Examkin

All practice questions

1542 questions

All types1,542Multiple choice782Multiple select746Ordering14
Question 481Question →

A developer is designing a high-traffic, stateful web application that will be hosted on Amazon ECS. The application requires an external session store to maintain user session states across multiple container instances. The session store must meet the following requirements:

1. Provide sub-millisecond latency for both read and write operations.
2. Automatically delete session records that have been inactive for more than 2424 hours.
3. Ensure high availability and data persistence, even in the event of an Availability Zone (AZ) failure.

Which caching solution should the developer implement to meet these requirements?

Show answer & explanation

Answer: Amazon ElastiCache for Redis configured with a replication group across multiple Availability Zones, using Redis key expiration (TTL) to manage the session lifecycle.

Answer

Amazon ElastiCache for Redis configured with a replication group across multiple Availability Zones, using Redis key expiration (TTL) to manage the session lifecycle.
The correct answer provides sub-millisecond latencies for both read and write operations, which is a native capability of Amazon ElastiCache for Redis. Utilizing a replication group across multiple Availability Zones ensures data replication and automatic failover to survive AZ failures. Redis key expiration (TTL) handles active key purges immediately upon expiration, fitting the 2424-hour cleanup constraint.

Step-by-Step Solution

1
Analyze the performance constraints.
The requirement for sub-millisecond latency for both reads and writes rules out solutions that do not cache writes (like DynamoDB with DAX) or services with slow transactional write speeds (like Systems Manager Parameter Store).
This establishes that the solution must use an in-memory caching system designed for rapid read/write workloads.
2
Evaluate the session lifecycle cleanup constraint.
Sessions must be deleted after 2424 hours of inactivity. DynamoDB's TTL feature does not guarantee deletion within 2424 hours (it can take up to 4848 hours), whereas Redis key expiration processes expirations in real time.
This rules out DynamoDB as a strict TTL compliance mechanism for this timeframe.
3
Evaluate the high availability and durability constraint.
An external caching tier like ElastiCache for Redis configured with replication across multiple Availability Zones provides automatic failover, keeping session data persisted and available.
This ensures the stateless application tier on ECS can survive node and AZ outages without session data loss.

Key Concept

Application Caching and Session State Management
Question 482Question →

A developer is configuring a cross-account deployment pipeline in AWS CodePipeline. The pipeline is located in Account A (the tooling account) and must deploy a containerized application to Amazon ECS in Account B (the target account). The pipeline's artifact store is an Amazon S3 bucket in Account A, which is encrypted with an AWS KMS Customer Managed Key (CMK) also located in Account A.

To successfully configure and run this pipeline, the developer needs to set up the necessary cross-account IAM roles, resource policies, and pipeline action settings.

What is the correct chronological sequence of steps required to successfully configure and execute this cross-account deployment?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: first, create the target deployment IAM role in Account B; second, update the KMS key policy and S3 bucket policy in Account A; third, configure the deploy action in the Account A pipeline; fourth, run the pipeline execution; and fifth, decrypt the artifact and deploy to Amazon ECS in Account B.
The correct sequence begins with creating the IAM role in Account B so that its ARN is valid. Then, policies in Account A (S3 and KMS) are updated to reference this ARN. Next, the pipeline deploy action is modified to use this role. Finally, the pipeline is executed, assuming the role, downloading, and decrypting the artifact to complete the deployment.

Step-by-Step Solution

1
Create the IAM role in Account B with a trust policy for Account A's CodePipeline service role.
The target deployment role exists, establishing a valid ARN for resource policy references.
AWS API validates principal ARNs in resource policies; the role must exist before it can be referenced elsewhere.
2
Update the KMS key policy and S3 bucket policy in Account A.
The Account B role is granted permissions to read from the artifact bucket and decrypt using the CMK.
Allows the cross-account deployment role to access the pipeline's encrypted artifacts.
3
Update the pipeline definition in Account A to specify the deploy action's roleArn.
The deploy action is configured to assume the Account B role during execution.
Tells CodePipeline which role to assume when running the deployment phase.
4
Trigger the pipeline execution.
CodePipeline assumes the Account B role and retrieves the artifact from S3.
Initiates the cross-account action execution workflow.
5
Decrypt the artifact and update the Amazon ECS service.
The application is successfully deployed to Account B.
Executes the final deployment step using the assumed role permissions and decrypted content.

Key Concept

Cross-account pipeline deployments with AWS KMS-encrypted artifact stores require strict ordering of IAM role creation, resource policy configuration (KMS and S3), and pipeline definition updates.
Estimated Time:3m 0s
Question 483Question →

A developer is configuring a CI/CD pipeline using AWS CodeDeploy for a serverless API hosted on AWS Lambda and integrated with Amazon API Gateway. The deployment process must adhere to the following requirements:

* Production traffic must be shifted in two stages: an initial 10%10\% of traffic is routed to the new version, followed by the remaining 90%90\% after a 1515-minute evaluation period.
* Prior to routing any production traffic to the new version, a test function must run to verify that the new version can successfully write to an Amazon DynamoDB table.
* If the test function fails, or if a CloudWatch alarm for 5xx5\text{xx} errors on the new version is triggered during the evaluation period, the deployment must immediately roll back.

Which TWO actions must the developer perform to configure the deployment?

Select all that apply

Show answer & explanation

Answer: Set the deployment configuration in AWS CodeDeploy to CodeDeployDefault.LambdaCanary10Percent15Minutes; Specify a validation Lambda function under the BeforeAllowTraffic hook in the AppSpec file to verify database connectivity

Answer

Configure the deployment in AWS CodeDeploy to use the CodeDeployDefault.LambdaCanary10Percent15Minutes configuration, and specify a validation Lambda function under the BeforeAllowTraffic hook in the AppSpec file to verify database connectivity.
To satisfy the deployment requirements, the developer must configure the traffic shifting behavior and implement the pre-traffic validation test. The 'CodeDeployDefault.LambdaCanary10Percent15Minutes' configuration routes 10%10\% of the traffic to the new version of the Lambda function initially, holds it for 1515 minutes to allow for monitoring, and then routes the remaining 90%90\% of traffic. Additionally, CodeDeploy uses the AppSpec file to define deployment lifecycle hooks. For Lambda deployments, the validation test must be executed during the 'BeforeAllowTraffic' hook, which runs before traffic routing begins. If the validation function fails, CodeDeploy automatically stops the deployment and rolls back the traffic.

Step-by-Step Solution

1
Analyze the traffic shifting requirement.
The requirements dictate shifting 10%10\% of traffic initially and the remaining 90%90\% after a 1515-minute evaluation period. This matches a canary deployment configuration, specifically 'CodeDeployDefault.LambdaCanary10Percent15Minutes'.
Identifying the correct built-in configuration ensures the traffic shifting logic adheres to the specifications.
2
Determine the appropriate lifecycle hook for pre-traffic verification.
The verification must run before any production traffic shifts. The correct hook for this in Lambda deployments is 'BeforeAllowTraffic'.
Running the validation code in 'BeforeAllowTraffic' ensures that if the validation fails, traffic is never shifted, preventing service disruption.
3
Verify hook support for AWS Lambda deployments in CodeDeploy.
AWS Lambda deployments only support the 'BeforeAllowTraffic' and 'AfterAllowTraffic' hooks. EC2 hooks like 'BeforeInstall' are unsupported and will cause deployment failures.
Understanding Lambda-specific lifecycle hooks prevents configuration errors in the AppSpec file.

Key Concept

AWS CodeDeploy deployment configurations and AppSpec lifecycle hooks for AWS Lambda.
Question 484Question →

A developer is configuring a containerized application running in AWS Batch. The application requires access to two sensitive values: a database password for an Amazon Aurora PostgreSQL database that must be rotated every 30 days, and an API key for a partner service that is static and does not require rotation. The developer wants to minimize costs while maintaining high security.

Which actions should the developer take to configure the storage for these secrets? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and enable automatic rotation using the built-in AWS Lambda rotation template for Amazon Aurora.; Store the partner API key in AWS Systems Manager Parameter Store as a SecureString parameter.

Answer

Store the database password in AWS Secrets Manager with automatic rotation enabled, and store the partner API key in AWS Systems Manager Parameter Store as a SecureString parameter.
The database password requires automatic rotation, which is a native feature of AWS Secrets Manager. The partner API key is static and does not require rotation, making Systems Manager Parameter Store (SecureString) the most cost-effective and secure choice.

Step-by-Step Solution

1
Identify the rotation requirement for the database password.
Since the Aurora PostgreSQL database password requires automatic rotation every 30 days, AWS Secrets Manager should be selected because it natively supports automatic rotation via built-in AWS Lambda templates for RDS.
AWS Systems Manager Parameter Store does not support native automatic rotation.
2
Identify the rotation and cost requirements for the partner API key.
Since the partner API key is static, does not require rotation, and the goal is to minimize costs, AWS Systems Manager Parameter Store (specifically a SecureString parameter) should be selected.
AWS Secrets Manager charges a monthly fee per secret, making it less cost-effective than Parameter Store for static configurations, while SecureString parameters provide the same level of encryption.

Key Concept

Selecting between AWS Secrets Manager and Systems Manager Parameter Store based on automatic rotation needs and cost efficiency.
Estimated Time:1m 0s
Question 485Question →

A developer is configuring a build in AWS CodeBuild that must retrieve an encrypted database password from the Systems Manager Parameter Store. The developer places a custom build specification file named build-config.yml inside a subdirectory named config in the source repository. When the build is triggered, CodeBuild fails with an error indicating that the buildspec file cannot be found. Additionally, once the buildspec is resolved, the build needs to be able to fetch and decrypt the password from Parameter Store.

Which TWO actions should the developer take to resolve these issues and ensure the build completes successfully?

Select all that apply

Show answer & explanation

Answer: Update the CodeBuild project settings to specify the buildspec path as config/build-config.yml.; Add the ssm:GetParameters and kms:Decrypt permissions to the CodeBuild service IAM role.

Answer

To resolve the issues, the developer must configure the custom buildspec path as config/build-config.yml in the CodeBuild project settings, and add both ssm:GetParameters and kms:Decrypt permissions to the CodeBuild service IAM role.
Specifying the custom buildspec path config/build-config.yml in the project settings tells CodeBuild where to locate the configuration file. Granting ssm:GetParameters and kms:Decrypt to the CodeBuild service role provides the necessary permissions to read and decrypt the secure parameter.

Step-by-Step Solution

1
Address the missing buildspec file issue.
Configured the project to look at config/build-config.yml instead of the default root path.
CodeBuild defaults to looking for buildspec.yml at the root directory. Subdirectories require explicit path mapping.
2
Configure Systems Manager Parameter Store permissions.
Added ssm:GetParameters to the CodeBuild service role.
Allows CodeBuild to retrieve the parameter value from Systems Manager Parameter Store.
3
Configure AWS Key Management Service (KMS) permissions.
Added kms:Decrypt to the CodeBuild service role.
Since the parameter is stored as a SecureString, CodeBuild needs decrypt permissions for the KMS key that encrypts it.

Key Concept

AWS CodeBuild buildspec configuration and IAM permissions for Systems Manager integration.
Question 486Question →

A developer is configuring an AWS Lambda function in AWS account 987654321098987654321098 to retrieve data from an Amazon S3 bucket. The function is assigned an IAM role named `LambdaS3ReaderRole`. The developer has already attached a permissions policy to this role that allows `s3:GetObject` on the target bucket. However, when the Lambda function runs, it fails with an authorization error indicating that the AWS Lambda service is not authorized to assume the role.

The developer inspects the trust policy of `LambdaS3ReaderRole` and finds the following configuration:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::my-app-data-bucket/*"
}
]
}

Which modification to the trust policy is required to resolve this error?

Show answer & explanation

Answer: Change the Action element to "sts:AssumeRole" and remove the Resource element.

Answer

Change the Action element to "sts:AssumeRole" and remove the Resource element.
Changing the Action element to "sts:AssumeRole" and removing the Resource element is correct because an IAM role's trust policy governs who is trusted to assume the role. It must use the "sts:AssumeRole" action with the trusted service principal ("lambda.amazonaws.com") as the principal. The specific resource actions (such as "s3:GetObject") must be defined in the permissions policy attached to the role, not the trust policy.

Step-by-Step Solution

1
Analyze the error message and the current trust policy structure.
The Lambda service cannot assume the execution role because the trust policy's Action is set to "s3:GetObject" instead of a valid STS assume role action.
An IAM role's trust policy must specify an action that allows trust delegation (specifically "sts:AssumeRole" for AWS services).
2
Differentiate between the role's trust policy and its permissions policy.
The trust policy determines who can assume the role (the Lambda service principal), while the permissions policy determines what actions the assumed role can perform (S3 object retrieval).
Mixing permission actions like "s3:GetObject" and resource restrictions into the trust policy prevents the role from being assumed and violates the structural constraints of trust documents.
3
Correct the trust policy elements.
The Action element is updated to "sts:AssumeRole" and the Resource element is removed (since trust policies do not target external resources like S3 buckets).
This establishes the necessary trust link between the AWS Lambda service and the execution role, allowing execution to succeed.

Key Concept

Distinction between IAM Trust Policies and Permissions Policies
Estimated Time:2m 0s
Question 487Question →

An application developer is deploying an updated version of a microservice REST API using Amazon API Gateway. To minimize blast radius, the developer wants to test the update under production conditions by routing 5%5\% of incoming API traffic to the new deployment. The developer also needs to monitor separate Amazon CloudWatch metrics for the test traffic and the production traffic. Once the new deployment is verified, the developer must promote it to receive 100%100\% of the traffic with minimum administrative overhead and without managing additional API Gateway stages. Which deployment strategy should the developer implement to meet these requirements?

Show answer & explanation

Answer: Configure a canary release on the active API Gateway stage, set the canary traffic percentage to 5%5\%, and then promote the canary to the stage after verification.

Answer

Configure a canary release on the active API Gateway stage, set the canary traffic percentage to 5%5\%, and then promote the canary to the stage after verification.
Configuring a canary release on the active API Gateway stage allows the developer to route a specific percentage of traffic (such as 5%5\%) to a new deployment on the same stage. API Gateway automatically generates separate Amazon CloudWatch metrics for the canary traffic, which can be monitored. When verification is complete, promoting the canary updates the stage deployment to the new version and deletes the canary, meeting all requirements with the lowest administrative overhead and without managing multiple stages.

Step-by-Step Solution

1
Evaluate the requirement for splitting traffic at the API Gateway level with separate metrics and no additional stages.
Identify that API Gateway canary releases support splitting traffic on a single stage and provide separate CloudWatch metrics.
This aligns with minimizing stage management and administrative overhead.
2
Set up the canary release on the active stage with 5%5\% traffic.
5%5\% of incoming requests are routed to the new API deployment, and API Gateway automatically publishes separate CloudWatch metrics for the canary stage.
This allows safe verification of the new version under production load.
3
Promote the canary release.
The new deployment becomes the active deployment for the stage, and the canary is disabled.
This completes the promotion to 100%100\% traffic with zero downtime and no additional stages to delete or manage.

Key Concept

API Gateway Canary Deployments
Estimated Time:2m 30s
Question 488Question →

A developer is using AWS Serverless Application Model (SAM) to deploy a Lambda function that processes incoming orders via Amazon API Gateway. The developer wants to configure the deployment pipeline to perform a canary deployment, shifting 10% of the traffic to the new version for a 5-minute evaluation period before routing the remaining traffic.

The current `template.yaml` is defined below:

yaml
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Deployment template for order processing service

Resources:
ProcessOrderFunction:
Type: AWS::Serverless::Function
Properties:
Handler: index.handler
Runtime: nodejs18.x
CodeUri: ./src
Events:
PostOrder:
Type: Api
Properties:
Path: /orders
Method: post

Which of the following modifications must the developer make to the template to enable this gradual deployment strategy? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Add the AutoPublishAlias property under the Properties section of ProcessOrderFunction and assign it an alias name.; Add the DeploymentPreference property under the Properties section of ProcessOrderFunction and set the Type to Canary10Percent5Minutes.

Answer

Add the AutoPublishAlias property under the Properties section of ProcessOrderFunction and assign it an alias name; and add the DeploymentPreference property under the Properties section of ProcessOrderFunction and set the Type to Canary10Percent5Minutes.
To configure a canary deployment for an AWS::Serverless::Function, the template must define both the AutoPublishAlias property (to create a Lambda alias pointing to the newly published version) and the DeploymentPreference property (to define the routing policy such as Canary10Percent5Minutes). AWS SAM uses these properties to automatically generate the underlying CodeDeploy resources and configurations needed to route traffic gradually.

Step-by-Step Solution

1
Identify the requirement for AWS CodeDeploy in gradual serverless deployments.
Recognize that AWS SAM relies on AWS CodeDeploy to perform canary or linear traffic shifting.
Enabling gradual traffic shifting requires configuring properties that AWS SAM uses to provision the necessary CodeDeploy resources.
2
Configure function versioning and aliasing in the SAM template.
Identify that AutoPublishAlias must be added to the function properties.
Traffic shifting can only happen between distinct, immutable Lambda function versions referenced by a Lambda alias.
3
Define the traffic shifting strategy details.
Add the DeploymentPreference object under the function properties, specifying the Type as Canary10Percent5Minutes.
This configuration maps directly to the CodeDeploy deployment configuration that manages the 10% traffic routing and 5-minute evaluation window.

Key Concept

Configuring gradual deployments (canary/linear) in AWS SAM using AutoPublishAlias and DeploymentPreference properties.
Question 489Question →

A developer is performing an in-place deployment of a new application revision to a fleet of Amazon EC2 instances using AWS CodeDeploy. The developer updated a cleanup script named 'stop-server.sh' in the new revision and referenced it in the 'ApplicationStop' lifecycle hook of the 'appspec.yml' file. However, the deployment fails during the 'ApplicationStop' phase. Investigation reveals that the 'stop-server.sh' script currently residing on the instances (from the previous deployment) has a syntax error that causes it to exit with a non-zero status, whereas the updated script in the new deployment bundle has this error fixed. Which of the following explains why the deployment failed and how the developer can successfully deploy the new application revision?

Show answer & explanation

Answer: CodeDeploy executes the 'ApplicationStop' hook using the script from the previously deployed revision on the instances. The developer can bypass this failure by redeploying the new revision with the ignore application stop failures option enabled.

Answer

CodeDeploy executes the ApplicationStop hook using the script from the previously deployed revision on the instances. The developer can bypass this failure by redeploying the new revision with the ignore application stop failures option enabled.
The correct option is correct because during an in-place deployment, CodeDeploy runs the ApplicationStop lifecycle hook using the scripts and appspec.yml from the previous successful deployment revision. Since the script on the instances has a bug, the hook fails and prevents the deployment from proceeding. Enabling the ignore application stop failures option allows CodeDeploy to bypass this hook's failure and successfully deploy the new version.

Step-by-Step Solution

1
Analyze the execution context of lifecycle hooks in an in-place CodeDeploy deployment.
Identify that the ApplicationStop hook occurs before the new revision bundle is downloaded and runs using the appspec.yml and scripts from the previously successful deployment revision.
This explains why the syntax error in the old version of the script causes the new deployment to fail, even though the script is fixed in the new revision bundle.
2
Evaluate recovery mechanisms for failing ApplicationStop scripts in CodeDeploy.
Determine that CodeDeploy allows bypassing ApplicationStop script failures using the '--ignore-application-stop-failures' flag in the AWS CLI or by checking the equivalent option in the AWS Management Console.
Since the local script on the EC2 instances is broken and cannot exit successfully, bypassing the hook is the only automated way to allow the new, fixed bundle to be downloaded and installed.

Key Concept

AWS CodeDeploy EC2 in-place deployment lifecycle hook execution and failure handling
Estimated Time:2m 0s
Question 490Question →

A developer uses AWS Serverless Application Model (SAM) to deploy a Lambda function that retrieves database credentials from AWS Secrets Manager. The secret is encrypted using a customer managed AWS KMS key. In the SAM template, the developer configures the function's `Policies` property with the `AWSSecretsManagerGetSecretValuePolicy` template, referencing the secret's ARN. The deployment completes successfully. However, when the function runs, it fails with an `AccessDeniedException` during the `GetSecretValue` API call. What is the reason for this runtime failure?

Show answer & explanation

Answer: The `AWSSecretsManagerGetSecretValuePolicy` policy template only grants permissions for the `secretsmanager:GetSecretValue` action, meaning the function execution role still lacks permissions to decrypt the secret using the customer managed KMS key.

Answer

The Lambda function's execution role lacks explicit decrypt permissions on the customer managed KMS key, as the pre-defined `AWSSecretsManagerGetSecretValuePolicy` SAM policy template only grants permission for the `secretsmanager:GetSecretValue` action.
The correct answer is correct because the built-in AWS SAM policy template `AWSSecretsManagerGetSecretValuePolicy` only grants the Lambda function permission to call `secretsmanager:GetSecretValue` on the specified resource. If the secret is encrypted with a customer managed KMS key (rather than the default AWS-managed key `aws/secretsmanager`), the function's IAM execution role must also be granted explicit `kms:Decrypt` permissions on that KMS key to successfully read the decrypted payload.

Step-by-Step Solution

1
Analyze the IAM policy generated by the `AWSSecretsManagerGetSecretValuePolicy` template.
The generated policy grants access to `secretsmanager:GetSecretValue` for the target secret resource.
To verify the scope of the permissions granted to the Lambda function's execution role by default.
2
Identify the encryption mechanism of the secret.
The secret is encrypted using a customer managed KMS key.
Secrets encrypted with customer managed keys require explicit KMS decrypt permissions for any identity attempting to read them.
3
Determine why the call fails with AccessDeniedException at runtime.
While the function can access Secrets Manager, the decryption fails because the execution role does not possess the `kms:Decrypt` permission on the customer managed key.
Both Secrets Manager and KMS permissions must be present in the execution role for successful retrieval of KMS-encrypted secrets.

Key Concept

AWS SAM Policy Templates and KMS Decrypt Permissions
Estimated Time:2m 0s
Question 491Question →

A developer is configuring the deployment policy for a high-traffic web application hosted on AWS Elastic Beanstalk. The application runs on multiple Amazon EC2 instances. The deployment policy must satisfy the following requirements:

1. The application must maintain 100%100\% of its instance capacity to handle incoming traffic at all times during the deployment.
2. If a deployment failure occurs, the rollback process must be rapid and must not perform any updates or modifications on the original, healthy instances.

Which two deployment strategies should the developer select to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Immutable; Traffic splitting

Answer

The correct strategies are Immutable and Traffic splitting.
The correct strategies are Immutable and Traffic splitting. Both of these strategies maintain 100%100\% instance capacity during deployment by launching a separate, temporary Auto Scaling group for the new version. Furthermore, if a deployment failure occurs, the rollback is rapid and clean because it only requires terminating the temporary Auto Scaling group and redirecting traffic, leaving the original, healthy instances completely untouched.

Step-by-Step Solution

1
Analyze capacity requirements during deployment.
To maintain 100%100\% capacity without reducing instance count, any strategy that takes existing instances offline (All-at-once, Rolling) is eliminated. Strategies that launch new instances (Rolling with additional batch, Immutable, Traffic splitting) are kept.
Eliminating options that reduce capacity ensures the application can handle peak traffic during the update.
2
Analyze rollback requirements in case of failure.
Rolling with additional batch modifies the existing instances. If it fails, rolling back requires redeploying the old version back onto the instances, which takes time and modifies active instances. Immutable and Traffic splitting launch a separate, temporary Auto Scaling group. If they fail, they immediately redirect traffic and terminate the temporary resources, leaving the original instances untouched.
This identifies the strategies that provide the fastest and cleanest rollback without performing out-of-band updates on original instances.

Key Concept

AWS Elastic Beanstalk deployment policies and their impact on capacity, rollback speed, and resource modification.
Question 492Question →

A developer is deploying a database-backed web application using an AWS CloudFormation template. The application requires a database password that must be automatically rotated every 30 days, and a database port setting that is non-sensitive and static. Which of the following approaches represent best practices for managing these configurations? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager, enable automatic rotation, and retrieve the password in the CloudFormation template using a dynamic reference.; Store the database port in AWS Systems Manager Parameter Store as a standard parameter, and retrieve it in the CloudFormation template using a dynamic reference.

Answer

Store the database password in AWS Secrets Manager with automatic rotation, and store the database port in AWS Systems Manager Parameter Store, referencing both via dynamic references.
The correct approach is to store the database password in AWS Secrets Manager because it is sensitive and requires automatic rotation, and store the database port in AWS Systems Manager Parameter Store because it is static and non-sensitive. Both values should be retrieved using dynamic references in the CloudFormation template to avoid hardcoding sensitive data and to ensure secure, automated retrieval at deployment time.

Step-by-Step Solution

1
Determine the security and lifecycle needs of each configuration item.
The database password is sensitive and requires automatic rotation; the database port is non-sensitive and static.
Identifying these traits ensures that resources are configured using the most secure and cost-efficient AWS services.
2
Select the correct storage service for the sensitive password.
AWS Secrets Manager is selected.
Secrets Manager natively supports automatic rotation and secure encryption, which are required for the database password.
3
Select the correct storage service for the non-sensitive port.
AWS Systems Manager Parameter Store is selected.
Parameter Store standard parameters are free and ideal for static, non-sensitive parameters, avoiding the cost of Secrets Manager.
4
Reference both values dynamically inside the CloudFormation template.
Dynamic references are added to the template parameters.
Dynamic references allow the stack to fetch the values at deploy time without storing sensitive data in the template definition.

Key Concept

AWS CloudFormation templates should integrate with AWS Systems Manager Parameter Store and AWS Secrets Manager using dynamic references to securely and cost-effectively inject parameters based on their sensitivity and rotation requirements.
Question 493Question →

A developer is troubleshooting performance issues on a web application where user session state is stored in an Amazon DynamoDB table. During high-traffic events, users frequently experience session timeouts and slow page loads. The application logs show numerous `ProvisionedThroughputExceededException` errors during session read and write operations. The developer confirms that the table has a partition key of `SessionId` and a sort key of `LastActiveTime`.

Which TWO strategies should the developer implement to optimize session state management and resolve the throughput issues? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable Amazon DynamoDB Time to Live (TTL) on the table using a dedicated attribute that stores the session expiration timestamp in Unix epoch format.; Modify the application logic to retrieve session items using DynamoDB GetItem or Query operations targeting the SessionId partition key.

Answer

Enable Amazon DynamoDB Time to Live (TTL) on the table using a dedicated epoch timestamp attribute and modify the application logic to retrieve session items using targeted DynamoDB GetItem or Query operations.
Enabling DynamoDB Time to Live (TTL) is an architectural best practice for session data since it automatically deletes expired items without consuming read or write capacity units. Additionally, querying the table directly by the SessionId partition key ensures that the database only retrieves the specific item requested, minimizing Read Capacity Unit (RCU) consumption and reducing latency.

Step-by-Step Solution

1
Analyze error logs to determine the cause of performance issues.
Identify that the ProvisionedThroughputExceededException errors are caused by inefficient data access patterns and expired data accumulation.
Before applying optimizations, it is necessary to identify the root cause of the DynamoDB throttling.
2
Enable DynamoDB Time to Live (TTL) on the table.
DynamoDB automatically deletes expired sessions behind the scenes without consuming provisioned write capacity.
This removes the need for expensive scan-and-delete processes to clean up stale session data.
3
Refactor application queries to perform direct lookups using the key schema.
The application retrieves session state using GetItem or Query operations on the SessionId partition key, which execute in O(1) time.
This prevents table scans and dramatically reduces Read Capacity Unit (RCU) consumption.

Key Concept

Optimizing DynamoDB throughput for session state management using TTL and key-based lookups instead of scans.
Estimated Time:2m 0s
Question 494Question →

A developer is troubleshooting an AWS Lambda function that processes customer orders. The function is configured to connect to an Amazon RDS PostgreSQL database in a private subnet of a custom VPC. The function also needs to call a third-party payment provider's public API endpoint over the internet. The developer configured the Lambda function to run in the public subnets of the VPC and associated it with a security group that allows all outbound traffic. During execution, the function successfully queries the database but times out when attempting to reach the payment provider's API.

Which of the following actions will resolve this connectivity issue?

Show answer & explanation

Answer: Associate the Lambda function with the private subnets of the VPC, deploy a NAT Gateway in a public subnet, and route internet-bound traffic from the private subnets through the NAT Gateway.

Answer

Associate the Lambda function with the private subnets of the VPC, deploy a NAT Gateway in a public subnet, and route internet-bound traffic from the private subnets through the NAT Gateway.
The correct solution is to associate the Lambda function with the private subnets of the VPC, deploy a NAT Gateway in a public subnet, and route internet-bound traffic from the private subnets through the NAT Gateway. AWS Lambda functions associated with a VPC do not receive public IP addresses. Even if placed in a public subnet, they cannot route traffic directly to the Internet Gateway. Moving the function to private subnets and routing outbound traffic through a NAT Gateway resolves this limitation.

Step-by-Step Solution

1
Analyze the network configuration of the Lambda function.
Identify that the Lambda function is placed in public subnets but lacks public IP addresses, preventing direct internet access.
Lambda functions in a VPC do not get public IPs, meaning they cannot use an Internet Gateway directly.
2
Reconfigure the Lambda subnets.
Move the Lambda function configuration to private subnets of the VPC.
This is the standard architectural pattern for resource isolation and enabling NAT-based outbound routes.
3
Deploy and configure a NAT Gateway.
Set up a NAT Gateway in a public subnet and update the private subnet's route table to direct 0.0.0.0/0 traffic to the NAT Gateway.
This enables resources in the private subnets (including the Lambda function) to securely route outbound requests to the public API.

Key Concept

AWS Lambda VPC networking and outbound internet access
Question 495Question →

A developer is configuring a backend application running on an Amazon EC2 instance to send application logs to Amazon CloudWatch Logs. The developer creates an IAM role named `EC2LoggingRole` with the following permissions policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": "arn:aws:logs:us-east-1:123456789012:log-group:AppServerLogs:*"
}
]
}

During testing, the application fails to write to CloudWatch Logs with authorization errors. Which two configuration steps must the developer perform to resolve this issue and securely grant permissions to the application? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the trust policy of `EC2LoggingRole` to allow the `ec2.amazonaws.com` service principal to perform the `sts:AssumeRole` action.; Create an IAM instance profile, add `EC2LoggingRole` to it, and attach the instance profile to the EC2 instance.

Answer

Configure the trust policy of the IAM role to allow the Amazon EC2 service principal to assume it, and associate the role with the instance by using an IAM instance profile.
The correct configuration requires defining a trust policy that permits the EC2 service principal to assume the role via the `sts:AssumeRole` action. Additionally, an IAM instance profile must be created to link the IAM role to the EC2 instance, allowing the AWS SDK on the instance to automatically retrieve temporary credentials from the Instance Metadata Service (IMDS).

Step-by-Step Solution

1
Configure the trust relationship of the IAM role.
The IAM role's trust policy is updated to explicitly trust the EC2 service principal (`ec2.amazonaws.com`).
This allows the Amazon EC2 service to assume the IAM role and obtain temporary credentials on behalf of the application.
2
Create and attach an IAM instance profile.
An IAM instance profile containing the role is attached to the EC2 instance.
Unlike other services such as Lambda, EC2 instances require an intermediate container (the instance profile) to deliver temporary credentials to the instance metadata service (IMDS).

Key Concept

To grant AWS resource access to applications running on Amazon EC2 instances, you must configure a trust relationship on the IAM role for the EC2 service principal (`ec2.amazonaws.com`) and attach the role via an IAM instance profile.
Question 496Question →

A developer is deploying a serverless application using AWS SAM. The template file (`template.yaml`) defines several `AWS::Serverless::Function` resources with the `CodeUri` property pointing to local directories (e.g., `./src`). The developer attempts to deploy the template directly using the command `aws cloudformation deploy --template-file template.yaml --stack-name my-stack`. The deployment fails with errors indicating that the template format is invalid because the `AWS::Serverless` resources are not recognized, and the local paths for `CodeUri` cannot be resolved. Which TWO actions must the developer take to resolve these issues and successfully deploy the application?

Select all that apply

Show answer & explanation

Answer: Add the `Transform: AWS::Serverless-2016-10-31` declaration at the root level of the template file.; Run the `sam package` command to upload the local artifacts to an Amazon S3 bucket and generate a new template file with S3 URIs.

Answer

To deploy a SAM application successfully, the developer must add the `Transform: AWS::Serverless-2016-10-31` declaration at the root level of the template file to enable SAM syntax translation, and run the `sam package` command to upload local assets to Amazon S3 and produce a packaged template referencing those S3 locations.
The correct options involve adding the `Transform: AWS::Serverless-2016-10-31` declaration to enable the CloudFormation SAM parser, and running the `sam package` command to process local paths and upload code artifacts to Amazon S3. These two steps resolve the validation errors and local file path reference limitations in CloudFormation.

Step-by-Step Solution

1
Add the required serverless transform header to the SAM template.
The template now includes `Transform: AWS::Serverless-2016-10-31` at the root level.
Without this declaration, AWS CloudFormation does not recognize SAM resource types like `AWS::Serverless::Function` and fails during parsing.
2
Run the `sam package` command specifying an Amazon S3 bucket for code storage.
The local artifacts are zipped and uploaded to the specified S3 bucket, and a new template file is generated where the `CodeUri` properties point to the S3 objects.
CloudFormation cannot upload local directory contents directly from the deployment command; packaging resolves local paths to S3 URIs.
3
Deploy the application using the packaged template file.
The stack is created or updated successfully in AWS CloudFormation.
The packaged template contains standard S3 locations and valid SAM syntax that CloudFormation can translate and execute.

Key Concept

AWS SAM templates must define the Transform header to be processed, and local files must be packaged and uploaded to Amazon S3 before deploying via CloudFormation.
Question 497Question →

A developer is troubleshooting an AWS Lambda function that occasionally fails. The developer wants to monitor these failures by creating a CloudWatch metric and alarm whenever the function times out. The Lambda function has a timeout configured for 15 seconds. The log stream contains the following log event:

`2026-07-14T12:00:00.000Z 8f029cfa-13e5-4b4f-8f81-540e7912a78f Task timed out after 15.02 seconds`

The developer configures a metric filter with the filter pattern `[timestamp, request_id, message = "Task timed out*"]` to increment a custom metric named `TimeoutCount`. However, the metric remains at 0 even after subsequent timeouts occur.

Which of the following actions should the developer take to resolve this issue and successfully track the timeouts? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Update the metric filter pattern to "Task timed out" (with double quotes) to match the exact phrase anywhere in the log event.; Update the metric filter pattern to [timestamp, request_id, word1 = "Task", word2 = "timed", word3 = "out"] to correctly match the individual space-delimited words in the log entry.

Answer

Update the metric filter pattern to "Task timed out" (with double quotes) and update the metric filter pattern to [timestamp, request_id, word1 = "Task", word2 = "timed", word3 = "out"].
The correct options are: updating the metric filter pattern to use the exact phrase "Task timed out" in double quotes, and updating the metric filter pattern to use individual space-delimited words. The first option works because enclosing a phrase in double quotes instructs CloudWatch Logs to search for the literal substring anywhere in the log event, bypassing field parsing. The second option works because it maps each space-separated term (e.g., 'Task', 'timed', 'out') to individual fields, matching the actual log structure.

Step-by-Step Solution

1
Analyze the log format and the failing filter pattern.
The log event is space-delimited: `2026-07-14T12:00:00.000Z 8f029cfa-13e5-4b4f-8f81-540e7912a78f Task timed out after 15.02 seconds`. The third field contains only 'Task', not the entire phrase 'Task timed out'.
Understanding why the current filter pattern `[timestamp, request_id, message = "Task timed out*"]` fails to match.
2
Identify correct string matching patterns in CloudWatch Logs.
Using a literal term search like `"Task timed out"` in double quotes matches the exact phrase anywhere in the log line.
Literal phrase matching is the simplest way to find multi-word strings without defining complex space-delimited fields.
3
Identify correct space-delimited field structures.
Represent the log event fields individually: `[timestamp, request_id, word1 = "Task", word2 = "timed", word3 = "out"]`.
This maps each space-separated word to a separate variable and matches them exactly, which is valid for space-delimited filtering.

Key Concept

CloudWatch Logs Metric Filter pattern syntax and space-delimited log parsing rules.
Question 498Question →

An application deployed on AWS Fargate publishes structured JSON logs to an Amazon CloudWatch Logs log group. Each log event contains fields such as `latency`, `statusCode`, `path`, and `userId`. A developer is tasked with creating a CloudWatch Logs Insights query to analyze application performance. The query must calculate the 95th95\text{th} percentile of latency for all requests and count the number of server errors (where `statusCode` is 500500 or greater). The results must be grouped by the API `path` and aggregated into 55-minute intervals. Which CloudWatch Logs Insights query should the developer use to meet these requirements?

Show answer & explanation

Answer: fields @timestamp, path, latency, statusCode | stats pct(latency, 95) as p95_latency, sum(statusCode >= 500) as error_count by path, bin(5m)

Answer

The query that uses the sum function with a conditional expression inside stats: 'fields @timestamp, path, latency, statusCode | stats pct(latency, 95) as p95_latency, sum(statusCode >= 500) as error_count by path, bin(5m)'
The correct query uses sum(statusCode >= 500) inside the stats command. In CloudWatch Logs Insights, boolean expressions inside aggregation functions evaluate to 1 for true and 0 for false. Therefore, summing the expression statusCode >= 500 effectively counts only the events where the status code indicates a server error, while allowing the percentile function pct(latency, 95) to be calculated over the entire dataset without prior filtering.

Step-by-Step Solution

1
Determine where to place the filtering/conditional logic to ensure latency is calculated over all requests.
Avoid using a top-level '| filter statusCode >= 500' command, as it would prematurely discard successful requests before the latency calculation.
A top-level filter restricts the input dataset to only matching records, skewing overall metrics like latency percentiles.
2
Select the correct conditional aggregation function in CloudWatch Logs Insights.
Use 'sum(statusCode >= 500)' to sum the boolean results (1 for true, 0 for false).
Boolean expressions inside 'sum()' evaluate to 1 when true and 0 when false, which acts as a conditional count.
3
Group and bin the aggregated results.
Use 'by path, bin(5m)' at the end of the 'stats' command.
This groups the calculated statistics by the request path and segments them into 5-minute time intervals.

Key Concept

Conditional aggregation in CloudWatch Logs Insights stats command
Estimated Time:1m 30s
Question 499Question →

A developer is writing an AWS Lambda function that programmatically launches an Amazon EC2 instance using the AWS SDK. The EC2 instance requires an IAM role to access an Amazon S3 bucket. The developer has created the EC2 IAM role `EC2AccessS3Role` and an associated instance profile.

The Lambda function runs under an execution role with the following identity-based policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:RunInstances",
"ec2:DescribeInstances"
],
"Resource": "*"
}
]
}

When the Lambda function executes the code to launch the instance with the instance profile, the API call fails with a `Client.UnauthorizedOperation` error.

Which of the following actions will resolve this issue?

Show answer & explanation

Answer: Add the `iam:PassRole` permission to the Lambda function's execution role policy, specifying the ARN of the `EC2AccessS3Role` as the resource.

Answer

The developer should add the `iam:PassRole` permission to the Lambda function's execution role, specifying the ARN of the EC2 IAM role as the resource.
The correct answer is to add the `iam:PassRole` permission to the Lambda execution role. To associate an IAM role with an EC2 instance during launch, the calling identity (the Lambda function) must have the `iam:PassRole` permission for the specific role being passed. This ensures that the user or service cannot escalate privileges by passing a role they are not authorized to use.

Step-by-Step Solution

1
Identify the action being performed when the error occurs.
The Lambda function is calling `ec2:RunInstances` and passing an IAM role (via an instance profile) to the EC2 instance.
The Lambda execution role has permission to run instances but fails with an unauthorized error when attempting to associate the role.
2
Apply the concept of delegation of permissions in AWS.
When an AWS service or user passes an IAM role to an AWS service, it requires the `iam:PassRole` permission.
AWS enforces the `iam:PassRole` permission to prevent users/services from passing roles with higher privileges than they themselves possess.
3
Configure the IAM policy.
Add an inline or managed policy to the Lambda execution role that allows `iam:PassRole` on the ARN of the EC2 role.
This allows the Lambda function's execution role to successfully delegate the EC2 role to the newly created EC2 instance.

Key Concept

IAM PassRole Permission
Question 500Question →

A developer is building a web application that uses Amazon Cognito User Pools for user authentication and Amazon API Gateway REST APIs for the backend. The developer needs to restrict access to a specific API resource so that only users who have a custom user attribute `custom:membership` set to `Gold` can access it. The client application must be able to call the API by passing the Cognito ID token in the `Authorization` header, without having to sign the requests using AWS Signature Version 4. Which solution should the developer implement to meet these requirements?

Show answer & explanation

Answer: Create a custom API Gateway Lambda authorizer that decodes the Cognito ID token, verifies its signature, validates the custom membership claim value, and returns an IAM policy to allow or deny the request.

Answer

Create a custom API Gateway Lambda authorizer that decodes the Cognito ID token, verifies its signature, validates the custom membership claim value, and returns an IAM policy to allow or deny the request.
The correct solution uses a custom API Gateway Lambda authorizer to decode the Cognito ID token, verify its signature, and inspect the custom membership claim value. Because Cognito ID tokens are JSON Web Tokens (JWTs) that carry custom user attributes in their payload, the Lambda authorizer can perform this check offline without calling Cognito APIs, and then return the appropriate IAM policy to allow or deny access. This achieves the desired authorization logic without requiring the client to perform Signature Version 4 signing.

Step-by-Step Solution

1
Select the API Gateway Lambda authorizer pattern over the built-in Cognito User Pool authorizer.
Enables inspection of custom claims such as custom attributes, which the built-in Cognito authorizer cannot evaluate for custom routing logic.
Built-in Cognito authorizers are limited to token validation and scope checks, making them unsuitable for fine-grained authorization based on custom attributes.
2
Configure the Lambda authorizer to decode and validate the token locally.
Ensures the token is authentic by checking the signature against Cognito's public keys, verifying expiration, and extracting user attributes directly from the payload.
Decoding the token locally prevents slow and rate-limited API calls (like AdminGetUser) to Cognito, optimizing performance and avoiding throttling.
3
Generate and return an IAM policy based on the custom membership claim value.
Returns an IAM Allow policy if the claim value is Gold, or Deny policy otherwise.
API Gateway uses the returned IAM policy to permit or block access to the backend integration.

Key Concept

Fine-grained API Gateway authorization using Cognito ID token claims with a custom Lambda Authorizer.
PreviousPage 25 / 78Next
All practice questions — AWS Certified Developer - Associate | Examkin