All practice questions

1542 questions

All types1,542 Multiple choice782 Multiple select746 Ordering14

A developer is building a corporate timesheet application where employee hours are stored in an Amazon DynamoDB table. The table uses `EmployeeID` as the partition key and `LogDate` as the sort key. The application needs to retrieve and display a list of all work logs for a specific employee during the month of June 2026. The operation must be optimized to minimize latency and Read Capacity Unit (RCU) consumption.

Which DynamoDB configuration and operation should the developer use to retrieve this data?

Perform a Query operation using the KeyConditionExpression parameter to specify both the EmployeeID partition key and a range condition on the LogDate sort key.

Perform a Query operation using the KeyConditionExpression parameter to specify the EmployeeID partition key, and apply a FilterExpression to filter the LogDate range.

Perform a Scan operation using the FilterExpression parameter to specify both the EmployeeID partition key and the LogDate range.

Perform a Scan operation with a ProjectionExpression to limit the returned attributes to EmployeeID and LogDate, then filter the logs on the client side.

Show answer & explanation

Answer: Perform a Query operation using the KeyConditionExpression parameter to specify both the EmployeeID partition key and a range condition on the LogDate sort key.

Answer

Perform a Query operation using the KeyConditionExpression parameter to specify both the EmployeeID partition key and a range condition on the LogDate sort key.

The correct option is the one suggesting a Query operation with KeyConditionExpression for both the partition and sort keys. In DynamoDB, a Query operation finds items based on primary key values. By specifying both the partition key (EmployeeID) and a range condition on the sort key (LogDate) in the KeyConditionExpression, DynamoDB only reads the items that match both conditions. This minimizes the number of items read from physical storage, resulting in low latency and minimal Read Capacity Unit (RCU) consumption.

Step-by-Step Solution

Analyze the table schema and retrieval requirements.

The table has a composite primary key: partition key (EmployeeID) and sort key (LogDate). The goal is to retrieve items for one specific employee within a specific date range (June 2026).

Understanding the primary key structure allows us to determine if we can use a Query instead of a Scan.

Evaluate Query vs. Scan operations.

A Scan reads the entire table. A Query searches only the specific partition associated with the EmployeeID.

Since the partition key (EmployeeID) is known, Query is the correct and most cost-effective operation.

Determine the optimal way to filter the sort key (LogDate).

Using KeyConditionExpression for both EmployeeID and LogDate filters items before reading. Using a FilterExpression filters them after reading, which consumes unnecessary RCUs.

To minimize RCU consumption, the sort key range must be defined inside KeyConditionExpression.

Key Concept

DynamoDB Query operations and RCU optimization via KeyConditionExpression

Question 462Question →

A logistics company uses an Amazon DynamoDB table to store tracking updates for shipments. The table uses ShipmentID as the partition key and Timestamp as the sort key. The application needs to retrieve all tracking updates for a specific ShipmentID that occurred within a given 48-hour window. The table contains millions of items representing shipments from the last year. How should the developer implement this retrieval to optimize read throughput and minimize latency?

Perform a Query operation specifying the ShipmentID in the KeyConditionExpression and a range condition on the Timestamp sort key.

Perform a Scan operation on the table and apply a FilterExpression on ShipmentID and Timestamp to filter out the undesired shipments and dates.

Perform a parallel Scan operation using segments to divide the table, and filter the returned items using the application code.

Initialize the DynamoDB client by embedding an IAM User's access key and secret key directly in the client configuration, and execute a Scan operation.

Show answer & explanation

Answer: Perform a Query operation specifying the ShipmentID in the KeyConditionExpression and a range condition on the Timestamp sort key.

Answer

Perform a Query operation specifying the ShipmentID in the KeyConditionExpression and a range condition on the Timestamp sort key.

Performing a Query operation specifying the ShipmentID in the KeyConditionExpression and a range condition on the Timestamp sort key is the most efficient method. A Query directly locates the items using the partition key index and filters them based on the sort key range, consuming Read Capacity Units (RCUs) only for the returned items.

Step-by-Step Solution

Identify the primary key structure of the DynamoDB table.

The table has a composite primary key consisting of ShipmentID (partition key) and Timestamp (sort key).

Understanding the key structure is necessary to determine if a Query operation is possible.

Evaluate the retrieval requirements against DynamoDB read operations.

The requirement is to fetch items for a specific partition key (ShipmentID) and a range of the sort key (Timestamp).

DynamoDB Query operations allow querying a specific partition key with optional sort key conditions, which matches the requirements.

Choose the most efficient operation and configuration.

Select a Query operation rather than a Scan, using KeyConditionExpression to specify both partition key and sort key conditions.

Query only consumes Read Capacity Units (RCUs) for the items read, whereas Scan reads the entire table, making Query far more efficient and lower latency.

Key Concept

Query vs Scan operations and key design in DynamoDB

Estimated Time:1m 30s

Question 463Question →

An organization's monorepo structure places the build configuration for the payment module in a file named buildspec-payment.yml inside the /services/payment/ directory. The module requires a payment gateway API key that is securely stored in AWS Secrets Manager. During the build, CodeBuild fails to locate the build configuration, and the application cannot retrieve the API key. Which two steps must be performed to resolve these failures? (Select TWO.)

Select all that apply

Configure the buildspec path in the CodeBuild project settings to point directly to services/payment/buildspec-payment.yml.

Define the API key variable under the secrets-manager block in the env phase of the buildspec, and grant the CodeBuild service role the secretsmanager:GetSecretValue permission.

Change the buildspec file name to buildspec.yml and keep it in the /services/payment/ directory, because CodeBuild automatically searches all subdirectories for files named buildspec.yml.

Modify the trust relationship of the CodeBuild service role to grant the Secrets Manager service principal (secretsmanager.amazonaws.com) permission to assume the role.

Define the API key variable under the parameter-store block in the env phase of the buildspec, and grant the CodeBuild service role the ssm:GetParameters permission.

Show answer & explanation

Answer: Configure the buildspec path in the CodeBuild project settings to point directly to services/payment/buildspec-payment.yml.; Define the API key variable under the secrets-manager block in the env phase of the buildspec, and grant the CodeBuild service role the secretsmanager:GetSecretValue permission.

Answer

To resolve the build failures, the buildspec path in the CodeBuild project settings must be updated to services/payment/buildspec-payment.yml, and the API key must be retrieved using the secrets-manager block under the env section of the buildspec, with the service role granted the secretsmanager:GetSecretValue permission.

Updating the project settings with the exact custom path allows CodeBuild to find the buildspec. Referencing the secret in the secrets-manager block in the env phase, combined with the secretsmanager:GetSecretValue API permissions in the execution role, allows CodeBuild to retrieve the API key.

Step-by-Step Solution

Configure the custom buildspec location

CodeBuild will correctly read the buildspec-payment.yml file located in the subdirectory during the initialization phase.

By default, CodeBuild only scans the root folder for buildspec.yml. A path override is required for subdirectories or custom file names.

Update the buildspec environment section

CodeBuild natively parses the API key from AWS Secrets Manager and sets it as an environment variable.

Specifying the secrets-manager block under the env phase allows CodeBuild to automatically fetch the secret during the build run.

Grant the necessary IAM permissions to the CodeBuild service role

The API key is successfully decrypted and made available to the build script.

Without secretsmanager:GetSecretValue permissions, CodeBuild cannot decrypt the secret, causing the build to fail.

Key Concept

AWS CodeBuild project configurations for custom buildspec paths and integration with AWS Secrets Manager

Question 464Question →

A mobile application client receives a 502 Bad Gateway error when calling a REST API endpoint. The endpoint is configured with Amazon API Gateway using a Lambda Proxy integration. Upon reviewing the Amazon CloudWatch logs, the developer confirms that the backend Lambda function executed successfully and completed without timing out. Which of the following is the most likely cause of this error?

The REST API resource does not have CORS enabled, which blocked API Gateway from processing the backend response.

The Lambda function is returning a raw string response instead of a JSON object containing the required statusCode field.

The developer did not configure an integration response mapping template in API Gateway to convert the Lambda output.

The Lambda function's IAM execution role lacks the permissions to invoke the API Gateway endpoint.

Show answer & explanation

Answer: The Lambda function is returning a raw string response instead of a JSON object containing the required statusCode field.

Answer

The Lambda function is returning a raw string response instead of a JSON object containing the required statusCode field.

The correct answer is correct because under a Lambda Proxy integration, API Gateway expects the backend Lambda function to return a JSON object containing specific keys, including 'statusCode' and 'body'. If the function returns a raw text string, API Gateway fails to parse the output and returns a 502 Bad Gateway error to the client.

Step-by-Step Solution

Analyze the error symptoms and configuration.

The client gets a 502 Bad Gateway error, but the backend Lambda function (integrated via Lambda Proxy integration) executes successfully according to CloudWatch logs.

This indicates the connection from API Gateway to Lambda was successful, but API Gateway failed to process the response returned by Lambda.

Identify the response requirements for Lambda Proxy integration.

For Lambda Proxy integrations, API Gateway expects the backend Lambda function to return a JSON object with specific fields, such as 'statusCode', 'body', and 'headers'.

API Gateway relies on these fields to construct the HTTP response to the client.

Determine the cause of the failure.

If the Lambda function returns a raw string or JSON that does not match this format (e.g., missing the 'statusCode' field), API Gateway cannot parse it and returns a 502 Bad Gateway error.

The function executed successfully, so the issue must lie in the format of the returned payload.

Key Concept

API Gateway Lambda Proxy Integration response format requirements

Question 465Question →

A developer is creating an Amazon ECS task definition to deploy a containerized application on AWS Fargate. The application needs to pull its container image from a private Amazon ECR repository in the same AWS account. Additionally, the application code itself must make calls to the Amazon Translate API to translate user reviews at runtime. Which configuration of IAM roles will allow the task to pull the image and run successfully with the least privilege?

Specify an IAM role in the taskExecutionRoleArn parameter that allows the Amazon ECS agent to pull the image from Amazon ECR, and specify a different IAM role in the taskRoleArn parameter that allows the containerized application to call the Amazon Translate API.

Specify an IAM role in the taskRoleArn parameter that allows ECR image retrieval, and specify a different IAM role in the taskExecutionRoleArn parameter that allows the containerized application to call the Amazon Translate API.

Specify an IAM role in the taskRoleArn parameter that allows Amazon Translate access with a trust policy that trusts the ec2.amazonaws.com service, and specify an IAM role in the taskExecutionRoleArn parameter that allows ECR image retrieval.

Specify an IAM role in the taskExecutionRoleArn parameter that allows ECR image retrieval, and configure the container environment variables to pass the AWS access key and secret access key of an IAM user with Amazon Translate permissions.

Show answer & explanation

Answer: Specify an IAM role in the taskExecutionRoleArn parameter that allows the Amazon ECS agent to pull the image from Amazon ECR, and specify a different IAM role in the taskRoleArn parameter that allows the containerized application to call the Amazon Translate API.

Answer

The correct configuration uses the Task Execution Role (taskExecutionRoleArn) to grant the Amazon ECS agent permissions to pull the image from Amazon ECR, and uses the Task Role (taskRoleArn) to grant the application running inside the container permission to call the Amazon Translate API. This respects the least-privilege model and aligns with how ECS handles agent-level versus container-level permissions.

Step-by-Step Solution

Determine the resource access required by the ECS agent versus the application container.

The Amazon ECS agent requires access to Amazon ECR to pull the image. The application code inside the container requires access to Amazon Translate.

The container infrastructure must pull the container image before startup. Once the container is running, the application code makes outgoing calls to other AWS APIs.

Map the access requirements to the correct ECS task definition role parameters.

Assign ECR access to the Task Execution Role (taskExecutionRoleArn) and Translate access to the Task Role (taskRoleArn).

The Task Execution Role is for ECS agent infrastructure activities (ECR pull, CloudWatch log streams). The Task Role is for the containerized application's own SDK calls.

Verify that the trust relationships are configured correctly and that credentials are secure.

Ensure both roles trust the 'ecs-tasks.amazonaws.com' service principal, avoiding the use of hardcoded IAM user keys.

ECS tasks must be allowed to assume these roles. Utilizing the Task Role provides automated credential rotation, ensuring security.

Key Concept

Distinction between ECS Task Role and ECS Task Execution Role

Question 466Question →

A development team has configured an AWS CodeBuild project to run inside a private subnet of a VPC. During the build execution, the project fails because it cannot download external package dependencies from the internet. Additionally, subsequent runs are taking a long time because the dependencies are fully downloaded from scratch each time. Which two actions should the developer take to resolve the internet connectivity issue and speed up the builds? (Select TWO.)

Select all that apply

Configure a NAT gateway in a public subnet of the VPC, and update the private subnet's route table to route

0.0.0.0/0

traffic through the NAT gateway.

Enable local dependency caching in the CodeBuild project settings, and specify the package manager's cache directory in the `cache` section of the `buildspec.yml` file.

Move the `buildspec.yml` file into a subdirectory named `.ebextensions` at the root of the source directory to automatically enable caching.

Add a trust policy to the CodeBuild service role that explicitly allows Systems Manager Parameter Store to assume the role and push cached dependencies.

Configure AWS Secrets Manager to store the compiled dependency binaries as secrets to enable automatic encryption and rotation between builds.

Show answer & explanation

Answer: Configure a NAT gateway in a public subnet of the VPC, and update the private subnet's route table to route $0.0.0.0/0$ traffic through the NAT gateway.; Enable local dependency caching in the CodeBuild project settings, and specify the package manager's cache directory in the `cache` section of the `buildspec.yml` file.

Answer

Configure a NAT gateway in a public subnet of the VPC, update the private subnet's route table to route traffic through the NAT gateway, enable local dependency caching in CodeBuild, and define the cache directories in the cache section of the buildspec file.

To resolve the issues, the developer must configure a NAT gateway in a public subnet and route outbound traffic from the private subnet to it. This provides the necessary internet access for CodeBuild to download external dependencies. Additionally, the developer must enable local caching in CodeBuild and define the target cache paths in the buildspec file. This ensures that dependencies are reused across builds instead of being downloaded from scratch.

Step-by-Step Solution

Address the outbound internet connectivity problem for resources inside the private subnet of the VPC.

Create a NAT gateway in a public subnet, and configure a route pointing

0.0.0.0/0

traffic to it in the private subnet's route table.

CodeBuild containers inside a private subnet cannot directly reach the internet to download external dependencies without a NAT gateway.

Implement a caching mechanism to avoid downloading dependencies from scratch on every run.

Configure local caching in CodeBuild project properties and add the cache directories (such as package manager cache folders) to the cache phase of the buildspec file.

This allows CodeBuild to persist downloaded files between build runs, significantly speeding up execution times.

Key Concept

AWS CodeBuild VPC network routing and local dependency caching configurations

Question 467Question →

An API gateway service writes usage logs for a multi-tenant software application. Each log entry is a JSON object containing `tenant_id`, `request_id`, `timestamp`, and `response_time`. A developer configures Amazon Kinesis Data Streams to ingest these logs for real-time usage billing calculations. During peak hours, the stream encounters `ProvisionedThroughputExceededException` errors on a single shard, even though the total write throughput is well below the overall provisioned capacity of the stream. The developer discovers that the partition key is set to the tenant's geographic region, which has only three possible values. Which partition key strategy should the developer implement to resolve this issue and distribute the workload evenly across all shards?

Use the request_id from each log entry as the partition key.

Set a static string such as 'billing_stream' as the partition key for all records.

Deploy the consumer Lambda function inside a private VPC subnet without a NAT Gateway or VPC endpoint.

Modify the trust policy of the consumer Lambda function's IAM role to allow the Kinesis Data Stream to assume the role.

Show answer & explanation

Answer: Use the request_id from each log entry as the partition key.

Answer

Use the request_id from each log entry as the partition key.

The correct answer is to use the request_id from each log entry as the partition key. Kinesis Data Streams uses the partition key input to an MD5 hash function to determine which shard a record is assigned to. By choosing a high-entropy key like request_id, which is unique for every transaction, records are distributed uniformly across all shards, resolving the hot shard throttling issue.

Step-by-Step Solution

Analyze the cause of the ProvisionedThroughputExceededException error on a single shard.

The error occurs because the write capacity of a specific shard is exceeded, which is caused by an uneven distribution of records (hot shard).

Identify why the overall stream capacity is not exceeded, but a single shard is throttled.

Evaluate the current partition key strategy.

The current partition key is the geographic region, which has only three possible values. This low-entropy key causes all records for a region to map to the same shard, leading to uneven distribution.

Determine how the partition key affects shard mapping in Kinesis.

Select a partition key with high entropy.

The request_id is highly unique for each API call, ensuring that the hash function distributes the records evenly across all available shards.

Ensure a uniform distribution of records to fully utilize the stream's capacity.

Key Concept

Kinesis partition keys and shard distribution

Estimated Time:1m 30s

Question 468Question →

A developer is building a digital coupon distribution service. The application stores coupon details in an Amazon DynamoDB table. The table uses $CouponID$ as the partition key and $BatchID$ as the sort key. The application needs to retrieve all coupons that belong to a specific $CampaignName$ attribute to calculate current redemption metrics. The $CampaignName$ attribute is not part of the primary key. Which DynamoDB operation or design configuration should the developer implement to retrieve this data with the lowest latency and minimal Read Capacity Unit (RCU) consumption?

Create a Global Secondary Index (GSI) with

CampaignName

as the partition key, and perform a Query operation on the GSI.

Perform a Scan operation on the base table and use a FilterExpression on the

CampaignName

attribute.

Hardcode access keys in the application SDK client initialization to bypass default IAM credential lookup and execute a Scan.

Increase the provisioned Read Capacity Units (RCUs) on the base table to prevent ProvisionedThroughputExceededException and continue using Scan operations.

Show answer & explanation

Answer: Create a Global Secondary Index (GSI) with $CampaignName$ as the partition key, and perform a Query operation on the GSI.

Answer

Create a Global Secondary Index (GSI) with

CampaignName

as the partition key, and perform a Query operation on the GSI.

Creating a Global Secondary Index (GSI) with the target query attribute as the partition key allows the application to perform a Query operation rather than a Scan. A Query operation in Amazon DynamoDB is highly efficient because it directly finds the target items using the index, consuming Read Capacity Units (RCUs) only for the returned items. This avoids scanning the entire base table, reducing both latency and operational costs.

Step-by-Step Solution

Analyze the table's access pattern and identify that retrieving items by a non-key attribute (

CampaignName

) across multiple

CouponID

partitions is required.

Querying the base table directly is not possible because the partition key is

CouponID

DynamoDB queries must specify the partition key of the table or index being searched.

Evaluate the difference between a Scan operation with a FilterExpression and a Query operation on a Global Secondary Index.

A Scan reads all items in the table and applies the filter afterward, consuming RCUs for the entire dataset. A Query on a GSI only reads the matching items.

Creating a GSI allows for efficient, targeted lookups on non-key attributes with minimal RCU consumption.

Define the GSI schema using

CampaignName

as the partition key.

The GSI isolates the relevant data, enabling a Query operation to fetch only the coupons associated with the specific

CampaignName

This strategy minimizes read latency and maximizes cost-efficiency by avoiding unnecessary scans.

Key Concept

Using Global Secondary Indexes (GSIs) to optimize read queries on non-key attributes and minimize RCU usage compared to Scan operations.

Alternative Method

If campaign queries are extremely infrequent, using Amazon Athena with DynamoDB Federated Query could scan the data in place, though it does not resolve the high latency issue for active application paths.

Estimated Time:1m 30s

Question 469Question →

A developer is designing a backend service for a ride-sharing application that stores ride details in an Amazon DynamoDB table. The base table uses `RideId` as the partition key. Each item contains attributes such as `RiderId`, `DriverId`, `Fare`, `RideDate`, and `Status` (which can be 'Requested', 'Ongoing', or 'Completed').

The application needs to retrieve the $50$ most recent completed rides for a specific driver to display on a dashboard.

Which approach is the most efficient and cost-effective to meet these requirements?

Perform a `Scan` operation on the base table with a filter expression matching the specific `DriverId` and `Status` of 'Completed', then sort the retrieved items by `RideDate` in the application code.

Create a Global Secondary Index (GSI) with `DriverId` as the partition key and `RideDate` as the sort key. Perform a `Query` operation on the GSI for the specific driver, setting `ScanIndexForward` to `false`, using a filter expression for the completed status, and setting the `Limit` to

50

Perform a `Scan` operation on the base table using a filter expression. If the operation throttles and returns a `ProvisionedThroughputExceededException`, increase the provisioned Read Capacity Units (RCUs) of the base table to handle the high volume of scanned items.

Initialize the AWS SDK client in the backend code by hardcoding a dedicated IAM user's credentials with read-only access to the DynamoDB table, then perform a parallel `Scan` operation to retrieve the rides.

Show answer & explanation

Answer: Create a Global Secondary Index (GSI) with `DriverId` as the partition key and `RideDate` as the sort key. Perform a `Query` operation on the GSI for the specific driver, setting `ScanIndexForward` to `false`, using a filter expression for the completed status, and setting the `Limit` to $50$ .

Answer

50

The correct approach involves creating a Global Secondary Index (GSI) with the driver identifier as the partition key and the ride date as the sort key. This allows the application to query directly for the specific driver. Setting the sort order parameter to false returns items in descending order, and specifying a limit of 50 restricts the read operation to only the required dataset, keeping costs low and performance high.

Step-by-Step Solution

Determine the partition and sort key requirements based on the query patterns.

Identify that the search attribute (`DriverId`) is not the base table's partition key, requiring an index to avoid scanning.

DynamoDB queries require matching the partition key of either the base table or an index to locate items efficiently.

Define a Global Secondary Index (GSI) with `DriverId` as the partition key and `RideDate` as the sort key.

Enables sorting records chronologically per driver directly on the index storage.

GSIs allow redefining partition and sort keys for flexible query patterns on non-key attributes.

Configure the Query operation with `ScanIndexForward` set to `false` and a `Limit` of

50

Retrieves only the latest

50

matching elements in descending order, minimizing RCU consumption.

Setting `ScanIndexForward` to `false` reverses the sort order, and setting `Limit` prevents reading extra items beyond the required dashboard threshold.

Key Concept

Using Global Secondary Indexes (GSIs) and Query operations to perform optimized lookups on non-key attributes in Amazon DynamoDB.

Question 470Question →

A developer is maintaining a real-time smart home telemetry system. Devices send sensor updates to an Amazon Kinesis Data Stream with 4 shards. A consumer AWS Lambda function, triggered by an event source mapping, processes these records. During peak hours, the developer notices a high rate of ProvisionedThroughputExceededException errors on the stream. CloudWatch metrics indicate that two of the shards are receiving almost all of the traffic, while the other two shards remain idle. The stream partition key is currently set to the device's region_id (representing one of four geographic zones). Which two actions should the developer take to resolve the throttling and ensure data is distributed evenly? (Select TWO.)

Select all that apply

Modify the producer application to use the unique device_id as the partition key instead of the region_id to ensure even data distribution across all shards.

Configure the producer application to retry requests with exponential backoff and jitter when encountering ProvisionedThroughputExceededException.

Change the partition key to a static string to ensure all events are sent to the same shard for strict chronological ordering.

Increase the Lambda function execution timeout to 15 minutes to allow the event source mapping to poll the stream more frequently.

Deploy the consumer Lambda function in a private VPC subnet without a NAT Gateway or VPC Endpoint to isolate Kinesis polling traffic.

Show answer & explanation

Answer: Modify the producer application to use the unique device_id as the partition key instead of the region_id to ensure even data distribution across all shards.; Configure the producer application to retry requests with exponential backoff and jitter when encountering ProvisionedThroughputExceededException.

Answer

To resolve the throttling and ensure data is distributed evenly, the developer must modify the producer to use the unique device ID as the partition key to achieve high entropy across shards, and configure the producer to retry throttled requests with exponential backoff and jitter.

The combination of using the unique device identifier as the partition key and configuring exponential backoff on the producer resolves both the structural bottleneck (hot shards) and handles temporary congestion elegantly. The high entropy of the device ID ensures uniform shard utilization, and retries with backoff mitigate stream ingestion errors under peak load.

Step-by-Step Solution

Analyze the shard utilization metrics.

Two shards are heavily utilized (hot shards) and two are idle, which indicates uneven distribution of records due to low-entropy partition keys.

The partition key region_id has only four possible values, mapping unevenly to Kinesis shards.

Select a high-entropy attribute for the partition key.

Using the unique device ID as the partition key distributes the write load uniformly across all shards.

A high number of unique keys ensures that the hash function spreads the payload across all available stream shards.

Implement transient error handling in the producer.

The producer handles ProvisionedThroughputExceededException by waiting and retrying with randomized delays.

Exponential backoff with jitter prevents retry storms and allows the stream to recover during transient load spikes.

Key Concept

Partition key entropy and producer-side error handling in Amazon Kinesis Data Streams

Question 471Question →

A developer is designing an Amazon DynamoDB table named `UserActivities` to track user actions in a web application. The table's primary key is configured with `UserID` as the partition key and `ActivityTimestamp` as the sort key.

The application needs to support the following operations:
1. Retrieve all activities for a specific `UserID` that occurred within a particular date range, sorted by timestamp.
2. Retrieve all activities of a specific `ActivityType` (such as 'login' or 'purchase') across all users, sorted by the timestamp of the activity.

The developer wants to implement this with optimal performance and minimal read capacity consumption.

Which two actions should the developer take to meet these requirements? (Select TWO.)

Select all that apply

Query the base table directly using the UserID partition key and a key condition expression on the ActivityTimestamp sort key.

Create a Global Secondary Index (GSI) with ActivityType as the partition key and ActivityTimestamp as the sort key.

Create a Local Secondary Index (LSI) with ActivityType as the partition key and ActivityTimestamp as the sort key.

Perform a Scan operation on the base table using a FilterExpression on the ActivityType attribute to retrieve activities across all users.

Initialize the DynamoDB client in the application by hardcoding the AWS Access Key ID and Secret Access Key of an IAM user with full permissions to the table to ensure fast authentication.

Show answer & explanation

Answer: Query the base table directly using the UserID partition key and a key condition expression on the ActivityTimestamp sort key.; Create a Global Secondary Index (GSI) with ActivityType as the partition key and ActivityTimestamp as the sort key.

Answer

Query the base table using the partition key and sort key for the first pattern, and create a Global Secondary Index (GSI) with the activity type as the partition key and timestamp as the sort key for the second pattern.

Querying the base table directly with a key condition expression is the most efficient way to retrieve sorted data within a single partition (UserID). Creating a Global Secondary Index (GSI) with ActivityType as the partition key and ActivityTimestamp as the sort key enables querying across all partitions while maintaining the required timestamp sort order.

Step-by-Step Solution

Analyze the first access pattern: Retrieve all activities for a specific UserID within a date range, sorted by timestamp.

Since UserID is the base table's partition key and ActivityTimestamp is the sort key, we can query the base table directly. A Query operation retrieves items with a specific partition key and can filter/sort using key conditions on the sort key.

Using Query on the base table avoids the cost of creating an additional index and is the most efficient way to access this data.

Analyze the second access pattern: Retrieve all activities of a specific ActivityType across all users, sorted by timestamp.

Because this query needs to span across all partitions (all UserIDs), we must change the partition key. This requires a Global Secondary Index (GSI) with ActivityType as the partition key and ActivityTimestamp as the sort key.

GSIs allow querying across all partitions of the base table using a new partition key, and the sort key provides the required ordering.

Key Concept

Selecting between base table queries, Local Secondary Indexes (LSIs), and Global Secondary Indexes (GSIs) based on access patterns.

Estimated Time:2m 0s

Question 472Question →

A developer is building a fleet monitoring application that tracks delivery vehicle telemetry. The application stores telemetry data in an Amazon DynamoDB table with `VehicleID` as the partition key and `Timestamp` as the sort key. The table contains millions of records spanning thousands of unique vehicles. The application needs to retrieve all telemetry logs for a specific vehicle within a given 24-hour window. Which of the following is the most efficient and cost-effective approach to retrieve this data?

Execute a Scan operation on the table and use a FilterExpression to retrieve only the items matching the target VehicleID and Timestamp range.

Perform a Query operation specifying the VehicleID in the KeyConditionExpression and a range condition for the Timestamp sort key.

Execute a parallel Scan operation by dividing the table into segments to speed up retrieval of the specific vehicle's telemetry logs.

Initialize the AWS SDK DynamoDB client by passing hardcoded IAM access keys directly into the client initialization code, and then execute a Query operation.

Show answer & explanation

Answer: Perform a Query operation specifying the VehicleID in the KeyConditionExpression and a range condition for the Timestamp sort key.

Answer

Perform a Query operation specifying the VehicleID in the KeyConditionExpression and a range condition for the Timestamp sort key.

Performing a Query operation is the most efficient and cost-effective method because it uses the partition key (VehicleID) to narrow the search to a single partition, and the sort key (Timestamp) condition to fetch only the relevant records. This reads only the requested items, minimizing Read Capacity Unit (RCU) consumption.

Step-by-Step Solution

Identify the primary key structure of the Amazon DynamoDB table.

The table partition key is VehicleID and the sort key is Timestamp.

Knowing the primary key structure determines which DynamoDB API operations (Query vs. Scan) are available for targeted lookups.

Evaluate the retrieval requirement against the API options.

The request asks for all logs for a specific VehicleID (partition key) within a specific Timestamp (sort key) range.

Since the partition key is known and the sort key is constrained, a Query operation is the most efficient choice because it performs a direct lookup and only reads matching items.

Avoid inefficient patterns (Scan) and insecure credential practices.

Scan operations read the entire table and waste read capacity, while hardcoding AWS access keys violates standard credential chain practices.

Filtering out these bad practices leaves the Query operation with standard credential provider chain usage as the correct choice.

Key Concept

Using Query instead of Scan for partition-key-based lookups in Amazon DynamoDB

Estimated Time:1m 30s

Question 473Question →

A developer is writing an AWS Lambda function that retrieves the $5$ most recent orders for a specific customer from an Amazon DynamoDB table named `Orders`. The table has a partition key of `CustomerID` and a sort key of `OrderDate`, and contains millions of records.

Which two options should the developer configure in the DynamoDB API request to retrieve the required data in the most resource-efficient manner? (Choose two.)

Select all that apply

Set the `ScanIndexForward` parameter to `false` to reverse the sort order of the query results.

Use a `FilterExpression` instead of a key condition expression to filter the query results to the

5

most recent orders.

Perform a `Scan` operation on the table and use a `ProjectionExpression` to retrieve only the required items.

Set the `Limit` parameter to `

5

` to restrict the number of items evaluated and returned by the query.

Set the `ConsistentRead` parameter to `true` to ensure the query returns the latest ordered items at a lower Read Capacity Unit (RCU) cost.

Show answer & explanation

Answer: Set the `ScanIndexForward` parameter to `false` to reverse the sort order of the query results.; Set the `Limit` parameter to ` $5$ ` to restrict the number of items evaluated and returned by the query.

Answer

To retrieve the five most recent orders efficiently, the developer should set the `ScanIndexForward` parameter to `false` to reverse the sort key order and set the `Limit` parameter to `

5

` to restrict the number of items evaluated and returned.

The correct configuration combines reversing the sort key order using `ScanIndexForward` set to `false` with restricting the evaluations using the `Limit` parameter set to `

5

`. This pattern allows DynamoDB to target the specific partition key, read the items in descending order of the sort key, and stop immediately after finding the first

5

items, minimizing the Read Capacity Units (RCUs) consumed.

Step-by-Step Solution

Reverse the default sort key order in the Query request.

By setting `ScanIndexForward` to `false`, DynamoDB reads the sort key (`OrderDate`) in descending order, starting with the most recent items.

This positions the most recent orders at the beginning of the evaluation set.

Apply a limit parameter to restrict the scope of the evaluation.

By setting the `Limit` parameter to `

5

`, DynamoDB stops reading records as soon as

5

items are evaluated and returned.

This prevents DynamoDB from reading the rest of the customer's partition, saving Read Capacity Units (RCUs).

Avoid post-query filter expressions or scan operations.

Using key condition expressions instead of filter expressions ensures only the target customer data is read, avoiding scanned item overhead.

Filter expressions and scan operations consume RCUs on evaluated items that are subsequently discarded.

Key Concept

Optimizing read query operations in DynamoDB using ScanIndexForward and Limit settings

Estimated Time:1m 30s

Question 474Question →

A developer is designing a secure file upload utility for a containerized microservice. The utility must encrypt files up to $100\text{ MB}$ locally before uploading them to an Amazon S3 bucket named `my-app-data`. To comply with strict security and auditing guidelines, the solution must satisfy the following requirements:

1. Ensure that plaintext data keys are never persisted or stored in any AWS service.
2. Prevent unauthorized decryption if the encrypted files are copied to a different S3 bucket.
3. Minimize AWS KMS API calls to avoid rate-limiting/throttling and control costs.
4. Record all cryptographic key usage in AWS CloudTrail for auditing.

Which KMS API workflow and architecture meets these requirements?

Call the KMS `GenerateDataKey` API using the Customer Managed Key (CMK), passing `{"Bucket": "my-app-data"}` as the `EncryptionContext`. Use the returned plaintext data key to encrypt the file locally using a symmetric encryption library, immediately delete the plaintext key from memory, and upload the encrypted file to S3 with the ciphertext data key stored in the object's user-defined metadata.

Call the KMS `GenerateDataKeyWithoutPlaintext` API using the Customer Managed Key (CMK), passing `{"Bucket": "my-app-data"}` as the `EncryptionContext`. Use the returned ciphertext data key to encrypt the file locally, then call the KMS `Decrypt` API to retrieve the plaintext key for validation before uploading the encrypted file to S3.

Divide each file into

4\text{ KB}

chunks. For each chunk, call the KMS `Encrypt` API using the Customer Managed Key (CMK) and passing `{"Bucket": "my-app-data"}` as the `EncryptionContext`. Concatenate the resulting ciphertext chunks and upload the final encrypted payload to the S3 bucket.

Call the KMS `GenerateDataKey` API using the Customer Managed Key (CMK). Use the returned plaintext data key to encrypt the file locally. Store the plaintext data key in AWS Secrets Manager under a dynamic path like `/keys/my-app-data/data-key`, configure the secret to auto-delete after 15 minutes, and upload the encrypted file to S3.

Show answer & explanation

Answer: Call the KMS `GenerateDataKey` API using the Customer Managed Key (CMK), passing `{"Bucket": "my-app-data"}` as the `EncryptionContext`. Use the returned plaintext data key to encrypt the file locally using a symmetric encryption library, immediately delete the plaintext key from memory, and upload the encrypted file to S3 with the ciphertext data key stored in the object's user-defined metadata.

Answer

The correct workflow uses `GenerateDataKey` with an `EncryptionContext` of the target bucket. This generates both the plaintext key (needed to perform the encryption locally) and the ciphertext key. The plaintext key is used to encrypt the payload and is immediately discarded. The ciphertext key is stored in the object's S3 metadata. Binding the bucket name via `EncryptionContext` ensures that if the object is copied to another bucket, decryption will fail because the context won't match the new bucket name.

Step-by-Step Solution

Request a data key from KMS with bucket context.

Receive both a plaintext data key and a ciphertext data key cryptographically bound to the bucket name via `EncryptionContext`.

This establishes the client-side envelope encryption workflow and enforces the security boundary constraint.

Encrypt the file payload locally.

The file is encrypted using a local symmetric library (like AES-GCM) with the plaintext data key.

This keeps encryption client-side, handles payloads larger than the KMS 4 KB direct encryption limit, and reduces network latency.

Secure memory and prepare metadata.

The plaintext data key is purged from the application's memory, leaving only the ciphertext data key.

This minimizes the lifetime of the plaintext key in memory, satisfying the security requirements.

Upload the encrypted file and metadata.

The encrypted file is uploaded to the S3 bucket, with the ciphertext data key stored in S3 metadata.

This keeps the encrypted payload and its decryptable key together, allowing decryption later only if the exact bucket context is provided to the KMS Decrypt API.

Key Concept

AWS KMS Client-Side Envelope Encryption and EncryptionContext Bindings

Estimated Time:3m 0s

Question 475Question →

A developer is building a serverless REST API using Amazon API Gateway and AWS Lambda. The API must authenticate users who are managed in an external identity provider that supports OpenID Connect (OIDC). The requirements specify that the solution must minimize custom code, validate the JSON Web Token (JWT) at the API Gateway layer, and securely pass user attributes—such as custom groups—to the backend Lambda function for fine-grained authorization. Additionally, the client application must not need to manage or sign requests with temporary AWS credentials.

Which architecture should the developer implement to meet these requirements with the least administrative effort?

Configure an Amazon Cognito User Pool federated with the external OIDC provider. Set up an API Gateway Cognito Authorizer that points to the Cognito User Pool. In the API Gateway Method Request, set the Authorization header. In the backend Lambda function, extract the user attributes from the request's context event under the authorizer claims.

Configure an Amazon Cognito Identity Pool federated with the external OIDC provider. Set up an API Gateway IAM Authorizer. Have the client application exchange the OIDC token for temporary AWS credentials using the Identity Pool, sign each HTTP request using Signature Version 4, and pass user attributes in custom headers.

Create a custom Lambda authorizer that performs manual token signature validation using a public key endpoint from the external OIDC provider. In the Lambda authorizer, parse the custom groups and return them inside the context object of the authorization response. Access these claims inside the backend Lambda function using a custom integration mapping template.

Configure an Amazon Cognito User Pool federated with the external OIDC provider. Configure a custom Lambda authorizer to intercept the token and write a Lambda Proxy Integration mapping template to parse the JWT payload. Inside the backend Lambda function, map the raw request payload back to the Cognito User Pool to retrieve user attributes.

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool federated with the external OIDC provider. Set up an API Gateway Cognito Authorizer that points to the Cognito User Pool. In the API Gateway Method Request, set the Authorization header. In the backend Lambda function, extract the user attributes from the request's context event under the authorizer claims.

Answer

Configure an Amazon Cognito User Pool federated with the external OIDC provider, set up an API Gateway Cognito Authorizer pointing to the user pool, and extract the user attributes from the request's context event under the authorizer claims in the backend Lambda function.

The correct solution uses an Amazon Cognito User Pool federated with the external OIDC provider. This configuration allows API Gateway to leverage the built-in Cognito Authorizer, which handles token validation at the gateway edge. Verified claims are automatically passed to the Lambda function in the request context event, eliminating custom validation code and client-side request signing.

Step-by-Step Solution

Analyze the token validation requirements and identity source.

The identity source is an external OIDC provider, and token validation must happen at the API Gateway layer.

This establishes that the API Gateway layer should handle validation, narrowing options to authorizers that natively validate OIDC/JWT tokens.

Evaluate native authorization options versus client-side overhead.

Using a Cognito Identity Pool requires IAM authorization and Signature Version 4 signing by the client, which violates the requirement to avoid client-side credentials management.

A Cognito User Pool with a Cognito Authorizer validates OIDC-derived tokens natively at the API Gateway edge, avoiding client-side request signing.

Verify custom code and claim transmission constraints.

A custom Lambda authorizer requires manual signature validation and parsing, violating the goal to minimize custom code. In contrast, the Cognito Authorizer automatically passes validated claims to the backend Lambda integration's request context.

This confirms that a federated Cognito User Pool combined with a native Cognito Authorizer is the most efficient, low-code solution.

Key Concept

API Gateway Cognito User Pool Authorizer integration for federated OIDC authentication.

Question 476Question →

A developer is deploying a containerized application to Amazon ECS on AWS Fargate using the following task definition snippet:

{
"containerDefinitions": [
{
"name": "app-container",
"image": "111122223333.dkr.ecr.us-east-1.amazonaws.com/my-app:latest",
"logConfiguration": {
"logDriver": "awslogs",
"options": {
"awslogs-group": "/ecs/my-app",
"awslogs-region": "us-east-1",
"awslogs-stream-prefix": "ecs"
}
}
}
],
"taskRoleArn": "arn:aws:iam::111122223333:role/MyTaskRole",
"executionRoleArn": "arn:aws:iam::111122223333:role/MyExecutionRole"
}

The application code inside the container must read and delete messages from an Amazon SQS queue. The ECS agent must pull the private container image from Amazon ECR and send container logs to Amazon CloudWatch Logs.

Which of the following configurations must the developer perform to grant the necessary permissions? (Select TWO.)

Select all that apply

Attach an IAM policy containing `sqs:ReceiveMessage` and `sqs:DeleteMessage` permissions to the MyTaskRole role.

Attach an IAM policy containing `ecr:BatchGetImage`, `ecr:GetDownloadUrlForLayer`, `ecr:GetAuthorizationToken`, and `logs:PutLogEvents` permissions to the MyExecutionRole role.

Attach an IAM policy containing `sqs:ReceiveMessage` and `sqs:DeleteMessage` permissions to the MyExecutionRole role.

Attach an IAM policy containing `ecr:BatchGetImage`, `ecr:GetDownloadUrlForLayer`, `ecr:GetAuthorizationToken`, and `logs:PutLogEvents` permissions to the MyTaskRole role.

Configure the trust relationship policy document of the MyExecutionRole role to allow the service principal `ecs.amazonaws.com` to perform the `sts:AssumeRole` action.

Show answer & explanation

Answer: Attach an IAM policy containing `sqs:ReceiveMessage` and `sqs:DeleteMessage` permissions to the MyTaskRole role.; Attach an IAM policy containing `ecr:BatchGetImage`, `ecr:GetDownloadUrlForLayer`, `ecr:GetAuthorizationToken`, and `logs:PutLogEvents` permissions to the MyExecutionRole role.

Answer

Attach SQS permissions to the task role (MyTaskRole) and attach ECR and CloudWatch Logs permissions to the task execution role (MyExecutionRole).

The configuration attaching SQS permissions to the task role is correct because the application code inside the container runs under the task role's context. The configuration attaching ECR and CloudWatch permissions to the task execution role is correct because the ECS agent needs these permissions to pull the image and send logs before/during the container runtime.

Step-by-Step Solution

Analyze the permission requirements of the application code running inside the container.

The application code reads and deletes SQS messages, which means it requires permissions for `sqs:ReceiveMessage` and `sqs:DeleteMessage` attached to the role that the application container assumes, which is the ECS Task Role (`taskRoleArn`).

The Task Role provides AWS credentials directly to the containerized application.

Analyze the permission requirements of the Amazon ECS container agent.

The ECS agent needs to authenticate with ECR, pull container images, and write logs to CloudWatch Logs. This requires `ecr:GetAuthorizationToken`, `ecr:BatchGetImage`, `ecr:GetDownloadUrlForLayer`, and `logs:PutLogEvents` permissions attached to the ECS Task Execution Role (`executionRoleArn`).

The Task Execution Role provides AWS credentials to the ECS container agent to perform infrastructure/management tasks on behalf of the container.

Evaluate the correct service principal for the trust relationship of the roles.

Both the Task Role and Task Execution Role must trust the `ecs-tasks.amazonaws.com` service principal so that the ECS container agent can assume these roles.

Using `ecs.amazonaws.com` is incorrect as it is for the ECS service scheduler, not individual tasks.

Key Concept

Division of responsibility between ECS Task Role and ECS Task Execution Role

Question 477Question →

A developer is managing a production web application deployed via an AWS CloudFormation stack. The stack consists of an Amazon RDS DB instance, an Amazon EC2 Auto Scaling group, and an IAM role associated with the EC2 instances. To troubleshoot a connection issue, an administrator manually modified the EC2 security group rules and deleted the IAM role directly in the AWS Management Console. During a subsequent stack update to upgrade the database instance class, the update failed and the stack is now in the UPDATE_ROLLBACK_FAILED state. Which two actions should the developer take to resolve the stack status and reconcile the resource configurations? (Select TWO.)

Select all that apply

Manually recreate the deleted IAM role using the exact name and configuration it had prior to deletion, and then initiate the continue-update-rollback action.

Execute the continue-update-rollback command and specify the logical ID of the deleted IAM role in the resources-to-skip parameter.

Perform a drift detection on the stack and use the CloudFormation drift resolution console to automatically import the manual security group modifications into the template.

Initiate a new stack update using the update-stack command with a modified template to bypass the rollback phase and force the database upgrade.

Store the updated security group configurations in the Systems Manager Parameter Store and use a dynamic reference to force stack synchronization.

Show answer & explanation

Answer: Manually recreate the deleted IAM role using the exact name and configuration it had prior to deletion, and then initiate the continue-update-rollback action.; Execute the continue-update-rollback command and specify the logical ID of the deleted IAM role in the resources-to-skip parameter.

Answer

To resolve the UPDATE_ROLLBACK_FAILED state, the developer should either manually recreate the deleted IAM role and continue the rollback, or execute continue-update-rollback while skipping the deleted IAM role.

The correct options identify the two supported methods for resolving a stack stuck in the UPDATE_ROLLBACK_FAILED state. Recreating the deleted IAM role allows CloudFormation to find and delete/modify it during the rollback phase, which enables the rollback to complete successfully. Alternatively, calling the continue-update-rollback command and choosing to skip the deleted IAM role permits the rollback operation to skip that specific resource and successfully transition the stack to the UPDATE_ROLLBACK_COMPLETE state.

Step-by-Step Solution

Analyze the stack status and event logs to identify the exact resource causing the rollback failure.

The logs indicate that the rollback failed because the IAM role referenced in the stack template was not found.

Before resolving the rollback failure, the root cause of the failure must be identified.

Choose to either restore the missing dependency or skip the resource during rollback.

Recreating the role allows the rollback to clean it up or update it normally. Alternatively, skipping the role allows the rollback to finish while leaving the resource state as-is.

CloudFormation requires either finding the resource to modify or delete it, or being explicitly told to skip it to complete the rollback sequence.

Perform a drift detection after the stack reaches a stable state to identify the out-of-band security group changes.

The drift detection report details the exact differences between the template and the actual security group rules.

This identifies all manual out-of-band changes that need to be reconciled manually or by updating the template.

Key Concept

CloudFormation Stack Rollback Failure Resolution

Question 478Question →

A software developer is writing a data reconciliation script that runs on AWS Lambda. The script must retrieve credentials from AWS Secrets Manager and query a PostgreSQL database hosted on an Amazon RDS instance that resides in the private subnets of a custom VPC. The Lambda function must run inside the custom VPC to connect to the database. Security policies require that all network traffic between the Lambda function, the database, and AWS Secrets Manager remains entirely within the VPC.

Which of the following actions should the developer take to establish secure and functional network connectivity for the Lambda function? (Select TWO.)

Select all that apply

Configure the Lambda function to connect to the private subnets of the VPC, and create an Interface VPC Endpoint for AWS Secrets Manager with Private DNS enabled.

Configure the security group of the Amazon RDS instance to allow inbound database traffic from the security group assigned to the Lambda function.

Configure the Lambda function to connect directly to the public subnets of the VPC to enable direct access to both the RDS database and the public Secrets Manager endpoint.

Modify the IAM trust relationship of the Lambda execution role to trust the Amazon RDS service principal (rds.amazonaws.com).

Store the database credentials in Systems Manager Parameter Store, and enable native automatic rotation using the Parameter Store console.

Show answer & explanation

Answer: Configure the Lambda function to connect to the private subnets of the VPC, and create an Interface VPC Endpoint for AWS Secrets Manager with Private DNS enabled.; Configure the security group of the Amazon RDS instance to allow inbound database traffic from the security group assigned to the Lambda function.

Answer

The correct actions are: configuring the Lambda function to connect to the private subnets of the VPC while creating an Interface VPC Endpoint for AWS Secrets Manager, and configuring the security group of the Amazon RDS instance to allow inbound traffic from the Lambda function's security group.

To connect the Lambda function to the database securely, the function must reside in the same VPC private subnets. An Interface VPC Endpoint (PrivateLink) for AWS Secrets Manager is required to allow the function to call Secrets Manager APIs over private IP addresses. Additionally, the RDS security group must explicitly allow inbound traffic from the security group associated with the Lambda function.

Step-by-Step Solution

Determine the network placement for the Lambda function.

The Lambda function must be associated with the private subnets of the VPC to route traffic to the RDS instance in the same private subnets.

VPC-connected Lambda functions need to be in subnets that have a network path to the resources they need to access.

Set up secure connection to AWS Secrets Manager.

Create an Interface VPC Endpoint (AWS PrivateLink) for Secrets Manager in the VPC subnets with Private DNS enabled.

This allows the Lambda function to resolve the Secrets Manager DNS name to a private IP within the VPC, ensuring traffic does not traverse the public internet.

Configure Security Group rules for RDS.

Add an inbound rule to the RDS security group that permits traffic on the database port (e.g., port 5432 for PostgreSQL) from the security group attached to the Lambda function.

Security groups act as a firewall at the resource level, and this rule is required to permit the inbound connection from the Lambda function.

Key Concept

VPC Security for Developers

Estimated Time:2m 30s

Question 479Question →

A development team is building a mobile application for a bicycle-sharing service. The app allows users to log in using their social media accounts. The backend services expose a REST API hosted on Amazon API Gateway, backed by AWS Lambda. Additionally, the mobile app needs to upload user-generated profile photos directly to a private Amazon S3 bucket without routing the files through the application's backend.

Which two architectural steps should the developer take to implement authentication, API authorization, and secure S3 uploads with the least amount of custom code?

Select all that apply

Establish a user directory using Cognito User Pools, and deploy a built-in Cognito Authorizer on the API Gateway to secure the endpoints.

Develop a custom Lambda authorizer that manually validates the identity tokens against the social provider, and secure the API Gateway using resource policies.

Link a Cognito Identity Pool to the user directory to obtain temporary AWS credentials, enabling the mobile client to upload photos to the S3 bucket.

Utilize the Cognito User Pool to directly exchange JSON Web Tokens (JWT) for temporary IAM credentials for S3 bucket access.

Configure an API Gateway Lambda Proxy integration that intercepts incoming requests and generates IAM execution policies dynamically for S3 upload.

Show answer & explanation

Answer: Establish a user directory using Cognito User Pools, and deploy a built-in Cognito Authorizer on the API Gateway to secure the endpoints.; Link a Cognito Identity Pool to the user directory to obtain temporary AWS credentials, enabling the mobile client to upload photos to the S3 bucket.

Answer

Establish a user directory using Cognito User Pools, and deploy a built-in Cognito Authorizer on the API Gateway to secure the endpoints. Link a Cognito Identity Pool to the user directory to obtain temporary AWS credentials, enabling the mobile client to upload photos to the S3 bucket.

The correct solution uses Cognito User Pools for user authentication and secures the API Gateway REST API with the built-in Cognito Authorizer to minimize custom code. It then utilizes a Cognito Identity Pool linked to the User Pool to vend temporary AWS credentials, allowing the mobile application to upload profile photos directly to the private S3 bucket without passing through backend servers.

Step-by-Step Solution

Set up a user directory with Cognito User Pools to manage social identity federation and authentication.

Users are authenticated, and the mobile client receives identity and access tokens (JWTs).

This establishes user identities and allows built-in integration with external social providers.

Configure a built-in Cognito Authorizer on the API Gateway REST API.

API Gateway automatically validates the JWT signature and expiration before allowing requests to proceed to the Lambda backend.

This secures the API endpoints with minimal custom code by leveraging native API Gateway integrations.

Deploy a Cognito Identity Pool and link it to the User Pool as an identity provider, granting authenticated users an IAM role with write permissions to the S3 bucket.

The mobile app can exchange User Pool tokens for temporary AWS IAM credentials, allowing direct and secure uploads to S3.

This satisfies the requirement to write directly to S3 without routing files through backend servers.

Key Concept

Combining Cognito User Pools for user authentication/API authorization with Cognito Identity Pools for AWS resource access (S3 direct upload).

Question 480Question →

A developer is managing a web application deployed using an AWS CloudFormation stack. The stack includes an Amazon ECS task definition, an IAM execution role, and an Amazon DynamoDB table. During a troubleshooting session, an administrator manually deleted the IAM execution role directly from the IAM Console. Subsequently, the developer attempted to update the CloudFormation stack to adjust the CPU allocation for the ECS tasks. The update failed, and the stack is now stuck in the UPDATE_ROLLBACK_FAILED state. The developer needs to resolve the rollback failure and successfully apply the new CPU allocation. Which two actions should the developer take to achieve this? (Select TWO.)

Select all that apply

Manually recreate the IAM execution role with the exact same name and configuration as defined in the CloudFormation template.

Invoke the continue-update-rollback operation on the CloudFormation stack to complete the rollback process.

Invoke the update-stack operation on the stack with the --force-update parameter to override the failed rollback state.

Run drift detection on the stack and select the auto-remediate option to restore the deleted IAM execution role.

Update the CloudFormation stack template to use a different IAM execution role name, and then execute the rollback-stack CLI command.

Show answer & explanation

Answer: Manually recreate the IAM execution role with the exact same name and configuration as defined in the CloudFormation template.; Invoke the continue-update-rollback operation on the CloudFormation stack to complete the rollback process.

Answer

Manually recreate the IAM execution role with the exact same name and configuration as defined in the CloudFormation template, and then invoke the continue-update-rollback operation on the CloudFormation stack to complete the rollback process.

When a resource is deleted manually out-of-band and a subsequent stack update fails and rolls back, the rollback itself fails because CloudFormation expects the deleted resource to exist. To resolve the UPDATE_ROLLBACK_FAILED state, the developer must first manually recreate the deleted resource with the exact name and configuration specified in the template. After resolving the underlying cause, the developer must call continue-update-rollback to resume the rollback process and return the stack to a stable state, allowing future updates.

Step-by-Step Solution

Identify the cause of the failed rollback by reviewing the stack events in the CloudFormation console or using the CLI.

The log events show that the IAM execution role is missing (deleted out-of-band), causing the rollback to fail because CloudFormation cannot update or delete resources depending on the role.

Before resolving the rollback state, you must identify which resource is missing or failed during the rollback process.

Manually recreate the deleted IAM execution role with the exact name, path, and configuration expected by the stack.

The IAM role exists again with the identical ARN and properties.

CloudFormation rollback actions reference the deleted resource by its physical ID/ARN; recreating it allows the cleanup or rollback operations to run successfully.

Run the continue-update-rollback command or use the AWS Console to continue rollback.

The stack successfully rolls back to the UPDATE_ROLLBACK_COMPLETE state.

This transitions the stack out of the blocked UPDATE_ROLLBACK_FAILED state into a stable state.

Initiate a new stack update with the updated template to modify the ECS task definition CPU limits.

The update finishes successfully, and the stack reaches the UPDATE_COMPLETE state.

Once the stack is in a stable UPDATE_ROLLBACK_COMPLETE state, regular updates can be performed safely.

Key Concept

Recovering from CloudFormation UPDATE_ROLLBACK_FAILED due to manual out-of-band resource deletion.

PreviousPage 24 / 78Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Alternative Method

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution