All practice questions

1542 questions

All types1,542 Multiple choice782 Multiple select746 Ordering14

A developer is implementing a real-time tracking pipeline for a logistics platform. A producer application writes delivery location updates to an Amazon Kinesis Data Stream using the delivery region name (e.g., 'us-east-1') as the partition key. A downstream AWS Lambda function is configured to process the stream via an event source mapping and must call an external third-party mapping API to validate coordinates. The Lambda function is deployed within private subnets of a VPC. During peak hours, the developer observes ProvisionedThroughputExceededException errors on the Kinesis stream, despite the total data volume being well below the stream's aggregate limit. Additionally, the Lambda function fails to connect to the external API. Which combination of changes should the developer implement to resolve both the Kinesis throttling and the connection issues?

Increase the Kinesis stream shard count to handle peak load. Move the Lambda function to a public subnet to allow direct access to the internet.

Update the producer application to use a high-entropy key, such as a unique delivery ID, as the partition key. Configure a NAT Gateway in a public subnet and route internet-bound traffic from the Lambda function's private subnet through it.

Update the producer application to use a high-entropy key, such as a unique delivery ID, as the partition key. Configure an AWS PrivateLink VPC endpoint for the external third-party API.

Keep the delivery region name as the partition key to preserve ordering, and increase the Kinesis stream shard count. Configure a NAT Gateway in a public subnet and route internet-bound traffic from the Lambda function's private subnet through it.

Show answer & explanation

Answer: Update the producer application to use a high-entropy key, such as a unique delivery ID, as the partition key. Configure a NAT Gateway in a public subnet and route internet-bound traffic from the Lambda function's private subnet through it.

Answer

The correct answer correctly identifies that a high-entropy key like a unique delivery ID is required to distribute writes evenly across all shards, resolving the ProvisionedThroughputExceededException throttling. It also correctly specifies that a NAT Gateway in a public subnet is required to enable outbound internet connectivity for the VPC-enabled Lambda function so that it can reach the third-party API.

Step-by-Step Solution

Analyze the cause of ProvisionedThroughputExceededException.

The current partition key is the region name, which has very low entropy. During peak hours, a large volume of writes goes to the same region, directing all traffic to a single shard (hot shard) and causing write throttling.

Kinesis routes records to shards based on the hash of the partition key; low entropy partition keys lead to uneven distribution.

Select a proper partition key strategy.

Using a unique delivery ID as the partition key provides high entropy, distributing writes evenly across all available shards.

High-entropy keys ensure balanced utilization of stream throughput capacity.

Analyze the Lambda function's connectivity issue.

The Lambda function is in private subnets and lacks internet connectivity to call the external third-party API.

VPC-enabled Lambda functions require a NAT Gateway configured in a public subnet with routing rules on the private subnet to connect to the public internet.

Key Concept

Handling Kinesis Data Stream hot shards using high-entropy partition keys, and configuring outbound internet access for Lambda functions running inside a VPC.

Question 382Question →

A developer is configuring an AWS Lambda function to process messages from an Amazon SQS queue using an event source mapping. The Lambda function has an execution role with the following permissions policy attached:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"sqs:ReceiveMessage",
"sqs:DeleteMessage"
],
"Resource": "arn:aws:sqs:us-east-1:123456789012:ProcessQueue"
}
]
}

When the developer attempts to create the event source mapping, the operation fails with an error indicating that the Lambda function does not have sufficient permissions to read from the queue.

Which of the following actions should the developer take to successfully configure the event source mapping?

Add the "sqs:GetQueueAttributes" action to the statement in the Lambda execution role's permissions policy.

Modify the trust policy of the Lambda execution role to list "sqs.amazonaws.com" as the principal allowed to perform the "sts:AssumeRole" action.

Add a statement to the SQS queue's resource-based policy that allows the Lambda execution role to perform the "sts:AssumeRole" action on the queue.

Modify the Lambda function code to initialize the AWS SDK client by retrieving and hardcoding temporary access keys from the queue's metadata attributes.

Show answer & explanation

Answer: Add the "sqs:GetQueueAttributes" action to the statement in the Lambda execution role's permissions policy.

Answer

Add the "sqs:GetQueueAttributes" action to the statement in the Lambda execution role's permissions policy.

The correct answer is correct because AWS Lambda requires the `sqs:GetQueueAttributes` permission in addition to `sqs:ReceiveMessage` and `sqs:DeleteMessage` to set up and manage an SQS event source mapping successfully. This permission allows Lambda to read parameters such as the visibility timeout and approximate message count.

Step-by-Step Solution

Analyze the error and permissions required for SQS event source mapping.

Identify that Lambda requires three permissions to poll SQS: ReceiveMessage, DeleteMessage, and GetQueueAttributes.

The Lambda service needs to query the queue parameters to scale polling and read messages properly.

Compare the current policy with the required permissions list.

The current permissions policy allows only sqs:ReceiveMessage and sqs:DeleteMessage, and is missing sqs:GetQueueAttributes.

This comparison identifies the missing permission cause of the configuration failure.

Select the resolution to append the missing permission.

Add the 'sqs:GetQueueAttributes' action to the existing IAM policy attached to the Lambda execution role.

This updates the permissions policy to grant all necessary access for the event source mapping.

Key Concept

Permissions required for SQS event source mappings in Lambda execution roles

Estimated Time:1m 30s

Question 383Question →

An application deployed on AWS Fargate publishes high-throughput security audit logs to an Amazon Kinesis Data Stream. An AWS Lambda function is configured to process the stream records in real-time. The Lambda function is deployed within private subnets of a VPC in order to access an internal Amazon RDS database. However, the Lambda function must also make outbound HTTPS calls to an external third-party security API to validate metadata.

During a high-traffic event, the developer notices two issues:
1. The Lambda function fails to connect to the external API, resulting in connection timeouts.
2. The Kinesis producer on Fargate receives ProvisionedThroughputExceededException errors on specific shards, even though the total stream ingestion rate is well below the overall provisioned limit.

Which two actions should the developer take to resolve these issues? (Select two.)

Select all that apply

Configure a NAT Gateway in a public subnet of the VPC and update the private subnet's route table to route outbound internet traffic through the NAT Gateway.

Update the Fargate producer application to use a high-cardinality identifier, such as a combination of UserID and a high-resolution timestamp, as the Kinesis partition key.

Increase the Lambda function's execution timeout configuration to 25 minutes to allow more time for the connection pool to clear and API calls to complete.

Modify the Fargate producer application to write all logs using a constant static partition key value to ensure that partition assignment is uniform.

Associate the Lambda function with a public subnet and enable the auto-assign public IP setting in the Lambda configuration to allow direct outbound internet routing.

Show answer & explanation

Answer: Configure a NAT Gateway in a public subnet of the VPC and update the private subnet's route table to route outbound internet traffic through the NAT Gateway.; Update the Fargate producer application to use a high-cardinality identifier, such as a combination of UserID and a high-resolution timestamp, as the Kinesis partition key.

Answer

Configure a NAT Gateway in a public subnet of the VPC to route outbound internet traffic from the private subnets, and update the Fargate producer application to use a high-cardinality Kinesis partition key combining UserID and a timestamp.

To resolve the Lambda connectivity issue, the function needs a path to the internet. Because it resides in a private VPC subnet to access RDS, it must route outbound traffic through a NAT Gateway located in a public subnet. To resolve the Kinesis throttling issue, the producer must use a high-cardinality partition key (like a UserID and timestamp combination) to distribute records evenly across all available shards, avoiding hot shards.

Step-by-Step Solution

Analyze the network path for the Lambda function in the private subnet.

Identify that the Lambda function lacks internet access because private subnets cannot route directly to the Internet Gateway without a NAT Gateway.

Since the external API resides on the public internet, a NAT Gateway is required to translate private IP addresses to a public IP.

Identify the cause of Kinesis ProvisionedThroughputExceededException under low aggregate load.

Determine that specific shards are hot due to an uneven distribution of records.

Hot shards occur when the partition key has low entropy, mapping too many writes to the same shard.

Select the correct partitioning strategy to spread the load.

Implement a high-entropy partition key (UserID + timestamp) so that hash values are distributed evenly across the key space.

This utilizes all provisioned shards in the Kinesis stream, resolving individual shard write throttling.

Key Concept

VPC internet connectivity for Lambda functions and high-entropy partition key design for Kinesis Data Streams.

Estimated Time:2m 30s

Question 384Question →

A developer is building a fleet management application that tracks real-time GPS location updates from delivery trucks. To build accurate route histories, the location updates for each individual truck must be processed in the exact order they are sent by the vehicle. However, updates from different trucks can be processed concurrently. The developer plans to use AWS integration services to decouple the data ingestion from the processing backend.

Which configuration will meet these requirements while maximizing scalability and throughput?

Configure an Amazon SNS FIFO topic and subscribe an Amazon SQS FIFO queue to it. Set the Message Group ID to the truck's unique identifier when publishing updates to the SNS FIFO topic.

Ingest the location updates using an Amazon Kinesis Data Stream, and configure a static string as the partition key for all records to ensure they are processed sequentially by a single consumer.

Configure a standard Amazon SNS topic subscribed to a standard Amazon SQS queue, and set the queue's visibility timeout to

0

seconds to ensure that messages are immediately visible and processed in arrival order.

Configure a standard Amazon SQS queue that triggers an AWS Lambda function, and store the last processed sequence number in the Lambda function's global variables to track and re-order updates in memory.

Show answer & explanation

Answer: Configure an Amazon SNS FIFO topic and subscribe an Amazon SQS FIFO queue to it. Set the Message Group ID to the truck's unique identifier when publishing updates to the SNS FIFO topic.

Answer

Configure an Amazon SNS FIFO topic and subscribe an Amazon SQS FIFO queue to it. Set the Message Group ID to the truck's unique identifier when publishing updates to the SNS FIFO topic.

Using an Amazon SNS FIFO topic subscribed to an Amazon SQS FIFO queue guarantees ordered message delivery. By setting the Message Group ID to the truck's unique identifier, messages for a specific truck are grouped together and processed sequentially, while messages with different Message Group IDs (other trucks) are processed in parallel. This configuration satisfies the ordering constraint per truck while maintaining high concurrency across the fleet.

Step-by-Step Solution

Select the appropriate messaging queue and topic type that supports ordering.

Amazon SNS FIFO and Amazon SQS FIFO are selected, as standard SQS queues do not guarantee first-in, first-out ordering.

FIFO delivery is a strict requirement for constructing accurate route histories per truck.

Determine the logical partition key for ordered processing.

The truck's unique identifier is selected as the Message Group ID.

Using the truck ID as the Message Group ID guarantees that location updates for any single truck are processed in sequence, while allowing concurrent processing of messages belonging to different trucks.

Configure the subscriber endpoint integration.

The Amazon SQS FIFO queue is subscribed to the Amazon SNS FIFO topic.

This allows fanout capability if additional downstream consumers need ordered messages, while ensuring that the SQS queue consumes messages in the correct sequence.

Key Concept

Ordering and parallelism in SQS FIFO and SNS FIFO using Message Group IDs

Estimated Time:1m 30s

Question 385Question →

A developer is configuring a GET method on a REST API in Amazon API Gateway using a Lambda custom integration (non-proxy integration). When the backend AWS Lambda function encounters an invalid input parameter, it returns an error with the message `InvalidParameter`. The client currently receives an HTTP $200$ OK response containing the error message. The developer wants the API Gateway endpoint to return an HTTP $400$ Bad Request status code when this error occurs.

Which configuration steps should the developer take in API Gateway to map this error?

Configure a mapping template in the Integration Request settings to match the string `InvalidParameter` and override the response status code to

400

Enable Lambda Proxy Integration in the Integration Request, then configure an HTTP

400

status code in the Method Response and map the error message in the Integration Response.

Define an HTTP

400

response in the Method Response settings. Under the Integration Response settings, create a response with the Lambda Error Regex set to `.*InvalidParameter.*` and associate it with the HTTP

400

Method Response.

Configure a custom Lambda authorizer for the GET method to inspect the backend response and return a policy that generates an HTTP

400

Gateway Response.

Show answer & explanation

Answer: Define an HTTP $400$ response in the Method Response settings. Under the Integration Response settings, create a response with the Lambda Error Regex set to `.*InvalidParameter.*` and associate it with the HTTP $400$ Method Response.

Answer

Define an HTTP 400 response in the Method Response settings, and under the Integration Response settings, create a response with the Lambda Error Regex set to match the error string and associate it with the HTTP 400 Method Response.

In a Lambda custom (non-proxy) integration, mapping a backend Lambda error to a specific HTTP status code requires two steps: first, declaring the target HTTP status code (such as

400

) in the Method Response configuration, and second, setting up an Integration Response with a regular expression (Lambda Error Regex) that matches the error message string returned by Lambda (e.g., `.*InvalidParameter.*`) and linking it to the declared Method Response.

Step-by-Step Solution

Add an HTTP

400

response code to the Method Response settings of the API Gateway method configuration.

This registers the HTTP

400

status code as a valid output that API Gateway can return to the client.

API Gateway requires all status codes returned by a custom integration to be defined in the Method Response first.

Add an Integration Response and configure the Lambda Error Regex to match the pattern `.*InvalidParameter.*`.

This enables API Gateway to parse the `errorMessage` field returned in the Lambda function's error payload and match it using the regular expression.

The Lambda Error Regex matches the error message string returned by AWS Lambda in custom integrations.

Set the Method Response Status of the newly created Integration Response to

400

Requests triggering the regex match will now return an HTTP

400

status code to the client instead of the default HTTP

200

This maps the matched backend error condition to the registered client-side HTTP status code.

Key Concept

Lambda custom (non-proxy) integrations require configuring Method Responses and Integration Responses with Lambda Error Regex to map backend errors to client HTTP status codes.

Estimated Time:1m 30s

Question 386Question →

A developer is configuring a REST API in Amazon API Gateway to integrate with a backend AWS Lambda function. To minimize administrative overhead and avoid writing custom mapping templates, the developer decides to use a Lambda proxy integration. Which TWO requirements must be met to ensure this integration works correctly? (Select TWO.)

Select all that apply

The Lambda function must return a JSON object containing at least statusCode, headers, and a stringified body.

API Gateway automatically passes the entire client request (including headers, query parameters, and body) as a single JSON object to the input event of the Lambda function.

The developer must define Integration Response mappings in API Gateway to map the Lambda output to specific HTTP status codes.

The developer must configure a custom Lambda authorizer to parse incoming query string parameters before passing them to the Lambda function.

The Lambda function must return a raw string containing the HTTP body, and API Gateway will automatically wrap it in a 200 OK status.

Show answer & explanation

Answer: The Lambda function must return a JSON object containing at least statusCode, headers, and a stringified body.; API Gateway automatically passes the entire client request (including headers, query parameters, and body) as a single JSON object to the input event of the Lambda function.

Answer

The Lambda function must return a JSON object containing at least statusCode, headers, and a stringified body; and API Gateway automatically passes the entire client request (including headers, query parameters, and body) as a single JSON object to the input event of the Lambda function.

In a Lambda proxy integration, API Gateway passes the raw client request directly to the Lambda function as a single JSON event structure, removing the need for request mapping templates. On the response path, API Gateway expects the Lambda function to return a specific JSON format containing the status code, headers, and body. If the function returns a raw string or lacks the expected structure, API Gateway will throw a 502 Bad Gateway error.

Step-by-Step Solution

Analyze the integration type selected by the developer, which is Lambda proxy integration.

Identify that Lambda proxy integration requires strict output formatting from the backend and passes the raw request directly to the backend without API Gateway mapping templates.

This establishes the core constraints of proxy integration vs. custom integration.

Evaluate how request data is passed from API Gateway to the backend Lambda function.

Determine that the entire HTTP request payload, including path parameters, query parameters, headers, and body, is mapped to the input event object automatically.

This validates the request-side requirements.

Evaluate the response contract required for Lambda proxy integration.

Determine that the Lambda function must return a specific JSON response containing fields such as statusCode, headers, and a stringified body, otherwise API Gateway will return a 502 Bad Gateway error.

This validates the response-side requirements.

Key Concept

Understanding request and response structure in API Gateway Lambda Proxy integration

Question 387Question →

A developer is implementing a serverless video processing pipeline. When a user uploads a new video, an Amazon SNS topic publishes an event that is fanned out to an Amazon SQS queue. An AWS Lambda function is configured to process messages from this SQS queue and perform CPU-intensive transcoding, which takes approximately 6 minutes per video. During initial testing, the developer notices two issues: some videos are processed multiple times, resulting in duplicate files in the target Amazon S3 bucket, and the Lambda function periodically times out before completing the transcoding task. Which two configuration changes should the developer implement to resolve these issues?

Select all that apply

Increase the visibility timeout of the SQS queue to 42 minutes, following the AWS best practice of setting it to at least six times the Lambda function's timeout.

Increase the execution timeout of the Lambda function to 7 minutes (420 seconds) to allow the transcoding process to complete.

Decrease the SQS queue's visibility timeout to 1 minute to allow other consumers to process failed messages faster.

Decrease the Lambda function's execution timeout to 2 seconds to force rapid execution context recycling.

Hardcode AWS access keys in the Lambda function code to bypass IAM role lookup latency during S3 uploads.

Show answer & explanation

Answer: Increase the visibility timeout of the SQS queue to 42 minutes, following the AWS best practice of setting it to at least six times the Lambda function's timeout.; Increase the execution timeout of the Lambda function to 7 minutes (420 seconds) to allow the transcoding process to complete.

Answer

Increase the visibility timeout of the SQS queue to 42 minutes, and increase the execution timeout of the Lambda function to 7 minutes (420 seconds).

To ensure messages are processed successfully exactly once without duplicate processing, the developer must align the Lambda function execution timeout and the SQS visibility timeout. First, the Lambda execution timeout must be increased to at least 7 minutes so that the 6-minute transcoding task can finish without being killed. Second, the SQS visibility timeout must be increased to at least 42 minutes (six times the Lambda function timeout). This prevents SQS from making the message visible to other consumers while the Lambda function is actively processing it, avoiding duplicate deliveries.

Step-by-Step Solution

Analyze the execution duration of the backend processing task.

The transcoding task takes approximately 6 minutes, which exceeds the default Lambda timeout and standard SQS visibility window.

Identifying the processing duration helps establish the minimum required thresholds for Lambda execution limits and queue visibility configurations.

Adjust the Lambda function's execution timeout to accommodate the workload.

The execution timeout is configured to 7 minutes (420 seconds).

This prevents the Lambda function from being aborted by AWS while the 6-minute transcoding task is running.

Apply AWS best practices to configure the SQS queue's visibility timeout based on the new Lambda timeout.

The SQS queue's visibility timeout is set to 42 minutes (6 times the Lambda timeout).

A visibility timeout of at least six times the function's timeout prevents messages from returning to the queue and being reprocessed by another instance before the active Lambda function has finished processing them.

Key Concept

Configuring SQS visibility timeout in relation to Lambda function timeouts to prevent duplicate message processing.

Question 388Question →

A developer is designing a real-time multiplayer analytics pipeline. A game server fleet publishes telemetry events to a custom Amazon EventBridge event bus. The developer wants to route these events to an Amazon Kinesis Data Stream for session-based aggregation. To prevent write throttling due to uneven distribution of records and ensure EventBridge can successfully publish to the stream, which two configurations must the developer implement?

Select all that apply

Configure the EventBridge target for the Kinesis Data Stream to use a PartitionKeyPath that extracts the game session identifier (e.g., $.detail.game_session_id) from the JSON event payload.

Associate an IAM role with the EventBridge rule target that has a trust policy allowing the events.amazonaws.com service principal to assume the role, and a permissions policy allowing the kinesis:PutRecord action.

Configure the EventBridge target to use a static string prefix as the partition key to guarantee that all telemetry events are ordered sequentially within a single shard.

Associate an IAM role with the EventBridge rule target that has a trust policy allowing the kinesis.amazonaws.com service principal to assume the role, and a permissions policy allowing the events:PutEvents action.

Configure a consumer Lambda function to process the Kinesis Data Stream from a private subnet without configuring a NAT Gateway or VPC endpoint.

Show answer & explanation

Answer: Configure the EventBridge target for the Kinesis Data Stream to use a PartitionKeyPath that extracts the game session identifier (e.g., $.detail.game_session_id) from the JSON event payload.; Associate an IAM role with the EventBridge rule target that has a trust policy allowing the events.amazonaws.com service principal to assume the role, and a permissions policy allowing the kinesis:PutRecord action.

Answer

The developer must configure the EventBridge target to use a PartitionKeyPath that extracts the game session identifier from the JSON payload, and associate an IAM role with the target that trusts the EventBridge service principal and has permissions to put records into the Kinesis stream.

To successfully route events from EventBridge to Kinesis, EventBridge needs permission to write to the Kinesis stream. This is accomplished by creating an IAM role that trusts the EventBridge service principal (events.amazonaws.com) and contains permissions to perform the kinesis:PutRecord action on the target stream. Additionally, to avoid hot shards and write throttling (such as a ProvisionedThroughputExceededException), the partition key must have high cardinality. Using a PartitionKeyPath to extract a dynamic field like the session identifier from the event payload ensures records are evenly distributed across the stream's shards.

Step-by-Step Solution

Analyze EventBridge target security requirements for Kinesis Data Streams.

Determine that EventBridge requires an IAM role with a trust policy for events.amazonaws.com and write access (kinesis:PutRecord) to the target stream.

EventBridge is a regional service that must assume a developer-provided role to publish events directly to a Kinesis stream target.

Analyze Kinesis partitioning strategy to prevent write throttling.

Determine that a dynamic PartitionKeyPath (like $.detail.game_session_id) must be specified in the EventBridge target configuration.

Using high-entropy fields distributes records evenly across multiple shards, preventing ProvisionedThroughputExceededException.

Evaluate network connectivity requirements for downstream consumers.

Ensure the consumer Lambda function has access to Kinesis, which requires internet access via a NAT Gateway or an AWS PrivateLink VPC endpoint if deployed in a private subnet.

Lambda functions inside a VPC require proper route tables and gateways to reach public AWS services.

Key Concept

Stream Processing and Event Routing with Amazon Kinesis and EventBridge

Estimated Time:2m 0s

Question 389Question →

A developer is designing a real-time notification service for a collaborative task management application. The application stores notifications in an Amazon DynamoDB table with the following schema:

- Partition key: `RecipientUserID` (String)
- Sort key: `NotificationTimestamp` (String)
- Attributes: `IsRead` (Boolean), `Message` (String)

The service needs to retrieve only the unread notifications for a specific user, sorted from newest to oldest. The developer implements a `Query` operation on the base table using a `KeyConditionExpression` of $\text{RecipientUserID} = \text{:userId}$ and a `FilterExpression` of $\text{IsRead} = \text{:false}$ .

As the number of read notifications per user grows over time, the application experiences latency spikes and frequently receives `ProvisionedThroughputExceededException` errors, even though the volume of unread notifications remains low. Which approach is the most cost-effective and performant way to optimize this read operation?

Modify the application to write a new attribute `UnreadTimestamp` only for unread notifications, removing it when marked as read. Create a Global Secondary Index (GSI) with `RecipientUserID` as the partition key and `UnreadTimestamp` as the sort key to query unread notifications directly.

Change the operation to a `Scan` on the base table with a `FilterExpression` of

\text{RecipientUserID} = \text{:userId}

and

\text{IsRead} = \text{:false}

to bypass partition-key sorting constraints, and scale up the table's provisioned Read Capacity Units (RCUs).

Keep the current base table query configuration and increase the provisioned Read Capacity Units (RCUs) on the table to handle the capacity consumed by the `FilterExpression`, as the error indicates overall table throughput limits have been reached.

Initialize the AWS SDK client inside the application code by hardcoding high-privilege IAM credentials with a dedicated policy that bypasses read capacity throttling for the target DynamoDB table.

Show answer & explanation

Answer: Modify the application to write a new attribute `UnreadTimestamp` only for unread notifications, removing it when marked as read. Create a Global Secondary Index (GSI) with `RecipientUserID` as the partition key and `UnreadTimestamp` as the sort key to query unread notifications directly.

Answer

The correct answer utilizes a sparse Global Secondary Index (GSI). By writing the sort key attribute `UnreadTimestamp` only for unread notifications and removing it when they are read, the index only contains unread notifications. Querying this GSI returns only the relevant items, significantly reducing RCU consumption and preventing throughput throttling.

Step-by-Step Solution

Analyze base table query behavior and capacity consumption

DynamoDB consumes Read Capacity Units (RCUs) based on the size of all items returned by the key condition expression (RecipientUserID = :userId), before the filter expression (IsRead = :false) is applied. As read notifications grow, this results in high RCU consumption and eventual throttling.

To identify why the current implementation fails to scale and why increasing RCUs on the base table is not the correct solution.

Design a sparse index strategy to filter items at the storage layer

Create a schema modification where an attribute like `UnreadTimestamp` only exists when a notification is unread. When the notification is read, the attribute is deleted.

DynamoDB Global Secondary Indexes (GSIs) are sparse by default: they only contain items that possess both the GSI partition key and sort key. This ensures the index size remains minimal and only contains active unread items.

Configure the GSI keys and query the index

Define the GSI with `RecipientUserID` as the partition key and `UnreadTimestamp` as the sort key. Query the GSI using `RecipientUserID = :userId` to fetch only unread notifications sorted chronologically.

To retrieve the required dataset directly without wasting RCUs on read notifications, achieving optimal performance and cost efficiency.

Key Concept

Sparse Global Secondary Indexes in Amazon DynamoDB

Question 390Question →

An application team is designing a real-time fraud detection system for a mobile payments platform. The application publishes transaction details as JSON events to a custom Amazon EventBridge event bus. A developer must create an EventBridge rule that filters transaction events to identify high-value payments exceeding $5000$ USD and routes them directly to an Amazon Kinesis Data Stream. The solution must ensure that transactions from the same user are processed in the order they occurred, without causing hot shards under normal load, and that the rule has the necessary access to publish to the stream. Which TWO configurations must the developer implement to meet these requirements?

Select all that apply

Configure the EventBridge rule target with the PartitionKeyPath parameter set to $.detail.userId to route events for the same user to the same Kinesis shard.

Create an IAM role with a trust policy that allows the events.amazonaws.com service principal to perform sts:AssumeRole, and a permission policy that grants the role kinesis:PutRecord permissions on the Kinesis stream.

Configure the EventBridge rule target with the PartitionKeyPath parameter set to $.detail.status to group and order all events by their transaction completion status.

Create an IAM role with a permission policy that allows the events.amazonaws.com service principal to perform the sts:AssumeRole action, and a trust policy that allows kinesis:PutRecord on the Kinesis stream.

Route the filtered events from EventBridge to a custom Lambda function deployed in a private VPC subnet with no NAT Gateway or VPC endpoint to forward the records to the Kinesis stream.

Show answer & explanation

Answer: Configure the EventBridge rule target with the PartitionKeyPath parameter set to $.detail.userId to route events for the same user to the same Kinesis shard.; Create an IAM role with a trust policy that allows the events.amazonaws.com service principal to perform sts:AssumeRole, and a permission policy that grants the role kinesis:PutRecord permissions on the Kinesis stream.

Answer

The developer must configure the EventBridge target with a PartitionKeyPath pointing to the user ID payload attribute, and assign an IAM role whose trust policy permits the EventBridge service principal to assume it and whose permissions policy allows writing to the Kinesis stream.

The correct options implement the appropriate target parameters and cross-service permissions. Specifying the user ID as the PartitionKeyPath ensures ordered delivery per user while avoiding hot shards. Providing an IAM role with a trust policy allowing the EventBridge service principal to assume it and permission policy allowing kinesis:PutRecord allows EventBridge to successfully write the filtered events to the Kinesis stream.

Step-by-Step Solution

Evaluate partitioning and ordering constraints.

Identify that Kinesis preserves transaction order within a single shard based on the partition key. To prevent hot shards and guarantee per-user ordering, a high-entropy field like the user ID must be chosen.

Choosing a low-entropy field like transaction status causes uneven shard utilization and fails the user-specific ordering requirement.

Set the target parameters in the EventBridge rule.

Configure the PartitionKeyPath target property using the JSONPath expression $.detail.userId.

This extracts the user ID from the EventBridge event detail payload and applies it as the partition key for Kinesis.

Define cross-service IAM authorization.

Create an IAM role allowing the events.amazonaws.com principal to assume the role, and associate a policy that allows kinesis:PutRecord on the target stream.

EventBridge needs explicit trust configuration to assume the role and permissions to write events to the stream.

Key Concept

Routing events from Amazon EventBridge to Amazon Kinesis Data Streams requires specifying a target JSONPath-based partition key for ordering and shard distribution, along with establishing an IAM trust relationship and permission boundary for EventBridge.

Question 391Question →

A developer is configuring an AWS Lambda function with the execution role `arn:aws:iam::123456789012:role/MyLambdaExecutionRole`. The Lambda function needs to temporarily assume a different IAM role named `arn:aws:iam::123456789012:role/TargetReportingRole` to perform analytical reporting. During execution, the Lambda function code calls the AWS Security Token Service (AWS STS) `AssumeRole` API but fails with an `AccessDenied` error. Which of the following configurations are required to successfully allow this role assumption? (Select TWO.)

Select all that apply

A permission policy attached to MyLambdaExecutionRole that allows the sts:AssumeRole action on the TargetReportingRole resource

A trust policy on TargetReportingRole that allows the principal MyLambdaExecutionRole to perform the sts:AssumeRole action

A trust policy on MyLambdaExecutionRole that allows TargetReportingRole to perform the sts:AssumeRole action

A resource-based policy attached to TargetReportingRole that grants the sts:AssumeRole permission to MyLambdaExecutionRole

Hardcoded temporary credentials of an IAM User with AdministratorAccess initialized directly in the Lambda function code

Show answer & explanation

Answer: A permission policy attached to MyLambdaExecutionRole that allows the sts:AssumeRole action on the TargetReportingRole resource; A trust policy on TargetReportingRole that allows the principal MyLambdaExecutionRole to perform the sts:AssumeRole action

Answer

To allow the Lambda function to assume the target role, you must attach a permission policy to the Lambda execution role allowing the sts:AssumeRole action on the target role's ARN, and configure the target role's trust policy to trust the Lambda execution role.

For an IAM entity to assume an IAM role, two conditions must be met: the caller's identity-based policy must explicitly allow the sts:AssumeRole action on the target role's resource ARN, and the target role's trust policy must list the caller's role ARN as a trusted principal for the sts:AssumeRole action.

Step-by-Step Solution

Authorize the caller (Lambda execution role)

The Lambda execution role is granted identity-based permissions to call the sts:AssumeRole action targeting the TargetReportingRole ARN.

The entity initiating the role assumption must be permitted by its own policies to perform the assumption action.

Configure trust on the destination (TargetReportingRole)

The trust policy of TargetReportingRole is modified to list the Lambda execution role ARN as a trusted principal for the sts:AssumeRole action.

An IAM role must explicitly define and trust the identities that are permitted to assume it.

Key Concept

IAM role assumption requires a two-way configuration: permissions on the caller (identity-based policy) and trust on the receiver (trust policy).

Question 392Question →

A developer is optimizing a backend order-management microservice for a high-volume retail application. The application stores order details in an Amazon DynamoDB table. The base table has `CustomerID` as the partition key and `OrderID` as the sort key. The average size of an item in the base table is $10\text{ KB}$ .

The developer needs to support a new dashboard feature that frequently retrieves the `OrderID`, `OrderDate`, and `TotalAmount` for all orders that have an `OrderStatus` of `BACKORDERED`. These results must be returned chronologically by `OrderDate`. The dashboard is expected to perform $80$ individual query requests per second, each retrieving a single order's projected fields. The dashboard can tolerate eventually consistent data. The average size of the projected attributes (`OrderID`, `OrderDate`, `TotalAmount`) along with the primary keys is $1.5\text{ KB}$ .

Which configuration will meet these requirements with the lowest latency and lowest provisioned Read Capacity Units (RCUs)?

Create a Global Secondary Index (GSI) with `OrderStatus` as the partition key and `OrderDate` as the sort key. Configure the GSI projection type to `ALL`. Provision

120\text{ RCUs}

for the GSI.

Create a Global Secondary Index (GSI) with `OrderStatus` as the partition key and `OrderDate` as the sort key. Configure the GSI projection type to `INCLUDE` and project `TotalAmount`. Provision

40\text{ RCUs}

for the GSI.

Perform a Scan operation on the base table using a FilterExpression on `OrderStatus` to filter for `BACKORDERED` items, and provision

200\text{ RCUs}

on the base table.

Configure the application to query the base table using a FilterExpression on `OrderStatus`, initializing the DynamoDB client by passing hardcoded IAM Access Keys directly into the AWS SDK client constructor.

Show answer & explanation

Answer: Create a Global Secondary Index (GSI) with `OrderStatus` as the partition key and `OrderDate` as the sort key. Configure the GSI projection type to `INCLUDE` and project `TotalAmount`. Provision $40\text{ RCUs}$ for the GSI.

Answer

Create a Global Secondary Index (GSI) with OrderStatus as the partition key and OrderDate as the sort key. Configure the GSI projection type to INCLUDE and project TotalAmount. Provision 40 RCUs for the GSI.

The correct answer recommends creating a Global Secondary Index (GSI) with `OrderStatus` as the partition key and `OrderDate` as the sort key, projecting only the required attributes (`TotalAmount`) via `INCLUDE`. Because the dashboard needs to query across all customers for a specific status, a GSI is required. By projecting only the necessary fields, the index item size remains small (

1.5\text{ KB}

), which rounds up to

4\text{ KB}

for capacity calculations. For eventually consistent reads, each

4\text{ KB}

read request consumes

0.5\text{ RCU}

(

1\text{ RCU}

per 2 reads/sec). Therefore, performing

80

reads per second requires exactly

40\text{ RCUs}

Step-by-Step Solution

Determine the correct indexing strategy to query across different partition keys.

A Global Secondary Index (GSI) with `OrderStatus` as the partition key and `OrderDate` as the sort key is selected.

The base table's partition key is `CustomerID`, but the queries do not specify a customer. An LSI cannot cross partitions, so a GSI is required to query by `OrderStatus` and sort by `OrderDate` across the entire table.

Determine the optimal projection type for the GSI to minimize item size.

The GSI is configured with projection type `INCLUDE` containing the `TotalAmount` attribute.

Projecting only `TotalAmount` keeps the GSI item size small (

1.5\text{ KB}

), because the base table keys (`CustomerID`, `OrderID`) and the GSI keys (`OrderStatus`, `OrderDate`) are automatically projected.

Calculate the required Read Capacity Units (RCUs) for the projected index.

The RCU calculation results in

40\text{ RCUs}

for the GSI.

The projected item size is

1.5\text{ KB}

, which rounds up to the next

4\text{ KB}

increment (

4\text{ KB}

). For eventually consistent reads, 1 RCU performs 2 reads per second. To support

80

reads per second:

\text{RCUs} = 80 / 2 = 40

Key Concept

DynamoDB index selection and Read Capacity Unit (RCU) optimization based on attribute projection and consistency models.

Estimated Time:2m 30s

Question 393Question →

A developer is implementing a serverless integration where an Amazon Simple Queue Service (Amazon SQS) queue triggers an AWS Lambda function to process batch data. Each batch of messages takes approximately 4 minutes to process, and the Lambda function's timeout is configured to 5 minutes. During testing, the developer notices that many messages are being received and processed multiple times by separate Lambda execution environments. Which action should the developer take to prevent these duplicate executions?

Configure the SQS queue's visibility timeout to 3 minutes to match the average batch processing time.

Increase the Amazon SQS queue's visibility timeout to at least 30 minutes.

Increase the AWS Lambda function's timeout to 30 minutes to allow ample time for all retries.

Update the AWS Lambda function's IAM execution role trust policy to grant the sqs:DeleteMessage permission.

Show answer & explanation

Answer: Increase the Amazon SQS queue's visibility timeout to at least 30 minutes.

Answer

Increase the Amazon SQS queue's visibility timeout to at least 30 minutes.

To prevent duplicate processing of SQS messages by Lambda, the SQS queue's visibility timeout must be set to at least 6 times the Lambda function's timeout. Since the Lambda function timeout is 5 minutes, the visibility timeout must be configured to at least 30 minutes (

6 \times 5 = 30

). This ensures messages remain invisible while the Lambda function processes the batch and handles any potential retries.

Step-by-Step Solution

Identify the cause of duplicate message processing.

The issue occurs because the SQS visibility timeout is too short, allowing other execution environments to pull the message before the active Lambda function completes and deletes it.

Since each batch takes 4 minutes and the Lambda timeout is 5 minutes, SQS must keep the messages hidden long enough to cover execution and retry attempts.

Calculate the recommended SQS visibility timeout.

Using the formula

\text{Visibility Timeout} \ge 6 \times \text{Lambda Timeout}

, we calculate

6 \times 5\text{ minutes} = 30\text{ minutes}

AWS recommends a visibility timeout of at least 6 times the Lambda function's timeout to prevent duplicate processing during retries.

Configure the SQS queue with the calculated value.

Setting the SQS queue's visibility timeout to at least 30 minutes resolves the duplicate processing issue.

This guarantees that messages remain invisible in the queue for the entire duration of the Lambda execution and potential retries.

Key Concept

Amazon SQS visibility timeout configuration for AWS Lambda integrations

Question 394Question →

A developer is configuring an AWS Lambda function that must query an Amazon Aurora PostgreSQL database cluster deployed in private subnets within a VPC. The Lambda function also needs to call an external, third-party payment processing API on the public internet. Which network configurations must the developer implement to enable this connectivity? (Select two.)

Select all that apply

Associate the Lambda function with the private subnets where the Amazon Aurora database cluster resides.

Configure a NAT Gateway in a public subnet, and update the route tables of the private subnets to route outbound traffic through the NAT Gateway.

Associate the Lambda function with the public subnets of the VPC to allow direct outbound internet communication.

Update the IAM execution role of the Lambda function with a trust policy that allows the vpc.amazonaws.com service principal to assume the role.

Initialize the database client by hardcoding the DB credentials in the environment variables and using a custom SDK credential provider inside the handler.

Show answer & explanation

Answer: Associate the Lambda function with the private subnets where the Amazon Aurora database cluster resides.; Configure a NAT Gateway in a public subnet, and update the route tables of the private subnets to route outbound traffic through the NAT Gateway.

Answer

Associate the Lambda function with the private subnets where the Amazon Aurora database cluster resides, and configure a NAT Gateway in a public subnet while updating the route tables of the private subnets to route outbound traffic through the NAT Gateway.

To connect the Lambda function to the database, it must be integrated with the VPC and associated with the private subnets where the database resides. To connect to the external payment API from inside the private subnets, a NAT Gateway must be configured in a public subnet, and the private subnet route tables must be updated to route outbound traffic to the NAT Gateway.

Step-by-Step Solution

Analyze the database connectivity requirement.

The Lambda function needs to query an Amazon Aurora database cluster in private subnets. To reach it, the Lambda function must be configured to associate with those private subnets.

This creates Elastic Network Interfaces (ENIs) inside the private subnets, enabling local network communication within the VPC.

Analyze the external API connectivity requirement.

The Lambda function in private subnets requires internet access to reach the third-party API. A NAT Gateway must be set up in a public subnet, and the private subnet route tables must direct 0.0.0.0/0 traffic to it.

This allows outbound-only internet traffic to flow from the private subnets to the public internet.

Key Concept

AWS Lambda VPC networking configuration for internal and external resources

Question 395Question →

A developer is designing a decoupled backend for a ridesharing application to handle completed trip events. When a trip ends, the system publishes a trip event that must be processed by two independent microservices:

1. A trip analytics service that calculates aggregate metrics and consumes messages from an Amazon SQS Standard queue.
2. A financial ledger service that updates customer balances in the exact order the trips occurred, utilizing an Amazon SQS FIFO queue.

The developer wants to implement a fanout pattern using Amazon SNS to distribute these events.

Which architectural configuration will successfully support this integration?

Create an Amazon SNS Standard topic to publish events to the SQS Standard queue, and create a separate Amazon SNS FIFO topic to publish events to the SQS FIFO queue.

Create a single Amazon SNS FIFO topic, subscribe both the SQS Standard queue and the SQS FIFO queue to it, and configure the SQS Standard queue visibility timeout to zero.

Create a single Amazon SNS Standard topic, subscribe the SQS Standard queue to it, and route messages to the SQS FIFO queue via an AWS Lambda function that maintains ordering using persistent execution context variables.

Create a single Amazon SNS Standard topic, subscribe both queues to it, and initialize the downstream AWS SDK clients using static IAM user access keys.

Show answer & explanation

Answer: Create an Amazon SNS Standard topic to publish events to the SQS Standard queue, and create a separate Amazon SNS FIFO topic to publish events to the SQS FIFO queue.

Answer

Create one Amazon SNS Standard topic to publish events to the SQS Standard queue, and create a separate Amazon SNS FIFO topic to publish events to the SQS FIFO queue.

The correct configuration uses two separate SNS topics (one Standard and one FIFO) to publish to their respective SQS queues. This is required because Amazon SNS FIFO topics only support subscriptions from SQS FIFO queues, and Standard SQS queues cannot subscribe to SNS FIFO topics. Similarly, SQS FIFO queues cannot subscribe to Standard SNS topics. To support both downstream consumer types, separate paths must be implemented.

Step-by-Step Solution

Analyze SQS queue requirements.

The analytics service uses a standard SQS queue, whereas the ledger service requires a FIFO SQS queue for strict ordering.

Different downstream services have different order and throughput requirements.

Evaluate Amazon SNS and SQS integration constraints.

Standard SQS queues cannot subscribe to SNS FIFO topics, and SQS FIFO queues cannot subscribe to standard SNS topics.

AWS enforces protocol homogeneity between standard and FIFO tiers to ensure ordering guarantees are maintained.

Formulate the fanout architecture.

Create a standard SNS topic to target the standard SQS queue, and a FIFO SNS topic to target the FIFO SQS queue.

Since a single SNS topic cannot fan out to both queue types due to subscription rules, the publisher must send events to both a standard and a FIFO topic.

Key Concept

Integration compatibility rules between Amazon SNS topics (Standard/FIFO) and Amazon SQS queues (Standard/FIFO).

Question 396Question →

A developer is building a smart home energy monitoring dashboard. The energy usage data is stored in an Amazon DynamoDB table where the partition key is SmartMeterID and the sort key is ReadingTimestamp. The developer needs to retrieve all energy consumption readings for a specific SmartMeterID over the last 7 days to display them on a user dashboard.

Which of the following approaches is the most performant and cost-effective method to retrieve these records?

Execute a Query operation with a KeyConditionExpression that specifies the SmartMeterID and uses a comparison operator on the ReadingTimestamp sort key.

Perform a Scan operation across the entire table, applying a FilterExpression to filter by the target SmartMeterID and ReadingTimestamp range.

Instantiate the DynamoDB client using hardcoded IAM access keys in the code to ensure permissions are resolved quickly, then run a Scan operation with a filter.

Perform a Scan operation, and if a ProvisionedThroughputExceededException occurs, scale up the overall provisioned Read Capacity Units (RCUs) for the table.

Show answer & explanation

Answer: Execute a Query operation with a KeyConditionExpression that specifies the SmartMeterID and uses a comparison operator on the ReadingTimestamp sort key.

Answer

Execute a Query operation with a KeyConditionExpression that specifies the SmartMeterID and uses a comparison operator on the ReadingTimestamp sort key.

The Query operation is the most efficient and cost-effective way to retrieve items from a DynamoDB table when the partition key is known. By specifying the partition key (SmartMeterID) and using a comparison operator on the sort key (ReadingTimestamp) in the KeyConditionExpression, DynamoDB only reads the items that match the criteria, minimizing the consumed Read Capacity Units (RCUs).

Step-by-Step Solution

Identify the primary key structure of the Amazon DynamoDB table.

The partition key is SmartMeterID, and the sort key is ReadingTimestamp.

Knowing the primary key structure determines which retrieval operations (GetItem, Query, or Scan) are supported and efficient.

Determine the data retrieval requirements.

The query needs to target a specific SmartMeterID and a specific range of ReadingTimestamp values (the last 7 days).

This requirement matches the exact structure of a Query operation, which requires an equality comparison on the partition key and optional range comparisons on the sort key.

Select the most efficient operation and define the parameters.

Use the Query API with a KeyConditionExpression that specifies the SmartMeterID and a comparison operator (such as BETWEEN or >) on ReadingTimestamp.

A Query operation only searches and consumes Read Capacity Units (RCUs) for the partition and matching sort key range, unlike a Scan which processes the entire table.

Key Concept

Efficient data retrieval using the DynamoDB Query API vs Scan API

Question 397Question →

A developer is implementing an AWS Lambda function in Node.js to process events. The developer wants to log the count of processed items for each individual invocation. The function code is structured as follows:

javascript
let totalItems = 0;

exports.handler = async (event) => {
totalItems += event.items.length;
console.log(`Processed ${totalItems} items.`);
return { statusCode: 200 };
};

During testing, the developer observes that when the function is invoked repeatedly in short succession, the logged count accumulates across requests rather than reflecting only the items processed in the current invocation.

Which of the following modifications should the developer make to ensure the function correctly logs only the items processed in the current invocation?

Configure the Lambda function's reserved concurrency to 1 to force the execution context to tear down and recreate after each invocation.

Declare the totalItems variable inside the handler function so that it is re-initialized on each invocation.

Associate the Lambda function with a private VPC subnet without a NAT Gateway to prevent execution contexts from sharing global variables.

Increase the visibility timeout of the trigger Amazon SQS queue to exceed the function execution time, forcing the Lambda service to clear the execution context.

Show answer & explanation

Answer: Declare the totalItems variable inside the handler function so that it is re-initialized on each invocation.

Answer

Declare the totalItems variable inside the handler function so that it is re-initialized on each invocation.

Declaring the variable inside the handler function ensures that its scope is limited to a single invocation. AWS Lambda reuses execution contexts to optimize performance on subsequent requests. Variables declared outside the handler (globally) persist across warm start invocations, leading to state leakage and cumulative counts, whereas local variables inside the handler are re-initialized on every execution.

Step-by-Step Solution

Analyze the variable scope and lifecycle of variables declared outside the handler function in AWS Lambda.

Identify that variables declared outside the handler (globally) are preserved in memory across subsequent execution context reuse (warm starts).

AWS Lambda reuses the container/execution context to minimize cold start latency, which keeps global state alive.

Determine the correct place to declare variables that must be isolated and reset per execution.

Move the variable declaration inside the handler block.

Local variable declarations inside the handler function run on every invocation, ensuring they start at 0 each time.

Key Concept

AWS Lambda Execution Context Reuse and Variable Scoping

Estimated Time:1m 30s

Question 398Question →

A developer is designing the data tier for a mobile multiplayer game. Player match logs are stored in an Amazon DynamoDB table with `PlayerID` as the partition key and `MatchID` as the sort key. The table contains millions of records. The game client needs to perform two operations:

1. Retrieve all matches played by a specific player within the last $7$ days.
2. Retrieve all matches across the entire game where a player scored more than $10,000$ points.

Which TWO strategies should the developer implement to support these access patterns with the lowest read latency and minimum consumption of Read Capacity Units (RCUs)?

Select all that apply

Create a Global Secondary Index (GSI) with `PlayerID` as the partition key and `MatchTimestamp` as the sort key, and query the GSI to retrieve the player's recent matches.

Implement a sparse Global Secondary Index (GSI) by writing a `HighScoreThreshold` attribute only when a score exceeds

10,000

, and query the GSI to retrieve the high-scoring matches.

Perform a `Scan` operation on the base table with a `FilterExpression` on `MatchTimestamp` to retrieve the player's recent matches.

Perform a `Scan` operation on the base table with a `FilterExpression` on `Score` to identify matches exceeding

10,000

points.

Initialize the DynamoDB client in the application code by hardcoding IAM User credentials to authorize the queries.

Show answer & explanation

Answer: Create a Global Secondary Index (GSI) with `PlayerID` as the partition key and `MatchTimestamp` as the sort key, and query the GSI to retrieve the player's recent matches.; Implement a sparse Global Secondary Index (GSI) by writing a `HighScoreThreshold` attribute only when a score exceeds $10,000$ , and query the GSI to retrieve the high-scoring matches.

Answer

The developer should create a Global Secondary Index (GSI) with PlayerID as the partition key and MatchTimestamp as the sort key to retrieve a player's recent matches. Additionally, they should implement a sparse GSI by writing a HighScoreThreshold attribute only when a score exceeds 10,000, and query this GSI for high-scoring matches.

Querying a Global Secondary Index (GSI) configured with PlayerID as the partition key and MatchTimestamp as the sort key allows the application to perform a highly efficient query to retrieve recent matches for a specific player. Additionally, creating a sparse GSI by conditionally writing a HighScoreThreshold attribute only when a score exceeds 10,000 enables the application to query only the high-scoring matches, bypassing the need to perform a costly scan of the entire table.

Step-by-Step Solution

Analyze the access pattern for retrieving matches for a specific player within a

7

-day window.

Identify that the base table only supports querying by PlayerID and MatchID. Filtering by MatchTimestamp on the base table requires a Scan or a Query with a FilterExpression, both of which read extra data and waste RCU.

To retrieve only the relevant matches directly, we must place MatchTimestamp as the sort key in a secondary index.

Create a Global Secondary Index (GSI) to resolve the first access pattern.

Define a GSI with PlayerID as the partition key and MatchTimestamp as the sort key. Use a Query operation on this GSI with a KeyConditionExpression to fetch matches within the

7

-day range.

This allows DynamoDB to read only the items that match the criteria, minimizing RCU consumption.

Analyze the access pattern for retrieving high-scoring matches across all players.

Scanning the base table is highly inefficient because it evaluates every record. We need a way to only index and retrieve records where the score is greater than

10,000

Using a sparse index will exclude low-scoring matches from the GSI, significantly reducing index size and retrieval costs.

Implement a sparse GSI for the second access pattern.

Modify the application logic to write a HighScoreThreshold attribute (e.g., containing the score) to the base table item only if the score exceeds

10,000

. Create a GSI with HighScoreThreshold as the partition key.

Items without the HighScoreThreshold attribute will not be indexed in the GSI, making the GSI sparse. Querying this sparse GSI directly targets high-scoring matches without scanning other records.

Key Concept

Optimizing read operations in DynamoDB using Global Secondary Indexes (GSIs) and sparse indexes instead of performing full table Scan operations.

Estimated Time:2m 0s

Question 399Question →

A developer is implementing a microservices-based subscription management system. When a customer's subscription changes, a backend service publishes a message. This message must be processed by three downstream components:

* A billing service that requires messages to be processed in the exact order they occurred to prevent payment conflicts, with zero duplicate deliveries.
* An email notification service that receives all subscription change events to send customer alerts.
* A marketing analytics engine that only processes subscription upgrade events.

Which combination of configuration steps will satisfy these requirements? (Select TWO.)

Select all that apply

Create an Amazon SNS FIFO topic to receive the subscription events, and subscribe Amazon SQS FIFO queues for the billing, email, and analytics services to this topic.

Configure an Amazon SNS subscription filter policy on the analytics service's queue subscription to only accept messages where the event type attribute is set to 'upgrade'.

Set the billing queue's visibility timeout to be lower than the billing application's average message processing time to guarantee rapid sequential processing of subsequent messages.

Configure an Amazon Kinesis Data Stream with a static partition key string value to order and stream all events to the downstream consumer applications.

Hardcode the AWS credentials within the subscription service initialization code to establish a faster, direct connection to the SNS topic.

Show answer & explanation

Answer: Create an Amazon SNS FIFO topic to receive the subscription events, and subscribe Amazon SQS FIFO queues for the billing, email, and analytics services to this topic.; Configure an Amazon SNS subscription filter policy on the analytics service's queue subscription to only accept messages where the event type attribute is set to 'upgrade'.

Answer

Create an Amazon SNS FIFO topic to receive the subscription events, and subscribe Amazon SQS FIFO queues for the billing, email, and analytics services to this topic; and configure an Amazon SNS subscription filter policy on the analytics service's queue subscription to only accept messages where the event type attribute is set to 'upgrade'.

To satisfy the requirements of message ordering and deduplication for the billing service, an Amazon SNS FIFO topic combined with Amazon SQS FIFO queues must be used. SNS FIFO topics only support SQS FIFO queues as subscribers. Therefore, SQS FIFO queues must be configured for all downstream services subscribing to the FIFO topic. To ensure the marketing analytics engine only processes subscription upgrade events, a subscription filter policy should be configured on the analytics service's subscription to inspect message attributes and filter out non-upgrade events.

Step-by-Step Solution

Analyze the message ordering and deduplication requirements for the billing service.

Identify that end-to-end FIFO (First-In-First-Out) ordering and exactly-once processing require Amazon SNS FIFO and Amazon SQS FIFO.

Standard SNS and SQS services do not guarantee strict ordering or duplicate prevention.

Determine the subscriber requirements for the SNS FIFO topic.

Recognize that Amazon SNS FIFO topics only support Amazon SQS FIFO queues as subscribers.

All downstream queues (billing, email, and analytics) must be SQS FIFO queues to subscribe to the SNS FIFO topic.

Apply event filtering for the marketing analytics engine.

Implement an SNS subscription filter policy on the analytics queue subscription to filter messages based on the event type attribute.

This offloads the filtering logic from the application to SNS, ensuring only upgrade events are delivered to the analytics queue.

Key Concept

Decoupling microservices using Amazon SNS FIFO topics and Amazon SQS FIFO queues with subscription filter policies.

Question 400Question →

A developer is designing an AWS Lambda function that processes payment transactions. The function needs to retrieve a payment gateway API key from AWS Systems Manager Parameter Store and write transaction status records to an Amazon DynamoDB table. The developer wants to optimize the function's startup time and runtime performance to handle sudden traffic spikes.

Which two configuration or coding practices should the developer implement to meet these requirements? (Select two.)

Select all that apply

Initialize the DynamoDB client outside of the Lambda handler function to enable execution context reuse.

Retrieve the API key from Systems Manager Parameter Store outside of the Lambda handler function during the initialization phase.

Hardcode the payment API key directly in the Lambda function's source code to avoid runtime parameter fetching.

Re-initialize the DynamoDB client inside the Lambda handler function for each invocation to ensure connections are closed cleanly.

Deploy the Lambda function in a public subnet of a VPC with a direct route to an Internet Gateway to bypass routing latency to AWS endpoints.

Show answer & explanation

Answer: Initialize the DynamoDB client outside of the Lambda handler function to enable execution context reuse.; Retrieve the API key from Systems Manager Parameter Store outside of the Lambda handler function during the initialization phase.

Answer

Initialize the DynamoDB client outside of the Lambda handler function, and retrieve the API key from Systems Manager Parameter Store outside of the Lambda handler function during the initialization phase.

Initializing the DynamoDB client and fetching parameters outside the handler leverages the Lambda execution environment lifecycle. Since the execution context is reused for warm starts, these initialization actions occur only during the cold start phase, saving significant time on subsequent invocations.

Step-by-Step Solution

Analyze execution context reuse benefits in AWS Lambda.

Identify that variables and SDK clients initialized outside the handler function persist across multiple invocations in the same execution environment container.

This reduces the overhead of re-establishing TCP connections and performing initialization logic on every invocation.

Evaluate the placement of the Parameter Store lookup.

Placing the Parameter Store lookup outside the handler caches the API key in memory, avoiding redundant network requests during subsequent invocations.

Parameter caching in the global scope optimizes execution time and reduces costs related to API calls.

Address security and networking constraints.

Reject hardcoding credentials because of security risks. Reject deploying the Lambda function to a public subnet to access AWS services, because Lambda functions in a VPC require a NAT Gateway or VPC endpoint to route traffic to the internet/AWS endpoints.

Standard VPC routing requires private subnets with a NAT Gateway or VPC endpoints for Lambda functions to access external services safely.

Key Concept

Execution context reuse for caching SDK clients and configuration parameters.

PreviousPage 20 / 78Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept