Examkin

All practice questions

1542 questions

All types1,542Multiple choice782Multiple select746Ordering14
Question 361Question →

A developer is configuring a REST API using Amazon API Gateway. The backend integrates with an AWS Lambda function using a Lambda custom (non-proxy) integration. The client sends a GET request to the API with a query string parameter named `version`. The developer wants the Lambda function to receive a JSON payload structured exactly as `{"apiVersion": "<version_value>"}` in its input event.

Which configuration must the developer implement in API Gateway to satisfy this requirement?

Show answer & explanation

Answer: Configure an Integration Request body mapping template for the application/json content type that maps the query parameter using $input.params('version') to the apiVersion key.

Answer

Configure an Integration Request body mapping template for the application/json content type that maps the query parameter using $input.params('version') to the apiVersion key.
In a Lambda custom (non-proxy) integration, API Gateway does not automatically pass the raw request structure to the backend. Instead, the developer must define a mapping template under the Integration Request settings to construct the JSON payload that the Lambda function receives. The $input.params() function is used in the VTL mapping template to extract query parameters, headers, or path variables, allowing the creation of the required structure.

Step-by-Step Solution

1
Identify the integration type and mapping requirements.
The requirement is to map a query parameter from an incoming request to a custom JSON structure for a Lambda custom (non-proxy) integration.
Because Lambda custom integration requires the developer to explicitly map incoming request data to the backend payload using VTL templates.
2
Select the correct API Gateway configuration phase.
Choose the Integration Request phase to map the incoming client request before it is sent to the backend Lambda function.
The Integration Request is where request transformations occur, whereas the Integration Response is for backend-to-client transformations.
3
Define the mapping template.
Use the VTL utility method input.params() to extract the 'version' query parameter and output the desired JSON structure: {"apiVersion": " input.params('version')"}.
This extracts the parameter from the request metadata and generates the exact JSON structure required by the Lambda function.

Key Concept

API Gateway Integration Request Mapping Templates
Question 362Question →

A developer is designing a logistics application. Real-time location telemetry events from fleet vehicles are published to an Amazon SNS topic. Two separate backend services need to process these events:

1. A routing analysis service that must process events in the exact chronological order they were generated per vehicle to calculate path history, and must prevent duplicate events from being processed.
2. An alerting service that checks for speeding and can process events in any order, but needs to receive all telemetry events.

The developer wants to implement a fanout architecture using Amazon SNS and Amazon SQS. Which two configuration steps should the developer perform to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an Amazon SNS FIFO topic, create two Amazon SQS FIFO queues (one for each service), and subscribe both queues to the SNS FIFO topic.; Set the vehicle's unique identifier as the Message Group ID when publishing the telemetry events to the Amazon SNS topic.

Answer

Create an Amazon SNS FIFO topic, create two Amazon SQS FIFO queues, and subscribe both queues to the SNS FIFO topic. In addition, set the vehicle's unique identifier as the Message Group ID when publishing telemetry events.
To implement a fanout pattern that preserves strict message ordering and deduplication, the pipeline must use an Amazon SNS FIFO topic and Amazon SQS FIFO queues. Since Amazon SNS FIFO topics only support SQS FIFO queues as subscribers, both queues in the fanout architecture must be FIFO queues, even if the alerting service does not strictly require ordering. To ensure that messages are ordered per vehicle while allowing concurrent processing of events from different vehicles, the vehicle's unique identifier should be used as the Message Group ID. This groups events by vehicle, serializing updates for each vehicle while allowing SQS to process multiple groups in parallel.

Step-by-Step Solution

1
Analyze the requirements for ordering and deduplication.
The routing analysis service requires message ordering and deduplication per vehicle. The alerting service does not require ordering but must receive all events. A fanout pattern with Amazon SNS and SQS is required.
This establishes that at least one queue must be FIFO, and a message grouping strategy is needed.
2
Select the appropriate SNS and SQS queue types.
An Amazon SNS FIFO topic must be used to preserve ordering. SQS Standard queues cannot subscribe to SNS FIFO topics, so both downstream queues (routing analysis and alerting) must be Amazon SQS FIFO queues.
This satisfies the AWS service limitation where only SQS FIFO queues can subscribe to SNS FIFO topics.
3
Determine the message grouping key strategy.
Set the vehicle's unique identifier as the Message Group ID when publishing events to the SNS FIFO topic.
This ensures chronological ordering of telemetry events is maintained per vehicle while allowing messages from different vehicles to be processed concurrently, avoiding performance bottlenecks.

Key Concept

End-to-end FIFO message delivery using Amazon SNS FIFO topics and Amazon SQS FIFO queues, ensuring message grouping by a high-entropy identifier to balance ordering and throughput.
Estimated Time:2m 30s
Question 363Question →

A developer is deploying an AWS Lambda function that reads incoming user data from an Amazon Kinesis data stream. The developer creates an IAM role with a permissions policy allowing the necessary Kinesis read actions. However, the Lambda function fails to retrieve data, and the logs indicate that the Lambda service is unauthorized to assume the configured execution role.

The trust policy attached to the IAM role is shown below:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "kinesis.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

How should the developer resolve this issue to allow the Lambda function to execute and read from the stream?

Show answer & explanation

Answer: Change the service principal in the trust policy to "lambda.amazonaws.com" to allow the Lambda service to assume the execution role.

Answer

Change the service principal in the trust policy to "lambda.amazonaws.com" to allow the Lambda service to assume the execution role.
To resolve the assumption failure, the trust policy of the execution role must specify lambda.amazonaws.com as the trusted service principal. This grants the AWS Lambda service the permission to assume the role and perform actions on behalf of the function.

Step-by-Step Solution

1
Analyze the error logs and trust policy of the execution role.
The log states the Lambda service is unauthorized to assume the role, and the trust policy lists 'kinesis.amazonaws.com' as the service principal.
Understanding why the assumption failed requires verifying the trust relationship configuration.
2
Identify the service principal that needs to assume the role.
The Lambda service itself ('lambda.amazonaws.com') is responsible for assuming the execution role and running the function code.
The trust policy must grant the service running the resource the permission to call 'sts:AssumeRole'.
3
Update the trust policy's principal block.
Change 'kinesis.amazonaws.com' to 'lambda.amazonaws.com'.
This grants the Lambda service the permission to assume the execution role natively.

Key Concept

IAM trust policies define which entities (accounts, users, or AWS services) are trusted to assume an IAM role, while IAM permissions policies define what actions the assumed role can perform.
Question 364Question →

An application uses an Amazon SNS topic to publish customer signup events. These events are fanned out to an Amazon SQS queue, which is processed by a downstream AWS Lambda function. During peak traffic, the developers notice that the Lambda function is frequently invoked with duplicate messages for the same customer signup, although the message was published to the SNS topic only once.

Which of the following configuration changes is the most effective solution to prevent these duplicate invocations?

Show answer & explanation

Answer: Increase the visibility timeout of the Amazon SQS queue to be at least six times the timeout of the AWS Lambda function.

Answer

Increase the visibility timeout of the Amazon SQS queue to be at least six times the timeout of the AWS Lambda function.
Increasing the visibility timeout of the Amazon SQS queue to at least six times the timeout of the AWS Lambda function prevents SQS from making the message visible again while the current Lambda execution is still processing it. This ensures that Lambda has sufficient time to complete execution and delete the message from the queue before it can be delivered to another worker.

Step-by-Step Solution

1
Analyze the cause of duplicate invocations in an SQS-triggered Lambda function.
Identify that the visibility timeout must accommodate the processing time of the consumer function plus retries.
If the visibility timeout is shorter than the Lambda execution time, SQS makes the message visible again, leading to duplicate reads.
2
Determine the AWS recommended relationship between SQS visibility timeout and Lambda timeout.
The visibility timeout of the source queue must be set to at least six times the timeout of the Lambda function.
This ratio accommodates multiple retries and avoids duplicate processing if a function is throttled while handling a batch.

Key Concept

SQS visibility timeout configuration relative to Lambda function execution time
Estimated Time:1m 30s
Question 365Question →

A developer is implementing a smart lock security system. Commands (such as `LOCK` and `UNLOCK`) sent to individual locks must be processed in the exact order they are received to prevent race conditions. The commands are published to an Amazon SNS FIFO topic, which fans out to Amazon SQS FIFO queues consumed by a fleet of processing workers. During testing, the developer notices that commands for different smart locks are occasionally blocking each other, causing high latency. Furthermore, consecutive identical commands for the same lock (e.g., two `LOCK` commands) are occasionally discarded. How should the developer configure the SNS FIFO topic and SQS FIFO queue parameters to resolve these issues?

Show answer & explanation

Answer: Set the MessageGroupId to the smart lock's unique identifier (LockIDLockID), and generate a unique UUID for each command to serve as the MessageDeduplicationId.

Answer

Set the MessageGroupId to the smart lock's unique identifier (LockIDLockID), and generate a unique UUID for each command to serve as the MessageDeduplicationId.
Setting the MessageGroupId to the smart lock's unique identifier (LockIDLockID) ensures that messages for a given lock are grouped and processed sequentially, preventing race conditions for that device while allowing messages for other locks to be processed concurrently. Using a unique UUID for the MessageDeduplicationId prevents separate, identical commands (like consecutive LOCK commands) sent within the 55-minute deduplication window from being incorrectly discarded as duplicates.

Step-by-Step Solution

1
Analyze the concurrency and ordering requirements.
Ordering must be guaranteed per individual lock, but locks should process independently.
To prevent head-of-line blocking and allow parallel processing across different devices, a unique identifier per device (LockIDLockID) must be used as the MessageGroupId.
2
Address the deduplication behavior for identical payloads.
A unique deduplication ID (like a UUID) must be passed for each request.
If content-based deduplication is enabled or a hash of the payload is used, consecutive identical commands (e.g., locking a door twice) sent within 55 minutes will be filtered out as duplicates by the SQS FIFO queue.
3
Validate the chosen architecture against AWS best practices.
Avoid hardcoded IAM credentials and standard SQS queues.
Standard queues do not guarantee order, and hardcoded credentials violate basic security principles.

Key Concept

Message Grouping and Deduplication in SNS/SQS FIFO Architectures
Question 366Question →

A developer is configuring an AWS Lambda function in Account A (123456789012123456789012) to write data to an Amazon DynamoDB table in Account B (210987654321210987654321). The developer wants to use a cross-account IAM role named `DynamoDBWriterRole` in Account B to perform the DynamoDB operations. The Lambda function runs under an execution role named `LambdaExecutionRole` in Account A. Which two configurations are required to establish this cross-account trust and allow the Lambda function to write to the table? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: A trust policy attached to the role in Account B that specifies the Lambda execution role in Account A as the principal and allows the sts:AssumeRole action.; An IAM permissions policy attached to the Lambda execution role in Account A that allows the sts:AssumeRole action on the Amazon Resource Name (ARN) of the role in Account B.

Answer

To configure cross-account access, the developer must attach a trust policy to the role in Account B that lists the Lambda execution role in Account A as a principal and allows the sts:AssumeRole action. In addition, the developer must attach an IAM permissions policy to the Lambda execution role in Account A allowing the sts:AssumeRole action on the target role's ARN in Account B.
Establishing cross-account delegation requires both sides to agree: the target role's trust policy in Account B must trust the calling IAM entity in Account A, and the calling identity in Account A must be granted permission in its identity policy to assume that target role.

Step-by-Step Solution

1
Configure the trust relationship on the target role in Account B.
The target role (DynamoDBWriterRole) trust policy is updated to permit the Lambda execution role ARN in Account A to perform sts:AssumeRole.
This establishes that the role in Account B trusts the specific entity in Account A to assume it.
2
Add permissions to the source Lambda execution role in Account A.
The Lambda execution role in Account A is granted identity-based permissions to call sts:AssumeRole on the ARN of DynamoDBWriterRole.
The entity in the source account must have permissions to initiate the AssumeRole call.
3
Implement the sts:AssumeRole API call in the Lambda function code.
The Lambda function uses the AWS SDK to retrieve temporary security credentials and uses them to write to the DynamoDB table.
This allows the function to execute operations with the authorization level of the target role in Account B.

Key Concept

Cross-account IAM Role Delegation
Estimated Time:2m 0s
Question 367Question →

A developer has implemented an AWS Lambda function in Node.js that processes orders and sends a response back to Amazon API Gateway. Inside the handler, the function sends tracking metrics to a third-party analytics API by initiating an asynchronous HTTP request without using an 'await' statement (a background promise). However, the developer notices that the Lambda function continues running and eventually times out, even though the main order processing logic completes and the callback is invoked. Which configuration change should the developer make to ensure the function returns the response immediately without waiting for the background tracking metrics request to complete?

Show answer & explanation

Answer: Set the callbackWaitsForEmptyEventLoop property of the context object to false in the Lambda handler.

Answer

Set the callbackWaitsForEmptyEventLoop property of the context object to false in the Lambda handler.
The correct answer is to set the callbackWaitsForEmptyEventLoop property of the context object to false. By default, the Lambda runtime for Node.js will not return the response until the Node.js event loop is completely empty. If an asynchronous background operation (such as a metrics API call without an await statement) is still pending when the handler finishes its main execution, Lambda will wait for that operation to complete or for the function to time out. Setting callbackWaitsForEmptyEventLoop to false overrides this behavior and returns the response immediately to the caller, while allowing background tasks to be frozen until the next invocation.

Step-by-Step Solution

1
Identify the cause of the Lambda function's prolonged execution.
The un-awaited asynchronous tracking metrics call creates a pending event/promise in the Node.js event loop.
By default, AWS Lambda waits for the Node.js event loop to be completely empty before freezing the execution environment and returning the response.
2
Modify the execution context behavior.
Assign context.callbackWaitsForEmptyEventLoop = false; inside the handler.
This configuration overrides the default behavior, instructing the runtime to immediately send the response back to API Gateway once the callback is called or the main handler promise resolves.

Key Concept

AWS Lambda Node.js event loop execution behavior
Question 368Question →

A developer is configuring a warehouse inventory application that sends real-time stock level updates from multiple warehouses to an Amazon Kinesis Data Stream. To maintain chronological processing order of updates within each warehouse, all records for a specific warehouse must be routed to the same shard. Which approach should the developer use to meet this requirement?

Show answer & explanation

Answer: Set the partition key to the unique warehouse ID for each record.

Answer

Set the partition key to the unique warehouse ID for each record.
The correct answer is to set the partition key to the unique warehouse ID for each record. Amazon Kinesis Data Streams uses the partition key to determine which shard a record is assigned to. By using the warehouse ID as the partition key, all records associated with a specific warehouse will have the same hash value and will be sent to the same shard. This guarantees that they are processed in the strict chronological order in which they were received.

Step-by-Step Solution

1
Identify the requirement to route records for the same warehouse to the same shard to ensure chronological ordering.
Determine that Kinesis uses partition keys to group related data onto the same shard.
Kinesis guarantees in-order processing only for records written to the same shard.
2
Evaluate the options for partition key design to select a high-entropy attribute that maps to the warehouse grouping.
Selecting the unique warehouse ID as the partition key ensures warehouse-specific ordering and distributes records across shards.
A unique key ensures sequential processing per warehouse while preventing hot shards.

Key Concept

Kinesis Data Streams uses the partition key to group data records and determine which shard they are routed to, ensuring ordered processing within that shard.
Estimated Time:1m 0s
Question 369Question →

A developer is designing a peer-to-peer mobile payment application. When a user initiates a funds transfer to another user, the application must perform three operations: deduct the transfer amount from the sender's account balance, add the transfer amount to the recipient's account balance, and record the transaction history in a log table. These operations must execute atomically so that either all of them succeed or all of them fail. Under high traffic, the system must maintain strict consistency and prevent throttling issues. Which implementation strategy should the developer use to meet these requirements?

Show answer & explanation

Answer: Use the TransactWriteItems API to perform conditional Update operations on the sender and recipient records in the Accounts table, checking that the sender's balance is sufficient, while simultaneously performing a Put operation in the Transactions table.

Answer

Use the TransactWriteItems API to perform conditional Update operations on the sender and recipient records in the Accounts table, checking that the sender's balance is sufficient, while simultaneously performing a Put operation in the Transactions table.
Using the TransactWriteItems API provides atomicity and consistency guarantees, ensuring that all operations (the balance updates and the transaction log) either succeed together or fail together. The conditional check verifies that the sender has sufficient funds prior to completing the write.

Step-by-Step Solution

1
Analyze the requirements for atomicity and consistency across multiple operations.
The requirements demand that deducting the sender's balance, adding the recipient's balance, and writing the transaction log must succeed or fail as a single atomic unit.
This guarantees that no money is lost or created in the system if a failure occurs mid-operation.
2
Evaluate the capabilities of different DynamoDB write APIs.
BatchWriteItem does not support atomic transactions or conditional checks. TransactWriteItems supports up to 100 actions (or 4 MB of data) and provides ACID transactions.
Choosing the correct API ensures both transactional integrity and data consistency.
3
Incorporate conditional checks for balance verification.
The balance check must be performed atomically at write time using a ConditionExpression on the sender's record (e.g., balance >= transfer amount).
This prevents overdrafts and race conditions in a concurrent high-throughput environment.

Key Concept

Using DynamoDB Transactions (TransactWriteItems) for atomic, multi-table write operations with conditional checks.
Question 370Question →

An enterprise applications developer is troubleshooting a batch processing pipeline. An Amazon SQS standard queue receives transaction messages, which trigger an AWS Lambda function. The Lambda function's timeout is set to 9090 seconds. Under heavy load, the developer observes that several messages are being processed multiple times by concurrent Lambda executions, resulting in duplicate database entries. Analysis of the logs shows that the Lambda function is executing successfully without timing out or throwing errors.

Which configuration change should the developer implement to resolve the duplicate processing issue?

Show answer & explanation

Answer: Increase the SQS queue's visibility timeout to at least 540 seconds.

Answer

Increase the SQS queue's visibility timeout to at least 540 seconds.
Increasing the SQS queue's visibility timeout to at least 540 seconds is correct because AWS best practices dictate that the visibility timeout of the source queue must be at least 6 times the timeout of the triggering Lambda function. For a 9090-second function timeout, this is calculated as 6×90=5406 \times 90 = 540 seconds. This safety window allows the Lambda function to safely complete its processing and delete the message without the message becoming visible to other concurrent consumers.

Step-by-Step Solution

1
Analyze the relationship between the Lambda function's timeout and the SQS queue's visibility timeout.
The Lambda function has a timeout of 9090 seconds, meaning its execution can take up to 9090 seconds.
To identify why messages are being reprocessed before the current Lambda function execution can complete and delete them.
2
Apply AWS integration recommendations for SQS event sources.
AWS recommends setting the SQS queue's visibility timeout to at least 66 times the timeout of the triggering Lambda function.
This configuration provides a safety margin (6×90=5406 \times 90 = 540 seconds) to accommodate processing delays, cold starts, and Lambda-managed retries.
3
Select the correct configuration change to prevent duplicate execution.
Configuring the SQS visibility timeout to at least 540540 seconds ensures the message remains hidden until the execution completes.
To ensure that SQS does not make the message visible to other polling instances while the current execution is still active.

Key Concept

SQS Visibility Timeout vs Lambda Function Timeout
Estimated Time:2m 0s
Question 371Question →

A developer is writing an AWS Lambda function that processes telemetry data sent from a custom web portal. The function must make an HTTP POST request to an external third-party API and then write the processed telemetry record to an Amazon DynamoDB table. During load testing, the developer observes high latencies due to connection setup overhead on each invocation and database access errors when trying to write to DynamoDB.

Which two changes should the developer make to optimize the performance of the function and ensure secure access to DynamoDB? (Select two.)

Select all that apply

Show answer & explanation

Answer: Instantiate the DynamoDB client and HTTP client outside the handler function to reuse connection pools across invocations.; Configure the Lambda function's IAM execution role with a policy allowing dynamodb:PutItem actions, and rely on the default credential provider chain.

Answer

The correct actions are to initialize client instances outside the handler function to enable connection reuse, and to assign an IAM execution role with appropriate write permissions to DynamoDB.
Initializing client instances outside the handler allows AWS Lambda to reuse the execution context and the existing TCP connections across subsequent warm invocations, reducing latency. Using an IAM execution role provides temporary credentials automatically managed by the AWS SDK, following the principle of least privilege and avoiding hardcoded credentials.

Step-by-Step Solution

1
Analyze the performance bottleneck caused by connection setup overhead.
Determine that initializing the clients outside the handler is required.
The Lambda execution context persists across warm invocations, allowing global variables and connections to be reused.
2
Address the database access errors securely.
Configure an IAM execution role for the function and grant it permission to write to DynamoDB.
Relying on the default credential provider chain avoids storing credentials in the code or environment variables.

Key Concept

AWS Lambda execution context reuse and IAM execution roles.
Estimated Time:2m 0s
Question 372Question →

A developer is building a serverless payment processing application. The application uses an Amazon SQS queue to trigger an AWS Lambda function. The Lambda function must connect to an Amazon RDS database residing in a private VPC subnet and also call an external payment gateway API over the internet. The Lambda function has a timeout of 1010 seconds. Which two configuration steps must the developer perform to ensure reliable processing and correct connectivity? (Select two.)

Select all that apply

Show answer & explanation

Answer: Associate the Lambda function with the private subnets of the VPC, and route outbound internet traffic from these subnets to a NAT Gateway in a public subnet.; Configure the SQS queue's visibility timeout to be at least 66 times the timeout of the Lambda function to prevent duplicate message processing.

Answer

The developer must associate the Lambda function with the private subnets of the VPC, routing internet-bound traffic through a NAT Gateway in a public subnet, and configure the SQS queue's visibility timeout to at least 6 times the Lambda function's timeout.
To securely connect to a database within a private VPC and also make outbound calls to an external payment API, the Lambda function must be associated with the private subnets of the VPC. The private subnets must then route outbound internet traffic through a NAT Gateway located in a public subnet. Additionally, when integration with Amazon SQS is used, the visibility timeout of the queue must be configured to at least 6 times the timeout of the Lambda function. This safety margin prevents other consumers from picking up a message while the Lambda function is still processing it.

Step-by-Step Solution

1
Determine the network routing requirements for the Lambda function.
The Lambda function needs to be associated with the private VPC subnets to reach the RDS database, and its outbound internet traffic (for the payment API) must be routed via a NAT Gateway in a public subnet.
Lambda functions associated with a VPC do not receive public IP addresses and cannot connect to the internet directly, even if placed in public subnets.
2
Calculate the appropriate SQS visibility timeout based on the Lambda timeout.
The SQS queue's visibility timeout must be set to at least 66 times the Lambda function's timeout (which is at least 6060 seconds for a 1010-second Lambda timeout).
This configuration provides a buffer to prevent messages from becoming visible again and being processed multiple times while the Lambda handler is still executing.

Key Concept

AWS Lambda VPC networking and Amazon SQS event source mapping timeout configurations.
Estimated Time:2m 0s
Question 373Question →

A developer is configuring an AWS CodeBuild project in Account 111111111111111111111111 that must retrieve database configuration credentials from AWS Systems Manager Parameter Store in Account 222222222222222222222222. The developer creates an IAM role named CrossAccountParamReaderRole in Account 222222222222222222222222 with permission to read the parameters.

The CodeBuild project's service role in Account 111111111111111111111111 has permissions to assume CrossAccountParamReaderRole. However, during the build phase, the CodeBuild build fails with an AccessDenied error when executing the assume-role CLI command.

The trust policy for CrossAccountParamReaderRole in Account 222222222222222222222222 is configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "codebuild.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which modification to the trust policy in Account 222222222222222222222222 will resolve this issue?

Show answer & explanation

Answer: Update the Principal block of the trust policy to reference Account 111111111111111111111111 or the specific CodeBuild service role ARN instead of the CodeBuild service principal.

Answer

Update the Principal block of the trust policy to reference Account 111111111111111111111111 or the specific CodeBuild service role ARN instead of the CodeBuild service principal.
To allow an IAM identity (such as a role or user) from another AWS account to assume an IAM role, the target role's trust policy must specify that external account or the specific IAM identity as a trusted principal. The original trust policy only trusts the regional AWS CodeBuild service principal within the same account (Account 222222222222222222222222). Updating the Principal block to trust Account 111111111111111111111111 (or the specific CodeBuild service role in Account 111111111111111111111111) permits the STS AssumeRole request to succeed.

Step-by-Step Solution

1
Identify the type of policy configuration error.
The current trust policy only trusts the regional 'codebuild.amazonaws.com' service within its own account (Account 222222222222222222222222).
For cross-account access, a trust policy must explicitly trust the external account or the specific identity attempting to assume the role.
2
Select the correct Principal modification.
Changing the Principal to target Account 111111111111111111111111 or the specific CodeBuild service role ARN allows the delegation of authority.
This establishes the trust boundary between the two AWS accounts so that sts:AssumeRole calls from Account 111111111111111111111111 are accepted.

Key Concept

IAM trust policies vs identity-based policies in cross-account access
Question 374Question →

A compliance scanning service utilizes an AWS Lambda function deployed in private subnets to access a private Amazon DocumentDB cluster. To validate document checksums, the function must also call an external verification service on the public internet. During high-concurrency event bursts, the Lambda function frequently exceeds its configured timeout when establishing connections to both DocumentDB and the external verification service. Which combination of steps should the developer take to resolve the timeouts and optimize connection performance?

Show answer & explanation

Answer: Configure a NAT Gateway in a public subnet, add a route to it in the private subnet's route table, and instantiate the DocumentDB client outside the Lambda handler function to enable connection reuse across warm starts.

Answer

Configure a NAT Gateway in a public subnet, add a route to it in the private subnet's route table, and instantiate the DocumentDB client outside the Lambda handler function to enable connection reuse across warm starts.
The correct option addresses both the connectivity and optimization issues. By placing a NAT Gateway in a public subnet and routing outbound traffic from the private subnet through it, the Lambda function can reach the public internet. By instantiating the DocumentDB client in the global scope (outside the handler), the function utilizes execution context reuse to cache the database connection pool, reducing connection setup overhead and latency for subsequent warm invocations.

Step-by-Step Solution

1
Enable internet connectivity for the private VPC subnet.
Deploy a NAT Gateway in a public subnet and update the private subnet's route table to direct outbound internet traffic (0.0.0.0/0) to the NAT Gateway.
This allows the Lambda function inside the private subnet to call the external verification service on the public internet while remaining in the private network to access the DocumentDB cluster.
2
Optimize database connection handling using execution context reuse.
Move the instantiation of the DocumentDB client and connection pool outside of the Lambda handler function, placing it in the global initialization code block.
This caches the database client within the container's memory, allowing subsequent warm starts to reuse the existing connection pool rather than incurring the overhead of creating a new connection on every invocation.

Key Concept

VPC Lambda connectivity and execution context reuse optimization
Question 375Question →

A developer is designing a telemetry ingestion pipeline for IoT smart meters. The metrics are published to an Amazon Kinesis Data Stream with 4 shards. The producer application currently uses the MeterID as the partition key. Because a subset of the smart meters generates a significantly higher volume of events, the developer observes frequent ProvisionedThroughputExceededException errors on specific shards during peak hours, while other shards remain underutilized. Additionally, a new requirement specifies that critical maintenance alarms embedded in the telemetry payload must be immediately routed to an Amazon EventBridge custom event bus for downstream processing. Which TWO actions should the developer take to resolve the partition throughput issues and route the critical alarms?

Select all that apply

Show answer & explanation

Answer: Modify the producer application to use a composite key consisting of the MeterID and a high-cardinality attribute (such as a hash of the event timestamp) as the partition key.; Create an Amazon EventBridge Pipe with the Kinesis Data Stream as the source, define a filter pattern matching the critical maintenance alarms, and set the custom event bus as the target.

Answer

Modify the producer application to use a composite key consisting of the MeterID and a high-cardinality attribute (such as a hash of the event timestamp) as the partition key, and create an Amazon EventBridge Pipe with the Kinesis Data Stream as the source, defining a filter pattern matching the critical maintenance alarms, with the custom event bus as the target.
The correct options address both the stream ingestion issue and the routing requirement. First, modifying the partition key to be a composite key of the MeterID and a high-cardinality value (such as a timestamp hash) ensures that write requests are evenly distributed across the shards, eliminating hot shards. Second, EventBridge Pipes is designed to poll data sources like Kinesis Data Streams, filter the events using defined patterns, and route them directly to targets such as a custom EventBridge event bus.

Step-by-Step Solution

1
Analyze the cause of Kinesis Data Stream throttling.
Identify that the current partition key (MeterID) has insufficient cardinality/entropy, causing a disproportionate amount of traffic to be routed to specific shards (hot shards).
This leads to ProvisionedThroughputExceededException errors because individual shard limits are exceeded.
2
Select a strategy to distribute partition keys evenly.
Introduce a composite key (MeterID + timestamp hash) to increase partition key entropy.
The Kinesis MD5 hashing algorithm will distribute these keys uniformly across all available shards.
3
Select the correct integration pattern to route events to EventBridge.
Implement an Amazon EventBridge Pipe with the Kinesis stream as the source and the custom event bus as the target, applying a JSON filter pattern.
EventBridge Pipes provides a native, serverless way to poll Kinesis streams, filter payloads, and route them to downstream targets like an EventBridge event bus.

Key Concept

Partition key entropy in Kinesis Data Streams and event routing using EventBridge Pipes.
Estimated Time:3m 0s
Question 376Question →

A developer is designing a retail ordering system. When an order is placed, the payment service must notify both a Fulfillment service and an Inventory service. Both services must receive and process every order message independently. The Inventory service processes messages at a slower rate than the Fulfillment service, so each service must be able to buffer and consume messages at its own pace. Which combination of steps should the developer perform to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Publish the order messages to an Amazon SNS topic when an order is placed.; Create two separate Amazon SQS queues—one for the Fulfillment service and one for the Inventory service—and subscribe both queues to the Amazon SNS topic.

Answer

Publish the order messages to an Amazon SNS topic when an order is placed, and create two separate Amazon SQS queues—one for the Fulfillment service and one for the Inventory service—and subscribe both queues to the Amazon SNS topic.
Publishing messages to an SNS topic and subscribing separate SQS queues for the Fulfillment and Inventory services implementation creates a reliable fan-out pattern. This ensures that every message is delivered to both queues, allowing each service to retrieve and process the messages independently and at its own pace.

Step-by-Step Solution

1
Analyze the architectural requirements for sending messages to multiple downstream systems that process data at different speeds.
Identify that a message fan-out pattern is required to deliver the same message to multiple destinations, and queueing is needed to allow consumers to process messages at their own rate.
Downstream consumers process messages independently, so they cannot share a single queue without competing for messages. SNS handles broadcasting, while SQS handles buffering.
2
Select the SNS topic publication step to serve as the message publisher.
Choose the action to publish order messages to an SNS topic when an order is placed.
SNS topics natively support pushing a message to multiple subscriptions simultaneously.
3
Select the SQS subscription step to create message buffers for each service.
Choose the action to create separate SQS queues for Fulfillment and Inventory, and subscribe them to the SNS topic.
This decouples the services, ensuring that if one service is slow, it does not drop messages or affect the other service.

Key Concept

Implementing the Amazon SNS-to-SQS fan-out pattern for decoupled, multi-consumer message processing.
Estimated Time:2m 0s
Question 377Question →

A developer is building a serverless application where an AWS Lambda function processes records from an Amazon Kinesis data stream. During testing, some malformed records cause the Lambda function to return an error, which causes the entire batch of records to be retried repeatedly. This retry behavior blocks the stream partition and causes processing latency to increase. The developer wants to configure the event source mapping to automatically split the failed batch and retry the smaller batches to isolate the malformed records. Which configuration change should the developer implement to achieve this goal?

Show answer & explanation

Answer: Configure the event source mapping with BisectBatchOnFunctionError set to true.

Answer

Configure the event source mapping with BisectBatchOnFunctionError set to true.
Configuring the event source mapping with BisectBatchOnFunctionError set to true tells Lambda to split a failed batch into two halves and retry them. This process repeats until the problematic record is isolated, allowing the other valid records in the batch to be processed successfully.

Step-by-Step Solution

1
Analyze the problem requirements.
The developer wants to prevent a failed batch of Kinesis records from repeatedly failing in its entirety, blocking the partition.
Understanding the goal helps select the correct event source mapping configuration.
2
Evaluate Amazon Kinesis event source mapping error handling features.
Lambda event source mappings for Kinesis support BisectBatchOnFunctionError.
This option allows Lambda to bisect the batch when a function error occurs and retry each half.
3
Select the configuration that isolates the bad records.
Setting BisectBatchOnFunctionError to true splits the batch recursively until the failing record is processed individually.
This minimizes duplicate processing of successful records and unblocks the stream.

Key Concept

Handling batch processing errors in AWS Lambda event source mappings for stream sources.
Estimated Time:1m 30s
Question 378Question →

A developer is designing an integration for an Amazon API Gateway REST API. The API needs to receive incoming JSON payloads from clients and write them directly into an Amazon SQS queue without using an intermediate AWS Lambda function. Which two configurations must the developer perform in API Gateway to implement this integration? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the integration type as 'AWS Service', select Amazon SQS as the target service, and define an integration request mapping template to format the client's JSON payload.; Create an IAM role that allows the API Gateway service principal to assume it, grant the role `sqs:SendMessage` permission, and specify the role's ARN as the integration's execution role.

Answer

To integrate Amazon API Gateway directly with Amazon SQS, configure the integration type as 'AWS Service', select Amazon SQS as the target service, and define an integration request mapping template. Additionally, create an IAM role that allows the API Gateway service principal to assume it, grant the role `sqs:SendMessage` permission, and specify the role's ARN as the integration's execution role.
To integrate Amazon API Gateway directly with Amazon SQS without using an intermediate AWS Lambda function, you must configure an 'AWS Service' integration type, select Amazon SQS, and use a mapping template to format the client's payload. Additionally, API Gateway requires an IAM execution role with permissions to perform the `sqs:SendMessage` action on the destination queue, and the role's trust policy must allow the API Gateway service principal to assume it.

Step-by-Step Solution

1
Determine the correct integration type for directly interfacing API Gateway with Amazon SQS.
Select the 'AWS Service' integration type in API Gateway, and choose Amazon SQS as the target service.
This bypasses Lambda entirely, sending requests directly from API Gateway to SQS, reducing latency and cost.
2
Configure the payload transformation using a mapping template in API Gateway.
Create an Integration Request mapping template for the incoming client content-type to transform client data into the SQS request format.
Amazon SQS requires specific request parameters (such as MessageBody) to receive messages, which client JSON requests do not natively match.
3
Establish secure authorization between API Gateway and Amazon SQS.
Create an IAM role that grants API Gateway permission to write to the SQS queue, and assign this role to the Execution Role field of the integration.
API Gateway must assume an IAM role with sufficient permissions to authenticate and write messages to SQS.

Key Concept

API Gateway AWS Service Integrations
Question 379Question →

A developer is configuring a local application to access an Amazon DynamoDB table in an AWS account. To comply with security best practices, the application must run locally by assuming an IAM role named DbAccessRole using temporary credentials. The developer has a local AWS CLI profile named dev-user configured with IAM user credentials.

Which two actions must the developer take to configure the application to assume the role?

Select all that apply

Show answer & explanation

Answer: Define a new profile in the local ~/.aws/config file, specifying the role_arn of DbAccessRole and setting the source_profile to dev-user.; Configure the trust policy of DbAccessRole to allow the sts:AssumeRole action for the ARN of the dev-user IAM user.

Answer

Define a new profile in the local ~/.aws/config file, specifying the role_arn of DbAccessRole and setting the source_profile to dev-user. Also, configure the trust policy of DbAccessRole to allow the sts:AssumeRole action for the ARN of the dev-user IAM user.
The correct configuration requires both configuring the target role to trust the specific IAM user, and setting up the local CLI configuration to chain the profiles. Specifying the role_arn and source_profile in ~/.aws/config tells the AWS SDK or CLI to use the credentials from the source profile to call sts:AssumeRole for the target role. The target role's trust policy must list the IAM user as a principal and allow the sts:AssumeRole action.

Step-by-Step Solution

1
Configure the IAM role trust relationship.
The role DbAccessRole is configured to trust the dev-user IAM user.
Before any principal can assume an IAM role, that principal must be explicitly trusted by the role's trust policy via the sts:AssumeRole action.
2
Configure the local AWS configuration profile.
A profile in ~/.aws/config is created that links the credentials profile to the target role.
Using the ~/.aws/config profile chaining mechanism allows the AWS CLI and SDKs to automatically handle the sts:AssumeRole API call and manage the lifecycle of temporary credentials without hardcoding secrets.

Key Concept

IAM role assumption requires a trust policy specifying the trusted principal, and client applications can use profile chaining in the local configuration to automatically retrieve temporary credentials.
Question 380Question →

A developer is building a serverless photo-sharing application that allows users to upload JPEG images. The application uses an Amazon API Gateway REST API with an AWS Lambda proxy integration to process the uploads. During testing, the developer discovers that the image files processed by the Lambda function are corrupted because the binary payload is being treated as UTF-8 string data instead of binary data. Which configuration steps must the developer take to resolve this issue?

Show answer & explanation

Answer: Add image/jpeg to the Binary Media Types of the API Gateway API, and update the Lambda function to base64-decode the body field from the input event when isBase64Encoded is true.

Answer

Add the image/jpeg content type to the API Gateway API's Binary Media Types, and update the Lambda function code to base64-decode the event body when the isBase64Encoded flag is true.
For API Gateway to properly pass binary payloads (such as JPEG images) to a Lambda proxy integration, the API must be configured with the appropriate Binary Media Types. When the request Content-Type matches a binary media type, API Gateway base64-encodes the request body and sets the isBase64Encoded boolean flag to true in the event object. The Lambda function must check this flag and decode the body to get the raw binary content.

Step-by-Step Solution

1
Configure API Gateway to recognize image/jpeg as a binary format by adding it to the Binary Media Types list in the API settings.
API Gateway will treat incoming requests with the image/jpeg Content-Type as binary payloads rather than text.
This prevents API Gateway from attempting to parse the binary image data as a UTF-8 string, which causes data corruption.
2
Pass the incoming request via Lambda proxy integration, allowing API Gateway to automatically base64-encode the binary body.
The event object passed to the Lambda function will contain a base64-encoded string in the body field, and the isBase64Encoded flag will be set to true.
Proxy integrations require binary payloads to be base64-encoded to safely transport the data inside the JSON event structure.
3
Modify the Lambda function code to check if isBase64Encoded is true, and if so, base64-decode the body payload.
The Lambda function successfully retrieves the original raw binary JPEG bytes for processing or storage.
The function must decode the base64 string to restore the original binary format of the image.

Key Concept

Handling binary media payloads with API Gateway Lambda Proxy integration
Estimated Time:1m 30s
PreviousPage 19 / 78Next
All practice questions — AWS Certified Developer - Associate | Examkin