Examkin

All practice questions

1542 questions

All types1,542Multiple choice782Multiple select746Ordering14
Question 321Question →

A developer is implementing a messaging solution for a retail checkout application. When a purchase is completed, an event must be sent to an Amazon SNS topic and fanned out to two Amazon SQS queues: one for shipping logistics and one for customer notifications.

Which of the following actions must the developer take to ensure that messages published to the SNS topic are successfully delivered to both SQS queues? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Subscribe both SQS queues to the SNS topic.; Configure the SQS queue access policy for both queues to grant the 'sqs:SendMessage' permission to the SNS topic principal.

Answer

To successfully fan out messages from an Amazon SNS topic to Amazon SQS queues, the developer must subscribe the SQS queues to the SNS topic and grant the SNS topic permission to send messages by updating the SQS queue access policies.
The correct options are to subscribe both SQS queues to the SNS topic and to configure the SQS queue access policies to grant the SNS topic principal the 'sqs:SendMessage' permission. This allows the SNS topic to successfully push messages to the SQS queues.

Step-by-Step Solution

1
Set up subscription.
Subscribed both SQS queues to the target SNS topic.
This establishes the relationship so that any message published to the SNS topic is forwarded to the queues.
2
Authorize SNS to write to SQS.
Updated the resource-based access policies of the SQS queues to allow the SNS topic to invoke 'sqs:SendMessage'.
By default, SQS queues reject message deliveries from external services unless a resource-based policy explicitly allows the service principal of the SNS topic to write to them.

Key Concept

Amazon SNS-to-SQS fanout requires subscribing the queues to the topic and configuring the SQS queue access policies to allow the SNS topic to write to the queues.
Question 322Question →

A developer is building an order processing system. A frontend application publishes order events to an Amazon SNS FIFO topic. An Amazon SQS FIFO queue is subscribed to the topic. An AWS Lambda function is configured to process messages from the queue. The Lambda function has a timeout of 4545 seconds.

During testing under heavy load, the developer notices two issues:
1. Some orders are processed multiple times by different Lambda invocations even though the Lambda function executes successfully without errors.
2. Multiple distinct orders submitted by the same customer in rapid succession are being discarded by the SQS FIFO queue.

Which TWO actions should the developer take to resolve these issues?

Select all that apply

Show answer & explanation

Answer: Modify the publisher application to construct the MessageDeduplicationId using a combination of the customer ID and a unique order ID, rather than using only the customer ID.; Set the Amazon SQS queue's visibility timeout to a value that is at least 66 times the Lambda function timeout, such as 270270 seconds.

Answer

Modify the publisher application to construct the MessageDeduplicationId using a combination of the customer ID and a unique order ID, and set the Amazon SQS queue's visibility timeout to a value that is at least 66 times the Lambda function timeout.
To resolve the duplicate processing issue, the SQS visibility timeout must be at least 66 times the Lambda function timeout (270270 seconds) so that active executions have ample time to finish and delete messages before they are made visible to other consumers. To resolve the discarded orders issue, the MessageDeduplicationId must be uniquely constructed using a combination of customer ID and order ID rather than just the customer ID, ensuring distinct messages are not incorrectly filtered out during the 55-minute deduplication window.

Step-by-Step Solution

1
Address the duplicate processing issue.
Identify that if the SQS visibility timeout is not long enough compared to the Lambda function timeout, messages can become visible again while being processed. Under AWS integration best practices, the queue's visibility timeout must be set to at least 66 times the timeout of the Lambda function (which is 6×45=2706 \times 45 = 270 seconds) to prevent duplicate processing.
This guarantees that the Lambda function has sufficient time to process the messages and delete them from the queue before they become visible to other consumers.
2
Address the discarded orders issue.
Identify that SQS FIFO queues use the MessageDeduplicationId to deduplicate messages within a sliding 55-minute window. Since multiple distinct orders from the same customer used only the customer ID as the deduplication ID, they were discarded as duplicates.
Constructing the deduplication ID using a combination of the customer ID and a unique order ID makes each transaction event unique, ensuring that legitimate orders are not discarded.

Key Concept

Managing SQS visibility timeout relative to Lambda timeouts and configuring proper MessageDeduplicationId for SQS FIFO queues.
Question 323Question →

A developer is writing a backend service for an internal corporate directory application. The application stores employee project assignments in an Amazon DynamoDB table where the partition key is EmployeeIdEmployeeId and the sort key is ProjectNameProjectName. The developer needs to retrieve all project assignments for a single specific employee. Which approach should the developer take to retrieve this data in the most cost-effective and performant manner?

Show answer & explanation

Answer: Perform a Query operation using the partition key EmployeeIdEmployeeId in the KeyConditionExpression.

Answer

Perform a Query operation using the partition key EmployeeId in the KeyConditionExpression.
The Query operation is the most efficient and cost-effective method to find items sharing the same partition key. It restricts its search to the single partition holding the partition key value and returns only the matching items, which consumes minimal Read Capacity Units (RCUs) and completes with low latency.

Step-by-Step Solution

1
Identify the data retrieval requirement
The developer needs to fetch all projects assigned to a single employee.
This establishes that we have a known partition key value (EmployeeIdEmployeeId) and want to retrieve a subset of items sharing that key.
2
Compare Query and Scan operations in DynamoDB
A Query directly accesses the physical partition associated with the partition key, whereas a Scan reads every single item in the table.
To minimize latency and RCU consumption, the Query operation must be selected instead of the Scan operation.
3
Formulate the Query parameter
Use the KeyConditionExpression with the partition key equal to the target value.
This ensures DynamoDB retrieves only the items matching the partition key without scanning unnecessary data.

Key Concept

DynamoDB Query vs Scan optimization
Question 324Question →

A developer is optimizing and troubleshooting an AWS Lambda function that reads transaction configurations from an Amazon DynamoDB table and then posts authorization requests to a third-party payment gateway via HTTPS.

The Lambda function is configured to run inside a VPC within two private subnets. The VPC has a Gateway VPC Endpoint configured for DynamoDB. During testing, the Lambda function successfully queries DynamoDB but fails with a network timeout error when attempting to connect to the payment gateway's external API. Additionally, Amazon CloudWatch logs show high execution latency during warm starts because the DynamoDB client is re-instantiated on every invocation.

Which two actions must the developer take to resolve the network timeout and optimize execution performance? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure a route in the route tables of the private subnets to direct internet-bound traffic (0.0.0.0/00.0.0.0/0) to a NAT Gateway deployed in a public subnet.; Initialize the DynamoDB SDK client outside of the Lambda handler function to reuse the client instance across subsequent invocations.

Answer

Configure a route in the route tables of the private subnets to direct internet-bound traffic to a NAT Gateway in a public subnet, and initialize the DynamoDB SDK client outside of the Lambda handler function.
To resolve the network timeout, the Lambda function needs internet access. Since it is located in private subnets, you must route its outbound traffic (0.0.0.0/00.0.0.0/0) to a NAT Gateway in a public subnet. Additionally, to optimize execution latency during warm starts, initializing the DynamoDB client outside the handler function allows Lambda to reuse the client instance from the execution context.

Step-by-Step Solution

1
Address the external API connection failure by checking the network route path.
The Lambda function is in private subnets and needs a path to the internet. Adding a route to a NAT Gateway in a public subnet allows outbound HTTPS requests.
Private subnets cannot reach the public internet directly and need a NAT Gateway for egress.
2
Address the high execution latency on warm starts by reviewing client initialization.
Move the DynamoDB client initialization code out of the handler block.
By placing initialization outside the handler, the client object is instantiated only once during cold start and reused across subsequent executions.

Key Concept

AWS Lambda VPC networking (NAT Gateway requirements) and execution context reuse optimization.
Estimated Time:2m 0s
Question 325Question →

A developer is designing a real-time ticketing system for high-demand concert sales. The booking requests are published to an Amazon SNS FIFO topic, which fans out to an Amazon SQS FIFO queue. An AWS Lambda function processes messages from the SQS FIFO queue in batches of up to 1010 messages.

During high-traffic events, some payments fail temporarily due to external payment provider rate limits, causing the Lambda function to return an error. The developer notices that when a single booking message fails in a batch, the entire batch of 1010 messages is retried. This leads to redundant processing of successfully authorized bookings in the same batch and blocks messages belonging to other users' sessions from being processed.

Which combination of configuration changes should the developer implement to resolve this issue, ensuring that only failed messages are retried while maintaining strict message ordering for each user?

Show answer & explanation

Answer: Configure the SQS FIFO queue as a Lambda trigger with `ReportBatchItemFailures` enabled in the event source mapping. Modify the Lambda function to catch exceptions during processing, accumulate failed message IDs, and return them in a `batchItemFailures` array. Set the `MessageGroupId` to the user's session ID when publishing to the SNS FIFO topic.

Answer

Configure the SQS FIFO queue as a Lambda trigger with `ReportBatchItemFailures` enabled, catch processing exceptions to return failed message IDs in `batchItemFailures`, and use the user's session ID as the `MessageGroupId` when publishing to the SNS FIFO topic.
The correct configuration combining `ReportBatchItemFailures` with a session-based `MessageGroupId` resolves both the batch retry issue and the head-of-line blocking problem. By returning the failed message IDs in `batchItemFailures`, AWS Lambda deletes the successfully processed messages from the SQS FIFO queue and only retries the failed messages. Using the user's session ID as the `MessageGroupId` preserves strict message ordering within each session while allowing different sessions to be processed concurrently across multiple Lambda scaling instances.

Step-by-Step Solution

1
Enable partial batch response support for SQS in AWS Lambda.
The Lambda event source mapping configuration is updated with `FunctionResponseTypes` set to `ReportBatchItemFailures`.
This allows Lambda to recognize custom responses indicating partial batch success/failure instead of treating the entire batch as a failure.
2
Modify the Lambda function code to catch errors at the individual message level.
The code wraps message processing in a try-catch block. Successfully processed messages are handled, and failed message IDs are collected into a `batchItemFailures` JSON structure.
This prevents a single failed message from throwing an unhandled exception that would fail the entire Lambda execution and force a retry of all 1010 messages.
3
Use the user's session ID as the Message Group ID on SNS FIFO.
Messages are grouped by session ID, ensuring that order is strictly preserved within each user session while enabling independent user sessions to run in parallel.
This avoids head-of-line blocking across different users while maintaining sequential processing of booking events per individual user.

Key Concept

Handling partial batch failures in SQS FIFO queues triggered by AWS Lambda while maintaining per-session message ordering.
Question 326Question →

A developer is designing an IoT home alert system. When a sensor detects an anomaly, it publishes a message to an Amazon SNS topic. An Amazon SQS queue is subscribed to this topic to buffer messages for an AWS Lambda function that processes alerts and notifies users. The Lambda function takes up to 2020 seconds to process a single message and send notifications. Currently, the SQS queue's Visibility Timeout is set to 1515 seconds, and the Lambda function's timeout is set to 3030 seconds. Users are receiving duplicate alert notifications for the same event. Which modification should the developer make to resolve the duplicate notifications?

Show answer & explanation

Answer: Increase the Amazon SQS queue's visibility timeout to 180180 seconds to satisfy the recommendation of being at least 6 times the Lambda function's timeout.

Answer

Increase the Amazon SQS queue's visibility timeout to 180180 seconds to satisfy the recommendation of being at least 6 times the Lambda function's timeout.
Increasing the Amazon SQS queue's visibility timeout to 180180 seconds matches the AWS recommendation of setting the visibility timeout to at least 6 times the Lambda function's timeout (6×306 \times 30 seconds). This prevents duplicate message processing by ensuring the message is not visible to other consumers while the Lambda function is executing or retrying.

Step-by-Step Solution

1
Identify the relationship between the Lambda function timeout and SQS visibility timeout.
The Lambda function timeout is set to 3030 seconds, while the SQS visibility timeout is set to 1515 seconds.
If the Lambda function takes longer than 1515 seconds to process a message (and it can take up to 2020 seconds), the message's visibility timeout will expire, making the message visible again in the queue before processing finishes, leading to duplicate processing.
2
Apply AWS best practices for setting visibility timeout when integrating SQS with Lambda.
AWS recommends setting the SQS visibility timeout to at least 6 times the Lambda function's timeout.
This extra buffer prevents duplicate message processing by ensuring the message remains invisible during Lambda function execution retries.
3
Calculate the required SQS visibility timeout.
Multiplying the Lambda timeout of 3030 seconds by 6 yields 180180 seconds.
An SQS visibility timeout of at least 180180 seconds is required to satisfy the best practices configuration.

Key Concept

Configuring SQS Visibility Timeout for Lambda Event Source Mapping
Question 327Question →

A developer is migrating an Amazon API Gateway REST API from a Lambda custom (non-proxy) integration to a Lambda proxy integration. The API endpoint handles user profile updates and accepts query string parameters. Which TWO changes must the developer make to ensure the backend Lambda function and API Gateway integration function correctly after this migration?

Select all that apply

Show answer & explanation

Answer: Modify the Lambda function's return statement to output a JSON object containing the status code, headers, and body.; Update the Lambda function code to retrieve query parameters from the structured properties under the event object instead of root-level keys.

Answer

The developer must modify the Lambda function's return statement to output a JSON object containing the status code, headers, and body, and update the Lambda function code to retrieve query parameters from the structured properties under the event object instead of root-level keys.
Migrating to a Lambda proxy integration simplifies configuration because API Gateway automatically forwards the raw request and response. The developer must update the Lambda function to return a structured JSON object containing the status code, headers, and body, and retrieve client request parameters from structured paths like event.queryStringParameters instead of root-level keys.

Step-by-Step Solution

1
Determine the output format requirements for Lambda proxy integrations.
Identify that the Lambda function must return a JSON object with statusCode, headers, and body.
Unlike custom integrations where API Gateway handles response mapping, proxy integrations require the backend to construct the raw response.
2
Determine the input format requirements for Lambda proxy integrations.
Understand that the raw request is passed directly as the event object, so query parameters must be accessed via structured keys like event.queryStringParameters.
Proxy integrations bypass input mapping templates, which changes how variables are parsed from the event object.
3
Eliminate configurations that are bypassed or unnecessary in proxy integrations.
Discard options suggesting the setup of API Gateway integration responses, method responses, or redundant custom authorizers.
Proxy integrations delegate response handling to the backend, rendering integration/method response mappings obsolete.

Key Concept

Understanding the difference in input/output payload structures and configuration requirements between API Gateway Lambda Proxy and Custom integrations.
Question 328Question →

A developer is building a product catalog application where items are stored in an Amazon DynamoDB table. The developer wants to retrieve specific product items based on their category while keeping the read latency and consumption of Read Capacity Units (RCUs) as low as possible. Which of the following strategies should the developer implement to achieve this goal? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Use the Query API operation instead of the Scan API operation to retrieve items.; Create a Global Secondary Index (GSI) with the product category as the partition key if it is not the partition key of the base table.

Answer

To optimize DynamoDB operations, the developer should use the Query API operation instead of the Scan API operation, and create a Global Secondary Index (GSI) with the product category as the partition key if it is not the partition key of the base table.
Using the Query operation directly targets the relevant partition and retrieves only the matching items, minimizing RCU usage. Additionally, defining a Global Secondary Index (GSI) with the category as the partition key enables the Query operation even when the category is not the base table's partition key.

Step-by-Step Solution

1
Analyze the retrieval requirements and compare API options.
The Query operation uses the partition key to find items directly, whereas the Scan operation reads the entire table, making Query much more efficient for retrieving specific categories.
Selecting Query over Scan reduces latency and RCU consumption.
2
Evaluate the table structure for the query attribute.
If the product category is not the partition key of the base table, a Scan would normally be required. However, creating a Global Secondary Index (GSI) with the category as the partition key enables Query operations on that attribute.
GSIs allow querying on non-key attributes of the base table, avoiding costly full table scans.

Key Concept

Optimizing DynamoDB reads using Query operations and Secondary Indexes instead of Scans.
Estimated Time:1m 0s
Question 329Question →

A retail platform uses an Amazon SNS topic to publish order transaction events. Two backend applications consume these events via individual Amazon SQS standard queues subscribed to the SNS topic. The first application, the Inventory Service, requires up to 5050 seconds to process a single transaction message. However, the developer notices that the Inventory Service is processing the same messages multiple times. The queue's default Visibility Timeout is set to 3030 seconds. The second application, the High-Value Alert Service, should only process transaction messages where the order total is greater than $1,000\$1,000. Which two configuration changes should the developer implement to resolve these issues? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Set the Visibility Timeout of the Inventory Service's SQS queue to 6060 seconds.; Configure a subscription filter policy on the Amazon SNS subscription for the High-Value Alert Service's queue to filter based on the order total attribute.

Answer

Configure the Inventory Service's SQS queue Visibility Timeout to 6060 seconds, and configure an SNS subscription filter policy on the High-Value Alert Service's queue subscription to filter messages based on the order total.
Setting the visibility timeout to 6060 seconds ensures that the Inventory Service has enough time (up to 5050 seconds) to process and delete the message before it becomes visible to other consumers. Configuring an SNS subscription filter policy ensures that only order events exceeding $1,000\$1,000 are delivered to the High-Value Alert Service's queue.

Step-by-Step Solution

1
Analyze the duplicate processing issue in the Inventory Service.
The message processing takes up to 5050 seconds, but the SQS visibility timeout is only 3030 seconds. This causes the message to become visible to other consumers before processing completes, leading to duplicates.
To prevent duplicates due to processing delays, the queue's Visibility Timeout must be set to a value greater than the maximum expected processing time (6060 seconds).
2
Analyze the message filtering requirement for the High-Value Alert Service.
Only messages with an order total greater than $1,000\$1,000 should be routed to this queue.
SNS subscription filter policies allow filtering at the subscription level before messages are pushed to the SQS queue.

Key Concept

Decoupled architecture message routing and visibility control using SQS Visibility Timeout and SNS Subscription Filter Policies.
Estimated Time:2m 0s
Question 330Question →

A developer is designing a messaging architecture for a smart thermostat application. The application publishes temperature alert messages to an Amazon SNS topic. The developer needs to process these alerts using an AWS Lambda function. The solution must ensure that no alerts are lost if the Lambda function experiences a sudden surge in invocations and is throttled.

Which two configuration steps should the developer perform to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Create an Amazon SQS queue and subscribe the queue to the Amazon SNS topic.; Configure the AWS Lambda function to consume messages from the Amazon SQS queue.

Answer

Create an Amazon SQS queue and subscribe the queue to the Amazon SNS topic, and configure the AWS Lambda function to consume messages from the Amazon SQS queue.
To handle sudden spikes and prevent message loss when Lambda is throttled, the developer should create an Amazon SQS queue and subscribe it to the Amazon SNS topic. Then, the Lambda function should be configured to consume from the SQS queue. This architecture buffers incoming traffic in the queue, allowing Lambda to process them reliably as execution capacity allows.

Step-by-Step Solution

1
Evaluate how to handle message bursts and avoid data loss from consumer throttling.
Determine that placing an Amazon SQS queue between the Amazon SNS topic and the AWS Lambda function allows messages to be safely buffered.
SNS attempts to push messages directly; if Lambda is throttled, messages can be lost. SQS provides durable message buffering.
2
Establish the polling integration between SQS and Lambda.
Configure the Lambda function with an SQS event source mapping.
This sets up the pull-based consumption pattern where Lambda processes messages at a controlled rate without being overwhelmed by SNS spikes.

Key Concept

Decoupling and buffering message processing using the SNS-to-SQS fanout pattern to handle downstream consumer throttling.
Estimated Time:1m 0s
Question 331Question →

A developer is designing a high-throughput REST API using Amazon API Gateway. To minimize latency, operational cost, and code maintenance, the API must place incoming message payloads directly into an Amazon Simple Queue Service (Amazon SQS) queue without utilizing an intermediate AWS Lambda function. Which configuration in API Gateway meets these requirements?

Show answer & explanation

Answer: Configure the API method with an AWS Service integration, select Simple Queue Service (SQS) as the AWS service, set the Action to SendMessage, and configure an IAM execution role with permission to write to SQS.

Answer

Configure the API method with an AWS Service integration, select Simple Queue Service (SQS) as the AWS service, set the Action to SendMessage, and configure an IAM execution role with permission to write to SQS.
The correct answer provides a direct AWS Service integration targeting SQS. Using the AWS Service integration type allows API Gateway to map HTTP requests directly to SQS SendMessage actions, authenticating via an IAM execution role and avoiding the cost, latency, and maintenance of Lambda compute.

Step-by-Step Solution

1
Determine the appropriate integration type for bypassing intermediate compute services.
Select the AWS Service integration type.
This integration type enables API Gateway to interact directly with other AWS service APIs without requiring a Lambda function or an EC2 instance.
2
Configure the integration parameters for the SQS SendMessage operation.
Choose SQS as the AWS Service, set the HTTP method to POST, and specify SendMessage in the Action field.
This instructs API Gateway to map the client's HTTP request details into the format expected by the SQS SendMessage API query parameter or payload.
3
Configure authentication and permission settings for API Gateway.
Create an IAM role with sqs:SendMessage permission for the target queue and associate it as the execution role in the integration request.
API Gateway requires temporary security credentials to call the SQS service securely on behalf of the client.

Key Concept

API Gateway AWS Service integration allows direct communication between API Gateway and AWS services (like SQS, DynamoDB, or Kinesis) without a Lambda execution layer, reducing request latency and runtime execution costs.
Question 332Question →

A developer is designing a mobile fitness application that stores daily step counts in an Amazon DynamoDB table. The table has UserId\text{UserId} as the partition key and ActivityDate\text{ActivityDate} as the sort key. The developer needs to retrieve all step counts for a specific user over the past month.

Which DynamoDB operation should the developer use to retrieve this data in the most efficient manner?

Show answer & explanation

Answer: Use the Query operation with a key condition expression specifying the UserId\text{UserId}.

Answer

Use the Query operation with a key condition expression specifying the UserId.
The Query operation is the most efficient way to retrieve items because it targets only the partition associated with the specified partition key value. In this scenario, specifying the UserId in a key condition expression allows DynamoDB to read only the items for that user, minimizing Read Capacity Unit (RCU) consumption.

Step-by-Step Solution

1
Identify the primary key structure of the DynamoDB table.
The table uses a composite primary key consisting of a partition key (UserId) and a sort key (ActivityDate).
Understanding the key structure is necessary to determine which API operations can perform targeted lookups.
2
Evaluate the query requirement against the key structure.
The application needs to retrieve all records associated with a specific partition key value (UserId) over a range of sort key values (ActivityDate).
This access pattern matches the design of the Query API, which allows fetching all items belonging to a single partition.
3
Compare the efficiency of Query vs Scan operations.
The Query operation accesses only the partition holding the specific UserId, whereas Scan reads the entire table. Therefore, Query is chosen to minimize Read Capacity Unit (RCU) consumption.
Using Query instead of Scan is the standard best practice for retrieving sorted items under a known partition key.

Key Concept

Using the Query operation instead of the Scan operation to retrieve items with a known partition key in Amazon DynamoDB.
Question 333Question →

A developer is building a high-throughput backend microservice that processes sensor telemetry events from an Amazon SQS queue. The microservice is written in Java and runs on Amazon ECS. During performance testing under high load, the developer notices high network latency, CPU spikes on the ECS container, and elevated AWS billing charges due to a large number of empty SQS `ReceiveMessage` API calls. Additionally, the application's polling loop exhausts local ephemeral port resources.

Which two actions should the developer take to optimize the SDK client and reduce cost and resource utilization? (Choose two.)

Select all that apply

Show answer & explanation

Answer: Configure the SQS client as a static or singleton instance within the application to enable HTTP connection pooling and reuse TCP connections.; Set the `WaitTimeSeconds` parameter to 2020 seconds during the `ReceiveMessage` API call to enable long polling.

Answer

The developer should configure the SQS client as a static or singleton instance to enable connection pooling and reuse TCP connections, and set the WaitTimeSeconds parameter to 2020 seconds during ReceiveMessage calls to enable long polling.
Configuring the SQS client as a static or singleton instance ensures that the underlying HTTP client reuses TCP connections via keep-alive, resolving ephemeral port exhaustion. Setting the WaitTimeSeconds parameter to 2020 seconds enables SQS Long Polling, which instructs Amazon SQS to wait until messages are available in the queue before responding, thereby eliminating empty responses, lowering API costs, and reducing container CPU usage.

Step-by-Step Solution

1
Analyze the SDK client initialization lifecycle in the message polling loop.
Reusing a single static/singleton client instance allows the HTTP client to maintain a connection pool, saving TCP/TLS handshake overhead and preventing local ephemeral port exhaustion.
Creating a new client instance per loop iteration spawns new HTTP connection pools, leading to a high rate of socket creation and port exhaustion.
2
Analyze the polling frequency and API call pattern.
Configuring SQS Long Polling by setting WaitTimeSeconds to a value up to 2020 seconds allows the SQS service to wait until a message becomes available before returning a response.
Long polling significantly reduces the number of empty ReceiveMessage responses, reducing API call count, CPU overhead, and SQS processing costs.

Key Concept

Optimizing SQS polling and AWS SDK client lifecycles for high-throughput and cost efficiency.
Question 334Question →

A developer is configuring an AWS Lambda function in AWS Account A (111111111111) that needs to read objects from an Amazon S3 bucket in AWS Account B (222222222222) by assuming an IAM role named CrossAccountS3Reader in Account B. The Lambda function is assigned an execution role in Account A named LambdaExecutionRole. However, when the Lambda function attempts to assume the CrossAccountS3Reader role using AWS STS, the API call fails with an AccessDenied error. Which of the following configurations are required to resolve this issue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In Account A, attach an IAM policy to the LambdaExecutionRole that allows the sts:AssumeRole action on the ARN of the CrossAccountS3Reader role in Account B.; In Account B, update the trust policy of the CrossAccountS3Reader role to allow the ARN of the LambdaExecutionRole from Account A to perform the sts:AssumeRole action.

Answer

In Account A, attach an IAM policy to the LambdaExecutionRole that allows the sts:AssumeRole action on the ARN of the CrossAccountS3Reader role in Account B, and in Account B, update the trust policy of the CrossAccountS3Reader role to allow the ARN of the LambdaExecutionRole from Account A to perform the sts:AssumeRole action.
For cross-account role assumption using AWS STS, two configurations are required: first, the identity-based policy of the caller (the Lambda execution role in Account A) must grant permission to perform sts:AssumeRole on the target role; second, the trust policy of the target role in Account B must trust the caller's role ARN.

Step-by-Step Solution

1
Configure the calling principal's permissions in Account A.
Attached an identity-based IAM policy to the LambdaExecutionRole allowing sts:AssumeRole targeting the ARN of the CrossAccountS3Reader role.
The entity attempting to assume a role must have explicit permission to perform the assume-role operation.
2
Configure the target role's trust relationship in Account B.
Updated the CrossAccountS3Reader role's trust policy to include the LambdaExecutionRole ARN as a trusted principal.
The destination role must trust the specific calling identity from the external account to successfully complete the sts:AssumeRole API call.

Key Concept

Cross-account IAM role delegation using AWS STS
Question 335Question →

A developer is designing a backend report generation system where users can request custom PDF reports. Due to network latency, the client application occasionally retries request submissions, resulting in duplicate messages being sent to the integration queue. The developer wants to ensure that if a request with the exact same payload is sent within a 5-minute window, the duplicate message is discarded and not processed. Which configuration will meet this requirement with the least development effort?

Show answer & explanation

Answer: Create an Amazon SQS FIFO queue and enable content-based deduplication on the queue.

Answer

Create an Amazon SQS FIFO queue and enable content-based deduplication on the queue.
Creating an Amazon SQS FIFO queue and enabling content-based deduplication is the most effective approach. When content-based deduplication is enabled, SQS automatically generates a SHA-256 hash of the message body to serve as the Message Deduplication ID. Any messages with the same body sent within the 5-minute deduplication window are recognized as duplicates and discarded.

Step-by-Step Solution

1
Identify the queue type needed to support message deduplication features natively.
Amazon SQS FIFO queues support message deduplication, whereas standard queues do not guarantee exactly-once delivery or message deduplication.
FIFO queues are required to prevent duplicate messages from being processed within the deduplication window.
2
Determine the mechanism to generate the deduplication ID based on message content.
Enable content-based deduplication on the FIFO queue.
This tells SQS to automatically calculate a SHA-256 hash of the message body to use as the MessageDeduplicationId, removing the need to generate and pass unique IDs from the client.
3
Confirm the deduplication window duration.
SQS FIFO queues enforce a fixed 5-minute (300 seconds) deduplication window.
This natively meets the developer's requirement to ignore duplicates within a 5-minute window without custom application logic.

Key Concept

Amazon SQS FIFO Queue Content-Based Deduplication
Question 336Question →

A company is refactoring its web API backend. A developer configures an Amazon API Gateway REST API to use a Lambda proxy integration with an existing AWS Lambda function. During testing, clients receive 502 Bad Gateway errors. The CloudWatch logs show that the Lambda function completed its execution successfully without errors and returned the computed payload. Which action should the developer take to resolve the integration error?

Show answer & explanation

Answer: Change the Lambda handler to return an object containing `statusCode` as an integer, `headers` as a map, and the serialized payload as a string under the `body` key.

Answer

The correct action is to change the Lambda handler to return an object containing `statusCode` as an integer, `headers` as a map, and the serialized payload as a string under the `body` key.
The correct action is to change the Lambda handler to return an object containing `statusCode` as an integer, `headers` as a map, and the serialized payload as a string under the `body` key. In an API Gateway Lambda proxy integration, the backend Lambda function is entirely responsible for defining the HTTP response structure, which requires these specific fields.

Step-by-Step Solution

1
Analyze the error context: a successful Lambda execution with a successful return payload, but a 502 Bad Gateway error at the API Gateway level.
The 502 Bad Gateway error indicates that API Gateway was unable to process the response from the backend Lambda function.
When using Lambda proxy integration, API Gateway enforces a strict response format contract on the backend integration.
2
Identify the response format requirements for Lambda proxy integration.
The Lambda function must return a JSON object with specific keys: `statusCode` (number), `headers` (object), and `body` (string).
Without these keys, API Gateway cannot map the backend response to a proper HTTP response for the client.
3
Determine the required changes to the Lambda function handler code.
The developer must wrap the raw payload by converting it to a string using JSON serialization and assigning it to the `body` key of the returned object.
This matches the expected proxy integration response schema, allowing API Gateway to parse the payload and return it to the client with the designated status code.

Key Concept

API Gateway Lambda Proxy Integration Response Format
Question 337Question →

A developer is building a web application that allows users to upload videos. When a video is uploaded, two separate tasks must run in parallel: one to generate a video thumbnail and another to extract metadata. The developer wants to decouple these tasks using a message-based architecture.

Which two actions should the developer take to implement this architecture? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Publish the video upload event to an Amazon SNS topic.; Subscribe two separate Amazon SQS queues to the SNS topic, and configure each service to poll its own queue.

Answer

To implement the required decoupled architecture, the developer should publish the video upload events to an Amazon SNS topic, and subscribe two separate Amazon SQS queues (one for the thumbnail service and one for the metadata service) to that topic.
To send a single event to multiple independent backend services simultaneously, the fan-out pattern is used. Publishing the event to an Amazon SNS topic allows it to be broadcast to multiple subscribers. Subscribing two separate Amazon SQS queues to the SNS topic ensures that both the thumbnail service and the metadata service receive their own copy of the message, decoupling the services and allowing them to process the event in parallel without message loss or competition.

Step-by-Step Solution

1
Publish the upload event to an Amazon SNS topic.
The event is broadcast to all active topic subscribers.
SNS acts as the publisher in the fan-out pattern, sending a single message to multiple endpoints simultaneously.
2
Subscribe two separate SQS queues to the SNS topic.
Each queue receives its own identical copy of the upload event message.
By having a dedicated queue per consuming service, the services are decoupled and do not compete for the same messages.

Key Concept

SNS-to-SQS Fan-out Pattern
Estimated Time:1m 0s
Question 338Question →

A developer is implementing a desktop gaming client that needs to authenticate users and allow them to upload gameplay screenshots directly to a private Amazon S3 bucket. The application must also communicate with a backend API hosted on Amazon API Gateway, where endpoints should only be accessible to authenticated users.

Which TWO actions must the developer take to implement this authentication and authorization design? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool to handle user registration and authentication, and use the Cognito Authorizer on the API Gateway endpoints.; Configure an Amazon Cognito Identity Pool using the User Pool as an identity provider to obtain temporary AWS credentials for S3 uploads.

Answer

To implement this architecture, configure an Amazon Cognito User Pool to handle user registration and authentication, and use the Cognito Authorizer on the API Gateway endpoints. Additionally, configure an Amazon Cognito Identity Pool using the User Pool as an identity provider to obtain temporary AWS credentials for S3 uploads.
To secure the backend API endpoints, the developer should configure an Amazon Cognito User Pool for user authentication and use the built-in API Gateway Cognito Authorizer, which natively validates JWTs without custom backend code. To enable direct uploads to Amazon S3 without exposing long-term credentials, the developer must configure an Amazon Cognito Identity Pool using the User Pool as an identity provider, which issues temporary AWS credentials with appropriate IAM permissions.

Step-by-Step Solution

1
Set up a Cognito User Pool to manage authentication.
Users can sign up, log in, and receive standard JSON Web Tokens (JWTs) representing their identity.
A User Pool acts as the primary identity provider for the application.
2
Integrate the User Pool with API Gateway.
API Gateway uses the Cognito User Pool Authorizer to inspect the Authorization header and validate the JWTs.
This secures the API endpoints with minimal operational overhead and zero custom code.
3
Set up a Cognito Identity Pool and link it to the User Pool.
The desktop client can exchange User Pool JWTs for temporary, short-lived AWS credentials via IAM roles defined in the Identity Pool.
This allows the client application to upload files directly to S3 securely without hardcoding long-term credentials.

Key Concept

Integration of Amazon Cognito User Pools for authentication and Identity Pools (Federated Identities) for authorizing access to AWS resources like S3.
Question 339Question →

A retail e-commerce company uses an Amazon DynamoDB table to store product inventory details. During a flash sale event, the product detail page experiences a huge spike in read traffic, resulting in `ProvisionedThroughputExceededException` errors on the DynamoDB table. To resolve this and reduce read latency, a developer deploys an Amazon DynamoDB Accelerator (DAX) cluster. However, despite deploying the DAX cluster, the table continues to experience throttling and read latency remains high. Analysis reveals that the DAX cache hit rate is 0%0\%.

Which two actions should the developer take to ensure the application successfully uses the DAX cache and resolves the throttling? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure the application to use the DAX client SDK and point it to the DAX cluster endpoint instead of the standard DynamoDB endpoint.; Ensure the application performs eventually consistent read requests rather than strongly consistent read requests.

Answer

To resolve the issue, the developer must configure the application to use the DAX client SDK pointing to the DAX cluster endpoint, and ensure that read requests are eventually consistent rather than strongly consistent.
The correct options state that the application should be configured to use the DAX client SDK pointed to the DAX cluster endpoint and perform eventually consistent read requests. Because DAX operates as a write-through cache, applications must actively direct their API calls to the DAX cluster endpoint using the API-compatible DAX SDK. Additionally, DAX only caches eventually consistent reads. Strongly consistent reads are always passed through to the DynamoDB table directly, which continues to consume table RCUs and leads to throttling if not changed.

Step-by-Step Solution

1
Redirect traffic to the cache.
The application sends API calls to the DAX cluster endpoint using the DAX SDK client instead of querying the DynamoDB endpoint directly.
If the application continues to call the standard DynamoDB endpoint, the caching layer is bypassed entirely.
2
Review the consistency model of the read requests.
The application's queries are updated to use eventual consistency instead of strong consistency.
Strongly consistent reads bypass the DAX cache and are forwarded to the underlying DynamoDB table, causing continued resource consumption and throttling.

Key Concept

DAX endpoint configuration and consistency caching rules
Question 340Question →

A developer is deploying a Java application on Amazon EC2 instances in AWS account `123456789012`. The application requires access to retrieve database credentials from AWS Systems Manager Parameter Store. The developer creates an IAM role named `SSMParameterReaderRole` and attaches a permissions policy that allows the `ssm:GetParameter` action. The developer then configures an Amazon EC2 Instance Profile to associate the EC2 instances with this role. During startup, the application fails to retrieve the parameters, and CloudTrail logs show that the EC2 service was unable to assume the role.

The trust policy currently attached to `SSMParameterReaderRole` is as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
},
"Action": "sts:AssumeRole"
}
]
}

Which modification must the developer make to the trust policy of `SSMParameterReaderRole` to resolve this issue?

Show answer & explanation

Answer: Update the trust policy's Principal block to specify the EC2 service principal (`"Service": "ec2.amazonaws.com"`) instead of the AWS account root principal.

Answer

Update the trust policy's Principal block to specify the EC2 service principal (`"Service": "ec2.amazonaws.com"`) instead of the AWS account root principal.
The correct answer is to update the trust policy's Principal block to specify the EC2 service principal. When an application runs on an EC2 instance and uses an instance profile, the EC2 service must assume the associated IAM role on behalf of the instance. Therefore, the IAM role's trust policy must trust the service principal `ec2.amazonaws.com` rather than the AWS account root principal, which only allows IAM identities within the account to assume the role via direct STS calls.

Step-by-Step Solution

1
Analyze the CloudTrail error indicating that the Amazon EC2 service is unable to assume the IAM role.
Identified that the issue is with the trust relationship of the IAM role, which defines which principals are allowed to assume it.
To allow a service like EC2 to assume a role, the trust policy must explicitly grant permission to that service principal.
2
Examine the current trust policy of the IAM role.
Observed that the Principal is set to the AWS account root (`arn:aws:iam::123456789012:root`) rather than the service principal.
The current configuration only allows IAM users or roles within the account to assume this role via STS, not the EC2 service itself.
3
Update the Principal field in the trust policy to specify the EC2 service principal.
The Principal is modified to `"Service": "ec2.amazonaws.com"`.
This allows the EC2 service to successfully perform `sts:AssumeRole` on behalf of the instance, enabling the application to access AWS resources using the instance profile.

Key Concept

IAM Role Trust Policy vs Permissions Policy
Estimated Time:1m 30s
PreviousPage 17 / 78Next
All practice questions — AWS Certified Developer - Associate | Examkin