All practice questions

1542 questions

All types1,542 Multiple choice782 Multiple select746 Ordering14

A developer is designing a REST API in Amazon API Gateway to serve as a backend for a mobile application. The API must validate user identity tokens issued by Amazon Cognito User Pools. Once authenticated, the requests must be routed to an AWS Lambda function. To minimize custom code maintenance, execution overhead, and configuration complexity, the developer wants to avoid writing custom request mapping templates or token validation code in API Gateway. Which TWO actions should the developer take to meet these requirements?

Select all that apply

Configure a Cognito User Pool Authorizer on the API Gateway method.

Use Lambda Proxy Integration for the integration request configuration.

Create a custom Lambda Authorizer to validate the user's Cognito JSON Web Token (JWT).

Use a Lambda Custom Integration and configure Velocity Template Language (VTL) mapping templates to pass request parameters.

Configure a Lambda Custom Integration and write code inside the Lambda function to parse the raw HTTP request structure directly from the event object.

Show answer & explanation

Answer: Configure a Cognito User Pool Authorizer on the API Gateway method.; Use Lambda Proxy Integration for the integration request configuration.

Answer

Configure a Cognito User Pool Authorizer on the API Gateway method and use Lambda Proxy Integration for the integration request configuration.

The correct options are configuring a Cognito User Pool Authorizer and using Lambda Proxy Integration. A Cognito User Pool Authorizer allows API Gateway to automatically validate identity tokens issued by Amazon Cognito without writing custom validation code. Lambda Proxy Integration passes the raw client request details directly to the backend Lambda function, eliminating the need to write and maintain Velocity Template Language (VTL) mapping templates in API Gateway.

Step-by-Step Solution

Select the authentication mechanism that minimizes custom code for Cognito validation.

Identify that the Cognito User Pool Authorizer is built directly into API Gateway and handles JWT token verification natively, whereas a custom Lambda Authorizer requires custom code development and maintenance.

This meets the constraint of avoiding custom token validation code.

Select the integration type that avoids custom mapping templates.

Identify that Lambda Proxy Integration automatically passes the entire HTTP request structure directly to Lambda in a standardized format, whereas Lambda Custom Integration requires writing VTL templates to map query parameters, headers, and payloads.

This meets the constraint of avoiding custom request mapping templates.

Key Concept

API Gateway offers native integrations and authentication mechanisms to reduce code overhead, including Cognito User Pool Authorizers and Lambda Proxy Integrations.

Question 42Question →

A developer is building a serverless integration where an AWS Lambda function with a timeout of $10$ seconds processes messages from an Amazon SQS FIFO queue containing inventory updates. The system must guarantee that updates for the same product are processed in the order they are received, and messages should not be processed multiple times due to timeout discrepancies.

Which of the following configurations should the developer implement to meet these requirements? (Select TWO.)

Select all that apply

Set the MessageGroupId of each message to the product ID to ensure sequential processing per product.

Set the SQS queue's visibility timeout to

60

seconds or more to align with the Lambda function's timeout.

Set the SQS queue's visibility timeout to

5

seconds to ensure that unprocessed messages are quickly retried.

Set the Lambda function's timeout to

60

seconds while keeping the SQS queue's visibility timeout at

30

seconds to allow the function more time to complete.

Hardcode the AWS access keys within the Lambda function code to instantiate the SQS client.

Show answer & explanation

Answer: Set the MessageGroupId of each message to the product ID to ensure sequential processing per product.; Set the SQS queue's visibility timeout to $60$ seconds or more to align with the Lambda function's timeout.

Answer

Setting the MessageGroupId to the product ID and configuring the SQS queue's visibility timeout to

60

seconds or more.

To guarantee sequential processing of messages for the same product, the messages must belong to the same message group, which is achieved by setting the MessageGroupId parameter to the product ID. Additionally, to prevent duplicate message processing when integrating SQS with AWS Lambda, the queue's visibility timeout must be configured to at least

6

times the Lambda function's timeout. Since the Lambda function has a timeout of

10

seconds, the visibility timeout must be set to

60

seconds or more.

Step-by-Step Solution

Determine the parameter required for message ordering in Amazon SQS FIFO queues.

Identify that the MessageGroupId parameter must be set to group related messages (e.g., by product ID) for sequential processing.

SQS FIFO queues guarantee in-order delivery within a message group, so setting the MessageGroupId to the product ID ensures updates for that product are processed sequentially.

Calculate the recommended SQS visibility timeout based on the Lambda function timeout.

Multiply the

10

-second Lambda timeout by

6

, yielding

60

seconds.

AWS Lambda best practices recommend setting the SQS queue's visibility timeout to at least

6

times the function's timeout to prevent concurrent processing of the same message during retries or delays.

Key Concept

Configuring SQS FIFO queues and visibility timeouts for reliable AWS Lambda integration.

Estimated Time:1m 30s

Question 43Question →

A developer is designing an integration for an IoT system that logs temperature metrics to an Amazon DynamoDB table. The table uses `SensorId` as the partition key and `Timestamp` as the sort key. A Lambda function executes a `Query` operation to retrieve metrics for a specific `SensorId` over a 24-hour period.

The query matches exactly 100 items, and each item has an average size of $5\text{ KB}$ . The operation uses a `FilterExpression` to only return the 20 items where the `AlertStatus` attribute is set to `RED`. Additionally, a `ProjectionExpression` is used to limit the returned attributes to `Timestamp` and `Reading`, reducing the payload size of each returned item to $1.5\text{ KB}$ .

If the query is configured to use strongly consistent reads and the Lambda function must handle 10 queries per second, what is the minimum read capacity units (RCUs) that must be provisioned for the table to prevent throttling?

625\text{ RCU}

1250\text{ RCU}

250\text{ RCU}

80\text{ RCU}

Show answer & explanation

Answer: $1250\text{ RCU}$

Answer

The minimum read capacity units (RCUs) that must be provisioned is

1250\text{ RCU}

The correct answer is

1250\text{ RCU}

. In Amazon DynamoDB, read capacity calculations are based on the amount of data read from the table before any FilterExpression or ProjectionExpression is applied. The query matches 100 items with an average size of

5\text{ KB}

, resulting in a total evaluated data size of

500\text{ KB}

. Since the query uses strongly consistent reads, each RCU provides one read per second for an item up to

4\text{ KB}

. Thus, a single query requires

500\text{ KB} / 4\text{ KB} = 125

read operations. To support 10 queries per second, the minimum provisioned capacity required is

125 \times 10 = 1250\text{ RCU}

Step-by-Step Solution

Determine the total data size evaluated by the Query operation.

The total evaluated size is

100 \times 5\text{ KB} = 500\text{ KB}

DynamoDB calculates read capacity based on the size of all items that match the key condition expression, before any FilterExpression or ProjectionExpression is applied.

Calculate the read operations required for a single query.

500\text{ KB} / 4\text{ KB} = 125

read operations.

For strongly consistent reads, one read operation is consumed for every

4\text{ KB}

of data read, rounded up.

Calculate the total provisioned RCU needed per second.

125 \text{ read operations} \times 10 \text{ queries/sec} = 1250\text{ RCU}

Read Capacity Units are provisioned per second, so the single-query requirement must be multiplied by the query rate.

Key Concept

DynamoDB read capacity unit calculation behaves independently of projection and filter expressions.

Question 44Question →

A developer has deployed an AWS Lambda function inside a private subnet of a VPC to process data and write it to an Amazon RDS database. The function also needs to call a third-party payment processing API over HTTPS and upload a summary report to Amazon S3. During testing, the developer observes that the Lambda function can write to the RDS database, but attempts to connect to the third-party API and Amazon S3 fail with network timeouts. Additionally, the Lambda function's execution duration is high due to establishing new HTTPS connections on every execution.

Which two actions should the developer take to resolve these network timeouts and optimize connection performance?

Select all that apply

Configure a NAT Gateway in a public subnet, and update the private subnet's route table to route external traffic (

0.0.0.0/0

) through the NAT Gateway.

Initialize the SDK and HTTP clients outside the Lambda handler function so that they can be reused across multiple execution context invocations.

Associate a public IP address with the Lambda function's Elastic Network Interfaces (ENIs) and place the function in a public subnet.

Pass static AWS credentials directly to the SDK client constructor inside the Lambda handler to authenticate requests to Amazon S3.

Re-initialize the SDK and HTTP clients inside the handler for every execution to ensure connection limits are not exceeded due to execution context reuse.

Show answer & explanation

Answer: Configure a NAT Gateway in a public subnet, and update the private subnet's route table to route external traffic ( $0.0.0.0/0$ ) through the NAT Gateway.; Initialize the SDK and HTTP clients outside the Lambda handler function so that they can be reused across multiple execution context invocations.

Answer

Configure a NAT Gateway in a public subnet, route outbound traffic to it, and initialize SDK/HTTP clients outside the Lambda handler function.

Configuring a NAT Gateway in a public subnet and routing external traffic from the private subnet through it allows the Lambda function to access external networks like the third-party API and AWS services. Initializing the SDK and HTTP clients outside the handler allows the Lambda function to reuse these clients and connection pools across subsequent invocations within the same execution context, reducing overhead and improving latency.

Step-by-Step Solution

Analyze the network failure context

The Lambda function is placed inside a private subnet of a VPC. It can reach the RDS database in the same VPC but cannot resolve public API DNS or reach external services.

Resources in private subnets do not have public IP addresses or routes to the internet, blocking HTTPS calls to external APIs and AWS endpoints.

Address the outbound internet connectivity issue

Create a NAT Gateway in a public subnet and add a route (

0.0.0.0/0

) in the private subnet's route table pointing to the NAT Gateway.

This enables secure outbound internet translation for resources within private subnets.

Optimize connection overhead

Declare the SDK and HTTP clients outside the handler code block.

Lambda reuses the execution context for subsequent warm starts. Code outside the handler is executed once during initialization (cold start), allowing subsequent invocations to reuse established connection pools.

Key Concept

VPC internet connectivity for Lambda and execution context optimization

Question 45Question →

A ride-sharing booking application named 'CabFlow' processes ride requests using an Amazon DynamoDB table. During a major city-wide holiday event, the application experiences a massive surge in booking requests, resulting in `ProvisionedThroughputExceededException` errors. Monitoring indicates that the write requests are heavily concentrated on a partition key representing the current hour and city (e.g., `20260715-NYC`), creating a hot partition, while the table's overall provisioned capacity is not fully utilized. Which of the following actions should the developer take to resolve this key distribution and throttling issue? (Select TWO options.)

Select all that apply

Append a randomized integer suffix to the partition key value before writing data to distribute the load across multiple partition keys.

Configure the AWS SDK client in the application to implement exponential backoff and jitter for retrying failed requests.

Increase the visibility timeout of the incoming Amazon SQS queue to allow more processing time for individual write operations.

Replace the query operations with Scan operations to search the table without relying on the partition key.

Hardcode AWS access keys directly in the client configuration to speed up authentication and authorization checks on subsequent requests.

Show answer & explanation

Answer: Append a randomized integer suffix to the partition key value before writing data to distribute the load across multiple partition keys.; Configure the AWS SDK client in the application to implement exponential backoff and jitter for retrying failed requests.

Answer

Modify the partition key schema by appending a randomized suffix to distribute the write load, and configure the AWS SDK client to use exponential backoff and jitter for retries.

To fix DynamoDB throttling caused by hot partitions, developers should distribute the write requests across multiple partitions. This is accomplished by sharding the partition keys (adding a random suffix). In addition, configuring the SDK client to implement exponential backoff and jitter allows the application to retry transient failures without overloading the database.

Step-by-Step Solution

Analyze the DynamoDB write pattern to identify the root cause of the throughput issue.

Identified a hot partition key problem due to low cardinality (all writes using the same hour-city key).

Resolving throttling requires distributing keys across partitions or managing retry behavior.

Implement write sharding (salting) by appending a random integer suffix to the partition key.

Writes are evenly distributed across different partition key values (e.g., `20260715-NYC-1` to `20260715-NYC-N`).

This allows DynamoDB to store and process the data across multiple physical partitions, utilizing the total allocated throughput.

Configure the application's SDK client to handle transient write failures gracefully.

The SDK retries failed operations using exponential backoff and jitter.

This avoids overwhelming the database with immediate retries and helps the application recover from temporary load spikes.

Key Concept

Resolving DynamoDB throttling issues by addressing hot partition keys through write sharding (salting) and handling client-side retries with backoff and jitter.

Question 46Question →

A developer is building a web-based reporting dashboard for an enterprise sales team. Users of the dashboard must authenticate using their email and password. Once authenticated, the client application needs to perform two actions: call a secure REST API hosted on Amazon API Gateway to fetch sales metadata, and download raw report files directly from a private Amazon S3 bucket. The developer wants to use Amazon Cognito to implement the authentication and authorization flows. Which TWO configuration steps should the developer perform to meet these requirements with the least administrative and operational overhead? (Select TWO.)

Select all that apply

Set up an Amazon Cognito User Pool to manage user registration and authentication, and configure a Cognito User Pool Authorizer on Amazon API Gateway to secure the REST API.

Create an Amazon Cognito Identity Pool, configure the Cognito User Pool as an identity provider for it, and map an IAM role with read permissions for the private S3 bucket to authenticated users.

Create a custom API Gateway Lambda Authorizer to decode and validate the JSON Web Tokens (JWT) issued by the Cognito User Pool for each REST API request.

Configure the API Gateway REST API to use AWS IAM authorization, and configure the client application to pass the Cognito User Pool access token directly in the HTTP Authorization header.

Configure the Amazon Cognito User Pool to generate temporary AWS credentials for authenticated users and attach an IAM policy directly to the User Pool to allow S3 access.

Show answer & explanation

Answer: Set up an Amazon Cognito User Pool to manage user registration and authentication, and configure a Cognito User Pool Authorizer on Amazon API Gateway to secure the REST API.; Create an Amazon Cognito Identity Pool, configure the Cognito User Pool as an identity provider for it, and map an IAM role with read permissions for the private S3 bucket to authenticated users.

Answer

The developer should set up a Cognito User Pool to manage user registration and login, and secure the API Gateway REST API using the native Cognito User Pool Authorizer. Additionally, the developer should create a Cognito Identity Pool linked to the User Pool to grant temporary AWS credentials for S3 bucket access via an authenticated IAM role.

To authenticate users and secure API Gateway REST APIs with the least overhead, a developer should use an Amazon Cognito User Pool combined with API Gateway's native Cognito User Pool Authorizer. To authorize users to download files directly from Amazon S3, the developer must exchange the Cognito User Pool identity tokens for temporary AWS credentials using a Cognito Identity Pool, which maps users to an IAM role with read permissions for the target S3 bucket.

Step-by-Step Solution

Configure the authentication directory and API security.

An Amazon Cognito User Pool is configured to manage user sign-in and sign-up. The API Gateway REST API is protected by selecting Cognito User Pool Authorizer, which natively parses and validates the client's token.

This establishes user identity and protects the REST API with the lowest operational complexity.

Configure AWS resource authorization.

An Amazon Cognito Identity Pool is created with the Cognito User Pool configured as an identity provider. An IAM role containing read permissions for the target S3 bucket is attached to the Identity Pool's authenticated role.

This allows authenticated users to obtain temporary AWS credentials for direct, secure interaction with the S3 bucket.

Key Concept

Amazon Cognito User Pools provide authentication and user directories, integrating natively with API Gateway via Cognito Authorizers. Cognito Identity Pools handle authorization by exchanging user identity tokens for temporary AWS credentials to access AWS services directly.

Question 47Question →

An organization is designing a microservice that will run on AWS Lambda within a private subnet to process messages. The microservice uses the AWS SDK to retrieve sensitive configuration data. During local testing on developer workstations, the application needs to use credentials from a local AWS CLI profile named `dev-profile`. When running on AWS, the microservice must run securely with minimal privilege and without hardcoded secrets.

Which two configuration steps should the developer perform to satisfy these requirements? (Select TWO.)

Select all that apply

Set the AWS_PROFILE environment variable to dev-profile on the developers' local workstations.

Assign an IAM execution role with the required permissions to the Lambda function.

Initialize the AWS SDK clients by passing the AWS Access Key ID and Secret Access Key retrieved from the developer profile directly in the constructor.

Configure the Lambda function's resource policy to trust the developer IAM user to allow access to AWS services.

Deploy a NAT Gateway in the private subnet where the Lambda function resides to allow it to retrieve secrets from AWS Secrets Manager.

Show answer & explanation

Answer: Set the AWS_PROFILE environment variable to dev-profile on the developers' local workstations.; Assign an IAM execution role with the required permissions to the Lambda function.

Answer

To satisfy the requirements, the developer should set the AWS_PROFILE environment variable to the named developer profile on local workstations, and assign an IAM execution role with the necessary permissions to the AWS Lambda function in the production environment.

The correct actions involve setting the environment variable to specify the local named profile and assigning an IAM execution role to the Lambda function. The default credential provider chain of the AWS SDK handles both scenarios seamlessly: locally it resolves the profile via the environment variable, and in Lambda it retrieves the temporary credentials from the execution role.

Step-by-Step Solution

Identify how the AWS SDK locates credentials locally.

Setting the AWS_PROFILE environment variable directs the SDK default credential provider chain to retrieve credentials from the shared credentials file for the specified profile.

This avoids hardcoding credentials or modifying code between environments.

Determine how the AWS SDK retrieves credentials in the AWS Lambda environment.

The SDK default credential provider chain automatically queries the Lambda execution environment to obtain temporary credentials from the assigned IAM execution role.

This conforms to the principle of least privilege and uses AWS managed temporary credentials.

Evaluate the security and routing requirements of the private subnet.

Deploying a NAT Gateway in a private subnet is incorrect; NAT Gateways must be in a public subnet. Additionally, accessing Secrets Manager from a private VPC can be done via VPC endpoints or a public NAT Gateway.

Correct network topology is required to allow the Lambda function to make outbound connections.

Key Concept

AWS SDK Default Credential Provider Chain

Question 48Question →

A developer is designing a corporate desk-booking application. The DynamoDB table uses `DeskId` as the partition key and `BookingDate#Slot` (e.g., `2026-08-01#Morning`) as the sort key. The application must support two new access patterns:

1. Retrieve all bookings for a specific employee (`EmployeeId`) sorted by date.
2. Retrieve only the bookings that are currently marked as "PendingApproval" (representing less than $1\%$ of all bookings) to run a daily cleanup cron job.

Which two options should the developer implement to satisfy these requirements with the lowest consumption of Read Capacity Units (RCUs)?

Select all that apply

Create a Global Secondary Index (GSI) with `EmployeeId` as the partition key and `BookingDate#Slot` as the sort key.

Create a Local Secondary Index (LSI) with `EmployeeId` as the sort key.

Create a GSI using a sparse attribute `PendingApprovalStatus` (which is only populated when a booking is pending approval) as the partition key.

Perform a `Scan` operation on the base table using a `FilterExpression` to retrieve bookings where the status attribute equals "PendingApproval".

Create a Local Secondary Index (LSI) with `PendingApprovalStatus` as the partition key.

Show answer & explanation

Answer: Create a Global Secondary Index (GSI) with `EmployeeId` as the partition key and `BookingDate#Slot` as the sort key.; Create a GSI using a sparse attribute `PendingApprovalStatus` (which is only populated when a booking is pending approval) as the partition key.

Answer

Create a Global Secondary Index (GSI) with `EmployeeId` as the partition key and `BookingDate#Slot` as the sort key, and create a GSI using a sparse attribute `PendingApprovalStatus` (which is only populated when a booking is pending approval) as the partition key.

The correct strategy involves two parts. First, to query across different partition keys (desks) by employee ID, a Global Secondary Index (GSI) with the employee ID as the partition key and the booking date/slot as the sort key must be created. Second, to retrieve the small fraction of bookings pending approval, a sparse GSI should be used. In DynamoDB, if an item does not contain the GSI's partition key attribute, it is not indexed. By populating a status attribute only when a booking is pending approval and setting it as the GSI's partition key, the index remains highly compact, and querying it consumes very few RCUs.

Step-by-Step Solution

Analyze the first access pattern requirement.

The requirement is to retrieve bookings by `EmployeeId` sorted by date. Since the base table partition key is `DeskId`, querying by `EmployeeId` across different desks requires a Global Secondary Index (GSI) with `EmployeeId` as the partition key. Because the GSI sort key can be `BookingDate#Slot`, the items will be returned in sorted order.

An LSI would require the same partition key as the base table (`DeskId`), which cannot query across multiple desks for a single employee.

Analyze the second access pattern requirement.

The requirement is to retrieve only "PendingApproval" bookings, which constitute less than

1\%

of total items. Creating a GSI using an attribute that is only present when the booking is in this status (a sparse GSI) ensures that the index size is extremely small.

Querying a sparse GSI only scans the relevant pending items, whereas scanning the base table with a filter expression would consume RCUs for every single item in the table.

Key Concept

Optimizing DynamoDB queries using Global Secondary Indexes (GSIs) and Sparse Indexes to minimize Read Capacity Unit (RCU) consumption.

Question 49Question →

A developer is configuring an AWS Lambda function that processes user session data. The function needs to connect to an Amazon ElastiCache for Redis cluster running in private subnets within a VPC. Additionally, the function must retrieve an API key stored in AWS Secrets Manager to authenticate calls to an external third-party service. The developer deploys the Lambda function inside the same private subnets of the VPC to ensure connectivity to the Redis cluster. However, during testing, the function fails to connect to AWS Secrets Manager and timeouts when attempting to invoke the external third-party API. Which two actions should the developer take to resolve these connectivity issues? (Select two.)

Select all that apply

Configure a NAT Gateway in a public subnet of the VPC, and add a route in the private subnets' route table directing

0.0.0.0/0

traffic to the NAT Gateway.

Create an Interface VPC Endpoint (AWS PrivateLink) for AWS Secrets Manager in the private subnets, and configure the security groups to allow traffic between the Lambda function and the endpoint.

Create a Gateway VPC Endpoint for AWS Secrets Manager, and associate it with the route tables of the private subnets where the Lambda function is deployed.

Move the Lambda function to the public subnets of the VPC and enable the public IP address setting in the function's VPC configuration.

Configure AWS Systems Manager Parameter Store using local environment variables to store the secret keys to avoid external network calls.

Show answer & explanation

Answer: Configure a NAT Gateway in a public subnet of the VPC, and add a route in the private subnets' route table directing $0.0.0.0/0$ traffic to the NAT Gateway.; Create an Interface VPC Endpoint (AWS PrivateLink) for AWS Secrets Manager in the private subnets, and configure the security groups to allow traffic between the Lambda function and the endpoint.

Answer

To resolve the connectivity issues, the developer must configure a NAT Gateway in a public subnet of the VPC and route internet-bound traffic from the private subnets to it, allowing the Lambda function to reach the external third-party API. Additionally, the developer should create an Interface VPC Endpoint for AWS Secrets Manager in the VPC so the Lambda function can privately access Secrets Manager without traversing the public internet.

The correct solution involves two steps: first, configuring a NAT Gateway in a public subnet of the VPC and adding a default route (

0.0.0.0/0

) in the private subnet route table to allow the Lambda function to reach the external API. Second, creating an Interface VPC Endpoint (AWS PrivateLink) for AWS Secrets Manager inside the VPC allows private communication with the Secrets Manager service without needing to go over the public internet, satisfying security and architectural requirements.

Step-by-Step Solution

Analyze the network requirements of the Lambda function.

The Lambda function needs access to a private resource (ElastiCache), an AWS service (Secrets Manager), and an external public endpoint (third-party API).

Placing the Lambda function in a private subnet allows it to access ElastiCache, but blocks outbound internet access by default.

Identify the solution for external internet access.

Create a NAT Gateway in a public subnet and update the private subnet route tables to direct

0.0.0.0/0

traffic to the NAT Gateway.

This allows the Lambda function to securely initiate outbound connections to the third-party API.

Identify the solution for secure AWS service access from a private subnet.

Create an Interface VPC Endpoint (AWS PrivateLink) for AWS Secrets Manager.

This enables private routing directly to Secrets Manager over the AWS network, which is more secure and cost-effective than routing AWS API traffic through a NAT Gateway.

Key Concept

Configuring VPC networking for AWS Lambda functions requiring both private VPC resource access and external internet/AWS service connectivity.

Question 50Question →

A developer is setting up an Amazon EventBridge rule to route custom application events to an Amazon Kinesis Data Stream target for real-time analytics. The stream consists of 12 shards. The incoming events contain a JSON payload with fields including `transaction_id` (a high-entropy UUID), `region` (one of 4 geographic regions), and `department` (one of 3 departments). The developer needs to ensure that the events are distributed evenly across all shards to prevent throttling, and that EventBridge has the necessary permissions to write to the Kinesis stream. Which configuration meets these requirements?

Configure the EventBridge target with PartitionKeyPath set to $.detail.transaction_id, and associate an IAM role with a trust policy that allows the events.amazonaws.com service principal to assume the role.

Configure the EventBridge target with PartitionKeyPath set to $.detail.region, and associate an IAM role with a trust policy that allows the events.amazonaws.com service principal to assume the role.

Configure the EventBridge target with PartitionKeyPath set to $.detail.transaction_id, and associate an IAM role with a trust policy that allows the kinesis.amazonaws.com service principal to assume the role.

Configure the EventBridge target with a static partition key value of transaction-event, and associate an IAM role with a trust policy that allows the events.amazonaws.com service principal to assume the role.

Show answer & explanation

Answer: Configure the EventBridge target with PartitionKeyPath set to $.detail.transaction_id, and associate an IAM role with a trust policy that allows the events.amazonaws.com service principal to assume the role.

Answer

The correct configuration uses the transaction_id JSON path as the partition key. Because the transaction ID is a UUID, it provides a high-entropy value that results in a uniform hash distribution of records across all 12 shards in the stream, preventing hot shards. Additionally, EventBridge requires an IAM role to write events to the stream, and the trust policy must explicitly allow the events.amazonaws.com service principal to assume this role.

Step-by-Step Solution

Analyze partition key selection for Kinesis Data Streams.

Using a high-entropy field like transaction_id (UUID) distributes records evenly across all 12 shards, whereas region (4 values) or a static key ('transaction-event') causes hot shards and write throttling.

Kinesis uses the MD5 hash of the partition key to determine which shard receives the record; high entropy ensures uniform distribution.

Analyze IAM role trust policy configuration for EventBridge targets.

The trust policy must allow the service performing the action (Amazon EventBridge, which is events.amazonaws.com) to assume the role.

If the trust policy specifies the target service (kinesis.amazonaws.com), EventBridge will be unable to assume the role to write events into the stream.

Key Concept

Partition key design for Kinesis Data Streams and EventBridge target permissions.

Question 51Question →

A developer is building a home automation backend where smart home hubs publish state-change events to a custom Amazon EventBridge event bus. The developer wants to route these events to an Amazon Kinesis Data Stream for real-time anomaly detection. It is critical that events originating from the same home hub are processed in the exact order they are generated to avoid false alarm triggers. During testing, the Kinesis Data Stream suffers from write throttling due to a hot shard, while other shards remain underutilized. Which target configuration change in the EventBridge rule will resolve the throttling while preserving the ordered processing of events from each hub?

Configure the Kinesis Data Stream target in the EventBridge rule to use a partition key path of $.detail.hubId.

Configure the Kinesis Data Stream target in the EventBridge rule with a static partition key string such as SmartHomeEvents.

Configure the Kinesis Data Stream target in the EventBridge rule to use a partition key path of $.detail.eventId, which is a unique UUID generated for every event.

Configure the Kinesis Data Stream target in the EventBridge rule to use a partition key path of $.detail.deviceType, and increase the consumer Lambda function timeout.

Show answer & explanation

Answer: Configure the Kinesis Data Stream target in the EventBridge rule to use a partition key path of $.detail.hubId.

Answer

Configure the Kinesis Data Stream target in the EventBridge rule to use a partition key path of $.detail.hubId.

Configuring the partition key path to extract the hub identifier ensures that all state-change events generated by a specific hub are assigned the same partition key. Kinesis hashes this key to route all these events to the same shard, preserving their sequential order. Since there are many unique hubs, this high-cardinality key distributes events evenly across all available shards, resolving the write throttling.

Step-by-Step Solution

Analyze the Kinesis shard allocation logic.

Events are routed to shards based on the hash of the partition key.

We must choose a partition key that has high cardinality to distribute the load, but also groups related messages to the same shard to ensure ordering.

Evaluate the ordering requirement.

Events from the same smart home hub must be processed in order.

This means all events from a given hub must share the same partition key so they are routed to the same shard.

Compare partition key candidates.

The hubId provides both grouping (guaranteeing ordering per hub) and high cardinality (distributing load across all shards).

A static key causes hot shards, a unique event ID violates ordering, and a low-cardinality device type does not solve throttling.

Key Concept

In Amazon Kinesis Data Streams, partition keys determine which shard receives a record. When Kinesis is targeted by EventBridge, configuring a partition key path with a high-cardinality identifier that is common to related events (like a hub ID) distributes the workload evenly across shards while guaranteeing sequential processing for each identifier.

Estimated Time:2m 0s

Question 52Question →

A developer is building a document conversion service where users upload files to be converted. The architecture uses an Amazon SQS queue to hold conversion tasks. A fleet of consumer instances running on Amazon ECS retrieves messages from the queue, processes the conversion (which takes up to 5 minutes per document), and then deletes the messages. During peak traffic, the developer notices that some documents are being processed multiple times by different container instances. Which two actions should the developer take to resolve this issue? (Select TWO)

Select all that apply

Increase the visibility timeout of the SQS queue to a value greater than 5 minutes.

Ensure the consumer application code calls DeleteMessage using the receipt handle of the message after the conversion is complete.

Decrease the visibility timeout of the SQS queue to 1 minute to allow other container instances to quickly retry failed tasks.

Embed the AWS access keys directly within the container application code to authenticate SDK calls to SQS.

Increase the timeout of the AWS Lambda function that processes the queue to 15 minutes.

Show answer & explanation

Answer: Increase the visibility timeout of the SQS queue to a value greater than 5 minutes.; Ensure the consumer application code calls DeleteMessage using the receipt handle of the message after the conversion is complete.

Answer

The developer should increase the visibility timeout of the SQS queue to a value greater than 5 minutes, and ensure the consumer application code calls DeleteMessage using the receipt handle of the message after the conversion is complete.

The correct options are increasing the SQS queue's visibility timeout and ensuring the consumer code calls DeleteMessage after successful processing. Increasing the visibility timeout to exceed the maximum processing duration (5 minutes) ensures that the message remains hidden from other consumers while being processed. Deleting the message using the receipt handle after conversion is complete ensures it is removed from the queue and not processed again.

Step-by-Step Solution

Analyze the message lifecycle and processing duration.

The document conversion task takes up to 5 minutes, but the SQS message becomes visible to other consumers before the conversion completes, leading to duplicate processing.

If the queue's visibility timeout is shorter than the processing time, SQS assumes the consumer failed and makes the message available to other consumers.

Adjust the SQS visibility timeout configuration.

Configure the SQS queue's visibility timeout to be greater than 5 minutes (e.g., 6 minutes).

This guarantees that no other consumer can retrieve the message while it is being actively processed by the first consumer.

Verify message deletion logic in the consumer code.

Ensure the application calls the SQS DeleteMessage API with the message's receipt handle once the task is finished.

Explicit deletion is required in SQS to permanently remove the message from the queue after successful processing, preventing it from reappearing.

Key Concept

SQS message visibility timeout and deletion lifecycle

Question 53Question →

A developer is implementing an IoT smart-home integration system. Devices publish telemetry and alert events to an Amazon SNS topic. These events must be fanout-routed to $2$ separate Amazon SQS queues: one for immediate alarm processing by an AWS Lambda function, and one for daily status archiving. The alarm events require up to $80$ seconds of processing time by the Lambda function, but alarms are currently being processed multiple times by the function. Which actions must the developer take to configure the message routing and prevent duplicate processing of the alarm messages? (Select TWO.)

Select all that apply

Configure an Amazon SNS subscription filter policy on the alarm queue's subscription to only accept messages with the 'alarm' attribute.

Increase the visibility timeout of the alarm queue to

90

seconds to exceed the Lambda function's processing time.

Convert the alarm queue to a FIFO (First-In-First-Out) queue to guarantee that messages are only processed once regardless of processing duration.

Increase the timeout of the Lambda function to

90

seconds while leaving the alarm queue's visibility timeout at the default

30

seconds.

Hardcode an IAM Access Key and Secret Key inside the Lambda function's code to authenticate with the Amazon SQS client.

Show answer & explanation

Answer: Configure an Amazon SNS subscription filter policy on the alarm queue's subscription to only accept messages with the 'alarm' attribute.; Increase the visibility timeout of the alarm queue to $90$ seconds to exceed the Lambda function's processing time.

Answer

Configure an Amazon SNS subscription filter policy on the alarm SQS queue's subscription, and increase the visibility timeout of the alarm queue to

90

seconds.

The correct configurations are setting up an Amazon SNS subscription filter policy and increasing the SQS queue's visibility timeout to

90

seconds. Subscription filter policies allow the SQS queue to selectively ingest only 'alarm' messages, preventing unnecessary messages from being sent to the queue. Since the processing duration of the Lambda function can take up to

80

seconds, increasing the SQS visibility timeout to

90

seconds (which is greater than the

80

-second processing time) ensures that messages remain invisible to other consumers while being processed, avoiding duplicate delivery.

Step-by-Step Solution

Configure message routing at the SNS subscription layer.

An SNS subscription filter policy is added to the alarm SQS queue's subscription, ensuring only messages with the attribute set to 'alarm' are forwarded to the queue.

This decouples the system and prevents the alarm processing queue from receiving unrelated status archiving messages.

Analyze the cause of duplicate message processing.

Recognize that because the Lambda function takes

80

seconds to process but the queue's default visibility timeout is

30

seconds, SQS makes the message visible again before the Lambda function deletes it.

To prevent duplicate delivery, the visibility timeout of the queue must exceed the maximum processing duration of the consumer.

Modify the SQS visibility timeout configuration.

The visibility timeout of the SQS queue is increased to

90

seconds.

This ensures the message remains invisible to other consumers until the Lambda function completes its

80

-second execution and deletes the message.

Key Concept

Decoupling message-based integrations using SNS subscription filter policies and managing SQS visibility timeouts to prevent duplicate processing.

Question 54Question →

A developer is designing a document management system where metadata is stored in an Amazon DynamoDB table with DocumentId as the partition key. The application must support two new requirements:
1. Retrieve all documents associated with a specific Department (e.g., 'HR') that were uploaded after a certain timestamp.
2. Retrieve a list of all documents that are flagged as containing malware (the IsMalicious attribute is set to true), which applies to less than 0.1% of all stored documents.

To optimize queries and minimize Read Capacity Units (RCUs) consumption, which two actions should the developer take? (Select TWO.)

Select all that apply

Create a Global Secondary Index (GSI) with Department as the partition key and UploadTimestamp as the sort key, and perform Query operations on this GSI.

Create a sparse Global Secondary Index (GSI) with IsMalicious as the partition key, and perform Query operations on this GSI to retrieve the flagged documents.

Use a Scan operation on the base table with a FilterExpression containing Department and UploadTimestamp to retrieve the department documents.

Perform a Scan operation on the base table with a FilterExpression checking if IsMalicious is equal to true to retrieve the flagged documents.

Embed a long-lived IAM Access Key and Secret Access Key directly in the AWS SDK client configuration within the application code to speed up client initialization.

Show answer & explanation

Answer: Create a Global Secondary Index (GSI) with Department as the partition key and UploadTimestamp as the sort key, and perform Query operations on this GSI.; Create a sparse Global Secondary Index (GSI) with IsMalicious as the partition key, and perform Query operations on this GSI to retrieve the flagged documents.

Answer

Create a Global Secondary Index (GSI) with Department as the partition key and UploadTimestamp as the sort key, and create a sparse GSI with IsMalicious as the partition key, querying both indexes rather than scanning the base table.

The correct approach involves optimizing the two read access patterns using DynamoDB Query operations instead of Scan operations. For the first access pattern, creating a Global Secondary Index (GSI) with Department as the partition key and UploadTimestamp as the sort key allows the application to directly target the required items. For the second access pattern, a sparse GSI with IsMalicious as the partition key only indexes items that have this attribute set, which represents less than 0.1% of the database. Querying this sparse index is highly cost-effective and performs exceptionally fast because DynamoDB does not have to scan the non-matching items.

Step-by-Step Solution

Analyze the access patterns and identify the primary query attributes.

The first access pattern queries on Department and filters/sorts on UploadTimestamp. The second access pattern queries a low-frequency boolean flag (IsMalicious = true).

Identifying the target query attributes helps determine whether to use the base table or secondary indexes.

Evaluate index design strategies to avoid Scan operations.

Creating a GSI with Department (partition key) and UploadTimestamp (sort key) enables Query operations for the first requirement. Since IsMalicious is present on less than 0.1% of items, creating a GSI with IsMalicious as the partition key will result in a sparse index containing only those items.

Queries on indexes are much more efficient and consume fewer RCUs than Scan operations on the base table.

Validate security credentials configuration according to AWS best practices.

Do not hardcode credentials in code. Ensure IAM roles and the default credential provider chain are used.

Hardcoding credentials creates security vulnerabilities and violates credential management guidelines.

Key Concept

Using Query operations on GSIs and sparse GSIs to optimize data retrieval and avoid Scan operations in DynamoDB.

Question 55Question →

A developer is developing a serverless application that uses an AWS Lambda function to write logs and user status updates to an Amazon RDS PostgreSQL database instance. During high-concurrency load testing, the database starts throwing connection limit exhaustion errors. Additionally, the developer notices that each invocation suffers from high latency because a new database connection is created every time. Which TWO actions should the developer take to resolve the database connection limit errors and improve connection latency? (Select TWO.)

Select all that apply

Create an Amazon RDS Proxy for the database and configure the Lambda function to connect to the RDS Proxy endpoint.

Initialize the database connection pool outside the Lambda handler function to enable connection reuse across warm invocations.

Initialize and close the database connection inside the Lambda handler function on every invocation to ensure connections are immediately released.

Increase the Lambda function's execution timeout limit to allow the database client more time to establish and close connections.

Configure the Lambda function to run in a public VPC subnet and associate it with a public IP address to bypass internal database routing delays.

Show answer & explanation

Answer: Create an Amazon RDS Proxy for the database and configure the Lambda function to connect to the RDS Proxy endpoint.; Initialize the database connection pool outside the Lambda handler function to enable connection reuse across warm invocations.

Answer

Amazon RDS Proxy should be created to pool and share database connections, and the database connection pool should be initialized outside the Lambda handler function to enable execution context reuse.

Using Amazon RDS Proxy allows connection pooling and sharing, which prevents database connection exhaustion during high-concurrency traffic spikes. Additionally, initializing the database connection pool outside of the Lambda handler function enables the SDK clients and database connections to be reused across subsequent invocations that run in the same warm execution context, reducing overall connection setup latency.

Step-by-Step Solution

Analyze the cause of database connection exhaustion under serverless scaling.

Identify that AWS Lambda functions scale horizontally by creating separate execution environments, which leads to many concurrent database connections if each environment initializes a connection.

Understanding why the problem occurs is necessary to apply connection pooling.

Introduce a connection proxying mechanism.

Deploy an Amazon RDS Proxy between the Lambda function and the RDS PostgreSQL instance to manage database connection reuse.

RDS Proxy buffers incoming traffic and limits the actual concurrent connections established on the database.

Optimize the Lambda function initialization code.

Move the database connection helper and initialization logic outside the handler method block.

Moving client instantiation outside the handler enables subsequent executions in the same container instance (warm starts) to reuse the active connection pool, reducing connection latency.

Key Concept

AWS Lambda execution context reuse and database connection pooling using Amazon RDS Proxy.

Question 56Question →

A developer is optimizing a multiplayer gaming application backend. The application tracks player performance in real time and stores match results in an Amazon DynamoDB table. The table has `MatchId` as the partition key and `PlayerId` as the sort key. Each item contains additional attributes such as `Score`, `Duration`, and `Region`. For a post-match leaderboard display, the application needs to retrieve only the players who scored more than $10,000$ points in a specific match. The target match contains approximately $5,000$ player records, but typically fewer than $50$ players achieve a score above $10,000$ . Which approach will retrieve this data with the lowest latency and minimum Read Capacity Unit (RCU) consumption?

Create a Global Secondary Index (GSI) with `MatchId` as the partition key and `Score` as the sort key, and then perform a `Query` operation on the GSI using a `KeyConditionExpression` for both keys.

Perform a `Query` operation on the base table using the partition key `MatchId`, and apply a `FilterExpression` of `Score > 10000` to filter the results.

Perform a `Scan` operation on the base table with a `FilterExpression` checking if `MatchId` matches the target match and `Score` is greater than 10,000.

Initialize the DynamoDB client in the application code using static IAM Access Keys, and run a parallel `Scan` operation with segment filters to retrieve the data.

Show answer & explanation

Answer: Create a Global Secondary Index (GSI) with `MatchId` as the partition key and `Score` as the sort key, and then perform a `Query` operation on the GSI using a `KeyConditionExpression` for both keys.

Answer

Create a Global Secondary Index (GSI) with `MatchId` as the partition key and `Score` as the sort key, and then perform a `Query` operation on the GSI using a `KeyConditionExpression` for both keys.

The correct approach is to create a Global Secondary Index (GSI) with the match identifier as the partition key and the score as the sort key. By doing so, the query operation can utilize both attributes in its key condition expression. Since DynamoDB only bills RCUs for items returned by a key condition expression, this consumes minimal capacity (only for the matching records) and minimizes retrieval latency.

Step-by-Step Solution

Identify the data access pattern and constraints.

The application needs to retrieve a small subset of records (fewer than

50

out of

5,000

) within a specific partition (`MatchId`) based on a non-key attribute (`Score`).

Understanding the data volume and distribution helps determine the most cost-effective and low-latency retrieval method.

Evaluate the behavior of FilterExpression vs KeyConditionExpression.

A FilterExpression on the base table Query would read all

5,000

records before filtering, consuming unnecessary RCUs. A KeyConditionExpression requires the attribute to be part of the primary key or index key.

Filtering must occur at the storage layer before RCU calculation to optimize costs.

Design a secondary index to support the query requirements.

Create a GSI with `MatchId` as the partition key and `Score` as the sort key. This allows both attributes to be used in the KeyConditionExpression.

GSIs allow sorting and querying on attributes other than the base table's primary keys, enabling highly targeted reads that only consume RCUs for matching records.

Key Concept

Optimizing DynamoDB retrieval using Global Secondary Indexes (GSI) and KeyConditionExpressions instead of FilterExpressions or Scans.

Estimated Time:2m 0s

Question 57Question →

A software team is transitioning an Amazon API Gateway REST API endpoint from a Lambda custom integration to a Lambda proxy integration to reduce configuration overhead. Currently, the backend AWS Lambda function receives a pre-mapped JSON payload containing only application data, and it returns a custom business object directly. What modification must be made to the Lambda function code to ensure the API endpoint continues to function correctly under the new integration?

Modify the code to extract request details from the raw event object (such as event.body) and format the returned value as a JSON object containing statusCode, headers, and a stringified body.

Keep the existing business object return format but update the function's input parameter to accept a serialized JSON string representing the entire HTTP request.

Configure the function to return a standard HTTP response stream using the AWS SDK, and parse the query parameters from the system environment variables.

Integrate a custom Lambda authorizer inside the existing handler code to parse client request headers and automatically map them to the client integration response.

Show answer & explanation

Answer: Modify the code to extract request details from the raw event object (such as event.body) and format the returned value as a JSON object containing statusCode, headers, and a stringified body.

Answer

Modify the code to extract request details from the raw event object (such as event.body) and format the returned value as a JSON object containing statusCode, headers, and a stringified body.

Under Lambda proxy integration, Amazon API Gateway passes the raw HTTP request to the Lambda function in the event object. The Lambda function is responsible for parsing the input (such as event.body) and must return the response in a structured format containing statusCode, headers, and body as a string. This eliminates the need to configure integration request and response mappings in API Gateway.

Step-by-Step Solution

Analyze the change in input payload format.

In a Lambda proxy integration, API Gateway does not apply mapping templates. The input payload becomes the raw HTTP request details encapsulated in the event object, meaning the handler must access fields like event.body or event.queryStringParameters directly.

To correctly process client data that was previously mapped.

Analyze the change in output payload format.

In a Lambda proxy integration, API Gateway bypasses integration response mapping templates. The Lambda function must return a JSON response conforming to a specific format: containing statusCode, headers, and body (as a string).

To prevent API Gateway from returning a 502 Bad Gateway error to the client due to a malformed proxy response.

Key Concept

Lambda Proxy vs Custom Integration request/response handling

Question 58Question →

An application uses an Amazon SQS queue to receive transaction records. A developer is designing an AWS Lambda function to process these transactions. The Lambda function should only be invoked for messages where the `transactionType` is `refund` and the `amount` is greater than $1000$ . The developer wants to minimize Lambda invocation costs. Which of the following steps should the developer take to meet these requirements? (Select two.)

Select all that apply

Configure an event source mapping between the SQS queue and the Lambda function.

Specify a FilterCriteria pattern of `{"body": {"transactionType": ["refund"], "amount": [{"numeric": [">", 1000]}]}}` in the event source mapping.

Write custom conditional logic in the Lambda function code to parse the SQS records and exit early if the criteria are not met.

Set the SQS queue's visibility timeout to be shorter than the Lambda function's timeout to automatically discard unqualified messages.

Add a Condition block to the SQS queue access policy to deny SendMessage actions for transactions that do not match the criteria.

Show answer & explanation

Answer: Configure an event source mapping between the SQS queue and the Lambda function.; Specify a FilterCriteria pattern of `{"body": {"transactionType": ["refund"], "amount": [{"numeric": [">", 1000]}]}}` in the event source mapping.

Answer

Configure an event source mapping between the SQS queue and the Lambda function, and specify a FilterCriteria pattern of `{"body": {"transactionType": ["refund"], "amount": [{"numeric": [">", 1000]}]}}` in the event source mapping.

The correct options are configuring the event source mapping and applying the filter pattern directly to the JSON message body. By defining a filter pattern in the event source mapping, the Lambda service automatically filters out messages where the transaction type is not a refund or the amount is

1000

or less. This ensures the Lambda function is only invoked for matching messages, minimizing invocation costs.

Step-by-Step Solution

Set up an event source mapping to connect SQS and Lambda.

This establishes the integration, allowing Lambda to poll the queue.

An event source mapping is required for Lambda to consume messages from an SQS queue automatically.

Configure FilterCriteria on the event source mapping.

This prevents Lambda from being invoked for messages that do not match the specified pattern.

By applying the filter pattern to the JSON message body, Lambda only charges for invocations of matching messages, minimizing cost.

Key Concept

AWS Lambda Event Source Filtering with Amazon SQS allows filtering of message payloads before invoking the function, reducing cost and processing overhead.

Estimated Time:2m 0s

Question 59Question →

A developer is configuring an AWS CloudFormation template to deploy an application that requires a database password. The password must be stored securely and rotated automatically every 30 days. Additionally, the developer must ensure that if a stack update fails, the resources are reverted to their previous working state. Which CloudFormation configurations and features should the developer use to meet these requirements? (Select TWO.)

Select all that apply

Use a CloudFormation dynamic reference to retrieve the database password from AWS Secrets Manager.

Allow the default CloudFormation behavior to roll back the stack automatically to its last stable state if the update fails.

Use a Systems Manager Parameter Store dynamic reference to retrieve the password, and configure Parameter Store to rotate the secret every 30 days.

Change the password manually using the Amazon RDS console, then execute a CloudFormation drift detection operation to update the stack's template parameters.

Disable the stack's rollback-on-failure setting and execute the AWS CLI command to manually reconcile and clean up the database state.

Show answer & explanation

Answer: Use a CloudFormation dynamic reference to retrieve the database password from AWS Secrets Manager.; Allow the default CloudFormation behavior to roll back the stack automatically to its last stable state if the update fails.

Answer

To securely reference a rotating password and ensure automatic rollback on failure, the developer should use a dynamic reference to retrieve the database password from AWS Secrets Manager and allow CloudFormation to execute its default automatic rollback behavior.

To retrieve a secret that rotates automatically, using a dynamic reference to AWS Secrets Manager is the correct choice because Secrets Manager natively handles automatic secret rotation. Allowing the default CloudFormation rollback behavior ensures that any failed updates are automatically reverted to the last stable configuration without manual intervention.

Step-by-Step Solution

Select a secure storage service for the database password that supports rotation.

Identify AWS Secrets Manager as the appropriate service because it supports automatic rotation, unlike Systems Manager Parameter Store.

The requirements demand a secure password storage solution that rotates every 30 days.

Integrate the secure storage with the CloudFormation template.

Configure a dynamic reference in the template to fetch the password from AWS Secrets Manager at deployment time.

Dynamic references retrieve sensitive values from external systems without exposing them in plaintext inside the template.

Evaluate the rollback strategy for failed updates.

Ensure default automatic rollback is enabled for the stack.

CloudFormation's default behavior is to roll back to the last stable state automatically when an update fails, satisfying the requirement to revert changes.

Key Concept

AWS CloudFormation manages resources declaratively. Using dynamic references to AWS Secrets Manager handles rotating credentials securely, while default stack rollback behavior ensures automated state recovery from update failures.

Estimated Time:1m 0s

Question 60Question →

A developer is configuring a basic continuous delivery pipeline in AWS CodePipeline to automate software releases. The pipeline must retrieve source code from an AWS CodeCommit repository, compile the project using AWS CodeBuild, and deploy it to an Amazon ECS service using AWS CodeDeploy. Arrange the following steps in the correct chronological order from first to last to complete a single pipeline execution.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of pipeline execution is: first, detecting the change in CodeCommit; second, retrieving the source files and storing them in Amazon S3; third, building the application using AWS CodeBuild; and finally, deploying the application to Amazon ECS using AWS CodeDeploy.

A pipeline execution in AWS CodePipeline flows sequentially through stages. First, CodePipeline detects a change in the source repository. Second, the source stage retrieves the code and stores it in Amazon S3 as an input artifact. Third, AWS CodeBuild compiles the code and generates the build output artifact. Lastly, AWS CodeDeploy uses the build artifact to update the Amazon ECS service.

Step-by-Step Solution

Detect change in the source repository

Pipeline execution is triggered.

AWS CodePipeline monitors the source repository for changes to start the release process automatically.

Retrieve source files and upload to the artifact store

Source artifact is created and stored in the pipeline's Amazon S3 bucket.

The files must be uploaded to the artifact store so they are accessible by downstream actions.

Execute the build stage action

A build output artifact is created.

AWS CodeBuild runs compile and packaging steps on the source artifact to generate the deployable artifact.

Execute the deploy stage action

The application is updated in the target environment.

AWS CodeDeploy consumes the build output artifact to update the Amazon ECS task definition and service.

Key Concept

AWS CodePipeline execution runs sequentially through stages (Source, Build, Deploy). Each stage processes input artifacts generated by previous stages and produces output artifacts for subsequent stages.

Estimated Time:45s

PreviousPage 3 / 78Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept