All practice questions

1542 questions

All types1,542 Multiple choice782 Multiple select746 Ordering14

A developer needs to configure an Amazon API Gateway REST API endpoint to return a static JSON payload and an HTTP $200$ OK status code for testing. To minimize latency and cost, the endpoint must not invoke any backend services or Lambda functions. Which two configuration steps must the developer perform to set up a Mock integration for this endpoint? (Select TWO.)

Select all that apply

Configure the Integration Request type as Mock, and define a mapping template for the application/json content type that outputs a JSON payload containing the statusCode property (e.g., {"statusCode": 200}).

Configure a Lambda Proxy integration with a Lambda function that returns a hardcoded JSON payload.

Configure a Method Response for HTTP status

200

, and define an Integration Response that maps to it with a template containing the static JSON payload.

Use a custom Lambda Authorizer to intercept the request and return the static JSON payload inside the context object.

Create a custom Gateway Response with a custom status code and configure it to return the static JSON payload under the DEFAULT_4XX type.

Show answer & explanation

Answer: Configure the Integration Request type as Mock, and define a mapping template for the application/json content type that outputs a JSON payload containing the statusCode property (e.g., {"statusCode": 200}).; Configure a Method Response for HTTP status $200$ , and define an Integration Response that maps to it with a template containing the static JSON payload.

Answer

To configure a Mock integration, set the Integration Request type to Mock and define a mapping template that outputs a JSON payload containing the statusCode property. Then, configure a Method Response for HTTP status

200

and map an Integration Response containing the static JSON payload to it.

A Mock integration allows API Gateway to return responses directly to the client without calling any downstream backend. Setting the integration type to Mock requires the integration request to specify a mapping template mapping the incoming request to a JSON object with a `statusCode` field. API Gateway uses this status code value to route the request to the matching Integration Response. To output the desired data, the developer must define an HTTP

200

Method Response and write an Integration Response mapping template for that status code containing the static JSON payload.

Step-by-Step Solution

Set the Integration Request type to Mock in API Gateway.

API Gateway is instructed to bypass backend routing and handle the request directly.

Mock integrations process the request internally within API Gateway.

Define an Integration Request mapping template for the content type application/json.

The template outputs a JSON object containing the statusCode parameter, such as {"statusCode": 200}.

API Gateway uses this statusCode value to select the correct integration response.

Define a Method Response for HTTP status

200

and a matching Integration Response.

An integration response maps the internal statusCode to the client-facing HTTP

200

response.

Allows returning the configured static JSON payload as the response body to the client.

Key Concept

API Gateway Mock Integration

Estimated Time:2m 0s

Question 542Question →

A developer is building an IoT application that processes telemetry from a fleet of connected vehicles. The data is sent to an Amazon Kinesis Data Stream and processed by an AWS Lambda function. The JSON payload of each event includes `vehicle_id` (a unique UUID), `manufacturer` (e.g., 'CompanyA'), `timestamp`, and `speed`. The Lambda function must also route critical warning events to an Amazon EventBridge custom event bus.

During testing, the developer observes `ProvisionedThroughputExceededException` errors during peak periods, indicating uneven distribution of traffic across shards. Additionally, some Lambda executions fail because the function times out before completing the processing of a large batch of records, and the function is unable to route events to EventBridge when deployed inside a private VPC subnet.

Which two actions should the developer take to resolve these issues? (Select TWO.)

Select all that apply

Use the vehicle_id as the partition key for records published to the Kinesis Data Stream.

Decrease the BatchSize parameter in the Lambda event source mapping, and ensure the Lambda function timeout is configured to an appropriate value up to 15 minutes.

Use the manufacturer as the partition key for records published to the Kinesis Data Stream.

Increase the Lambda function timeout to 25 minutes to allow sufficient time for large batches of records to complete processing.

Deploy the Lambda function in a private VPC subnet without configuring a NAT Gateway or VPC interface endpoints.

Show answer & explanation

Answer: Use the vehicle_id as the partition key for records published to the Kinesis Data Stream.; Decrease the BatchSize parameter in the Lambda event source mapping, and ensure the Lambda function timeout is configured to an appropriate value up to 15 minutes.

Answer

Use the vehicle_id as the partition key for the stream records, and decrease the BatchSize parameter on the Lambda event source mapping while ensuring the Lambda timeout is set to a value up to 15 minutes.

The correct options ensure the Kinesis stream shards are balanced using a high-entropy key (vehicle_id) and that the Lambda consumer is properly calibrated for batch size and timeout within the platform limit of 15 minutes.

Step-by-Step Solution

Select a high-entropy partition key.

Using the unique vehicle UUID (vehicle_id) distributes write operations evenly across Kinesis shards.

This prevents hot shards and resolves the ProvisionedThroughputExceededException.

Adjust the Lambda batch size and timeout settings.

Reduce BatchSize on the Kinesis event source mapping and adjust the Lambda function timeout up to the 15-minute maximum limit.

This ensures the function does not time out while processing large batches of stream records.

Ensure outbound connectivity in the private VPC subnet.

Provide internet access via a NAT Gateway or configure a VPC interface endpoint for Amazon EventBridge.

This allows the Lambda function to successfully communicate with the EventBridge API.

Key Concept

Kinesis Data Stream partitioning strategy and AWS Lambda execution limits and VPC routing.

Question 543Question →

A developer is designing a mobile multiplayer game. The game client needs to read and write player progress data directly to an Amazon DynamoDB table without routing requests through a custom backend API, to minimize latency and server costs. Players must authenticate using an Amazon Cognito User Pool. The security design requires that players can only access DynamoDB items where the partition key matches their unique Cognito user identifier. Which solution meets these requirements with the least operational overhead?

Configure a Amazon Cognito User Pool with a Post-Authentication AWS Lambda trigger. Have the Lambda function call the AWS Security Token Service (STS) to assume an IAM role with DynamoDB access, and inject these temporary credentials into the Cognito ID token claims returned to the mobile client.

Configure an Amazon Cognito Identity Pool and set the Amazon Cognito User Pool as the authentication provider. Associate an IAM role with the authenticated users that permits DynamoDB access, using the dynamodb:LeadingKeys condition key set to ${cognito-identity.amazonaws.com:sub} in the IAM policy.

Configure an Amazon API Gateway REST API with a Cognito User Pool Authorizer to proxy DynamoDB requests. Secure the DynamoDB table using an IAM resource policy that restricts access based on the cognito:username claim passed in the API Gateway request context.

Create a Cognito User Pool and assign an IAM role directly to a User Pool group. Have the mobile client authenticate against the User Pool and use the User Pool ID token directly to initialize the DynamoDB client, which automatically restricts access based on the group role.

Show answer & explanation

Answer: Configure an Amazon Cognito Identity Pool and set the Amazon Cognito User Pool as the authentication provider. Associate an IAM role with the authenticated users that permits DynamoDB access, using the dynamodb:LeadingKeys condition key set to ${cognito-identity.amazonaws.com:sub} in the IAM policy.

Answer

Configure an Amazon Cognito Identity Pool, configure the User Pool as the identity provider, and apply an IAM policy with a dynamodb:LeadingKeys condition using the Cognito Identity ID.

To access AWS resources directly from a client application using the AWS SDK, the client must obtain temporary AWS credentials. Amazon Cognito Identity Pools (federated identities) are designed for this purpose. They authenticate users via an identity provider (such as an Amazon Cognito User Pool) and exchange the resulting token for temporary AWS credentials associated with an IAM role. Fine-grained access control to DynamoDB is achieved by attaching a policy to the IAM role that uses the dynamodb:LeadingKeys condition key set to the special AWS variable ${cognito-identity.amazonaws.com:sub}, which represents the user's unique Cognito Identity ID.

Step-by-Step Solution

Identify the authentication and authorization flow required for direct AWS SDK access from the mobile client.

Recognize that while Cognito User Pools handle user directory and authentication (generating JWT tokens), they do not vend temporary AWS credentials needed by the AWS SDK to sign DynamoDB requests. An Amazon Cognito Identity Pool (federated identities) is required to exchange the User Pool JWT for temporary AWS credentials.

This establishes the identity federation pipeline to obtain valid AWS credentials directly on the client.

Configure the Cognito Identity Pool authentication provider.

Link the Cognito User Pool as the authentication provider in the Identity Pool configuration.

This allows the Identity Pool to trust tokens issued by the User Pool and assign an authenticated IAM role to the users.

Implement fine-grained access control on the DynamoDB table using IAM policies.

Create an IAM policy for the authenticated user role that grants access to DynamoDB, utilizing the dynamodb:LeadingKeys condition key set to the user's unique Cognito Identity ID: ${cognito-identity.amazonaws.com:sub}.

This dynamically limits the player's access to only the DynamoDB items where the partition key value matches their authenticated Cognito Identity ID, fulfilling the security requirement.

Key Concept

Cognito Identity Pools handle authorization by exchanging authentication tokens for temporary AWS credentials, enabling fine-grained access control to AWS resources via IAM policy variables.

Question 544Question →

A developer is configuring an AWS Step Functions state machine that will write logs to Amazon CloudWatch Logs, write data directly to an Amazon DynamoDB table, and send notifications to an Amazon SNS topic. The developer is creating an IAM role for the state machine to grant the necessary permissions.

Which two configuration steps must the developer perform to successfully and securely configure this IAM role? (Select two.)

Select all that apply

Configure the trust policy of the IAM role to allow the states.amazonaws.com service principal to assume the role.

Attach a permissions policy to the IAM role that grants permissions for dynamodb:PutItem, sns:Publish, and CloudWatch Logs write actions on the specific target resource ARNs.

Configure the trust policy of the IAM role to allow the dynamodb.amazonaws.com and sns.amazonaws.com service principals to assume the role.

Attach a permissions policy to the IAM role that grants the sts:AssumeRole permission to the DynamoDB and SNS service principals.

Store permanent AWS access keys in the Step Functions state machine definition to authenticate API calls to DynamoDB and SNS.

Show answer & explanation

Answer: Configure the trust policy of the IAM role to allow the states.amazonaws.com service principal to assume the role.; Attach a permissions policy to the IAM role that grants permissions for dynamodb:PutItem, sns:Publish, and CloudWatch Logs write actions on the specific target resource ARNs.

Answer

Configure the trust policy of the IAM role to trust the Step Functions service principal (states.amazonaws.com) and attach a permissions policy that grants access to the specific DynamoDB table, SNS topic, and CloudWatch Logs target resources.

To successfully run the Step Functions state machine with the necessary permissions, two parts of the IAM role configuration are required. First, the trust policy must trust the Step Functions service principal ('states.amazonaws.com') to allow it to assume the role. Second, the permissions policy attached to the role must grant the required access to the target DynamoDB table, SNS topic, and CloudWatch Logs resource ARNs.

Step-by-Step Solution

Identify the service principal that needs to assume the role.

The AWS Step Functions service principal (states.amazonaws.com) requires permission to assume the execution role.

This configuration belongs in the role's trust policy so Step Functions can obtain temporary credentials using the Security Token Service (STS).

Determine the necessary permissions for the application workflow.

The state machine needs permissions to put items in DynamoDB, publish to SNS, and write logs to CloudWatch Logs.

These API operations must be explicitly allowed by attaching an identity-based permissions policy to the execution role.

Apply the principle of least privilege.

Limit the permissions policy resources to specific target ARNs (DynamoDB table, SNS topic, and CloudWatch log group) rather than using wildcards.

This secures the environment by preventing the state machine from accessing unintended resources.

Key Concept

IAM execution roles consist of a trust policy (defining which principal can assume the role) and a permissions policy (defining what actions that role can perform on which resources).

Estimated Time:1m 30s

Question 545Question →

A developer is designing a serverless application where an Amazon SQS queue triggers an AWS Lambda function to process customer orders in batches. During peak traffic, some orders fail to process due to downstream database locks. To prevent successful messages in a batch from being returned to the queue and reprocessed, the developer wants to enable partial batch response handling. Which combination of actions should the developer take to achieve this behavior? (Select TWO.)

Select all that apply

Set the FunctionResponseTypes parameter to include ReportBatchItemFailures in the Lambda event source mapping.

Return a JSON object from the Lambda function containing a batchItemFailures list with the failed message IDs specified in the itemIdentifier field.

Configure a Dead-Letter Queue (DLQ) directly on the Lambda function configuration to catch individual messages that fail to process within the batch.

Set the visibility timeout of the SQS queue to be shorter than the Lambda function's execution timeout to allow failed messages to be retried immediately.

Configure an Amazon API Gateway Lambda Proxy integration to intercept and filter out the failed messages before they are processed by the Lambda function.

Show answer & explanation

Answer: Set the FunctionResponseTypes parameter to include ReportBatchItemFailures in the Lambda event source mapping.; Return a JSON object from the Lambda function containing a batchItemFailures list with the failed message IDs specified in the itemIdentifier field.

Answer

To configure partial batch response handling, the developer must set the FunctionResponseTypes parameter to include ReportBatchItemFailures in the Lambda event source mapping, and the Lambda function must return a JSON object containing a batchItemFailures list with the failed message IDs in the itemIdentifier field.

To achieve partial batch response handling, the event source mapping must be configured to report batch item failures. The Lambda function must then return a JSON object with a list named batchItemFailures. Inside this list, each failed message is represented by an object with its message ID stored under the itemIdentifier key. SQS will automatically delete all successfully processed messages from the queue and make only the failed messages visible again.

Step-by-Step Solution

Configure the SQS event source mapping.

Enable the ReportBatchItemFailures response type on the integration.

This informs Lambda that the function will return a custom structure indicating which specific messages in the batch failed to process.

Update the Lambda function return payload.

Return a JSON object structured with a batchItemFailures array containing the failed message IDs in the itemIdentifier field.

This allows AWS Lambda to identify the failed messages, delete the successful messages from the SQS queue, and leave only the failed messages on the queue for retries.

Key Concept

Partial batch response handling in AWS Lambda when integrated with Amazon SQS using event source mappings.

Estimated Time:2m 0s

Question 546Question →

A developer is designing a high-throughput REST API using Amazon API Gateway that integrates directly with Amazon DynamoDB via an AWS Service integration. The API must write client request payloads directly to a DynamoDB table. The developer needs to ensure that:

1. The incoming JSON payload is validated to confirm it contains all required fields before calling DynamoDB.
2. The DynamoDB JSON response is transformed into an XML payload with a Content-Type of `application/xml` before being sent back to the client.

Which two configurations must the developer perform in Amazon API Gateway to meet these requirements? (Select TWO.)

Select all that apply

Define a JSON schema Model for the request payload, and configure a Request Validator on the API method to validate the request body.

Define a Method Response for a `

200

` status code, and configure an Integration Response mapping template for the `application/xml` Content-Type to transform the DynamoDB response.

Configure a Lambda Authorizer to validate the request payload schema and return the transformed XML payload to the client in the authorization response context.

Enable a Lambda Proxy Integration and write a Velocity Template Language (VTL) mapping template to parse the incoming request body.

Configure a CORS configuration on the API resource to automatically format the output content type to `application/xml` for the client.

Show answer & explanation

Answer: Define a JSON schema Model for the request payload, and configure a Request Validator on the API method to validate the request body.; Define a Method Response for a ` $200$ ` status code, and configure an Integration Response mapping template for the `application/xml` Content-Type to transform the DynamoDB response.

Answer

The developer must define a JSON schema Model for the request payload and associate it with a Request Validator to check the request body. Additionally, they must configure a Method Response for the `

200

` status code and map the response via an Integration Response template configured for the `application/xml` Content-Type.

To perform validation on incoming request bodies directly at the API Gateway layer, a JSON schema Model must be mapped to the request body, and a Request Validator must be configured on the method. To convert the database JSON payload to XML, a Method Response must first be defined for the desired response code, and an Integration Response must use a mapping template configured for the `application/xml` Content-Type.

Step-by-Step Solution

Create a JSON schema representing the expected request structure and register it as an API Gateway Model.

The model definition dictates the required fields and types for incoming client request payloads.

Request validation requires a predefined model schema to compare incoming client payloads against.

Enable request validation on the API Gateway method and target the request body using the newly created Model.

API Gateway automatically validates incoming request payloads and rejects invalid requests with a `

400

Bad Request` response, preventing unnecessary backend execution.

Offloading validation to the API Gateway edge saves backend processing capacity and cost.

Configure the Method Response and Integration Response with a mapping template targeting the `application/xml` Content-Type.

API Gateway processes the DynamoDB JSON response using the VTL mapping template and formats the final payload into XML with the appropriate content headers.

Custom integrations (like AWS service integrations) require mapping templates to translate responses from the backend format to the client's preferred format.

Key Concept

Amazon API Gateway Request Validation and Integration Response Mapping

Estimated Time:2m 0s

Question 547Question →

An online learning platform uses Amazon API Gateway to expose a REST API that delivers course catalog data. The platform needs to restrict access to this API so that only users who have registered and authenticated through the platform's Amazon Cognito User Pool can retrieve the catalog. The development team wants to implement this security control with the minimum amount of custom code and operational overhead.

Which configuration should the developer implement to secure the REST API?

Configure an API Gateway Cognito User Pools authorizer on the REST API methods, using the user pool's token for authorization.

Configure an API Gateway Lambda authorizer that calls Cognito Identity Pools to obtain temporary AWS credentials for each user request.

Deploy an API Gateway Lambda authorizer that validates the Cognito JWT token by downloading the JSON Web Key Set (JWKS) and programmatically verifying the signature.

Enable Lambda Proxy Integration on the API Gateway resource and write custom JWT verification logic inside the backend Lambda function.

Show answer & explanation

Answer: Configure an API Gateway Cognito User Pools authorizer on the REST API methods, using the user pool's token for authorization.

Answer

Configure an API Gateway Cognito User Pools authorizer on the REST API methods, using the user pool's token for authorization.

The correct option is the one that configures a native Cognito User Pools authorizer. Amazon API Gateway has built-in integration to validate JSON Web Tokens (JWTs) generated by Amazon Cognito User Pools. This native feature requires zero custom code, provides automatic validation, and handles unauthorized requests at the API Gateway layer before invoking any backend integration, meeting all requirements with the lowest operational overhead.

Step-by-Step Solution

Identify the authentication provider and the requirement for authorization.

The users authenticate using an Amazon Cognito User Pool.

Knowing that users are in a Cognito User Pool helps choose between Cognito-native authorizers and custom authorizers.

Determine the implementation option with the lowest operational overhead and custom code.

API Gateway has a built-in 'Cognito User Pools authorizer' which natively validates Cognito tokens.

Using native integration eliminates the need to write, deploy, or maintain custom code in a Lambda function.

Configure the method execution in API Gateway to use the authorizer.

The REST API methods are secured using the Cognito User Pools authorizer.

This configuration validates the token at the edge before requests reach any backend integration.

Key Concept

API Gateway Cognito User Pools Authorizer

Estimated Time:1m 0s

Question 548Question →

A developer is designing a serverless payment processing application running on AWS Lambda. The application must retrieve the following credentials and configuration settings securely:

1. A third-party API key that is manually rotated every 90 days and must be securely accessed by Lambda functions running in different AWS accounts.
2. A database credential for an Amazon RDS PostgreSQL database that requires automatic rotation every 30 days without causing application downtime.
3. Non-sensitive application configuration parameters (such as timeout limits and connection pool sizes) that must be stored hierarchically and retrieved at minimal cost.

Which of the following configuration options should the developer select to meet these requirements? (Select TWO).

Select all that apply

Store the RDS database credentials and the third-party API key in AWS Secrets Manager, attaching a resource-based policy to the API key secret to grant read access to the Lambda functions in the other AWS accounts.

Store the non-sensitive configuration parameters as Standard parameters in AWS Systems Manager Parameter Store using hierarchical paths.

Store the third-party API key in AWS Systems Manager Parameter Store as a SecureString parameter, and configure a resource-based policy on the parameter to allow the other AWS accounts to retrieve it.

Store the database credentials in AWS Systems Manager Parameter Store, and configure an Amazon EventBridge rule that triggers an AWS Lambda function to rotate the credentials in RDS and update the parameter value.

Hardcode the third-party API key directly in the Lambda function's source code to avoid API retrieval latency, and use the default credential provider chain to authenticate the database client.

Show answer & explanation

Answer: Store the RDS database credentials and the third-party API key in AWS Secrets Manager, attaching a resource-based policy to the API key secret to grant read access to the Lambda functions in the other AWS accounts.; Store the non-sensitive configuration parameters as Standard parameters in AWS Systems Manager Parameter Store using hierarchical paths.

Answer

Store the database credentials and the third-party API key in AWS Secrets Manager, utilizing a resource-based policy for cross-account access to the API key, and store non-sensitive configuration parameters as Standard parameters in AWS Systems Manager Parameter Store.

The correct architecture leverages AWS Secrets Manager for secrets requiring automatic rotation or cross-account access via resource-based policies, and AWS Systems Manager Parameter Store for cost-effective hierarchical configuration storage. Database credentials require automatic rotation, which is a native feature of AWS Secrets Manager for Amazon RDS. The third-party API key needs cross-account access, which is supported in Secrets Manager using resource-based policies. Non-sensitive configurations are best stored as Standard parameters in Parameter Store, as they are free and support hierarchical paths.

Step-by-Step Solution

Analyze the database credential rotation requirement.

Identify that Amazon RDS database credentials require automatic rotation every 30 days.

AWS Secrets Manager natively supports automatic rotation of RDS credentials without custom Lambda code or downtime.

Analyze the third-party API key sharing requirement.

Identify that the API key needs to be securely shared cross-account.

AWS Secrets Manager supports resource-based policies, allowing direct cross-account access without assuming cross-account IAM roles, unlike Systems Manager Parameter Store.

Analyze the non-sensitive configuration storage requirement.

Identify that non-sensitive settings need hierarchical storage at minimal cost.

Systems Manager Parameter Store Standard parameters are free of charge, support hierarchical paths, and are the most cost-effective choice for non-sensitive data.

Key Concept

Distinguishing between AWS Secrets Manager and Systems Manager Parameter Store based on automatic rotation, cross-account access capabilities, and cost efficiency.

Question 549Question →

A developer is using AWS CodeDeploy to manage deployments for a containerized application running on Amazon ECS (Fargate) behind an Application Load Balancer (ALB). The application requires zero downtime during updates. The developer needs to implement a deployment strategy where a new version is validated with exactly $10\%$ of production traffic for 15 minutes before shifting the remaining $90\%$ of traffic. Additionally, a database migration script must be executed automatically after the new task set is created but before it receives any production traffic. The deployment must automatically roll back immediately if the load balancer target group's HTTP 5xx errors spike during the validation window.

Which TWO actions should the developer take to meet these requirements?

Select all that apply

Use the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration.

Define an AWS Lambda function under the AfterInstall hook in the AppSpec file to execute the database migration script.

Use the CodeDeployDefault.ECSLinear10PercentEvery15Minutes deployment configuration.

Define an AWS Lambda function under the ApplicationStart hook in the AppSpec file to execute the database migration script.

Configure a CloudWatch Alarm monitoring the HTTPCode_Target_5XX_Count metric with a 15-minute period, and link it to the CodeDeploy deployment group's alarm configuration.

Show answer & explanation

Answer: Use the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration.; Define an AWS Lambda function under the AfterInstall hook in the AppSpec file to execute the database migration script.

Answer

Use the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration and define an AWS Lambda function under the AfterInstall hook in the AppSpec file to execute the database migration script.

The correct options are the strategy to use CodeDeployDefault.ECSCanary10Percent15Minutes and using the AfterInstall hook. The deployment configuration Canary10Percent15Minutes routes 10% of traffic to the new task set, waits for 15 minutes, and then routes the remaining 90%. The AfterInstall lifecycle hook in an ECS deployment runs immediately after the replacement task set is created but before it receives any traffic, making it the perfect stage to execute database migrations or pre-traffic checks.

Step-by-Step Solution

Analyze the traffic shifting pattern requirements.

The requirement states that 10% of traffic must be routed to the new version for a 15-minute validation period, after which the remaining 90% is shifted. This corresponds directly to a Canary strategy: CodeDeployDefault.ECSCanary10Percent15Minutes.

This establishes the traffic routing configuration for CodeDeploy.

Determine the correct lifecycle hook for running database migrations in an ECS deployment.

Identify that the migration must run after the task set is created but before any traffic is routed. In ECS deployments, this matches the AfterInstall hook. EC2 hooks like ApplicationStart are invalid.

This ensures the migration script executes at the correct stage of the deployment sequence without failing due to unsupported platform hooks.

Evaluate the rollback trigger configurations.

To roll back immediately within a 15-minute window, the associated CloudWatch Alarm must use a short evaluation period (such as 1 minute or 60 seconds). A 15-minute period would delay the rollback response.

This rules out the incorrect CloudWatch Alarm configuration.

Key Concept

AWS CodeDeploy deployment strategies and AppSpec lifecycle hooks for ECS deployments

Estimated Time:3m 0s

Question 550Question →

A retail company is deploying a secure microservices-based application. A developer needs to expose a backend administrative endpoint via an Amazon API Gateway REST API. The API will be accessed exclusively by internal backend applications running on Amazon EC2 instances. The company requires that all requests be authenticated using AWS Signature Version 4 (SigV4) to enforce IAM-based access control. Which two options should the developer configure to secure this API under these requirements?

Select all that apply

Set the API Gateway method authorization type to AWS_IAM.

Attach an IAM policy to the EC2 instances' instance profile that grants execute-api:Invoke permissions on the API Gateway method resource.

Create an Amazon Cognito User Pool Authorizer and configure the EC2 instances to retrieve JWTs by authenticating directly with AWS STS.

Implement a Lambda Authorizer that parses the Authorization header, validates the AWS Signature Version 4 structure, and returns an IAM policy.

Enable Lambda proxy integration and inspect the event's requestContext.authorizer.claims object within the backend Lambda function to verify the IAM role.

Show answer & explanation

Answer: Set the API Gateway method authorization type to AWS_IAM.; Attach an IAM policy to the EC2 instances' instance profile that grants execute-api:Invoke permissions on the API Gateway method resource.

Answer

To secure the API using AWS Signature Version 4 and IAM roles, the developer must set the method authorization type to AWS_IAM and grant the calling applications' EC2 instance profiles an IAM policy with execute-api:Invoke permissions.

The correct options are setting the authorization type to AWS_IAM and attaching an IAM policy with execute-api:Invoke permissions to the EC2 instances' instance profile. Setting the authorization to AWS_IAM utilizes API Gateway's native support for verifying Signature Version 4 headers. For the client application on EC2 to invoke this method, its IAM role must be granted the execute-api:Invoke permission.

Step-by-Step Solution

Configure the API Gateway method to use IAM authentication.

The method's authorization type is set to AWS_IAM.

This native API Gateway feature ensures that all incoming requests must be signed with AWS Signature Version 4 credentials.

Assign permissions to the calling EC2 instances.

An IAM policy with execute-api:Invoke permissions is attached to the instances' IAM execution role.

This allows the calling services to successfully invoke the IAM-authorized API Gateway endpoint.

Key Concept

API Gateway authorization using AWS_IAM and Signature Version 4

Estimated Time:2m 0s

Question 551Question →

A developer needs to encrypt a large data file locally on an application server before uploading it to Amazon S3. The developer wants to use client-side envelope encryption with an AWS KMS customer managed key. Which of the following steps must the developer perform to complete this encryption process? (Select TWO.)

Select all that apply

Call the AWS KMS GenerateDataKey API operation to receive a plaintext data key and an encrypted ciphertext data key.

Encrypt the file locally using the plaintext data key, and then delete the plaintext data key from memory.

Call the AWS KMS Encrypt API operation to encrypt the entire data file directly using the customer managed key.

Call the AWS KMS GenerateDataKeyWithoutPlaintext API operation to obtain the plaintext data key for local encryption.

Save the plaintext data key in AWS Systems Manager Parameter Store as a SecureString parameter to use for decryption.

Show answer & explanation

Answer: Call the AWS KMS GenerateDataKey API operation to receive a plaintext data key and an encrypted ciphertext data key.; Encrypt the file locally using the plaintext data key, and then delete the plaintext data key from memory.

Answer

To encrypt the file using envelope encryption, the developer must call the GenerateDataKey API to obtain the plaintext and ciphertext data keys, encrypt the data locally with the plaintext key, and then delete the plaintext key from memory.

The correct options describe the client-side envelope encryption workflow: calling the GenerateDataKey API to get both the plaintext and ciphertext keys, using the plaintext key to encrypt the file locally, and subsequently discarding the plaintext key from memory.

Step-by-Step Solution

Generate data keys using AWS KMS

The application receives a plaintext data key and a ciphertext data key from the GenerateDataKey API call.

The plaintext key is needed to perform the encryption algorithm locally, and the ciphertext key is needed to store with the data for future decryption.

Encrypt the file locally

The file is encrypted using the plaintext data key.

Envelope encryption uses a unique symmetric data key locally to secure the file content.

Clean up memory and prepare storage

The plaintext key is deleted from the application's memory, and the encrypted file is paired with the ciphertext data key.

Removing the plaintext key from memory minimizes the risk of exposure. The ciphertext data key can be safely stored alongside the encrypted file in S3.

Key Concept

Envelope encryption is the practice of encrypting data with a data key, and then encrypting the data key under another key.

Estimated Time:1m 30s

Question 552Question →

A developer is deploying an AWS Lambda function inside the private subnets of a custom VPC to process internal company data. The function needs to retrieve non-sensitive application settings, such as feature flags and external API endpoint URLs, without traversing the public internet. The architecture must minimize operational costs and must not use NAT Gateways or Internet Gateways. Which configuration should the developer implement to meet these requirements?

Store the configuration settings in AWS Secrets Manager, create an interface VPC endpoint for Secrets Manager in the VPC, and configure the security groups to allow HTTPS traffic between the Lambda function and the Secrets Manager VPC endpoint.

Store the configuration settings as standard parameters in AWS Systems Manager Parameter Store, create an interface VPC endpoint for Systems Manager in the VPC, and configure the security groups to allow HTTPS traffic between the Lambda function and the Systems Manager VPC endpoint.

Store the configuration settings as standard parameters in AWS Systems Manager Parameter Store, associate the Lambda function with the private subnets of the VPC, and rely on the default AWS Lambda execution role's permissions to bypass network routing and access Parameter Store directly without any VPC endpoints.

Store the configuration settings as standard parameters in AWS Systems Manager Parameter Store, create an interface VPC endpoint for Systems Manager in the VPC, and modify the IAM role trust policy of the Lambda execution role to allow the Systems Manager service principal to assume the role.

Show answer & explanation

Answer: Store the configuration settings as standard parameters in AWS Systems Manager Parameter Store, create an interface VPC endpoint for Systems Manager in the VPC, and configure the security groups to allow HTTPS traffic between the Lambda function and the Systems Manager VPC endpoint.

Answer

The correct option correctly identifies the need for Systems Manager Parameter Store to handle non-sensitive configuration settings cost-effectively (as standard parameters have no associated cost, unlike Secrets Manager). It also correctly configures an interface VPC endpoint to enable private communication between the Lambda function in the private subnet and the Systems Manager service, bypassing the need for a NAT Gateway or public internet routing.

Step-by-Step Solution

Analyze cost and data sensitivity requirements.

Identify that the settings are non-sensitive and the architecture must minimize operational costs, leading to the selection of AWS Systems Manager Parameter Store standard parameters, which are free of charge, over AWS Secrets Manager.

AWS Secrets Manager charges a flat rate per secret per month, which increases operational costs unnecessarily for non-sensitive configuration settings.

Analyze network path constraints.

Recognize that because the Lambda function is attached to a private subnet in a VPC with no NAT Gateway or Internet Gateway, it lacks a default route to public AWS endpoints over the internet.

AWS resources inside a custom VPC private subnet cannot resolve or connect to public service endpoints like Parameter Store without an explicit routing path.

Select the private connectivity mechanism.

Establish an interface VPC endpoint (AWS PrivateLink) specifically for Systems Manager (com.amazonaws.region.ssm) in the custom VPC.

An interface VPC endpoint places elastic network interfaces (ENIs) with private IP addresses in the subnets, enabling secure and private connections to AWS services.

Configure the security groups.

Allow outbound HTTPS (TCP port 443) from the Lambda function's security group to the interface VPC endpoint's security group, and inbound HTTPS on the endpoint's security group from the Lambda function.

Security groups are stateful and must explicitly allow the necessary traffic to complete the PrivateLink network connection.

Key Concept

Configuring private access to AWS services via Interface VPC Endpoints (AWS PrivateLink) for resource-constrained architectures.

Estimated Time:2m 0s

Question 553Question →

A developer is preparing a deployment strategy for a high-traffic HTTP API hosted on AWS Elastic Beanstalk. The deployment must satisfy the following constraints:

1. The API must maintain $100\%$ of its serving capacity throughout the entire deployment process to prevent performance degradation.
2. A small, configurable percentage of live production traffic (e.g., $10\%$ ) must be routed to the new version for a 15-minute evaluation period.
3. If any CloudWatch alarms are triggered or health checks fail during this evaluation period, the deployment must automatically roll back by routing all traffic back to the old version and terminating the new instances.
4. The deployment process must be managed entirely within the existing Elastic Beanstalk environment to minimize configuration overhead.

Which deployment policy should the developer configure to meet these requirements?

Traffic splitting deployment

Immutable deployment

Rolling with additional batch deployment

Blue/green deployment

Show answer & explanation

Answer: Traffic splitting deployment

Answer

Traffic splitting deployment

The correct option is traffic splitting deployment. This deployment policy allows developers to perform canary testing within a single Elastic Beanstalk environment. It launches a temporary Auto Scaling group with the new version, routes a small percentage of production traffic to it, and monitors its health. If any alarms are triggered or health checks fail, Elastic Beanstalk automatically routes all traffic back to the old version and terminates the temporary instances, achieving zero-downtime and

100\%

capacity maintenance with automated rollback capabilities.

Step-by-Step Solution

Analyze the capacity requirement.

The deployment must maintain

100\%

capacity, which rules out standard Rolling or All-at-once deployments (both temporarily reduce capacity).

To maintain

100\%

capacity, we need a policy that provisions additional instances before replacing old ones, such as Rolling with additional batch, Immutable, Traffic splitting, or Blue/green.

Analyze the traffic routing and testing requirement.

A small, configurable percentage of traffic (e.g.,

10\%

) must be routed to the new version for evaluation, ruling out standard Immutable and Rolling with additional batch policies.

Immutable and Rolling with additional batch immediately serve traffic to the new instances at full scale or in batch increments, without isolating a specific percentage of overall traffic for canary testing.

Analyze the environment boundary constraint.

The deployment must occur within a single Elastic Beanstalk environment, ruling out Blue/green deployment.

Blue/green deployment in Elastic Beanstalk requires creating a separate clone environment and swapping CNAMEs, which violates the requirement to avoid multi-environment overhead.

Select the policy that meets all criteria.

Traffic splitting deployment meets all constraints:

100\%

capacity (via temporary Auto Scaling group), configurable canary percentage routing, automated rollback via CloudWatch alarms, and execution within a single environment.

Elastic Beanstalk native traffic splitting is designed specifically for canary testing within a single environment while maintaining

100\%

capacity.

Key Concept

AWS Elastic Beanstalk Traffic Splitting Deployment

Estimated Time:3m 0s

Question 554Question →

A developer is troubleshooting an application where an AWS Lambda function processes batch orders from an Amazon SQS standard queue. The Lambda function is configured with a timeout of 45 seconds and a batch size of 10 messages. The SQS queue is configured with a visibility timeout of 60 seconds and a redrive policy targeting a Dead-Letter Queue (DLQ) with a maxReceiveCount of 3. During peak hours, the developer observes that some messages are processed multiple times by different Lambda invocations, and the DLQ receives an increased number of messages, even though no errors are logged by the function code. CloudWatch Logs indicate that some executions time out at 45 seconds under heavy database load, while others complete in under 5 seconds. Which of the following changes should the developer make to resolve these issues?

Enable 'Report Batch Item Failures' on the Lambda event source mapping, modify the function to return a list of failed message IDs in the response, and increase the SQS queue's visibility timeout to 270 seconds.

Deploy the Lambda function in a VPC with private subnets, configure an interface VPC Endpoint for Amazon SQS, and update the function's IAM execution role to allow SQS DeleteMessage actions.

Decrease the SQS queue's visibility timeout to 15 seconds to trigger faster retries when the database is congested, and increase the Lambda function memory size to 3008 MB.

Implement a global SQS client helper outside the Lambda handler to manually delete processed messages from the queue, and increase the Lambda function timeout to 90 seconds.

Show answer & explanation

Answer: Enable 'Report Batch Item Failures' on the Lambda event source mapping, modify the function to return a list of failed message IDs in the response, and increase the SQS queue's visibility timeout to 270 seconds.

Answer

Enabling 'Report Batch Item Failures' on the event source mapping and returning the `batchItemFailures` array containing the failed message IDs ensures that SQS deletes the successfully processed messages and only retries the ones that failed. Furthermore, increasing the SQS visibility timeout to 270 seconds aligns with the AWS recommendation of setting the visibility timeout to at least 6 times the Lambda function timeout (

6 \times 45 = 270

seconds) to accommodate processing delays and retries.

Step-by-Step Solution

Analyze the relationship between the Lambda timeout and the SQS visibility timeout.

The current visibility timeout is 60 seconds, which is only slightly higher than the Lambda timeout of 45 seconds. AWS best practice recommends that SQS visibility timeout should be configured to at least 6 times the Lambda function's timeout (

6 \times 45 = 270

seconds) to prevent messages from becoming visible again during retry cycles.

Ensuring the visibility timeout is appropriately scaled prevents duplicate processing of active invocations.

Analyze the cause of duplicate processing when Lambda times out on a batch of SQS messages.

By default, if a Lambda function times out or throws an error while processing a batch, SQS considers the entire batch of 10 messages to have failed. Consequently, successfully processed messages in that same batch are not deleted and will be reprocessed, causing duplicate writes.

Identifying why successfully processed messages are being sent back to the queue.

Determine the solution for handling partial batch failures.

Enabling 'Report Batch Item Failures' in the SQS event source mapping allows the Lambda function to return a list of failed message IDs (under the keys `batchItemFailures` and `itemIdentifier`). SQS then deletes only the successful messages from the queue and retries only the failed ones.

Configuring the Lambda function to safely handle partial failures without reprocessing successful messages.

Key Concept

SQS Event Source Mapping, Partial Batch Failures, and Visibility Timeout Alignment.

Estimated Time:3m 0s

Question 555Question →

A developer is troubleshooting an AWS Lambda function that processes transaction files stored in an Amazon S3 bucket and updates a database running on an Amazon RDS MySQL DB instance. The RDS instance is deployed in $2$ private subnets of a custom VPC.

To enable the Lambda function to access both Amazon S3 and the RDS instance, the developer configured the function to run within the VPC and associated it with the public subnets of the VPC. The Lambda function's security group is correctly allowed in the RDS security group's inbound rules.

During execution, the function fails with a timeout error. The logs show that the connection to the RDS DB instance is successful, but the function times out after $15$ seconds while attempting to connect to the Amazon S3 service endpoint.

Which two actions should the developer take to resolve this issue and follow AWS security best practices? (Select TWO.)

Select all that apply

Associate the Lambda function with the private subnets of the VPC instead of the public subnets.

Create a Gateway VPC Endpoint for Amazon S3 and associate it with the route tables of the subnets where the Lambda function is deployed.

Enable the 'Assign Public IP' configuration option on the Lambda function's network interface settings.

Attach an Elastic IP address directly to the Elastic Network Interfaces (ENIs) created by the Lambda function in the public subnets.

Increase the Lambda function's timeout configuration to a value greater than

30

seconds to allow DNS resolution to complete.

Show answer & explanation

Answer: Associate the Lambda function with the private subnets of the VPC instead of the public subnets.; Create a Gateway VPC Endpoint for Amazon S3 and associate it with the route tables of the subnets where the Lambda function is deployed.

Answer

Associate the Lambda function with the private subnets of the VPC and create a Gateway VPC Endpoint for Amazon S3 associated with the route tables of those subnets.

To resolve the S3 timeout and secure the architecture, the developer must associate the Lambda function with the private subnets of the VPC and create a Gateway VPC Endpoint for Amazon S3. When a Lambda function is configured to run inside a VPC, it only receives private IP addresses on its Elastic Network Interfaces (ENIs). Consequently, it cannot route traffic to public AWS endpoints like Amazon S3 via the Internet Gateway, even if placed in a public subnet. Creating a Gateway VPC Endpoint for Amazon S3 allows the Lambda function to communicate with S3 over the private AWS network using the subnet's route tables. Moving the function to private subnets complies with security best practices.

Step-by-Step Solution

Analyze the network route paths for a Lambda function configured inside a VPC.

Understand that Lambda functions inside a VPC are allocated Elastic Network Interfaces (ENIs) with private IP addresses only. They do not get public IPs even if associated with public subnets.

Explain why the connection to the RDS DB instance inside the VPC succeeded (local routing), but the connection to S3 (public endpoint) failed.

Evaluate the security and architecture best practices for deploying Lambda functions that access VPC resources.

Determine that the Lambda function should be moved from the public subnets to the private subnets.

Lambda functions should always be placed in private subnets when connected to a VPC to reduce the attack surface and align with the principle of least privilege.

Configure a private connectivity mechanism for the Lambda function to access Amazon S3.

Create an Amazon S3 Gateway VPC Endpoint and associate it with the route tables of the private subnets.

This allows traffic destined for S3 to be routed internally through the AWS network backbone instead of attempting to go over the public internet, resolving the timeout error.

Key Concept

AWS Lambda functions running inside a VPC do not receive public IP addresses. To access public AWS services like Amazon S3, they must use VPC endpoints (such as a Gateway VPC Endpoint for S3) or route traffic through a NAT Gateway in a public subnet. For security, Lambda functions should always be associated with private subnets rather than public subnets.

Question 556Question →

A developer is managing an application infrastructure deployed using AWS CloudFormation. During a stack update, the update fails, and the stack enters the UPDATE_ROLLBACK_FAILED state because an IAM role resource defined in the template was manually deleted from the AWS account out-of-band. Which two actions should the developer take to resolve this issue and return the stack to a usable state? (Select TWO.)

Select all that apply

Manually recreate the IAM role with the exact same name and configuration that existed prior to the deletion, and then continue the update rollback

Perform the ContinueUpdateRollback operation and list the deleted IAM role in the ResourcesToSkip parameter

Modify the CloudFormation template to remove the IAM role, and then immediately call the UpdateStack API to apply the template changes to the stack

Perform a stack drift detection, and then select the 'Auto-Remediate' option in the AWS CloudFormation console to automatically recreate the deleted IAM role

Create a new parameter in AWS Systems Manager Parameter Store to store the IAM role properties, enable automatic rotation, and reference it via a dynamic reference in the stack

Show answer & explanation

Answer: Manually recreate the IAM role with the exact same name and configuration that existed prior to the deletion, and then continue the update rollback; Perform the ContinueUpdateRollback operation and list the deleted IAM role in the ResourcesToSkip parameter

Answer

To resolve the UPDATE_ROLLBACK_FAILED state caused by an out-of-band deletion, the developer must either manually recreate the IAM role with the same name and config before continuing the rollback, or execute the ContinueUpdateRollback operation while specifying the deleted IAM role in the ResourcesToSkip parameter.

The correct actions are to either recreate the deleted resource manually with the same name to allow the rollback process to interact with it, or skip the resource entirely using the ContinueUpdateRollback operation. Both approaches allow the stack to exit the UPDATE_ROLLBACK_FAILED state.

Step-by-Step Solution

Identify the root cause of the rollback failure by inspecting the CloudFormation stack events.

The stack is confirmed to be in the UPDATE_ROLLBACK_FAILED state due to a missing IAM role resource that was deleted out-of-band.

Understanding why the rollback failed is necessary to choose the appropriate recovery strategy.

Resolve the rollback blockage by either manually recreating the deleted resource with the matching name or using ContinueUpdateRollback with the ResourcesToSkip parameter.

The stack successfully rolls back to the UPDATE_ROLLBACK_COMPLETE state.

The stack must be brought to a stable completed rollback state before any new update operations can be initiated.

Perform a stack update to synchronize any desired configuration changes or recreate resources within the template.

The stack is updated successfully to the UPDATE_COMPLETE state.

This ensures that all resources are correctly aligned with the CloudFormation template.

Key Concept

Handling CloudFormation stack update rollback failures caused by out-of-band resource deletion.

Question 557Question →

A developer is configuring a continuous delivery pipeline in AWS CodePipeline to deploy a containerized application to Amazon ECS. The application requires access to a database password that must be rotated automatically every 30 days. The pipeline must deploy the new version to ECS with zero downtime, using a secure method to supply the database password to the container without exposing it in plaintext in the pipeline artifacts or source code.

Which configuration should the developer implement?

Store the password in AWS Secrets Manager with automatic rotation enabled. In the Amazon ECS task definition, reference the secret using its ARN in the secrets section. Use AWS CodeDeploy within CodePipeline to perform a Blue/Green deployment for the ECS service.

Store the password as a SecureString parameter in Systems Manager Parameter Store with automatic rotation enabled. In the CodePipeline build stage, retrieve the parameter and pass it as an output artifact to the ECS deployment stage. Use AWS CodeDeploy to perform a Canary deployment.

Store the password in AWS Secrets Manager with automatic rotation enabled. Update the ECS Task Execution Role's trust policy to allow the secretsmanager.amazonaws.com service principal to assume the role. Reference the secret ARN in the task definition environment variables. Use AWS CodeDeploy within CodePipeline to run a Blue/Green deployment.

Store the password in AWS Secrets Manager with automatic rotation enabled. In the CodePipeline source stage, add the password directly to the container environment variables in the AppSpec file. Use AWS CodeDeploy within CodePipeline to perform an All-at-Once deployment to replace the running ECS tasks.

Show answer & explanation

Answer: Store the password in AWS Secrets Manager with automatic rotation enabled. In the Amazon ECS task definition, reference the secret using its ARN in the secrets section. Use AWS CodeDeploy within CodePipeline to perform a Blue/Green deployment for the ECS service.

Answer

The correct answer correctly identifies AWS Secrets Manager as the appropriate service for credentials requiring automatic rotation. It correctly uses the ECS task definition 'secrets' section to securely inject the secret into the container at runtime, and uses AWS CodeDeploy Blue/Green deployment to ensure a zero-downtime deployment.

Step-by-Step Solution

Store and secure the secret

The database password is saved in AWS Secrets Manager, and automatic rotation is configured for every 30 days.

Secrets Manager natively supports automatic rotation, meeting the requirement, while Systems Manager Parameter Store does not.

Configure ECS task definition integration

The ECS task definition references the Secrets Manager ARN in the 'secrets' parameter, rather than placing it in plaintext environment variables.

This enables the ECS agent to securely retrieve the password and inject it into the container at launch time without exposing it in the pipeline definition.

Define the deployment strategy in CodePipeline

A Blue/Green deployment is set up using AWS CodeDeploy as a deploy action in CodePipeline.

A Blue/Green deployment provisions a new task set and routes traffic traffic incrementally or all-at-once to the new tasks, ensuring zero downtime and providing an automated rollback path if the deployment fails.

Key Concept

AWS CodePipeline integration with ECS and AWS Secrets Manager for secure container deployment.

Question 558Question →

A startup is building a multi-tenant SaaS application on AWS. The application exposes a REST API through Amazon API Gateway. The startup uses an Amazon Cognito User Pool for user authentication, and the frontend client receives a JSON Web Token (JWT) after successful login. The developer needs to secure a set of API endpoints: some endpoints require validation of standard JWT claims, while other endpoints require validating the JWT and then looking up the user's subscription status in a DynamoDB table to grant or deny access. Which two configuration methods should the developer use on the API Gateway endpoints to meet these requirements with the least operational overhead? (Select TWO.)

Select all that apply

Configure a built-in API Gateway Amazon Cognito user pool authorizer for endpoints that only require standard JWT claim validation.

Configure an API Gateway Lambda authorizer of token type for endpoints that require querying the database to check subscription status.

Configure an API Gateway Lambda authorizer of request parameter type to manually verify the JWT signature and expiration for standard claims.

Configure an Amazon Cognito Identity Pool authorizer directly on API Gateway to validate the JWT and verify the subscription status.

Configure API Gateway Lambda Proxy integration with IAM authorization to automatically pass the client JWT to the backend Lambda function.

Show answer & explanation

Answer: Configure a built-in API Gateway Amazon Cognito user pool authorizer for endpoints that only require standard JWT claim validation.; Configure an API Gateway Lambda authorizer of token type for endpoints that require querying the database to check subscription status.

Answer

To secure the API endpoints with minimal operational overhead, the developer should configure a built-in API Gateway Amazon Cognito user pool authorizer for the standard JWT claim validation, and configure an API Gateway Lambda authorizer of token type for endpoints requiring a DynamoDB database lookup.

For endpoints requiring only standard validation of Cognito User Pool JWTs, using the built-in API Gateway Cognito User Pool authorizer requires no custom code, minimizing operational overhead. For endpoints requiring database checks (such as verifying subscription status in DynamoDB), a custom Lambda authorizer must be used to execute the custom database query and return the corresponding IAM policy.

Step-by-Step Solution

Analyze endpoint requirements

Identified two distinct types of authentication requirements: simple validation of Cognito JWT claims, and custom validation requiring a database lookup.

This determines the capabilities required for the authorizers on each API route.

Select authorization method for standard validation

Chose the built-in Amazon Cognito user pool authorizer.

API Gateway natively validates Cognito User Pool JWTs without custom code, satisfying the least operational overhead criteria.

Select authorization method for custom database validation

Chose an API Gateway Lambda authorizer of token type.

Because checking a database requires custom execution logic not supported by the built-in Cognito authorizer, a Lambda authorizer must be used to perform the query and return an IAM policy.

Key Concept

API Gateway Authorizers selection based on requirement complexity

Question 559Question →

A developer has a Python-based worker application running on Amazon EC2 instances. The application manually polls an Amazon SQS queue for incoming messages, processes them, and writes the results to an Amazon DynamoDB table. The AWS X-Ray daemon is running on the EC2 instances, and the AWS SDK for Python (boto3) is instrumented. However, in the AWS X-Ray console, the developer observes that the traces for the SQS queue and the DynamoDB operations appear as separate, disconnected traces rather than a single end-to-end trace.

Which action should the developer take to correlate these traces?

Extract the tracing header from the Amazon SQS message's `AWSTraceHeader` attribute, and use the AWS X-Ray SDK to create a segment using that header as the parent context before invoking the Amazon DynamoDB API.

Enable active tracing on the Amazon DynamoDB table, which automatically instructs the AWS SDK to retrieve the trace context from the SQS message attributes and associate it with the DynamoDB write request.

Modify the application to initialize the boto3 DynamoDB client by passing the AWS access key and secret access key retrieved from the SQS message metadata directly into the client constructor.

Increase the Amazon SQS visibility timeout to be at least double the database write execution time to allow the X-Ray daemon to flush the segment data before the message becomes visible again.

Show answer & explanation

Answer: Extract the tracing header from the Amazon SQS message's `AWSTraceHeader` attribute, and use the AWS X-Ray SDK to create a segment using that header as the parent context before invoking the Amazon DynamoDB API.

Answer

When a worker application manually polls an Amazon SQS queue, the tracing context from the producer is carried in the message's `AWSTraceHeader` attribute. Because context propagation is not automatic for manual polling, the developer must programmatically extract this header and use the AWS X-Ray SDK to create a segment with the correct parent trace ID. This links the worker's processing and any downstream AWS calls (like DynamoDB) to the original trace.

Step-by-Step Solution

Identify the mechanism for tracing context propagation through message queues.

Amazon SQS messages contain a trace header in the `AWSTraceHeader` attribute when sent from an instrumented upstream service.

Because the worker polls SQS manually, the context does not propagate automatically like it does in a direct AWS Lambda SQS event source trigger.

Use the AWS X-Ray SDK to parse the retrieved tracing header.

The SDK creates a new segment or subsegment using the extracted header as the parent context.

This establishes the parent-child relationship between the message producer and the worker's processing steps.

Execute downstream AWS SDK calls (DynamoDB write) within the context of the newly created segment.

The downstream calls are recorded as subsegments of the parent trace.

This ensures that all operations are correlated into a single, continuous trace on the X-Ray service map.

Key Concept

Manual propagation of AWS X-Ray tracing context across Amazon SQS message boundaries using the `AWSTraceHeader` attribute.

Estimated Time:1m 30s

Question 560Question →

A developer is configuring an Amazon ECS task definition to deploy a backend service to AWS Fargate. The service requires sensitive database credentials stored in AWS Systems Manager Parameter Store to be injected as environment variables when the container starts. Additionally, the service logs must be sent directly to Amazon CloudWatch Logs. Which TWO configurations must the developer implement to meet these requirements?

Select all that apply

Add the ssm:GetParameters and logs:PutLogEvents permissions to the ECS Task Execution Role.

In the task definition, define the secrets parameter inside the container definition referencing the Parameter Store parameter ARNs, and configure the logConfiguration parameter to use the awslogs log driver.

Add the ssm:GetParameters and logs:PutLogEvents permissions to the ECS Task Role.

Add a trust policy to the ECS Task Role that allows the Systems Manager service principal (ssm.amazonaws.com) to assume the role.

Store the database credentials in the environment parameter of the task definition, and configure the task definition to use the host network mode to forward logs.

Show answer & explanation

Answer: Add the ssm:GetParameters and logs:PutLogEvents permissions to the ECS Task Execution Role.; In the task definition, define the secrets parameter inside the container definition referencing the Parameter Store parameter ARNs, and configure the logConfiguration parameter to use the awslogs log driver.

Answer

The correct configurations are: adding ssm:GetParameters and logs:PutLogEvents permissions to the ECS Task Execution Role, and defining the secrets parameter referencing the Parameter Store ARNs along with the awslogs log driver in the container definition.

The correct configuration requires adding the necessary permissions to the ECS Task Execution Role, as this is the IAM role used by the ECS container agent to call AWS APIs (like SSM to pull parameters and CloudWatch to write logs) before the containerized application runs. Additionally, the task definition must use the 'secrets' parameter to declare the environment variables mapped to SSM parameters, and configure 'logConfiguration' with the 'awslogs' driver to natively forward standard output and standard error stream logs.

Step-by-Step Solution

Determine which role requires permissions for startup operations.

The ECS Task Execution Role is identified because the ECS container agent (not the application code) is responsible for pulling secrets at startup and routing logs.

Understanding the division of responsibilities between the Task Execution Role (agent permissions) and the Task Role (application permissions) is key.

Identify the proper configuration syntax in the task definition for secrets and logging.

The 'secrets' parameter is used to map Parameter Store values to environment variables, and the 'logConfiguration' with 'awslogs' driver is used for CloudWatch Logs.

This matches the native ECS integration requirements for secure environment variables and log routing.

Grant the necessary IAM permissions to the correct role.

Attach an IAM policy with ssm:GetParameters and logs:PutLogEvents (along with logs:CreateLogStream) to the Task Execution Role.

The ECS agent requires these specific permissions to retrieve the parameters and write log data to CloudWatch.

Key Concept

ECS Task Role vs. Task Execution Role & ECS Secret Injection

Estimated Time:2m 0s

PreviousPage 28 / 78Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept