create and close the database connection inside the Lambda handler function on every invocation.

Initialize the database connection inside the handler function using hardcoded access credentials.

Initialize the database connection client outside of the Lambda handler function.

Return the database connection object in the response payload formatted for an API Gateway proxy integration.

Show answer & explanation

Answer: Initialize the database connection client outside of the Lambda handler function.

Answer

Initialize the database connection client outside of the Lambda handler function.

Initializing the database connection client outside of the Lambda handler function allows the connection to be kept alive in the execution context's memory. When subsequent invocations occur (warm starts), Lambda reuses the existing container and execution context, making the existing database connection immediately available and avoiding connection overhead.

Step-by-Step Solution

Analyze the request to reuse database connections in an AWS Lambda function.

Identify that the database connection should persist across warm invocations.

Reusing connections avoids the overhead of establishing a new connection on every function invocation.

Evaluate where to declare the database connection client in the code.

Determine that variables declared outside the handler function (global scope) are retained when the execution context is reused.

AWS Lambda preserves the execution context (including global variables) for subsequent invocations until the container is destroyed.

Select the configuration that places the client initialization in the global scope.

Choose the option to initialize the database connection client outside of the Lambda handler function.

This is the AWS-recommended pattern for client reuse, database connection management, and latency reduction.

Key Concept

AWS Lambda Execution Context Reuse

Estimated Time:45s

Question 282Question →

An organization's order-fulfillment system uses an AWS Lambda function to process batch payloads and write them to an Amazon Aurora PostgreSQL database located in a private subnet of a VPC. The Lambda function is configured to access the database directly by running within the same private VPC subnets. Database credentials must be retrieved from AWS Secrets Manager on each execution. During load testing, the Lambda function experiences connection timeouts when trying to retrieve secrets from Secrets Manager. Additionally, high concurrency causes the database to reject connections due to reaching its maximum connection limit. Which combination of actions should the developer take to resolve these issues? (Select two.)

Select all that apply

Create an Interface VPC endpoint (AWS PrivateLink) for AWS Secrets Manager in the VPC, and associate it with the route tables and subnets used by the Lambda function.

Set up an Amazon RDS Proxy for the Aurora database and configure the Lambda function to connect to the proxy endpoint instead of the database instance.

Move the Lambda function to a public subnet within the VPC, assign a public IP address to the function, and configure a route to route Secrets Manager traffic directly through an Internet Gateway.

Migrate the database credentials from AWS Secrets Manager to Systems Manager Parameter Store, and configure the Lambda function to retrieve them using the default endpoint without a VPC endpoint.

Increase the Lambda function's execution timeout to 15 minutes, and instantiate the database connection pool inside the Lambda handler function on every invocation.

Show answer & explanation

Answer: Create an Interface VPC endpoint (AWS PrivateLink) for AWS Secrets Manager in the VPC, and associate it with the route tables and subnets used by the Lambda function.; Set up an Amazon RDS Proxy for the Aurora database and configure the Lambda function to connect to the proxy endpoint instead of the database instance.

Answer

To resolve the issues, the developer must create an Interface VPC endpoint (AWS PrivateLink) for AWS Secrets Manager in the VPC, and set up an Amazon RDS Proxy for the Aurora database to manage connection pooling.

Creating an Interface VPC Endpoint (AWS PrivateLink) for AWS Secrets Manager creates private network interfaces in the subnets, enabling the Lambda function to reach Secrets Manager without leaving the AWS network. Setting up Amazon RDS Proxy pools database connections, preventing concurrent Lambda invocations from exhausting the database instance's connection limits.

Step-by-Step Solution

Analyze the connection timeouts to AWS Secrets Manager.

The Lambda function runs inside private subnets of a custom VPC to reach the RDS database. Without a NAT Gateway or VPC endpoints, resources in private subnets cannot access public AWS endpoints like Secrets Manager.

AWS Secrets Manager is a public service. To connect to it privately from a private VPC subnet, an Interface VPC Endpoint must be established.

Analyze the database connection limit exhaustion.

AWS Lambda is highly scalable and creates separate execution environments (and database connections) for concurrent requests, which quickly overwhelms traditional database connection limits.

To manage connections effectively, Amazon RDS Proxy should be introduced between the Lambda function and the database to pool and reuse database connections.

Key Concept

VPC endpoints are required for private VPC subnets to access public AWS services without a NAT Gateway, and RDS Proxy manages connection pooling for highly concurrent serverless environments.

Question 283Question →

A developer is building a mobile fitness application that stores daily user activity summaries in an Amazon DynamoDB table. The table is configured with UserId as the partition key and ActivityDate as the sort key. The developer needs to retrieve the activity summary for a specific user on a specific date in the most efficient and secure manner. Which two actions should the developer take?

Select all that apply

Use the GetItem API operation specifying both the UserId and ActivityDate to retrieve the item.

Initialize the AWS SDK DynamoDB client using the default credential provider chain.

Use the Scan API operation with a filter expression on UserId and ActivityDate to locate the item.

Hardcode the AWS access key ID and secret access key directly in the DynamoDB client configuration code.

Store the application's IAM credentials in AWS Systems Manager Parameter Store as standard unencrypted parameters.

Show answer & explanation

Answer: Use the GetItem API operation specifying both the UserId and ActivityDate to retrieve the item.; Initialize the AWS SDK DynamoDB client using the default credential provider chain.

Answer

Use the GetItem API operation specifying both the UserId and ActivityDate to retrieve the item, and initialize the AWS SDK DynamoDB client using the default credential provider chain.

Using the GetItem operation is the most efficient and cost-effective way to retrieve a single item when both the partition key (UserId) and sort key (ActivityDate) are known, consuming only the capacity units required for that single item. Additionally, initializing the AWS SDK DynamoDB client using the default credential provider chain follows security best practices by dynamically loading credentials from IAM roles or environment variables, avoiding the need to hardcode secrets.

Step-by-Step Solution

Identify the primary key components required for the item lookup.

Both the partition key (UserId) and the sort key (ActivityDate) are known for the target item.

DynamoDB requires both keys of a composite primary key to perform a single-item GetItem lookup.

Select the most efficient DynamoDB API operation.

Choose GetItem instead of Scan or Query.

GetItem retrieves a single item directly using its primary key, minimizing latency and RCU consumption.

Select the secure method for configuring AWS SDK credentials.

Use the default credential provider chain.

This avoids hardcoding AWS credentials in the code, adhering to the principle of least privilege and secure credential management.

Key Concept

Efficient item retrieval using GetItem and secure client authentication using the default credential provider chain.

Question 284Question →

A developer is building a serverless API where an Amazon API Gateway REST API is integrated with an AWS Lambda function using Lambda proxy integration. The Lambda function processes user data and returns a response. During testing, clients receive a $502$ Bad Gateway error. The Lambda execution logs show that the function ran successfully and completed without error. Which two changes should the developer make to the Lambda function's response to resolve this issue? (Select two.)

Select all that apply

Format the return value of the Lambda handler as a JSON object containing the statusCode and body fields.

Ensure that the body field of the returned JSON object is serialized as a string.

Configure integration response mapping rules in the API Gateway console to map the return value to an HTTP status code.

Return a raw string response directly from the Lambda function handler.

Add permission to the Lambda execution role to allow the apigateway:POST action.

Show answer & explanation

Answer: Format the return value of the Lambda handler as a JSON object containing the statusCode and body fields.; Ensure that the body field of the returned JSON object is serialized as a string.

Answer

The developer should format the return value of the Lambda handler as a JSON object containing the statusCode and body fields, and ensure that the body field of the returned JSON object is serialized as a string.

For an Amazon API Gateway REST API utilizing Lambda proxy integration, the backend Lambda function must return a JSON response with a specific schema. This schema requires a 'statusCode' key (as an integer) and a 'body' key (which must be a string). If the function finishes successfully but returns a malformed structure or a non-string 'body' value, API Gateway cannot construct the HTTP response and returns a

502

Bad Gateway error.

Step-by-Step Solution

Identify the integration type between Amazon API Gateway and the AWS Lambda function.

The integration type is Lambda proxy integration.

This determines the response structure requirements. Lambda proxy integration bypasses integration response mappings and expects the Lambda function to return a specific JSON payload format directly.

Verify the structure of the Lambda response payload.

Ensure the payload is a JSON object containing the statusCode and body keys.

API Gateway requires the statusCode to determine the HTTP response code and the body key to populate the response payload. Without these fields, API Gateway returns a

502

Bad Gateway error.

Serialize the body payload.

Convert the body object into a string (e.g., using JSON.stringify()).

API Gateway requires the body parameter within the returned JSON object to be a string. Returning a raw JSON object or array under the body key will cause the integration to fail.

Key Concept

API Gateway Lambda Proxy Integration Response Format

Question 285Question →

A development team has configured a telemetry analysis application where an Amazon SQS queue triggers an AWS Lambda function to process device payloads. During load testing, the team observes the following issues:

1. Telemetry payloads are occasionally processed multiple times by different concurrent executions of the Lambda function.
2. The Lambda function periodically fails with a 'No space left on device' error when downloading temporary configuration files for validation.

Which two changes should the developer implement to resolve these issues? (Select TWO.)

Select all that apply

Configure the SQS queue's visibility timeout to be at least six times the timeout of the Lambda function.

Modify the Lambda function code to delete the downloaded validation files from the /tmp directory before the handler execution completes.

Decrease the SQS queue's visibility timeout to match the Lambda function's timeout to guarantee that failed messages are immediately visible for reprocessing.

Place the Lambda function in a public subnet of the VPC and associate a public IP address to allow outbound HTTP connections for downloading files.

Increase the memory allocation of the Lambda function, which automatically increases the ephemeral disk space proportionally up to 10 GB.

Show answer & explanation

Answer: Configure the SQS queue's visibility timeout to be at least six times the timeout of the Lambda function.; Modify the Lambda function code to delete the downloaded validation files from the /tmp directory before the handler execution completes.

Answer

The correct options are configuring the SQS queue's visibility timeout to be at least six times the Lambda function's timeout, and deleting the validation files from the /tmp directory before the handler execution completes.

Configuring the SQS queue's visibility timeout to be at least six times the Lambda function's timeout prevents messages from being visible to other consumers while the active invocation is running, thereby resolving the duplicate processing issue. Additionally, explicitly deleting downloaded files from the /tmp directory before the execution finishes ensures that subsequent invocations reusing the execution context do not run out of space.

Step-by-Step Solution

Analyze the cause of duplicate message processing in SQS-to-Lambda integrations.

Identify that if SQS visibility timeout is too close to or less than Lambda's execution timeout, messages can reappear in the queue before the Lambda function finishes processing, leading to duplicate invocations.

This establishes that the SQS queue's visibility timeout must be set to at least six times the Lambda function's timeout.

Analyze the cause of the 'No space left on device' error in Lambda executions.

Understand that because Lambda execution contexts are reused, files downloaded to the /tmp directory persist across subsequent invocations, eventually exhausting the storage limit.

This shows the need to clean up temporary files in the /tmp directory at the end of each handler execution.

Key Concept

AWS Lambda ephemeral storage lifecycle management and Amazon SQS integration timeout best practices.

Question 286Question →

A developer is building a serverless application where a frontend web application, hosted on a custom domain, interacts with a backend REST API. The backend is configured using Amazon API Gateway with a Lambda proxy integration. To support cross-origin requests, the developer enabled CORS on the API Gateway resource using the AWS Console, which successfully created the OPTIONS method. However, when the frontend application attempts to send a POST request, the browser console displays a CORS error indicating that the 'Access-Control-Allow-Origin' header is missing. What must the developer do to resolve this issue?

In the API Gateway console, configure the POST method's Integration Response to map the 'Access-Control-Allow-Origin' header to the client's origin.

Configure the Lambda function to return a raw JSON string containing the data payload, as API Gateway automatically injects the CORS headers configured on the resource into proxy integration responses.

Modify the Lambda function's code to return a JSON object that includes a 'headers' field containing 'Access-Control-Allow-Origin' with the appropriate origin value, alongside the 'statusCode' and 'body' fields.

Increase the timeout of the Lambda function to prevent the execution context from timing out during the preflight OPTIONS request, and implement connection pooling in the global scope.

Show answer & explanation

Answer: Modify the Lambda function's code to return a JSON object that includes a 'headers' field containing 'Access-Control-Allow-Origin' with the appropriate origin value, alongside the 'statusCode' and 'body' fields.

Answer

In Amazon API Gateway, when using Lambda proxy integration, the backend Lambda function is responsible for returning the entire HTTP response. This response must be a JSON object containing 'statusCode', 'body', and 'headers'. To support CORS, the 'headers' object must explicitly contain the 'Access-Control-Allow-Origin' header. Enabling CORS via the API Gateway console only configures the mock integration for the preflight OPTIONS method, but does not modify the response payload returned by the Lambda function for actual HTTP methods like POST.

Step-by-Step Solution

Analyze the integration type between API Gateway and the Lambda function.

The API uses Lambda proxy integration.

Knowing the integration type is critical because Lambda proxy integrations bypass API Gateway's integration response mappings, shifting the responsibility of formatting the HTTP response (including headers) to the backend Lambda function.

Determine the source of the missing header error.

The preflight OPTIONS method succeeds, but the POST request fails due to a missing 'Access-Control-Allow-Origin' header.

This confirms that while API Gateway handles CORS for the preflight OPTIONS check (since the console automatically configures the mock response), the actual POST response returned by Lambda lacks the required header.

Formulate the correct payload structure for the Lambda function response.

Return a JSON object containing 'statusCode', 'body' (as a stringified JSON), and a 'headers' object with 'Access-Control-Allow-Origin'.

This compliant structure ensures that API Gateway parses the response correctly and forwards the required CORS headers to the browser.

Key Concept

API Gateway Lambda Proxy Integration CORS Requirements

Question 287Question →

An online learning platform stores student registration records in an Amazon DynamoDB table. The table uses StudentID as the partition key. A new feature requires retrieving a list of all students who registered in the last $30$ days. Registration dates are stored in an attribute named RegistrationDate. Which approach should the developer use to retrieve these records with the lowest latency and minimal Read Capacity Unit (RCU) consumption?

Create a Global Secondary Index (GSI) with RegistrationDate as the partition key, and perform a Query operation on the GSI.

Perform a Scan operation on the base table using a FilterExpression on RegistrationDate.

Perform a Scan operation on the base table, and double the provisioned Read Capacity Units (RCUs) to prevent ProvisionedThroughputExceededException errors.

Initialize the AWS SDK DynamoDB client using hardcoded AWS access keys in the application code, and perform a Scan operation.

Show answer & explanation

Answer: Create a Global Secondary Index (GSI) with RegistrationDate as the partition key, and perform a Query operation on the GSI.

Answer

Create a Global Secondary Index (GSI) with RegistrationDate as the partition key, and perform a Query operation on the GSI.

Creating a Global Secondary Index (GSI) with RegistrationDate as the partition key enables the application to use the Query operation. A Query operation targets only the items within the specified partition key value, significantly reducing latency and RCU consumption compared to scanning the entire table.

Step-by-Step Solution

Analyze the table key schema and query requirements.

The base table only supports querying by StudentID. Because the query needs to look up records by RegistrationDate (a non-key attribute), a direct Query operation on the base table is not possible.

DynamoDB Query operations require specifying the partition key of the index or table being queried.

Compare Query and Scan operations for data retrieval.

A Scan operation reads every item in the table, whereas a Query searches only items matching the partition key. A Scan is highly inefficient for large datasets.

To minimize latency and RCU consumption, the developer must find a way to perform a Query instead of a Scan.

Design a secondary index to enable the Query operation.

Create a Global Secondary Index (GSI) using RegistrationDate as the partition key. Perform a Query operation against this GSI to retrieve the records.

A GSI allows queries on alternate keys, returning only the desired records and consuming minimal RCUs.

Key Concept

Using Global Secondary Indexes (GSIs) and the Query operation instead of a Scan operation to retrieve data efficiently based on non-key attributes.

Question 288Question →

A developer is building a REST API in Amazon API Gateway. To allow the frontend development team to test their application before the backend microservices are fully implemented, the developer wants to configure an endpoint to return a mock response with a static JSON payload and an HTTP 200 status code. Which two actions must the developer take to configure this Mock integration in API Gateway? (Select TWO.)

Select all that apply

Configure the Method Response to include the HTTP 200 status code, and configure the Integration Response for the 200 status with an application/json body mapping template that outputs the static JSON payload.

Set the method's integration type to MOCK, and define an Integration Request mapping template for the application/json content type that returns a JSON object containing a statusCode of 200.

Configure a custom Lambda authorizer for the method that intercepts the incoming request and returns the static mock JSON payload in the authorizer context.

Configure the method to use an HTTP integration with the endpoint URL pointing to http://localhost/mock, and use a VTL mapping template to define the static response.

Set the method's integration type to Lambda Proxy Integration with an empty function name, and define the mock JSON payload in the Method Request body mapping template.

Show answer & explanation

Answer: Configure the Method Response to include the HTTP 200 status code, and configure the Integration Response for the 200 status with an application/json body mapping template that outputs the static JSON payload.; Set the method's integration type to MOCK, and define an Integration Request mapping template for the application/json content type that returns a JSON object containing a statusCode of 200.

Answer

To configure a Mock integration in Amazon API Gateway to return a static JSON response, the developer must set the method's integration type to MOCK and configure the Integration Request with a mapping template returning a statusCode (such as 200). Additionally, the developer must define the HTTP 200 status code in the Method Response and configure the corresponding Integration Response with an application/json body mapping template that contains the static JSON payload.

The correct options explain the two halves of a Mock integration configuration: setting the integration type to MOCK with an Integration Request template that outputs a statusCode (e.g., 200), and configuring the Method Response (to define the 200 HTTP code) along with an Integration Response mapping template to return the static JSON payload.

Step-by-Step Solution

Set the integration type of the API Gateway method to MOCK.

Specifies that API Gateway should generate a direct response without forwarding the request to a backend service.

This establishes a Mock integration.

Configure an Integration Request mapping template for application/json that returns a statusCode key, such as {'statusCode': 200}.

Provides API Gateway with the status code parameter needed to route the mock request internally.

API Gateway uses this statusCode value to select the matching Integration Response.

Define an HTTP 200 status code in the Method Response, and configure the corresponding 200 Integration Response with a body mapping template containing the static JSON payload.

Maps the internal status code to the client-facing response and formats the final static response body returned to the client.

This ensures the client receives the expected HTTP 200 status code and mock JSON payload.

Key Concept

Mock integrations in API Gateway bypass backend services and use mapping templates in both the Integration Request and Integration Response to construct static client responses.

Question 289Question →

An engineering team is building a REST API using Amazon API Gateway that integrates with a legacy HTTP backend service using an HTTP integration (non-proxy). When the legacy backend cannot find a record, it returns an HTTP status code 404 with a plain text error message. The team wants the API Gateway to intercept this 404 response and instead return an HTTP status code 200 to the client, containing a structured JSON payload: {"available": false, "reason": "Record not found"}. Which configuration steps must the developer perform in API Gateway to meet these requirements?

Configure the API Gateway method to use an HTTP Proxy integration, and set up a Gateway Response for the 404 status code to rewrite the HTTP status code to 200 and inject the custom JSON payload.

In the Method Response configuration, create a response mapping rule with a regex of 404 and specify the custom JSON mapping template. In the Integration Response configuration, add a method response with a status code of 200.

In the Method Response configuration, ensure the 200 status code is defined. In the Integration Response configuration, create a mapping rule with an HTTP status regex of 404, map it to the 200 method response, and define an application/json mapping template to output the custom JSON payload.

Configure an Amazon Cognito User Pool authorizer to intercept the legacy HTTP backend's response, validate the OAuth scopes, and transform the 404 status code into a 200 status code with the custom JSON payload.

Show answer & explanation

Answer: In the Method Response configuration, ensure the 200 status code is defined. In the Integration Response configuration, create a mapping rule with an HTTP status regex of 404, map it to the 200 method response, and define an application/json mapping template to output the custom JSON payload.

Answer

To transform a backend response's status code and body in a non-proxy integration, you must first define the target status code (200) in the Method Response. Then, in the Integration Response, you map the backend's response status code (404) to the target Method Response status code (200) and specify a mapping template to output the required JSON format. This decouples the client-facing API contract from the legacy backend implementation.

Step-by-Step Solution

Define the target HTTP status code in the Method Response configuration.

The API Gateway method is configured to allow a client-facing HTTP 200 response.

Before mapping any integration response to a client response status, that status code must exist in the Method Response configuration.

Configure the Integration Response mapping rule for HTTP 404.

API Gateway intercepts backend HTTP 404 responses and redirects them to the 200 Method Response path.

The HTTP status regex in the Integration Response matches the incoming backend status code to direct it to the appropriate client status code.

Specify an application/json mapping template in the Integration Response.

The backend plain text body is transformed into the desired JSON format.

Mapping templates (VTL) reshape backend payloads to conform to the client's expected interface.

Key Concept

API Gateway Integration Response Mapping

Estimated Time:2m 0s

Question 290Question →

A developer is writing a backend service for a task management application. The application stores user tasks in an Amazon DynamoDB table with UserId as the partition key and TaskId as the sort key. The developer needs to retrieve all tasks associated with a specific UserId that have a status of 'Pending'. The developer wants to minimize latency and the consumption of Read Capacity Units (RCUs).

Which two actions should the developer take to retrieve the required items efficiently? (Select TWO.)

Select all that apply

Perform a Query operation specifying the UserId in the key condition expression.

Use a FilterExpression in the Query operation to return only tasks with a status of 'Pending'.

Perform a Scan operation on the table and apply a FilterExpression for UserId and status.

Use the GetItem API operation specifying only the UserId parameter.

Hardcode AWS access keys in the application client to bypass standard IAM role credential retrieval.

Show answer & explanation

Answer: Perform a Query operation specifying the UserId in the key condition expression.; Use a FilterExpression in the Query operation to return only tasks with a status of 'Pending'.

Answer

To retrieve the tasks efficiently, the developer should perform a Query operation specifying the UserId in the key condition expression, and use a FilterExpression in that Query operation to filter for tasks with a status of 'Pending'.

The most efficient way to retrieve multiple items sharing the same partition key (UserId) is to perform a Query operation. A FilterExpression can then be applied to the Query operation to narrow down the results to only include those where the status is 'Pending'. This ensures only the relevant partition is read, minimizing RCU consumption and latency.

Step-by-Step Solution

Determine the appropriate DynamoDB API operation.

Since the developer has the partition key (UserId) and wants to retrieve all matching items, the Query operation is the correct choice. GetItem cannot retrieve multiple items without the sort key, and Scan reads the entire table which is inefficient.

Using Query minimizes Read Capacity Unit (RCU) consumption by targeting only the specific partition.

Apply the filter for non-key attributes.

Since 'status' is not part of the primary key, a FilterExpression must be added to the Query operation to filter out items where the status is not 'Pending'.

FilterExpression is applied after the query reads the partition, reducing the payload size returned to the application.

Key Concept

Efficient data retrieval using DynamoDB Query and FilterExpressions

Question 291Question →

A developer is implementing a serverless data processing application where an Amazon Kinesis data stream triggers an AWS Lambda function via an event source mapping. During high-traffic periods, temporary downstream database connection failures cause the Lambda function to fail when processing certain batches. This results in the entire batch of records being repeatedly retried, causing head-of-line blocking and redundant processing of valid records. The developer wants to isolate the failing records, avoid processing duplicates where possible, and capture failed records for offline analysis without stalling stream ingestion.

Which two configurations should the developer apply to the Lambda event source mapping to meet these requirements? (Select two.)

Select all that apply

Set BisectBatchOnFunctionError to true in the event source mapping configuration.

Configure an on-failure destination (DestinationConfig) in the event source mapping to route discarded record metadata to an Amazon SQS queue.

Configure the DeadLetterConfig property of the Lambda function to send failed execution payloads directly to an Amazon SQS queue.

Increase the Lambda function's timeout configuration to match the retention period of the Kinesis data stream.

Modify the Kinesis stream partition key logic to route failed records to a single static key to isolate them in a dedicated shard.

Show answer & explanation

Answer: Set BisectBatchOnFunctionError to true in the event source mapping configuration.; Configure an on-failure destination (DestinationConfig) in the event source mapping to route discarded record metadata to an Amazon SQS queue.

Answer

The correct configurations are to enable BisectBatchOnFunctionError in the event source mapping and configure an on-failure destination on the mapping to route metadata of discarded records to an Amazon SQS queue.

To prevent head-of-line blocking in Kinesis event source mappings, the developer must set BisectBatchOnFunctionError to true. This splits the failed batch into two halves and retries them separately, narrowing down the failure to the specific failing record. To capture failed records without stalling ingestion, the developer should configure an on-failure destination on the event source mapping itself. When a batch reaches its maximum retry limit or maximum record age, Lambda discards the batch and sends metadata (including shard ID and sequence number) to the destination.

Step-by-Step Solution

Analyze the event source mapping behavior for stream-based sources.

Identify that by default, a single failed record in a batch causes the entire batch to be retried repeatedly, leading to head-of-line blocking.

This helps locate where the logic for splitting batches and routing failures resides.

Select the correct mechanism to isolate failing records within a batch.

Enable BisectBatchOnFunctionError so that Lambda splits the failing batch in half and retries each half independently.

This isolates the problematic record and allows successful records in the original batch to proceed.

Select the correct mechanism to capture permanently failing records without blocking the stream.

Configure an on-failure destination on the event source mapping.

Since the stream is polled synchronously by Lambda, standard function-level DLQs do not apply. An on-failure destination ensures that record metadata is captured once retry limits are exhausted.

Key Concept

Error handling configurations for AWS Lambda event source mappings integrated with Amazon Kinesis Data Streams.

Question 292Question →

A developer is working on an AWS Lambda function that retrieves transaction data from an Amazon RDS PostgreSQL database running in a private subnet of a VPC. The function must also send an HTTP request to a third-party payment processor endpoint on the public internet. The developer configures the Lambda function to run inside the same VPC and private subnets as the database. Testing reveals that the Lambda function successfully queries the database but times out when attempting to connect to the payment processor.

Which configuration change should the developer make to resolve this connection timeout?

Configure a NAT Gateway in a public subnet of the VPC, and add a route in the route table of the Lambda function's subnets to direct internet-bound traffic to the NAT Gateway.

Move the Lambda function's subnet configuration to the public subnets of the VPC to allow it to utilize the VPC's Internet Gateway directly.

Enable the 'Assign Public IP' option in the Lambda function's VPC settings and associate an Elastic IP address with the function's network interface.

Modify the trust policy of the Lambda function's execution role to allow the VPC service principal to assume the role, and attach the AWSLambdaVPCAccessExecutionRole policy.

Show answer & explanation

Answer: Configure a NAT Gateway in a public subnet of the VPC, and add a route in the route table of the Lambda function's subnets to direct internet-bound traffic to the NAT Gateway.

Answer

Configure a NAT Gateway in a public subnet of the VPC, and add a route in the route table of the Lambda function's subnets to direct internet-bound traffic to the NAT Gateway.

The correct action is to route internet-bound traffic through a NAT Gateway. When a Lambda function is configured to run inside a VPC, it accesses resources via Elastic Network Interfaces (ENIs) allocated in the configured subnets. Since these ENIs do not have public IP addresses, they cannot communicate directly with the internet, even if placed in a public subnet. To enable internet connectivity, the function must be placed in private subnets, and the corresponding route table must route all external traffic (0.0.0.0/0) to a NAT Gateway deployed in a public subnet.

Step-by-Step Solution

Analyze the network route paths for the Lambda function inside the VPC.

The Lambda function is in a private subnet with route paths to the database, but it has no route to the internet.

Since Lambda ENIs do not have public IPs, they cannot use an Internet Gateway directly even if placed in a public subnet.

Introduce a NAT Gateway into the network architecture.

A NAT Gateway is created in a public subnet of the VPC, which has a route to the Internet Gateway.

The NAT Gateway acts as a proxy, translating private IPs to its own public IP for outgoing internet traffic.

Update the routing table of the Lambda function's private subnet.

A route for 0.0.0.0/0 pointing to the NAT Gateway is added to the private subnet's route table.

This directs all external traffic from the Lambda function through the NAT Gateway, resolving the connection timeout.

Key Concept

VPC Networking for AWS Lambda

Question 293Question →

A developer is designing a REST API in Amazon API Gateway that must secure access to its endpoints using an existing Amazon Cognito User Pool. The developer wants to validate the JSON Web Tokens (JWTs) passed in the `Authorization` header of client requests with the minimum amount of custom code and lowest latency. Which configuration should the developer implement in API Gateway?

Configure a Cognito User Pool authorizer on the API Gateway methods and set the Token Source to 'Authorization'

Create a custom Lambda token authorizer that performs cryptographic validation of the Cognito JWT and returns an IAM policy

Implement a Lambda proxy integration and write application logic in the backend function to inspect the proxy event headers for token verification

Configure an IAM authorizer on API Gateway and write a custom Lambda authorizer to map User Pool tokens to IAM policies

Show answer & explanation

Answer: Configure a Cognito User Pool authorizer on the API Gateway methods and set the Token Source to 'Authorization'

Answer

Configure a Cognito User Pool authorizer on the API Gateway methods and set the Token Source to 'Authorization'

The native Cognito User Pool authorizer in Amazon API Gateway validates the JWT signatures from Cognito User Pools directly at the gateway layer. This requires no custom code, is easy to set up, and avoids the cold-start latency and execution costs of a Lambda function.

Step-by-Step Solution

Identify the authentication source and requirements

The client sends a JWT from Amazon Cognito User Pool in the 'Authorization' header, and the goal is validation with minimal code and latency.

This establishes that we need to inspect the header and compare it with the Cognito User Pool keys.

Evaluate API Gateway's built-in capabilities vs custom solutions

API Gateway provides a native 'Cognito User Pool Authorizer' that validates JWTs automatically without invoking Lambda functions.

Choosing a native feature eliminates code maintenance (minimizes custom code) and reduces execution overhead (minimizes latency).

Configure the token source mapping

Map the token source field to 'Authorization' so API Gateway knows which incoming header contains the JWT.

API Gateway requires this mapping to extract the token for verification.

Key Concept

API Gateway Cognito User Pool Authorizer

Question 294Question →

A developer is configuring an Amazon SQS FIFO queue to process incoming order events. To ensure that duplicate orders are ignored during a 5-minute window and that orders are processed in the strict order they were received, which TWO configurations must the developer implement?

Select all that apply

Provide a unique MessageDeduplicationId for each sent message, or enable Content-Based Deduplication on the queue.

Provide a MessageGroupId for each message to group related messages for ordered sequential processing.

Configure the SQS Visibility Timeout to 5 minutes to prevent duplicate messages from being received.

Initialize the AWS SDK client inside a Lambda consumer using static, hardcoded access credentials to speed up delivery.

Configure the Lambda consumer function timeout to be at least 5 minutes to allow execution context reuse to handle deduplication.

Show answer & explanation

Answer: Provide a unique MessageDeduplicationId for each sent message, or enable Content-Based Deduplication on the queue.; Provide a MessageGroupId for each message to group related messages for ordered sequential processing.

Answer

To ensure deduplication and ordered delivery in Amazon SQS FIFO queues, the developer must configure the MessageDeduplicationId (or use Content-Based Deduplication) and provide a MessageGroupId.

The correct options are specifying a MessageDeduplicationId (or enabling Content-Based Deduplication) and providing a MessageGroupId. SQS FIFO queues require a MessageDeduplicationId to uniquely identify messages and discard duplicates within the 5-minute deduplication window. They also require a MessageGroupId to guarantee that messages belonging to the same group are processed sequentially in the order they were sent.

Step-by-Step Solution

Identify the mechanism for message deduplication in Amazon SQS FIFO queues.

Amazon SQS FIFO queues use a MessageDeduplicationId or Content-Based Deduplication to identify duplicates within a 5-minute window.

This prevents duplicate processing of identical messages.

Identify the mechanism for message ordering in Amazon SQS FIFO queues.

Amazon SQS FIFO queues require a MessageGroupId to group messages that must be processed in order.

This ensures that messages within the same group are processed sequentially, preserving the strict ordering requirement.

Key Concept

SQS FIFO Message Deduplication and Grouping

Question 295Question →

A developer is configuring a REST API in Amazon API Gateway that integrates with an AWS Lambda function. The API must use a Lambda non-proxy (custom) integration to allow request transformation. The developer needs to pass the incoming client request header X-App-Tenant-Id as a JSON property named tenantId in the payload sent to Lambda. Additionally, if the Lambda function fails with an error message containing TenantSuspended, the API must return an HTTP 403 Forbidden status code and a custom JSON message to the client. Which two configurations are required to meet these requirements? (Select two.)

Select all that apply

Define a mapping template of type application/json in the Integration Request that extracts the header value using the expression $input.params('X-App-Tenant-Id').

Configure an Integration Response with a Lambda Error Regex pattern set to .*TenantSuspended.* and map it to a Method Response with a 403 status code.

Enable Lambda Proxy Integration, then configure the Integration Response regex to intercept the Lambda execution error and map it to a 403 status code.

Create a custom Lambda Authorizer to catch the backend Lambda execution exception and return an IAM policy denying access to the resource.

Configure an API Gateway Response of type DEFAULT_5XX to intercept the Lambda error and map the response body to a 403 status code.

Show answer & explanation

Answer: Define a mapping template of type application/json in the Integration Request that extracts the header value using the expression $input.params('X-App-Tenant-Id').; Configure an Integration Response with a Lambda Error Regex pattern set to .*TenantSuspended.* and map it to a Method Response with a 403 status code.

Answer

To pass the header, define an Integration Request mapping template for application/json that extracts the header using $input.params('X-App-Tenant-Id'). To map the backend error, configure an Integration Response with a Lambda Error Regex pattern matching .*TenantSuspended.* and map it to a 403 Method Response.

The correct configurations are defining a mapping template in the Integration Request using the $input.params('X-App-Tenant-Id') expression, and configuring an Integration Response with a Lambda Error Regex pattern to capture the exception and return a 403 Method Response. With Lambda non-proxy integration, developers use Integration Request mapping templates to extract parameters and shape the payload, and Integration Responses to map backend error messages to target HTTP status codes.

Step-by-Step Solution

Configure the Integration Request mapping template.

Extracts the client header value and constructs a JSON payload with a tenantId property for the backend Lambda function.

Because Lambda non-proxy integration is used, API Gateway must explicitly transform the incoming HTTP request metadata into a JSON format expected by the Lambda function.

Configure a Method Response for the resource method.

Defines an HTTP 403 status code response block for the client.

API Gateway requires that the HTTP status code (Method Response) be defined before the integration response mapping can target it.

Configure the Integration Response mapping rules.

Matches the error message string from Lambda using regex and maps the execution result to the 403 Method Response.

For custom integrations, API Gateway evaluates the errorMessage field returned from Lambda against the configured regex pattern to determine which HTTP response code to send back.

Key Concept

API Gateway Lambda Custom Integration Request and Response Mapping

Estimated Time:2m 0s

Question 296Question →

A developer is implementing a transaction processing system using an Amazon SQS FIFO queue. The system must process transactions in the exact order they occur. During testing, the developer notices that when two different transactions with identical message bodies are sent within two minutes of each other, the second transaction is discarded. Content-based deduplication is disabled on the queue. How should the developer modify the application configuration or message attributes to ensure both transactions are processed?

Increase the VisibilityTimeout parameter on the queue to be greater than five minutes.

Configure the consumer Lambda function's timeout parameter to match the SQS message retention period.

Set a unique MessageDeduplicationId parameter on each sent message.

Initialize the AmazonSQS client using hardcoded AWS access keys to bypass SQS message deduplication checks.

Show answer & explanation

Answer: Set a unique MessageDeduplicationId parameter on each sent message.

Answer

Set a unique MessageDeduplicationId parameter on each sent message.

Setting a unique MessageDeduplicationId on each sent message ensures that Amazon SQS treats transactions with identical bodies as distinct messages, preventing incorrect deduplication when content-based deduplication is disabled.

Step-by-Step Solution

Analyze the message discard behavior in the SQS FIFO queue.

The second message is discarded because it has an identical body to a message sent within the 5-minute deduplication window, and content-based deduplication is disabled.

SQS FIFO queues require a mechanism to distinguish between duplicate retries and distinct messages with the same payload.

Evaluate SQS FIFO deduplication parameters.

When content-based deduplication is disabled, SQS relies strictly on the MessageDeduplicationId token passed with the message.

A unique MessageDeduplicationId tells SQS that the message is distinct despite having the same body.

Select the correct option to configure.

Setting a unique MessageDeduplicationId on each message.

This allows both transactions to bypass the 5-minute deduplication check and be successfully queued.

Key Concept

SQS FIFO Message Deduplication

Question 297Question →

A developer has implemented an AWS Lambda function that is triggered by an Amazon SQS queue. The function retrieves database credentials from AWS Secrets Manager, connects to an Amazon RDS PostgreSQL database in a private subnet, and processes messages. During load testing, the database experiences connection exhaustion, and some SQS messages are processed multiple times. Which TWO actions should the developer take to resolve these issues?

Select all that apply

Move the database connection initialization and secrets retrieval code outside of the Lambda handler function.

Configure the SQS queue's visibility timeout to be at least six times the timeout configuration of the Lambda function.

Hardcode the database credentials directly in the SDK client initialization within the Lambda function code to bypass retrieving secrets.

Decrease the SQS queue's visibility timeout to a value less than the Lambda function's timeout to speed up processing.

Associate the Lambda function with the private subnets containing the database without creating a NAT Gateway or VPC endpoint.

Show answer & explanation

Answer: Move the database connection initialization and secrets retrieval code outside of the Lambda handler function.; Configure the SQS queue's visibility timeout to be at least six times the timeout configuration of the Lambda function.

Answer

Initialize the database connection and secrets retrieval outside of the handler function, and configure the SQS queue's visibility timeout to be at least six times the Lambda function's timeout.

Moving the connection code outside the handler allows subsequent invocations to reuse the established database connections from the execution context. Configuring the SQS visibility timeout to be at least six times the Lambda function's timeout prevents messages from being visible to other pollers before the active execution has completed.

Step-by-Step Solution

Analyze the database connection exhaustion issue.

The Lambda function is creating a new connection on every invocation. By moving the connection logic outside the handler, the function leverages execution context reuse.

This maintains persistent database connection pools across multiple invocations in the same execution container.

Analyze the duplicate message processing issue.

If the execution time of the function exceeds the SQS queue's visibility timeout, messages become visible to other function instances while still processing.

Setting the visibility timeout to at least six times the Lambda timeout provides a safety buffer for processing and retries.

Key Concept

Reusing execution contexts and managing integration timeouts are critical for optimizing Lambda performance and ensuring message delivery semantics.

Estimated Time:1m 30s

Question 298Question →

A developer is building a backend service that retrieves user profile history records from an Amazon DynamoDB table. The table is configured with UserID as the partition key and LastUpdated as the sort key. The developer wants to retrieve all historical records for a specific UserID using the AWS SDK. Which approach should the developer use to perform this retrieve operation most efficiently and securely?

Perform a Query operation specifying the UserID in the key condition expression, and initialize the AWS SDK client using the default credential provider chain.

Perform a Scan operation and filter the results by UserID in the application code, and initialize the AWS SDK client using the default credential provider chain.

Perform a Query operation specifying the UserID in the key condition expression, and initialize the AWS SDK client by hardcoding the AWS Access Key ID and Secret Access Key.

Perform a Scan operation using a FilterExpression specifying the UserID, and initialize the AWS SDK client using the default credential provider chain.

Show answer & explanation

Answer: Perform a Query operation specifying the UserID in the key condition expression, and initialize the AWS SDK client using the default credential provider chain.

Answer

Perform a Query operation specifying the UserID in the key condition expression, and initialize the AWS SDK client using the default credential provider chain.

The correct approach retrieves the historical records using the Query API since it directly queries the table using the partition key, ensuring minimal Read Capacity Unit consumption. It also secures the application by utilizing the default credential provider chain to handle authentication.

Step-by-Step Solution

Determine the optimal DynamoDB API operation to retrieve multiple items that share the same partition key.

The Query operation is selected because it directly targets the partition key and reads only the matching items.

Unlike Scan, which reads every item in the table, Query minimizes Read Capacity Unit consumption and request latency.

Identify the secure method for managing AWS credentials when initializing the SDK client.

The default credential provider chain is used to automatically load credentials from IAM roles or environment variables.

Hardcoding credentials in the code exposes sensitive access keys to repositories and unauthorized users.

Key Concept

DynamoDB Query operations and secure AWS SDK credential initialization

Alternative Method

If only a single specific historical record is needed and both the partition key and sort key are known, the GetItem API operation would be the most efficient approach.

Estimated Time:45s

Question 299Question →

A developer is designing a real-time fleet logistics tracking system. The system stores shipment event logs in an Amazon DynamoDB table. The table has `CarrierID` (String) as the partition key and `EventID` (String) as the sort key. The application must support three operations:

1. Retrieve all event logs for a specific carrier within a specific timestamp window, ordered from the most recent to the oldest.
2. Retrieve a specific event log's details across all carriers using the unique `EventID`.
3. Update the status of up to 10 event logs simultaneously in a single transaction, ensuring all updates succeed or all fail together.

Which combination of DynamoDB configurations and API operations will meet these requirements most efficiently? (Select TWO.)

Select all that apply

Create a Global Secondary Index (GSI) with `CarrierID` as the partition key and `Timestamp` as the sort key. Query this GSI with `ScanIndexForward` set to `false` to retrieve the sorted logs.

Create a Global Secondary Index (GSI) with `EventID` as the partition key. Query this GSI to retrieve the specific event details, and use the `TransactWriteItems` API to execute the transaction updates.

Retrieve the specific event details by calling the `Scan` operation on the base table with a `FilterExpression` matching the `EventID`, and use the `BatchWriteItem` API to process the transaction updates.

Create a Local Secondary Index (LSI) with `EventID` as the partition key to query the specific event details, and use the `BatchWriteItem` API to process the transaction updates.

Retrieve the sorted logs by calling the `Scan` operation on the base table with a `FilterExpression` on `Timestamp`, and use the `TransactWriteItems` API to execute the transaction updates.

Show answer & explanation

Answer: Create a Global Secondary Index (GSI) with `CarrierID` as the partition key and `Timestamp` as the sort key. Query this GSI with `ScanIndexForward` set to `false` to retrieve the sorted logs.; Create a Global Secondary Index (GSI) with `EventID` as the partition key. Query this GSI to retrieve the specific event details, and use the `TransactWriteItems` API to execute the transaction updates.

Answer

To meet the requirements efficiently, create a Global Secondary Index (GSI) with CarrierID as the partition key and Timestamp as the sort key, and query it with ScanIndexForward set to false. Additionally, create a GSI with EventID as the partition key to query specific events, and use the TransactWriteItems API to perform atomic updates.

To retrieve sorted logs by carrier and timestamp efficiently, a Global Secondary Index (GSI) with CarrierID as the partition key and Timestamp as the sort key is required. Querying this GSI with ScanIndexForward set to false returns the results in descending order. To retrieve an event by EventID without knowing the CarrierID, a GSI with EventID as the partition key is needed. To perform atomic updates on up to 10 logs simultaneously, the TransactWriteItems API must be used because it provides transactional guarantees where either all updates succeed or all fail.

Step-by-Step Solution

Identify the most efficient way to query sorted event logs by carrier and timestamp.

Define a Global Secondary Index (GSI) with CarrierID as the partition key and Timestamp as the sort key. Perform a Query operation rather than a Scan. Set ScanIndexForward to false to return items in descending chronological order.

A Query on a GSI is much more efficient than a Scan on the base table because it target-reads only the matching partition key and sort key range, conserving Read Capacity Units (RCUs).

Identify how to retrieve a specific event log across all carriers without knowing the CarrierID.

Define a Global Secondary Index (GSI) with EventID as the partition key. Retrieve the item by performing a Query on this GSI.

Since CarrierID is the partition key of the base table, locating an item by EventID alone would require scanning the entire base table. A GSI on EventID enables direct, single-lookup queries across all partitions.

Determine the API operation required for executing atomic write updates across multiple items.

Use the TransactWriteItems API rather than BatchWriteItem.

TransactWriteItems provides ACID transaction guarantees, ensuring that either all status updates succeed or none are applied. BatchWriteItem does not support transactional atomicity and can result in partial successes.

Key Concept

Optimizing DynamoDB queries and transactions using Global Secondary Indexes (GSIs) and TransactWriteItems.

Question 300Question →

A developer is building a mobile shopping application that stores product details in an Amazon DynamoDB table. The application currently retrieves products belonging to a specific department by performing a Scan operation on the base table and filtering the results using a FilterExpression on the Department attribute. This is causing high latency and excessive Read Capacity Unit (RCU) consumption. Which two actions should the developer take to retrieve the products efficiently while minimizing RCU consumption? (Select TWO.)

Select all that apply

Create a Global Secondary Index (GSI) with Department as the partition key.

Use the Query API operation on the GSI to retrieve the products.

Use a Scan operation with a FilterExpression to filter products by their department on the server side.

Use a ProjectionExpression in the Scan operation to only retrieve items matching the department.

Configure the DynamoDB client by hardcoding AWS access keys inside the application initialization code to bypass authorization overhead.

Show answer & explanation

Answer: Create a Global Secondary Index (GSI) with Department as the partition key.; Use the Query API operation on the GSI to retrieve the products.

Answer

Create a Global Secondary Index (GSI) with Department as the partition key, and use the Query API operation on the GSI to retrieve the products.

To optimize the read operations and minimize Read Capacity Unit (RCU) consumption, the developer should create a Global Secondary Index (GSI) using the Department attribute as the partition key, and then use the Query API operation instead of Scan. The Query operation only reads the items that share the target partition key, significantly reducing the RCU footprint compared to a full Scan.

Step-by-Step Solution

Analyze the current data retrieval pattern.

The application performs a Scan on the base table and filters items using a FilterExpression.

To identify why the operation consumes excessive RCUs and causes latency.

Identify the performance bottleneck of Scan vs Query.

Scan operations read every item in the table before applying the FilterExpression, consuming RCUs proportional to the table size. Query operations only read items matching the specified partition key.

To choose the correct API operation for efficient retrieval.

Determine the necessary table configuration changes.

Create a Global Secondary Index (GSI) with Department as the partition key because the base table partition key cannot be used to query by department directly.

To enable the use of the Query operation on the Department attribute.

Key Concept

DynamoDB Query vs Scan optimization using Global Secondary Indexes (GSIs)

PreviousPage 15 / 78Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Alternative Method

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution