All practice questions

1542 questions

Question 341Question

A developer is implementing a REST API using Amazon API Gateway that integrates with a backend AWS Lambda function. The API needs to support search queries where clients can send arbitrary query string parameters and custom headers. The developer wants to ensure that any new query parameters or headers sent by the client are immediately available to the backend Lambda function without requiring modifications to the API Gateway integration or mapping templates.

Which configuration should the developer use to meet these requirements?

Show answer & explanation

Answer: Configure a Lambda proxy integration for the API method.

Answer

Configure a Lambda proxy integration for the API method.
Configuring a Lambda proxy integration is the correct solution. In a proxy integration, API Gateway automatically passes the entire HTTP request—including all headers, query string parameters, path parameters, and request body—directly to the backend Lambda function as a single JSON object (the event parameter). This eliminates the need to configure mapping templates or explicitly declare allowed parameters in API Gateway, meaning any new headers or query parameters sent by the client are immediately visible to the Lambda function without modifying the API configuration.

Step-by-Step Solution

1
Analyze the requirement to dynamically forward client-supplied query parameters and headers without maintaining mapping configuration in API Gateway.
Identify that the system must forward the raw incoming HTTP request context directly to the backend.
This establishes that any manual mapping (which is required by custom integrations) will not meet the requirement of zero maintenance when parameters change.
2
Evaluate API Gateway integration types for Lambda backends.
Lambda proxy integration automatically wraps the raw request in a standardized JSON payload and forwards it directly to Lambda. Lambda custom integration requires VTL templates for mapping.
This shows that proxy integration is the designed solution for passing headers, parameters, and body directly to the Lambda execution context.
3
Assess the impact of security and auxiliary features like Lambda Authorizers and CORS.
Authorizers are verified as security mechanisms, and CORS is identified as a client-side access control configuration, neither of which routes request parameters.
This eliminates options that misuse security features for data passing purposes.

Key Concept

Using Amazon API Gateway Lambda Proxy Integration to dynamically pass incoming headers and query string parameters directly to the backend function without mapping templates.
Estimated Time:1m 30s
Question 342Question

A logistics company operates an IoT fleet monitoring dashboard. Telemetry data from devices is continuously written to an Amazon DynamoDB table. The table's partition key is `device_type` (which has three distinct values) and its sort key is `timestamp`. During peak periods, the application receives a high volume of writes and experiences `ProvisionedThroughputExceededException` errors. To resolve this, a developer deploys an Amazon DynamoDB Accelerator (DAX) cluster in front of the table and updates the application to write through the DAX client. However, the write throttling errors persist. Which of the following explains why the write throttling continues and provides the correct resolution?

Show answer & explanation

Answer: DAX is a write-through cache and does not shield the DynamoDB table from write throttling. The developer must redesign the table schema to use a high-cardinality partition key like `device_id`.

Answer

DAX is a write-through cache and does not shield the DynamoDB table from write throttling. The developer must redesign the table schema to use a high-cardinality partition key like `device_id` to distribute writes evenly across partitions.
The correct choice explains that Amazon DynamoDB Accelerator (DAX) is a write-through cache, meaning write requests are forwarded directly to the backend DynamoDB table. Deploying DAX does not prevent write throttling on the underlying database. The write throttling is caused by a hot partition key because the partition key (`device_type`) has low cardinality (only three values). Changing the partition key to a high-cardinality attribute like `device_id` ensures that writes are distributed across multiple partitions.

Step-by-Step Solution

1
Identify the operation type experiencing throttling.
The application is experiencing `ProvisionedThroughputExceededException` specifically during write operations.
Understanding whether read or write capacity is exhausted helps narrow down the effectiveness of DAX, which behaves differently for reads versus writes.
2
Analyze the architecture of DAX and its write behavior.
DAX is a write-through cache. Writes are written to DAX and synchronously written to the DynamoDB table.
This confirms that deploying DAX does not shield DynamoDB from write throttling.
3
Evaluate the table's partition key design.
The partition key `device_type` has low cardinality (only 3 unique values), leading to all write traffic targeting a few partitions.
A low-cardinality partition key causes a hot partition issue. Redesigning the schema to use a high-cardinality key like `device_id` resolves the write throttling.

Key Concept

Amazon DynamoDB Accelerator (DAX) is a write-through cache, meaning write requests are forwarded directly to the backend DynamoDB table. It does not queue or buffer write operations to protect DynamoDB from write capacity exhaustion or hot partitions. Redesigning the schema with a high-cardinality partition key is necessary to address write hot partitions.
Question 343Question

An e-commerce application has a backend worker service running on Amazon EC2 instances that processes order fulfillment messages from an Amazon SQS standard queue. Each order takes approximately 25 seconds to process and complete. However, during testing, the developer observes that multiple EC2 instances are processing the same order message simultaneously. Which action should the developer take to resolve this duplication issue?

Show answer & explanation

Answer: Increase the Visibility Timeout of the Amazon SQS queue to a value greater than 25 seconds.

Answer

Increase the Visibility Timeout of the Amazon SQS queue to a value greater than 25 seconds.
Increasing the visibility timeout of the SQS queue beyond the processing time of 25 seconds prevents other worker instances from seeing and consuming the message while it is being actively processed. Once the worker finishes processing, it deletes the message, preventing duplicate processing altogether.

Step-by-Step Solution

1
Analyze the cause of duplicate processing in SQS queues.
Duplicate processing occurs when a message's visibility timeout is shorter than the time it takes a consumer to process the message. The message becomes visible again in the queue before the first consumer can delete it.
Understanding the interaction between processing duration and visibility timeout is key to preventing redundant consumer operations.
2
Identify the message processing duration.
The scenario states that processing an order message takes approximately 25 seconds.
This establishes the minimum threshold for the visibility timeout duration.
3
Compare the processing duration with the SQS queue configurations.
Setting the visibility timeout to a value greater than 25 seconds ensures that the message remains invisible to other consumers until processing completes.
This allows the active consumer enough time to process and call DeleteMessage before any other consumer can retrieve it.

Key Concept

Amazon SQS Visibility Timeout

Alternative Method

The worker application can dynamically extend the visibility timeout of a specific message by calling the ChangeMessageVisibility API action if it detects that processing is taking longer than expected.
Estimated Time:1m 0s
Question 344Question

A smart grid monitoring application named 'GridMonitor' collects electricity usage data from regional smart meters. The application writes these metrics directly to an Amazon DynamoDB table configured with provisioned write capacity. During daily peak hours, the application occasionally receives ProvisionedThroughputExceededException errors, leading to immediate transaction failures. A review of Amazon CloudWatch metrics shows that the overall write throughput is well below the provisioned capacity limit, but the application's SDK client configuration has retries disabled. Which action should the developer take to resolve these transient write errors in the most cost-effective manner?

Show answer & explanation

Answer: Configure the SDK client to use exponential backoff and jitter for retries.

Answer

Configure the SDK client to use exponential backoff and jitter for retries.
Implementing exponential backoff and jitter in the SDK client allows the application to automatically retry failed requests after progressively longer intervals with randomized variation (jitter). This spreads out the retries to avoid overwhelming the database during transient spikes in traffic, making it the most cost-effective solution as it does not require provisioning extra database capacity or changing the architecture.

Step-by-Step Solution

1
Analyze the error metrics and application configuration.
Identify that the ProvisionedThroughputExceededException is occurring despite the table's total throughput being sufficient, indicating transient spikes, and that the SDK has retries disabled.
To pinpoint whether the issue requires scaling the table or modifying client-side retry behaviors.
2
Select a retry strategy that spreads requests over time.
Configure the SDK client with exponential backoff and jitter.
Exponential backoff increases wait times between consecutive retries, while jitter introduces randomness to prevent retry collisions from multiple client instances.
3
Deploy the updated application configuration and verify the error rate.
Transient spikes are handled gracefully by SDK retries, eliminating immediate write failures without increasing DynamoDB capacity costs.
To confirm that the solution handles the micro-bursts of traffic effectively.

Key Concept

Configuring SDK client retry policy with exponential backoff and jitter to mitigate transient DynamoDB throttling exceptions.
Question 345Question

A developer is creating a high-performance REST API using Amazon API Gateway that must write incoming JSON payloads directly into an Amazon DynamoDB table. To minimize latency and operational costs, the developer decides to use an AWS service integration instead of invoking an intermediate AWS Lambda function. Which two configurations are required to successfully set up this direct integration? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure an integration request of type AWS Service, targeting DynamoDB and specifying the PutItem action, and assign an IAM role that allows API Gateway to perform the PutItem operation.; Create an integration request mapping template for the application/json content type to transform the incoming JSON payload into the format required by the DynamoDB PutItem API.

Answer

To set up a direct API Gateway integration with DynamoDB, the developer must configure an integration request of type AWS Service targeting DynamoDB with the PutItem action and an API Gateway execution role, and create an integration request mapping template for application/json to format the payload.
To connect API Gateway directly to DynamoDB without an intermediate Lambda function, an AWS Service integration must be configured. This requires specifying the target service, action (PutItem), and an IAM execution role that allows API Gateway to write to the table. Additionally, because DynamoDB expects a specific JSON format containing attribute types (e.g., specifying string values with 'S'), an integration request mapping template is required to transform the incoming client JSON payload into the DynamoDB PutItem format.

Step-by-Step Solution

1
Determine the integration type and backend settings.
Choose AWS Service integration, select DynamoDB, set the action as PutItem, and specify an IAM execution role.
This establishes direct API-to-service connectivity and provides permissions for API Gateway to invoke the DynamoDB endpoint.
2
Configure the trust policy for the API Gateway execution role.
Ensure the IAM role trusts the API Gateway service principal (apigateway.amazonaws.com).
API Gateway needs trust permissions to assume the execution role and perform operations on DynamoDB.
3
Define request mapping to format input JSON into DynamoDB JSON format.
Create an integration request mapping template mapping client properties into the DynamoDB PutItem structure.
DynamoDB does not accept arbitrary JSON payloads; it requires typed fields (such as S or N) to represent data attributes.

Key Concept

API Gateway Direct AWS Service Integration with DynamoDB
Question 346Question

An organization is refactoring its order fulfillment system. The system publishes order transaction events to an Amazon SNS standard topic, which fans them out to two Amazon SQS standard queues. The first SQS queue is consumed by a processing application that processes messages in batches; each batch takes up to 8 minutes to complete database writes. During peak traffic, the database shows duplicate entries for the same order because messages are being reprocessed before the first run completes. The second SQS queue is polled by an analytics application that queries the queue continuously, resulting in high API call counts and elevated costs even when no messages are present. Which two changes should the developer implement to resolve the duplicate processing issue and optimize the polling efficiency for the analytics queue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Increase the VisibilityTimeout attribute of the first SQS queue to 9 minutes, ensuring it exceeds the maximum database write time.; Configure the analytics application to use SQS long polling by setting the ReceiveMessageWaitTimeSeconds attribute of the second SQS queue to 20 seconds.

Answer

To resolve the issues, increase the VisibilityTimeout of the first SQS queue to 9 minutes to cover the 8-minute processing time, and configure long polling on the second SQS queue by setting ReceiveMessageWaitTimeSeconds to 20 seconds.
To prevent duplicate processing, the visibility timeout of the SQS queue must be set higher than the maximum processing time of 8 minutes, making the configuration of 9 minutes correct. To optimize costs and reduce empty API calls on the polling consumer, long polling must be configured by setting ReceiveMessageWaitTimeSeconds to a value up to 20 seconds.

Step-by-Step Solution

1
Analyze the cause of duplicate entries in the first queue.
The processing application takes up to 8 minutes to complete a batch, but if the visibility timeout is shorter than 8 minutes, messages become visible again to other instances before deletion, causing duplicate processing.
The visibility timeout must be set to a value greater than the maximum expected processing time.
2
Select the appropriate visibility timeout configuration.
Increase the VisibilityTimeout of the first SQS queue to 9 minutes.
This guarantees that the processing application has sufficient time to complete its database writes and delete the messages from the queue before they can be re-driven.
3
Analyze the high API call counts and costs for the second queue.
Continuous short polling returns empty responses immediately, which increases API call charges and CPU utilization.
Long polling must be enabled to allow SQS to wait for messages to arrive before returning a response.
4
Select the long polling configuration.
Set the ReceiveMessageWaitTimeSeconds attribute of the second SQS queue to 20 seconds.
Setting the value to 20 seconds maximizes long polling efficiency, reducing empty receives and associated costs.

Key Concept

Configuring SQS Visibility Timeout to match processing times and using SQS Long Polling to minimize API cost and overhead.
Question 347Question

A developer is deploying a containerized application to Amazon ECS using AWS Fargate. The application needs to perform read and write operations on an Amazon DynamoDB table. Additionally, the ECS agent must pull the container image from a private Amazon ECR repository and send container startup logs to Amazon CloudWatch Logs.

To satisfy these security requirements using the principle of least privilege, how should the developer configure the IAM roles?

Show answer & explanation

Answer: Define an ECS Task Role with a permissions policy allowing DynamoDB actions and assign it to the task definition. Define an ECS Task Execution Role with a permissions policy allowing ECR and CloudWatch logs actions, and assign it as the execution role in the task definition.

Answer

Define an ECS Task Role with a permissions policy allowing DynamoDB actions and assign it to the task definition. Define an ECS Task Execution Role with a permissions policy allowing ECR and CloudWatch logs actions, and assign it as the execution role in the task definition.
The correct configuration uses two distinct roles to enforce the principle of least privilege. The ECS Task Role is designated for credentials needed by the application itself running inside the container (e.g., calling DynamoDB APIs). The ECS Task Execution Role is designated for actions performed by the Amazon ECS container agent (e.g., pulling the Docker image from Amazon ECR and sending container logs to Amazon CloudWatch). Specifying both correctly in the task definition allows the containerized workload to execute securely.

Step-by-Step Solution

1
Analyze the container application permissions needs.
The application inside the container makes API requests to write and read from DynamoDB.
These application-level permissions must be mapped to the ECS Task Role.
2
Analyze the infrastructure and agent permissions needs.
The ECS Fargate agent needs to pull images from ECR and write system/startup logs to CloudWatch.
These agent-level infrastructure permissions must be mapped to the ECS Task Execution Role.
3
Map roles to the ECS task definition parameters.
Assign the DynamoDB role to taskRoleArn, and the ECR/CloudWatch role to executionRoleArn.
This separation follows AWS security best practices for container permissions.

Key Concept

ECS Task Role vs ECS Task Execution Role separation of duties
Question 348Question

A developer is writing a background worker application that processes messages from an Amazon SQS queue. Each message takes exactly 45 seconds to process. The SQS queue has a default visibility timeout of 30 seconds. Currently, the worker successfully processes the messages, but the same messages keep appearing back in the queue and are processed multiple times, causing duplicate records. Which of the following actions should the developer take to resolve this issue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Increase the visibility timeout of the Amazon SQS queue to a value greater than 45 seconds.; Ensure the worker application calls the SQS DeleteMessage API operation after the message is successfully processed.

Answer

To resolve the issue, the developer must increase the SQS queue's visibility timeout to a value greater than 45 seconds (the processing time) and configure the worker to explicitly call the DeleteMessage API after successful processing.
The correct actions are to increase the visibility timeout of the SQS queue to a value greater than the processing time of 45 seconds, and to ensure that the worker application explicitly calls the DeleteMessage API operation after processing. SQS messages are only hidden temporarily during the visibility timeout; if the processing time exceeds this timeout, or if the message is never deleted, the message will become visible again to other consumers, resulting in duplicate processing.

Step-by-Step Solution

1
Identify the relationship between the message processing time and the SQS visibility timeout.
The processing time (45 seconds) exceeds the visibility timeout (30 seconds), causing the message to become visible to other workers while still being processed.
To prevent premature reprocessing, the SQS visibility timeout must be set to a value greater than the maximum expected processing time.
2
Ensure the worker application cleans up successfully processed messages.
The worker application must explicitly delete the message from the queue after processing is complete.
SQS does not automatically delete messages upon retrieval; they must be removed via the DeleteMessage API to prevent them from becoming visible again.

Key Concept

Amazon SQS message visibility timeout and explicit deletion
Question 349Question

A developer is designing a real-time multiplayer gaming application where match event messages must be processed by different backend microservices. The match events must be processed in the exact order they occur per match, and duplicate messages must be avoided. The developer publishes the events to an Amazon SNS FIFO topic, which fans out to multiple Amazon SQS FIFO queues subscribed to the topic. During testing, the developer observes that the player achievements service, which runs on AWS Lambda and takes up to 4545 seconds to process certain messages, occasionally receives and processes duplicate match events. The SQS FIFO queue's visibility timeout is currently configured to 3030 seconds. Which modification should the developer make to resolve this issue?

Show answer & explanation

Answer: Increase the visibility timeout of the Amazon SQS FIFO queue to 60 seconds to ensure it exceeds the maximum processing time of the Lambda function.

Answer

Increase the visibility timeout of the Amazon SQS FIFO queue to 60 seconds to ensure it exceeds the maximum processing time of the Lambda function.
Increasing the SQS visibility timeout to 60 seconds is the correct solution. Since the Lambda function takes up to 45 seconds to process a message, a 30-second visibility timeout results in the message returning to the queue before the processing is complete. A 60-second visibility window ensures the message is successfully deleted from the queue before it becomes visible again.

Step-by-Step Solution

1
Analyze the relationship between the consumer processing duration and the SQS visibility timeout.
The Lambda function takes up to 4545 seconds to process messages, but the SQS visibility timeout is only 3030 seconds.
If the processing time exceeds the visibility timeout, SQS assumes the consumer failed and makes the message visible to other pollers, resulting in duplicate processing.
2
Identify the target visibility timeout configuration.
The visibility timeout must be set to a value greater than the maximum expected processing time (e.g., 6060 seconds).
This guarantees that the message remains hidden until the current Lambda execution completes and deletes the message from the queue.
3
Evaluate the architectural constraints of FIFO queues.
FIFO ordering is maintained, and duplicate processing is prevented by aligning the visibility timeout with the worker runtime.
Unlike standard queues, FIFO queues guarantee exactly-once processing and strict ordering, which would be compromised if converted to standard queues.

Key Concept

SQS Visibility Timeout vs. Consumer Processing Time
Question 350Question

A developer has configured an Amazon API Gateway REST API with a Lambda Proxy Integration. A client application sends an HTTP POST request containing a JSON body with the following structure:

{
"email": "[email protected]",
"name": "John Doe"
}

In the Lambda function code, the developer attempts to retrieve the email using the following code:

javascript
const email = event.email;

However, the function execution logs show that the `email` variable is `undefined`. How should the developer modify the Lambda function code to correctly retrieve the email address?

Show answer & explanation

Answer: Parse the body of the event as a JSON object, then access the email property (for example: `const email = JSON.parse(event.body).email;`).

Answer

Parse the body of the event as a JSON object, then access the email property (for example: `const email = JSON.parse(event.body).email;`).
Under API Gateway Lambda Proxy Integration, the request body is not automatically parsed by API Gateway. Instead, the raw string representation of the request payload is passed to the Lambda function in the `body` property of the `event` object. To access properties such as the email address, the developer must first deserialize the JSON string using a method like `JSON.parse(event.body)` before accessing the specific field.

Step-by-Step Solution

1
Identify the API Gateway integration type being used.
The scenario specifies Lambda Proxy Integration.
Different integration types pass request data to the Lambda function in different formats.
2
Determine where the HTTP request body is located in the Lambda event object for Lambda Proxy Integration.
The HTTP body is passed as a stringified JSON payload in the `event.body` property.
API Gateway does not automatically parse the JSON body of a request into the root of the event object.
3
Parse the stringified body and access the target property.
Using `JSON.parse(event.body).email` correctly retrieves the value of the email key.
This deserializes the JSON string into an object so that its fields can be accessed programmatically.

Key Concept

API Gateway Lambda Proxy Integration payload format
Estimated Time:1m 30s
Question 351Question

A developer is designing an event-driven transaction ingestion pipeline for a financial application. When a customer performs a transaction, the event must be published to Amazon SNS and consumed by two downstream applications:

1. An auditing service that requires transaction events to be processed in the exact order they occurred per customer.
2. A reconciliation service that does not require ordered processing but must ensure that no duplicate events are processed.

Which combination of actions should the developer perform to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an Amazon SNS FIFO topic and subscribe two Amazon SQS FIFO queues to the topic, one for each backend service.; Publish messages to the SNS FIFO topic by specifying a consistent MessageGroupId based on the customer identifier and providing a unique MessageDeduplicationId for each transaction.

Answer

To configure the integration, create an Amazon SNS FIFO topic and subscribe two Amazon SQS FIFO queues to it. Then, publish messages to the SNS FIFO topic using a consistent MessageGroupId based on the customer identifier and providing a unique MessageDeduplicationId for each transaction.
To achieve transaction ordering per customer and prevent duplicates across two separate downstream consumers, the architecture must utilize an Amazon SNS FIFO topic fanning out to two separate Amazon SQS FIFO queues. SNS FIFO topics only allow SQS FIFO queues as subscribers. Messages published to the SNS FIFO topic must include a consistent MessageGroupId (such as the customer ID) to guarantee ordered delivery for each customer group, and a MessageDeduplicationId to ensure transaction-level deduplication.

Step-by-Step Solution

1
Identify downstream ordering and deduplication needs.
The application requires message ordering for one service and deduplication for both.
Standard queues and topics do not guarantee ordering or single-delivery, meaning FIFO resources must be selected.
2
Determine subscriber compatibility rules for Amazon SNS FIFO.
An Amazon SNS FIFO topic must be paired with SQS FIFO queues as subscribers.
SNS FIFO topics do not support standard SQS queues, requiring both services to use SQS FIFO queues regardless of whether they require ordering.
3
Define message parameters for publisher clients.
Set a consistent MessageGroupId based on the customer ID and provide a unique MessageDeduplicationId.
The MessageGroupId routes messages to the same message group to maintain ordering, while the MessageDeduplicationId ensures transactions are not processed multiple times.

Key Concept

Amazon SNS FIFO to Amazon SQS FIFO Fanout Integration
Question 352Question

A multiplayer gaming application named 'QuestRealm' stores active player matchmaking lobby states in an Amazon DynamoDB table. The backend application uses the AWS SDK to write frequent updates. During peak event periods, the backend application logs show a high volume of `ProvisionedThroughputExceededException` errors, leading to lobby disconnections. A review of Amazon CloudWatch metrics indicates that the write requests are evenly distributed across all partitions, but transient traffic bursts occasionally exceed the provisioned write capacity for fractions of a second. Which action should the developer take to resolve these errors and prevent lobby disconnections?

Show answer & explanation

Answer: Configure the AWS SDK client to use exponential backoff and jitter for retrying throttled request errors.

Answer

Configure the AWS SDK client to use exponential backoff and jitter for retrying throttled request errors.
Since write requests are evenly distributed across partitions and throttling is caused by short-lived, transient spikes in traffic that occasionally exceed the provisioned capacity, implementing retry logic with exponential backoff and jitter on the client side is the best solution. The AWS SDKs default to standard retries, but configuring customized backoff and jitter helps smooth out the retry rate, avoiding additional throttling and allowing requests to succeed when the transient capacity burst subsides.

Step-by-Step Solution

1
Analyze the CloudWatch metrics and application logs to identify the error pattern.
Confirm that writes are evenly distributed (eliminating hot key/partition issues) but experience brief, transient spikes exceeding the provisioned capacity limit, causing ProvisionedThroughputExceededException.
Understanding the nature of the throttling helps differentiate between schema issues (e.g., hot partitions) and simple transient burst capacity issues.
2
Determine the appropriate mitigation strategy for transient write capacity throttling.
Select exponential backoff with jitter on the client SDK retries, which spaces out retry attempts to handle brief spikes without dropping requests or overloading the database.
For transient spikes, retrying with backoff allows the client to wait out the brief capacity deficit, while jitter prevents collision of simultaneous retries.
3
Configure the AWS SDK client settings in the backend application code.
The application now handles transient exceptions gracefully by retrying automatically with randomized delays, resolving the lobby disconnection issues.
Proper SDK client configuration ensures the application handles database-level transient errors robustly without requiring manual capacity intervention.

Key Concept

Handling transient DynamoDB write throttling with SDK retries, exponential backoff, and jitter.
Estimated Time:1m 30s
Question 353Question

A developer is implementing a food delivery platform where courier dispatch updates are processed using an Amazon SQS standard queue. An AWS Lambda function is configured to consume messages from the queue with a batch size of 1010 messages and a function timeout of 1515 seconds. During peak loads, some courier assignments are processed multiple times by different Lambda execution environments, even though the Lambda function executes successfully and returns within 1212 seconds. Which of the following configuration changes will resolve this issue?

Show answer & explanation

Answer: Increase the SQS queue's visibility timeout to at least 9090 seconds.

Answer

Increase the Amazon SQS queue's visibility timeout to at least 9090 seconds.
The correct answer is to increase the SQS queue's visibility timeout to at least 9090 seconds. AWS recommends setting the visibility timeout of a source SQS queue to at least 66 times the timeout of the consuming Lambda function. With a 1515-second Lambda timeout, the SQS visibility timeout must be set to at least 9090 seconds (15 seconds×615 \text{ seconds} \times 6) to allow sufficient time for processing and retries without messages becoming visible to other instances.

Step-by-Step Solution

1
Identify the cause of duplicate processing under peak load.
The Lambda function timeout is 1515 seconds. If the default SQS visibility timeout (3030 seconds) is too low relative to peak processing and retries, other Lambda workers pull the same messages before the current invocation deletes them.
This occurs because SQS makes the message visible again once the visibility timeout expires.
2
Apply the AWS recommended best practice formula for SQS-to-Lambda integration.
The visibility timeout of the source SQS queue should be set to at least 66 times the timeout of the consumer Lambda function (15 seconds×6=90 seconds15 \text{ seconds} \times 6 = 90 \text{ seconds}).
This buffer prevents other consumers from receiving and processing messages while the current Lambda execution handles the batch and potential transient errors.

Key Concept

Amazon SQS Visibility Timeout for Lambda Event Sources
Question 354Question

A developer is managing a logistics tracking application that stores package delivery status in an Amazon DynamoDB table. The table's partition key is PackageIdPackageId and the sort key is CheckpointTimestampCheckpointTimestamp. A background worker periodically retrieves all packages currently marked with a status of In-Transit-DelayedIn\text{-}Transit\text{-}Delayed to generate a real-time dashboard. Currently, the worker performs a ScanScan operation on the table and uses a FilterExpressionFilterExpression to filter by status. As the table has grown to millions of items, the worker is consistently exceeding the table's provisioned read capacity, resulting in ProvisionedThroughputExceededExceptionProvisionedThroughputExceededException errors. Which two changes should the developer make to resolve the throttling issues and optimize the read performance?

Select all that apply

Show answer & explanation

Answer: Create a Global Secondary Index (GSI) with a sparse partition key attribute that is only populated when the package status is In-Transit-Delayed.; Update the background worker to use the Query API operation on the new GSI to retrieve the delayed packages.

Answer

Create a Global Secondary Index (GSI) with a sparse partition key attribute that is only populated when the package status is In-Transit-Delayed, and update the background worker to use the Query API operation on this GSI.
The correct solution involves creating a Global Secondary Index (GSI) with a sparse partition key. Because DynamoDB only populates a GSI when the index key attributes are present in the item, this index will only contain the small subset of packages that are delayed. By querying this GSI instead of scanning the entire base table, the developer restricts data retrieval to only the relevant items, which drastically reduces RCU usage and eliminates throttling.

Step-by-Step Solution

1
Identify the performance bottleneck in the data retrieval pattern.
Scanning a large table with a FilterExpression reads all items and discards non-matching ones after consumption, wasting RCU.
To optimize costs and performance, we must transition from a Scan to a Query operation.
2
Design an index that selectively indexes only the required data subset.
Create a GSI with a sparse attribute (e.g., status is only written when equal to the desired status).
DynamoDB does not index items that lack the GSI's partition key, creating a highly efficient sparse index containing only delayed packages.
3
Refactor the read API call in the application code.
Replace the Scan operation with a Query operation targeted at the GSI.
Query operations retrieve only the matching items, consuming RCUs proportional to the returned dataset size rather than the entire table size.

Key Concept

Using Sparse Global Secondary Indexes (GSIs) and the Query API instead of Scan operations to optimize DynamoDB read performance and reduce RCU consumption.
Question 355Question

A developer is deploying an AWS Lambda function that processes incoming telemetry data and writes it to an Amazon Aurora PostgreSQL database located in a private VPC subnet. During testing, the developer observes that the Lambda function is unable to establish a connection to Aurora, and the function's execution times out. Additionally, performance logs show significant latency during cold starts due to repeated database credential retrieval from AWS Secrets Manager.

Which two actions should the developer take to resolve the database connectivity issues and improve the cold start performance?

Select all that apply

Show answer & explanation

Answer: Configure the Lambda function to run within the private subnets of the VPC, and associate the function with a security group that allows outbound traffic to the database.; Instantiate the AWS SDK client for Secrets Manager and the database connection pool globally outside of the handler function.

Answer

To resolve the connectivity issues and improve performance, the developer should configure the Lambda function to run within the private VPC subnets with a security group that allows outbound traffic to the database, and instantiate the AWS SDK client and database connection pool globally outside the handler function.
The correct combination requires establishing network connectivity to a private database and optimizing cold start performance. Configuring the function to run in the private subnets with a security group that allows outbound access to the database resolves the database connectivity issue. Moving the instantiation of the SDK client and the database connection pool outside the handler function ensures these resources are reused across execution contexts, optimizing performance.

Step-by-Step Solution

1
Configure the Lambda function VPC settings.
The Lambda function is associated with the private subnets of the VPC and configured with a security group allowing outbound traffic to the database port.
This establishes the physical network connectivity from the Lambda function's elastic network interfaces (ENIs) to the private Aurora PostgreSQL database.
2
Refactor the Lambda function code to instantiate resources globally.
The database connection pool and Secrets Manager SDK client are defined outside the handler block.
This implements execution context reuse, ensuring these resources are created once during the cold start initialization phase and reused across subsequent warm invocations, thereby decreasing latency.

Key Concept

AWS Lambda VPC networking and execution context optimization
Question 356Question

An IoT telemetry platform named "VesselTrack" monitors maritime vessel operations. It records real-time sensor updates in an Amazon DynamoDB table. The table has a provisioned write capacity of 5,000 WCU. The partition key is `vessel_type` (e.g., "Cargo", "Tanker", "Passenger") and the sort key is `timestamp`. During peak operational hours, the application experiences frequent `ProvisionedThroughputExceededException` errors when writing cargo ship telemetry, even though the total write volume across the entire table is well below the table's total provisioned WCU limit.

Which TWO actions should the developer take to resolve these throttling issues and optimize the table's performance?

Select all that apply

Show answer & explanation

Answer: Redesign the partition key schema by appending a calculated hash of the vessel ID to the vessel type (e.g., Cargo#12a3) to distribute writes more evenly across partitions.; Configure the application's AWS SDK client to implement exponential backoff with jitter for all write requests.

Answer

Redesign the partition key schema by appending a calculated hash of the vessel ID to the vessel type (e.g., Cargo#12a3) to distribute writes more evenly across partitions, and configure the application's AWS SDK client to implement exponential backoff with jitter for all write requests.
The ProvisionedThroughputExceededException is caused by a hot partition key ('Cargo' representing the majority of the writes), which overwhelms a single partition. Redesigning the partition key by adding a hash or suffix distributes the data across more partition keys. Additionally, configuring the AWS SDK with exponential backoff and jitter ensures that temporary retry spikes are handled gracefully.

Step-by-Step Solution

1
Analyze the table key schema and distribution of values.
Identify that the partition key 'vessel_type' has very low cardinality and 'Cargo' accounts for the vast majority of operations, leading to a hot partition.
DynamoDB tables partition data based on the partition key. Low cardinality partition keys with high traffic skew lead to uneven partition loading.
2
Apply write partition key sharding (salting).
Append a calculated hash of the vessel ID to the vessel type, which increases partition key cardinality and spreads writes across multiple physical partitions.
This resolves the structural hot partition issue by ensuring that different cargo ships write to different partition keys.
3
Implement exponential backoff and jitter in the application's SDK client.
The client handles transient throttling gracefully and avoids retry storms.
Randomized retry delays allow the table partitions to catch up and handle transient spikes without failing the overall request.

Key Concept

Resolving hot partition keys via key salting and handling throttling with SDK exponential backoff with jitter.
Estimated Time:2m 0s
Question 357Question

A developer is setting up an Amazon EventBridge rule to route custom application events to an Amazon Kinesis Data Firehose delivery stream. The developer creates an IAM role named `EventBridgeToFirehoseRole` to allow EventBridge to put records into the delivery stream. The IAM role has the following trust policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "firehose.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

The permissions policy attached to the role is:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"firehose:PutRecord",
"firehose:PutRecordBatch"
],
"Resource": "arn:aws:firehose:us-east-1:123456789012:deliverystream/my-stream"
}
]
}

However, when events are triggered, EventBridge fails to send the events to the delivery stream. Which of the following changes will resolve this issue?

Show answer & explanation

Answer: Update the IAM role trust policy to list events.amazonaws.com as the service principal instead of firehose.amazonaws.com.

Answer

Update the IAM role trust policy to list events.amazonaws.com as the service principal instead of firehose.amazonaws.com.
The correct option is to update the trust policy because Amazon EventBridge is the service initiating the action and needs to assume the IAM role to put records into the Kinesis Data Firehose delivery stream. The trust policy governs which security principal is allowed to assume the role. Listing firehose.amazonaws.com in the trust policy is a common mistake that incorrectly trusts the destination service instead of the invoking service.

Step-by-Step Solution

1
Identify which AWS service principal needs to assume the role to perform the action.
Amazon EventBridge (events.amazonaws.com) is the service triggering the rule and needs to write to the Firehose delivery stream.
The service invoking the target must be the one granted permission to assume the execution role.
2
Inspect the role's trust policy to verify the trusted entity.
The current trust policy lists firehose.amazonaws.com as the trusted entity.
A misconfigured trust policy will prevent the calling service (EventBridge) from assuming the role to perform downstream tasks.
3
Modify the trust policy to trust the correct calling service principal.
Change the principal service from firehose.amazonaws.com to events.amazonaws.com.
This allows EventBridge to assume the role and use the permissions granted in the permissions policy to write to Kinesis Firehose.

Key Concept

IAM Trust Policies vs. Permissions Policies
Question 358Question

An application team is designing a serverless API using Amazon API Gateway. The API must route incoming HTTP requests to a backend AWS Lambda function. The Lambda function requires access to the client request's HTTP headers, query string parameters, and API Gateway stage variables. To optimize development time, the team wants to implement this integration without writing or maintaining any custom mapping templates.

Which integration configuration should the developer choose to meet these requirements?

Show answer & explanation

Answer: Set the integration type to Lambda proxy integration for the API Gateway method.

Answer

Set the integration type to Lambda proxy integration for the API Gateway method.
The correct option is to set the integration type to Lambda proxy integration. With Lambda proxy integration, API Gateway passes the raw HTTP request directly to the backend Lambda function as a structured JSON object. This payload contains the body, headers, query string parameters, path parameters, stage variables, and request context. As a result, developers do not need to write or maintain VTL mapping templates, which satisfies the goal of minimizing configuration overhead.

Step-by-Step Solution

1
Analyze the requirements: the API must pass HTTP headers, query string parameters, and stage variables to the backend Lambda function.
Identify that mapping incoming request components is necessary.
This establishes the data components that need to be parsed by the backend.
2
Consider the design constraint: do not write or maintain custom VTL mapping templates.
Exclude integration types that require manual request template mapping.
This rules out custom integrations which rely on VTL mappings to inject metadata into the event payload.
3
Evaluate Lambda proxy integration features.
Verify that API Gateway automatically maps headers, query parameters, stage variables, and context into a standardized event structure.
Proxy integration fulfills all requirements out-of-the-box with zero configuration overhead.

Key Concept

Understanding the difference between Lambda Proxy and Lambda Custom integrations in API Gateway.
Question 359Question

A developer is configuring a multiplayer game server to send real-time player action logs to an Amazon Kinesis Data Stream with four shards. The developer notices that one shard is constantly throttled, causing the producer to receive ProvisionedThroughputExceededException errors, while the other three shards are barely utilized. Upon inspecting the application code, the developer finds that the partition key in the PutRecord API call is set to a constant string value: "PlayerAction". Which modification should the developer make to resolve this throttling issue?

Show answer & explanation

Answer: Change the partition key to use the unique ID of the player performing each action.

Answer

Change the partition key to use the unique ID of the player performing each action.
The correct answer is to use the unique ID of the player performing each action as the partition key. Amazon Kinesis Data Streams uses the partition key to group data by shard. The partition key is hashed, and the hash value determines which shard the record is assigned to. By using a high-entropy key like a unique player ID, data is distributed evenly across all shards, preventing any single shard from becoming a hot shard and causing throttling.

Step-by-Step Solution

1
Identify the root cause of the ProvisionedThroughputExceededException errors by checking shard utilization.
One shard is heavily utilized (hot shard) while the other three are idle, pointing to uneven data distribution.
Throttling occurs when a single shard's capacity limit of 1 MB/s or 1,000 records/s is exceeded.
2
Inspect the partition key design in the producer application code.
The partition key is found to be the static string "PlayerAction" for all records.
A static partition key hashes to the same value, causing Kinesis to route all records to a single shard.
3
Select and implement a high-entropy partition key.
Replace the static partition key with the unique player ID.
A high-cardinality key like a unique player ID distributes data evenly across all shards using Kinesis's hashing mechanism.

Key Concept

Kinesis Shard Throttling and Partition Key Selection
Question 360Question

A developer is building a serverless REST API using Amazon API Gateway and an AWS Lambda backend with Lambda proxy integration. The API will be accessed by a web application hosted on a different domain. The developer needs to secure the API using an existing Amazon Cognito User Pool and ensure that the web application can successfully make cross-origin requests. Which two actions should the developer take to meet these requirements? (Choose two.)

Select all that apply

Show answer & explanation

Answer: Configure a Cognito User Pool authorizer in API Gateway and apply it to the API methods.; Enable CORS on the API Gateway resource to handle preflight OPTIONS requests, and program the Lambda function to include the Access-Control-Allow-Origin header in its response object.

Answer

To meet the requirements, the developer must configure a native Cognito User Pool authorizer in API Gateway to secure the API methods. To support CORS in a Lambda proxy integration, the developer must enable CORS on the API Gateway resource to handle preflight OPTIONS requests, and also ensure the backend Lambda function returns the Access-Control-Allow-Origin header in its JSON response object.
To secure the API with Cognito, the developer should configure a native Cognito User Pool authorizer, which natively validates JWTs without needing custom Lambda authorizer code. To allow cross-origin requests in a Lambda proxy integration, the developer must enable CORS on the resource to handle the OPTIONS preflight requests, and the Lambda function itself must return the Access-Control-Allow-Origin header, because API Gateway does not modify headers in proxy integrations.

Step-by-Step Solution

1
Configure the native Cognito User Pool authorizer under the API Gateway console, and associate it with the appropriate resource methods.
API Gateway automatically validates the Cognito JWT token passed in the Authorization header of client requests.
Using the built-in Cognito authorizer avoids custom Lambda authorizer overhead and code maintenance.
2
Enable CORS for the API resource in the API Gateway console.
An OPTIONS method is created with a mock integration to respond to preflight requests with CORS headers.
Browsers require a successful preflight response before making actual cross-origin requests.
3
Update the Lambda function's return payload to include the Access-Control-Allow-Origin header in the headers map.
The final response payload received by the client contains the CORS headers.
In a Lambda proxy integration, API Gateway passes the backend response directly to the client without modifying headers.

Key Concept

Configuring security authorization and cross-origin resource sharing (CORS) within Amazon API Gateway REST APIs using Lambda proxy integration.
Estimated Time:2m 0s
PreviousPage 18 / 78Next