Examkin

All practice questions

1542 questions

All types1,542Multiple choice782Multiple select746Ordering14
Question 1221Question →

A developer is configuring a CI/CD pipeline in AWS CodePipeline that uses AWS CodeDeploy to perform a blue/green deployment for a microservice running on Amazon ECS. The developer defines a set of deployment lifecycle hooks in the appspec.yaml file to run Lambda functions that perform integration tests. The pipeline fails during the deployment phase, and the CodeDeploy deployment log shows that the appspec.yaml contains an invalid lifecycle hook. The appspec.yaml includes the 'BeforeInstall', 'ApplicationStart', and 'AfterAllowTraffic' hooks. Which of the following is the primary cause of this deployment failure?

Show answer & explanation

Answer: The 'ApplicationStart' hook is an EC2/On-Premises deployment lifecycle hook and is not supported in Amazon ECS deployments.

Answer

The 'ApplicationStart' hook is an EC2/On-Premises deployment lifecycle hook and is not supported in Amazon ECS deployments.
In Amazon ECS deployments, AWS CodeDeploy supports a specific, limited set of lifecycle hooks to run Lambda validation functions: BeforeInstall, AfterInstall, AfterAllowTestTraffic, BeforeAllowTraffic, and AfterAllowTraffic. The ApplicationStart hook is specific to EC2/On-Premises deployments (which also include ApplicationStop, BeforeInstall, Install, AfterInstall, ValidateService, etc.). Including ApplicationStart in an ECS appspec.yaml file results in a validation failure during the deployment phase.

Step-by-Step Solution

1
Identify the deployment target and configuration context from the error message.
The target is Amazon ECS using CodeDeploy, and the failure is caused by an invalid lifecycle hook in the appspec.yaml file.
Understanding the target environment (ECS vs EC2) determines which AppSpec structure and hook names are valid.
2
Compare the hook names provided in the scenario with the list of supported hooks for ECS deployments.
ECS deployments support hooks like BeforeInstall, AfterInstall, AfterAllowTestTraffic, BeforeAllowTraffic, and AfterAllowTraffic. The hook 'ApplicationStart' is only supported in EC2/On-Premises deployments.
Mismatched lifecycle hooks between platforms cause validation errors in AWS CodeDeploy.
3
Select the option that correctly identifies the invalid hook and the target compatibility mismatch.
The correct option is the one stating that 'ApplicationStart' is an EC2-specific hook and not supported in ECS.
This directly matches the root cause of the AppSpec parsing/validation failure in CodeDeploy.

Key Concept

AWS CodeDeploy AppSpec lifecycle hooks differ significantly between EC2/On-Premises and Amazon ECS deployment types.
Estimated Time:1m 30s
Question 1222Question →

A developer is implementing an AWS Lambda function that processes customer feedback and calls a third-party translation API over the internet. The Lambda function is configured to run inside a custom VPC and is associated with two public subnets. The VPC has an Internet Gateway, and the route table for the public subnets contains a route pointing 0.0.0.0/0 to the Internet Gateway. During testing, the Lambda function fails to connect to the translation API and terminates after reaching its maximum timeout limit. What configuration change should the developer make to resolve this connection issue?

Show answer & explanation

Answer: Configure the Lambda function to run in private subnets, and route internet-bound traffic through a NAT Gateway.

Answer

Configure the Lambda function to run in private subnets, and route internet-bound traffic through a NAT Gateway.
The correct answer is to configure the Lambda function to run in private subnets and route internet-bound traffic through a NAT Gateway. This is because AWS Lambda functions configured within a VPC do not receive public IP addresses, even when associated with public subnets. As a result, they cannot route traffic directly to an Internet Gateway. Placing the Lambda function in private subnets and routing internet-bound traffic through a NAT Gateway (which has a public IP address) enables the function to reach external web APIs.

Step-by-Step Solution

1
Analyze the network configuration of the Lambda function.
The Lambda function is placed in public subnets with a route to an Internet Gateway.
To understand why the network connection to the public internet API is failing.
2
Determine how Lambda ENIs handle public routing.
Lambda ENIs are only assigned private IP addresses, regardless of whether they are deployed in a public or private subnet.
This explains why the Lambda function cannot communicate directly with the Internet Gateway (which requires a public IP address on the source interface).
3
Apply the standard serverless networking pattern for outbound internet access.
Move the Lambda function to private subnets and direct outbound traffic (0.0.0.0/0) to a NAT Gateway located in a public subnet.
The NAT Gateway performs network address translation using its elastic IP address, allowing the Lambda function to establish outbound connections to the internet.

Key Concept

AWS Lambda VPC networking and outbound internet access constraints
Question 1223Question →

A developer is troubleshooting a Python application running on a local workstation. The application uses the AWS SDK for Python (Boto3) to read objects from an Amazon S3 bucket. To configure the correct development credentials, the developer creates a profile named 'dev-profile' in the local ~/.aws/credentials file and sets the environment variable AWS_PROFILE=dev-profile in the terminal. However, when executing the script, the developer receives an AccessDenied error indicating that access is denied for an old, incorrect IAM user that is not defined in the 'dev-profile'. Which of the following is the most likely cause of this behavior?

Show answer & explanation

Answer: Active AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables are set in the terminal session, which take precedence over the AWS_PROFILE environment variable.

Answer

Active AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables are set in the terminal session, which take precedence over the AWS_PROFILE environment variable.
The correct option is correct because the AWS SDK credential provider chain evaluates explicit credential environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY) before the shared credentials file. If these environment variables are set in the active terminal session, Boto3 will use them and ignore the profile specified by the AWS_PROFILE environment variable.

Step-by-Step Solution

1
Evaluate the AWS SDK credential provider chain order.
The SDK looks first for credentials passed directly to the client constructor, followed by environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN), and then shared configuration and credential files (referenced by AWS_PROFILE).
This establishes which credential source takes precedence when multiple sources are configured.
2
Analyze the conflicting configurations in the scenario.
The developer configured AWS_PROFILE in the environment, but the application is still authenticating as an incorrect, old IAM user.
This indicates that a credential source with higher precedence than the credentials file (such as active credential environment variables) is active in the environment and overriding the AWS_PROFILE selection.
3
Identify the corrective action.
Unsetting the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables in the terminal session will allow the SDK to fall back to the credentials file and load the 'dev-profile' profile specified by AWS_PROFILE.
Removing the higher-precedence environment variables allows the lower-precedence profile credentials to be resolved successfully.

Key Concept

AWS SDK Credential Provider Chain Precedence
Question 1224Question →

A company runs a containerized web application on Amazon ECS using the AWS Fargate launch type. The ECS service is configured with a desired count of 88 tasks. Due to strict budget constraints, the developer cannot allocate any additional Fargate tasks or capacity during a deployment. However, the application must remain online, maintaining at least 50%50\% of its desired processing capacity throughout the update process.

Which two deployment configuration values should the developer specify in the ECS service definition to meet these requirements?

Select all that apply

Show answer & explanation

Answer: `minimumHealthyPercent` set to 5050; `maximumPercent` set to 100100

Answer

Setting the minimum healthy percent to 5050 and the maximum percent to 100100.
Specifying a `maximumPercent` of 100100 and a `minimumHealthyPercent` of 5050 satisfies all constraints. Setting `maximumPercent` to 100100 ensures that Amazon ECS does not provision any extra Fargate tasks beyond the desired count during the deployment, adhering to the strict budget limits. Setting `minimumHealthyPercent` to 5050 ensures that at least half of the tasks (44 out of 88) remain running and healthy during the update, maintaining the required processing capacity online.

Step-by-Step Solution

1
Analyze the capacity and resource constraint.
The constraint states that no additional tasks or capacity can be allocated during the deployment. Therefore, the maximum number of concurrent running or pending tasks must be capped exactly at the desired count, which is 100%100\%. This determines that `maximumPercent` must be 100100.
Setting `maximumPercent` to 100100 prevents Amazon ECS from scaling up and provisioning extra Fargate tasks during the update.
2
Analyze the availability constraint.
The application must maintain at least 50%50\% of its processing capacity online at all times. Since the desired count is 88 tasks, at least 44 tasks must remain running and healthy. This determines that `minimumHealthyPercent` must be 5050.
Setting `minimumHealthyPercent` to 5050 guarantees that Amazon ECS will only stop up to 44 tasks at a time, keeping the remaining 44 active to handle incoming traffic.

Key Concept

Amazon ECS Rolling Updates Configuration
Question 1225Question →

A Vue.js single-page application hosted on `https://dashboard.analyticsapp.io` receives a `502 Bad Gateway` error in the browser console when sending a `DELETE` request to an Amazon API Gateway REST API. The API Gateway resource is integrated with a Lambda function using Lambda Proxy Integration. While CloudWatch logs show the Lambda function executed successfully and returned the raw JSON `{"status": "success", "message": "Record deleted"}`, the API Gateway Execution logs reveal the error: 'Execution failed due to configuration error: Malformed Lambda proxy response'. Which of the following modifications should the developer make to resolve this error?

Show answer & explanation

Answer: Change the Lambda function code to return a JSON object with the keys `statusCode` as an integer, `headers` containing the required CORS headers, and a stringified JSON string of the payload in the `body` field.

Answer

Change the Lambda function code to return a JSON object with the keys statusCode as an integer, headers containing the required CORS headers, and a stringified JSON string of the payload in the body field.
The correct answer is to modify the Lambda function to return a formatted JSON object with `statusCode`, `headers`, and a stringified `body`. When using Lambda Proxy Integration, API Gateway requires the backend function to return a specific JSON schema. If the function returns a raw custom JSON object without these fields, API Gateway cannot construct the HTTP response, resulting in a `502 Bad Gateway` error with the 'Malformed Lambda proxy response' log. Additionally, because the client is a single-page application hosted on a different origin, the `headers` object must include the necessary CORS headers (e.g., `Access-Control-Allow-Origin`) to prevent browser CORS blocks.

Step-by-Step Solution

1
Analyze the API Gateway execution logs and client-side HTTP error.
The 502 Bad Gateway status and the log message 'Malformed Lambda proxy response' indicate that the backend Lambda function is integrated via Lambda Proxy Integration but did not return the schema expected by API Gateway.
API Gateway requires a specific output format from Lambda functions when using proxy integrations.
2
Differentiate between Lambda Proxy and Lambda Custom integration response handling.
Unlike Custom Integration, which allows the use of API Gateway Integration Response mapping templates (VTL) to format raw outputs, Proxy Integration requires the backend Lambda function to construct the complete HTTP response structure directly.
This establishes that the fix must be implemented within the Lambda function code rather than in the API Gateway configuration.
3
Identify the required schema fields for Lambda Proxy Integration.
The Lambda function response must be a JSON object with `statusCode` (integer), `headers` (map/object), and `body` (stringified payload).
Failing to supply these fields leads to a configuration execution failure in API Gateway.
4
Determine the CORS requirements for cross-origin frontend requests.
Because the request is initiated from `https://dashboard.analyticsapp.io` (a different origin), the function must return the CORS header `Access-Control-Allow-Origin` inside the `headers` key of the proxy response.
For Proxy Integrations, CORS headers enabled via the API Gateway console only apply to the mock OPTIONS preflight response, not to the actual integration response.

Key Concept

API Gateway Lambda Proxy Integration Response Structure and CORS Requirements
Estimated Time:2m 0s
Question 1226Question →

A restaurant reservation system named TableReserve records guest bookings into an Amazon DynamoDB table. During peak hours, the application experiences performance degradation and receives multiple ProvisionedThroughputExceededException errors when writing reservation records. The table's partition key is ReservationDate (formatted as YYYY-MM-DD), causing all write requests for a specific date to target the same partition. Which TWO actions should the developer take to resolve these throttling issues and improve partition write distribution? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Append a random hash or suffix to the partition key value when writing records to distribute the write load.; Migrate the DynamoDB table from provisioned capacity mode to on-demand capacity mode to handle traffic spikes automatically.

Answer

The correct actions are appending a random suffix to the partition key value and migrating the table to on-demand capacity mode.
The correct solution involves appending a random suffix to the partition key (write sharding) to distribute writes across multiple partitions and migrating to on-demand capacity mode to handle reservation spikes dynamically.

Step-by-Step Solution

1
Analyze the DynamoDB partition key design.
Using ReservationDate (YYYY-MM-DD) results in a hot partition key because all reservations for a given day hit the same partition.
Identifying the root cause helps determine that the database throughput degradation is due to poor write distribution.
2
Apply write sharding by appending a random suffix to the partition key.
Writes are distributed across multiple partitions (e.g., YYYY-MM-DD#1, YYYY-MM-DD#2).
This distributes the workload uniformly and resolves hot partition throttling.
3
Configure the table to use on-demand capacity mode.
DynamoDB dynamically scales to handle peak booking traffic automatically.
This accommodates spikes in reservations without manual capacity provisioning adjustments.

Key Concept

Resolving DynamoDB throttling issues by redesigning the partition key schema (sharding) and adjusting the table capacity mode.
Question 1227Question →

A developer is configuring an AWS CodeBuild project to build a Docker image and push it to an Amazon Elastic Container Registry (ECR) repository. The CodeBuild project is configured to run inside a private VPC subnet to access internal databases. During the build execution, CodeBuild fails to pull the public base image from Docker Hub and fails to authenticate with the Amazon ECR repository. Which TWO actions should the developer take to resolve these issues?

Select all that apply

Show answer & explanation

Answer: Configure a NAT Gateway in a public subnet of the VPC, and update the route table of the CodeBuild private subnet to route outbound traffic through the NAT Gateway.; Add the ecr:GetAuthorizationToken permission and repository permissions (such as ecr:BatchCheckLayerAvailability and ecr:PutImage) to the IAM service role associated with the CodeBuild project.

Answer

The developer should configure a NAT Gateway to allow internet access for CodeBuild's private subnet, and attach the required ECR permissions to the CodeBuild service role.
Routing outbound traffic through a NAT Gateway enables the CodeBuild container inside the private subnet to connect to the public Docker Hub registry. Additionally, attaching ECR permissions to the service role allows the build container to authenticate and push the compiled Docker image to Amazon ECR.

Step-by-Step Solution

1
Analyze the network route for pulling external dependencies.
CodeBuild requires internet access to pull base images from public Docker Hub. Since CodeBuild is running in a private VPC subnet, a NAT Gateway must be configured in a public subnet to forward this outbound traffic.
Resolves the connection failure when attempting to pull the public base image.
2
Analyze IAM role permissions for ECR authentication and upload.
The CodeBuild project's service role needs permission to fetch an authorization token from ECR (ecr:GetAuthorizationToken) and perform repository write actions.
Resolves the authentication and push authorization failures when interacting with Amazon ECR.

Key Concept

AWS CodeBuild VPC routing and ECR IAM permissions
Question 1228Question →

A developer is building a serverless web application that allows users to access corporate resources through a backend REST API hosted on Amazon API Gateway and powered by AWS Lambda. The developer has configured an Amazon Cognito User Pool to handle user authentication. The developer needs to secure the API Gateway endpoints so that only authenticated users can access them, and the backend Lambda function must retrieve the authenticated user's email address to record audit logs. The solution must minimize custom code and operational overhead.

Which two actions should the developer take to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Configure an API Gateway Cognito User Pools authorizer on the API methods, specifying the Cognito User Pool as the identity source.; Use a Lambda proxy integration and access the user's email address from the requestContext.authorizer.claims.email field in the input event.

Answer

Configure an API Gateway Cognito User Pools authorizer on the API methods, specifying the Cognito User Pool as the identity source, and use a Lambda proxy integration to access the user's email address from the requestContext.authorizer.claims.email field in the input event.
The correct options implement the most efficient serverless pattern: using API Gateway's native Cognito User Pools authorizer to authenticate users and validate tokens at the API gateway layer, and then passing the identity claims to the backend Lambda function via the Lambda proxy integration's requestContext. This requires zero custom authorizer code and minimal backend logic to extract the user's email.

Step-by-Step Solution

1
Select Cognito User Pools as the authentication mechanism for API Gateway.
API Gateway validates tokens natively using the built-in Cognito authorizer.
This minimizes operational overhead by avoiding the need to write custom authorization logic.
2
Enable Lambda proxy integration for the API Gateway integration.
The entire HTTP request context, including authorizer metadata, is passed to the backend Lambda function.
API Gateway automatically populates the authorizer claims in the request event context, enabling the Lambda function to read the user's email.

Key Concept

API Gateway Cognito User Pool Authorizer integration with Lambda Proxy
Estimated Time:2m 0s
Question 1229Question →

A developer has deployed an AWS Lambda function inside the private subnets of a custom VPC. The function processes metadata uploads, writes records to an Amazon Aurora PostgreSQL database located in the same private subnets, and notifies an external analytics endpoint (https://analytics.example.com/api/log) via HTTPS. During testing, the developer notices that the Lambda function intermittently fails due to execution timeouts when calling the external API. Additionally, under heavy concurrent load, the Aurora database runs out of available connections, causing subsequent invocations to fail. The database connection client is currently initialized inside the Lambda handler function.

Which two actions should the developer take to resolve the timeout failures and prevent database connection exhaustion? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Update the route table associated with the Lambda function's subnets to route traffic destined for 0.0.0.0/0 to a NAT Gateway.; Initialize the database connection client outside of the Lambda handler function, allowing the connection to be reused across warm execution contexts.

Answer

Update the route table associated with the Lambda function's subnets to route traffic destined for 0.0.0.0/0 to a NAT Gateway, and initialize the database connection client outside of the Lambda handler function to reuse it across executions.
The correct options are updating the private subnet route table to point default traffic to a NAT Gateway and initializing the database connection client outside the handler. The NAT Gateway provides the outbound route required for the Lambda function to reach the external analytics endpoint. Moving the database connection logic outside the handler leverages Lambda's execution context reuse, preserving database connection limits.

Step-by-Step Solution

1
Address the external API timeout issue by configuring network routing.
The Lambda function inside the private VPC subnet can access the internet to call the external HTTP endpoint.
VPC-enabled Lambda functions lack internet access by default. To reach the internet, they must be deployed in private subnets with a route table rule pointing 0.0.0.0/0 traffic to a NAT Gateway located in a public subnet.
2
Address the database connection limit exhaustion by optimizing connection reuse.
Database connections are reused across sequential Lambda invocations on the same execution environment, drastically reducing the total concurrent connection count on the Aurora database.
Initializing connections inside the handler function creates a new PostgreSQL connection per invocation. Moving the initialization outside the handler ensures execution context reuse, meaning warm containers keep their database connections active and reuse them.

Key Concept

Configuring outbound VPC routing for Lambda and utilizing execution context reuse for resource connection management.
Question 1230Question →

A developer is configuring an AWS Lambda function to process events from an Amazon SQS queue. The queue is encrypted using an AWS Key Management Service (AWS KMS) customer managed key. The Lambda function's execution role has the following IAM policy attached:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"sqs:ReceiveMessage",
"sqs:DeleteMessage",
"sqs:GetQueueAttributes"
],
"Resource": "arn:aws:sqs:us-east-1:123456789012:QueueA"
}
]
}

The KMS customer managed key has the following key policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Allow administration of the key",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:user/KeyManager"
},
"Action": "kms:*",
"Resource": "*"
}
]
}

When the Lambda event source mapping attempts to poll the queue, the function is not triggered, and CloudWatch logs indicate that the Lambda service is unauthorized to decrypt the SQS messages.

Which of the following modifications is required to resolve this authorization failure?

Show answer & explanation

Answer: Add kms:Decrypt permissions targeting the KMS key to the Lambda execution role's policy, and update the KMS key policy to allow the Lambda execution role to perform kms:Decrypt operations.

Answer

Add kms:Decrypt permissions targeting the KMS key to the Lambda execution role's policy, and update the KMS key policy to allow the Lambda execution role to perform kms:Decrypt operations.
The correct action is to add the kms:Decrypt permission to both the Lambda execution role and the KMS key policy. This is because AWS KMS customer managed keys require explicit authorization in the key policy itself if they do not delegate permission management to the account root principal. Without the key policy explicitly permitting the Lambda execution role, and the execution role explicitly permitting the action, the decryption request will fail.

Step-by-Step Solution

1
Analyze the IAM execution role of the Lambda function and notice it lacks kms:Decrypt permissions on the customer managed key used to encrypt the SQS queue.
Identify that the Lambda function execution role cannot decrypt the messages fetched from SQS.
AWS SQS queues encrypted with customer managed keys require KMS decrypt permissions for the consumer principal.
2
Analyze the customer managed KMS key policy and notice it only grants administrative permissions to a specific user, without delegating authorization to the account root or the Lambda execution role.
Identify that adding kms:Decrypt only to the IAM role is insufficient; the key policy must also explicitly allow it.
KMS key policies are the primary authorization mechanism for KMS keys and must explicitly allow the caller unless delegation to the account root is configured.
3
Update both the Lambda execution role policy and the KMS key policy to permit the kms:Decrypt operation.
The Lambda event source mapping successfully decrypts SQS payloads and triggers the Lambda function.
Providing permissions at both the IAM identity layer and the KMS key resource layer satisfies AWS evaluation logic for customer managed KMS keys.

Key Concept

AWS KMS evaluation logic requires that customer managed keys explicitly grant permissions to the IAM caller in the key policy, in addition to permissions in the identity-based policy.
Question 1231Question →

A developer is troubleshooting a local Node.js application that uses the AWS SDK for JavaScript (v3) to query an Amazon DynamoDB table in a development environment. The developer has configured a local profile named 'dev-profile' in the ~/.aws/credentials file and specified the target region as 'us-west-2' in ~/.aws/config under the same profile. The developer runs the application after setting the AWS_PROFILE environment variable to 'dev-profile'. However, the application fails to connect to the development DynamoDB table, throwing access denied errors because it is attempting to connect to the us-east-1 region using credentials associated with a production account. Upon checking the environment, the developer discovers that the AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_REGION (set to us-east-1) environment variables are also set in the current shell session. Which two actions should the developer take to ensure the local application correctly uses the credentials and region defined in the 'dev-profile' profile?

Select all that apply

Show answer & explanation

Answer: Unset the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables in the local shell session.; Unset the AWS_REGION environment variable in the local shell session.

Answer

Unset the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables in the local shell session, and unset the AWS_REGION environment variable in the local shell session.
Unsetting the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables forces the AWS SDK credentials provider chain to fall back to the next source, which is the shared credentials file profile indicated by AWS_PROFILE. Similarly, unsetting the AWS_REGION environment variable allows the SDK to read the region property defined under the profile configuration in ~/.aws/config instead of being overridden by the environment.

Step-by-Step Solution

1
Analyze the AWS SDK credential provider chain resolution order.
The SDK checks environment variables (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) before checking shared credentials files.
Because credentials environment variables are set, they override the AWS_PROFILE setting, causing the application to use production credentials.
2
Analyze the AWS SDK region configuration resolution order.
The SDK checks the AWS_REGION environment variable before checking profile-specific configurations in ~/.aws/config.
Because the AWS_REGION environment variable is set to us-east-1, it overrides the us-west-2 setting specified in the dev-profile profile.
3
Unset the overriding environment variables in the active shell environment.
The environment variables are cleared, and the SDK successfully falls back to retrieving credentials and region configuration from the dev-profile configurations.
Clearing the environment variables enables the default provider chain to locate and use the profile settings correctly.

Key Concept

AWS SDK Credential and Configuration Resolution Precedence
Question 1232Question →

An organization requires a developer to build a secure configuration strategy for an application running on AWS Lambda. The application must connect to an Amazon RDS PostgreSQL database, which requires credentials to be rotated every 30 days. The application also needs to access non-sensitive service configuration parameters that change frequently. To minimize costs and management overhead, which of the following actions should the developer take? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and configure automatic rotation.; Store the non-sensitive service configuration parameters as standard parameters in AWS Systems Manager Parameter Store.

Answer

Store the database credentials in AWS Secrets Manager with automatic rotation configured, and store the non-sensitive service configuration parameters as standard parameters in AWS Systems Manager Parameter Store.
Storing database credentials in AWS Secrets Manager with automatic rotation configured satisfies the security requirement natively. Storing non-sensitive configuration parameters in AWS Systems Manager Parameter Store standard parameters satisfies the cost-effectiveness requirement, as standard parameters in Parameter Store do not incur any additional charges.

Step-by-Step Solution

1
Identify the storage requirements for the database credentials, which include secure storage and automatic rotation every 30 days.
Determine that AWS Secrets Manager is the appropriate service because it natively supports secret rotation for databases.
Systems Manager Parameter Store does not offer built-in automatic rotation.
2
Identify the storage requirements for the non-sensitive configuration parameters, which need to be updated frequently and stored cost-effectively.
Determine that Systems Manager Parameter Store standard parameters are the best choice since they are free.
Storing non-sensitive values in Secrets Manager incurs unnecessary costs.
3
Ensure secure SDK initialization inside the Lambda function without hardcoding credentials.
Determine that IAM roles should be used for authentication instead of passing hardcoded access keys in the code.
Hardcoding credentials in the SDK initialization violates security best practices.

Key Concept

Selecting the appropriate AWS service (Secrets Manager vs. Parameter Store) based on rotation requirements and cost-effectiveness, while adhering to secure credential management practices.
Question 1233Question →

A developer is configuring a new AWS CodeBuild project to build and package a serverless application. When attempting to start a build, the execution fails immediately with the error message: "Failed to assume the service role." The developer confirms that the associated IAM service role has the correct managed policies for accessing Amazon S3, Amazon CloudWatch Logs, and VPC resources. What should the developer modify to resolve this issue and allow the build to initiate?

Show answer & explanation

Answer: The trust relationship of the IAM service role, ensuring that the codebuild.amazonaws.com service principal is allowed to perform the sts:AssumeRole action.

Answer

The trust relationship of the IAM service role, ensuring that the codebuild.amazonaws.com service principal is allowed to perform the sts:AssumeRole action.
The correct option is the one specifying the trust relationship of the IAM service role. For AWS CodeBuild to execute a build, it must assume the specified IAM service role. This trust relationship must be defined in the role's trust policy, permitting the 'codebuild.amazonaws.com' service principal to call 'sts:AssumeRole'.

Step-by-Step Solution

1
Analyze the error message "Failed to assume the service role."
Identify that the issue is an authorization failure preventing CodeBuild from assuming the assigned IAM role at build start.
This isolates the issue to the trust boundary between the AWS CodeBuild service and the IAM service role.
2
Differentiate between IAM permissions policies and IAM trust policies.
Determine that while permissions policies govern what the role can do after it is assumed, the trust policy (trust relationship) governs which entities are permitted to assume the role.
This explains why verifying the attached managed policies did not solve the startup failure.
3
Configure the trust relationship to trust CodeBuild.
Add codebuild.amazonaws.com as a trusted service principal with the sts:AssumeRole action.
This allows CodeBuild to successfully assume the role and execute the container environment.

Key Concept

AWS CodeBuild Service Role Trust Policy
Question 1234Question →

A company is creating a customer portal where registered users can log in and view their monthly account statements. These statements are stored in a private Amazon S3 bucket. The developer needs to implement a solution that authenticates users, manages their accounts, and provides them with temporary, limited-privilege AWS credentials to download their statements directly from S3.

Which Amazon Cognito configuration should the developer use to meet these requirements?

Show answer & explanation

Answer: Configure a Cognito User Pool to handle user registration and login, and associate it with a Cognito Identity Pool to exchange the identity token for temporary AWS credentials that allow S3 access.

Answer

Configure a Cognito User Pool to handle user registration and login, and associate it with a Cognito Identity Pool to exchange the identity token for temporary AWS credentials that allow S3 access.
The correct solution uses a Cognito User Pool to handle registration and authentication (acting as the user directory and producing identity tokens) and exchanges these tokens via a Cognito Identity Pool to obtain temporary AWS credentials with permissions to retrieve files from the Amazon S3 bucket.

Step-by-Step Solution

1
Identify the authentication and user management component.
Amazon Cognito User Pool is selected to act as the user directory and handle user registration, login, and token generation.
User Pools are designed to manage user identities, profiles, and authentication flows.
2
Identify the authorization component for accessing AWS services.
Amazon Cognito Identity Pool is selected to act as the credential broker.
Identity Pools exchange identity tokens (JWTs) from a User Pool (or other identity providers) for temporary, limited-privilege AWS credentials.
3
Define IAM permissions for the authenticated role.
Associate the authenticated IAM role in the Identity Pool with an IAM policy that allows read access to the specific S3 bucket.
This grants the temporary credentials the necessary permission to access the private S3 objects.

Key Concept

Cognito User Pools handle authentication (user directory), while Cognito Identity Pools handle authorization (temporary AWS credentials for AWS services).
Question 1235Question →

A developer has a payment-processing application implemented as an AWS Lambda function. During peak hours, this function occasionally fails because it exceeds its configured timeout limit of 15 seconds. The developer needs to configure an Amazon CloudWatch Logs metric filter to count these timeout occurrences and trigger an alarm. The log group contains both application-generated JSON logs and standard Lambda platform logs. The Lambda platform writes the timeout log as a plain text string:

`2026-07-14T17:20:32.123Z 88a381cf-192a-4a6f-9988-51fcf5498bd6 Task timed out after 15.02 seconds`

Which of the following is the correct configuration or filter pattern for this metric filter?

Show answer & explanation

Answer: Set the filter pattern to "Task timed out" to match the plain text log line generated by the Lambda service.

Answer

Set the filter pattern to "Task timed out" to match the plain text log line generated by the Lambda service.
The correct answer is to use a simple text/phrase filter pattern. The Lambda platform writes timeout logs as plain text rather than JSON. An exact phrase match in double quotes like "Task timed out" will correctly scan the log group and match these events.

Step-by-Step Solution

1
Analyze the log format of the target event
The target event is a standard Lambda platform timeout log, which is a plain text string: `2026-07-14T17:20:32.123Z 88a381cf-192a-4a6f-9988-51fcf5498bd6 Task timed out after 15.02 seconds`.
Understanding the format (JSON vs. plain text) is critical to selecting the correct CloudWatch Logs filter pattern type.
2
Determine if application-level handling is possible
Since execution timeouts are enforced by the Lambda service, the execution context is immediately halted. Application code cannot catch the timeout to write a custom JSON log.
This rules out relying on custom JSON logs for timeout monitoring.
3
Select the correct filter pattern syntax for plain text logs
Since the log is plain text, JSON filter syntax cannot be used. A simple phrase match pattern like "Task timed out" must be used to match the exact substring.
Using double quotes ensures an exact, case-sensitive phrase match for the plain text log line.

Key Concept

Monitoring and Analyzing Logs with Amazon CloudWatch
Estimated Time:2m 0s
Question 1236Question →

An AWS Lambda function is configured to run inside private subnets of a custom VPC to retrieve records from an Amazon RDS PostgreSQL database. After retrieving the records, the function attempts to upload a compiled report to an Amazon S3 bucket. The function successfully connects to the database but consistently times out when attempting to write to the S3 bucket. The VPC has no NAT Gateway or internet connectivity. Which action should the developer take to resolve this execution issue?

Show answer & explanation

Answer: Create a Gateway VPC Endpoint for Amazon S3 and associate it with the route table of the Lambda function's subnets.

Answer

Create a Gateway VPC Endpoint for Amazon S3 and associate it with the route table of the Lambda function's subnets.
The correct answer is to create a Gateway VPC Endpoint for Amazon S3. When a Lambda function runs inside a custom VPC without internet egress (no NAT Gateway), it can communicate locally but cannot reach public AWS endpoints. A Gateway VPC Endpoint establishes private connectivity to Amazon S3 directly from the private subnet's route table.

Step-by-Step Solution

1
Analyze execution symptoms
Database access succeeds, but S3 upload hangs and times out.
Since database access works, the function's VPC configuration is correct for internal routing, but the lack of public access blocks direct S3 uploads.
2
Check VPC egress design
Identify that the VPC has no NAT Gateway or public internet route.
S3 is a public service, so requests to it from a private VPC subnet require either NAT egress or a direct VPC endpoint.
3
Configure a Gateway VPC Endpoint
A Gateway VPC Endpoint for S3 is provisioned and linked to the subnet's route table.
Gateway endpoints allow secure, private routing of S3 traffic without routing traffic over the public internet.

Key Concept

Debugging network routing for Lambda functions configured inside a custom VPC
Question 1237Question →

A developer is implementing a custom Lambda authorizer for Amazon API Gateway. The authorizer must validate incoming JSON Web Tokens (JWT) using a secret client key that is updated manually every six months. The API receives millions of requests daily, and the developer wants to minimize AWS service costs associated with secret retrieval while maintaining security. Which strategy should the developer use?

Show answer & explanation

Answer: Store the secret client key as a SecureString parameter in AWS Systems Manager Parameter Store. Retrieve the parameter outside the Lambda handler function to cache it, and enable caching on the API Gateway authorizer.

Answer

Store the secret client key as a SecureString parameter in AWS Systems Manager Parameter Store, retrieve it outside the Lambda handler for caching, and enable authorizer caching in API Gateway.
Storing the key as a SecureString in Systems Manager Parameter Store satisfies the security requirement by encrypting the secret at rest with AWS KMS. Since the key is rotated manually every six months, the automatic rotation features of Secrets Manager are not needed. Choosing Parameter Store is highly cost-effective because standard parameters do not incur API request fees. Furthermore, caching the secret outside the Lambda handler ensures it is reused across warm container invocations, and enabling authorizer caching in API Gateway prevents invoking the Lambda function for every incoming client request.

Step-by-Step Solution

1
Evaluate the encryption and rotation requirements for the secret client key.
The key must be stored securely with encryption, but it is rotated manually every six months rather than requiring automatic rotation.
This determines whether the advanced automatic rotation features of AWS Secrets Manager are required.
2
Evaluate the scale and cost implications of the AWS services under a high-volume request load.
Secrets Manager charges per API call, which is expensive at millions of requests per day. Systems Manager Parameter Store standard parameters provide SecureString encryption using AWS KMS keys without per-request charges.
This identifies Parameter Store as the most cost-effective option for manually rotated secrets at scale.
3
Optimize key retrieval performance and rate limiting.
Retrieve the Parameter Store value outside the Lambda handler to cache the value across execution contexts, and enable caching on the API Gateway authorizer.
This reduces latency, prevents API rate-limiting issues on Parameter Store, and minimizes Lambda executions.

Key Concept

Parameter Store vs Secrets Manager cost and features trade-offs
Estimated Time:1m 30s
Question 1238Question →

A developer is troubleshooting an application where messages are being processed multiple times from an Amazon SQS queue. The developer suspects that the consumer AWS Lambda function is timing out during execution, causing messages to return to the queue. The developer wants to monitor and analyze these timeouts using Amazon CloudWatch Logs.

Which of the following actions should the developer take to correctly identify and track these execution timeouts? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a CloudWatch metric filter on the Lambda function's log group using the filter pattern "\"Task timed out\"" to increment a custom metric.; Use Amazon CloudWatch Logs Insights to run a query with the command "filter @message like /Task timed out/" on the Lambda function's log group.

Answer

Create a CloudWatch metric filter with the quoted pattern "Task timed out" to count occurrences of timeouts, and use CloudWatch Logs Insights to query the log group with a filter mapping the timeout phrase.
The correct options involve creating a CloudWatch metric filter using the exact phrase search pattern enclosed in double quotes (which allows tracking the exact phrase written by the Lambda service), and using CloudWatch Logs Insights with a string match filter to query these plain text timeout logs.

Step-by-Step Solution

1
Understand how AWS Lambda reports execution timeouts in CloudWatch Logs.
Identify that the Lambda service appends a plain text log line containing 'Task timed out after X seconds' when a function times out.
Since the function is abruptly terminated, the application itself cannot catch the timeout, making CloudWatch Logs analysis the only direct way to verify timeouts.
2
Select the correct pattern matching syntax for CloudWatch metric filters.
Use double quotes around the phrase "Task timed out" to perform an exact match query on the plain text log events.
Unquoted terms act as an OR condition (Task OR timed OR out), which will match other log lines and trigger false alarms.
3
Use CloudWatch Logs Insights to query historical logs.
Write a query utilizing the 'like' operator to search log streams for the timeout message.
Logs Insights allows rapid searching and analysis of log events without having to manually read through individual log streams.

Key Concept

Monitoring plain text Lambda runtime logs in CloudWatch using exact phrase metric filters and Logs Insights queries.
Question 1239Question →

An accounting application named LedgerSync records daily business transactions into an Amazon DynamoDB table. The table is configured with a partition key of `TransactionDate` (formatted as `YYYY-MM-DD`) and a sort key of `TransactionId`. The table is provisioned with 1,0001,000 Write Capacity Units (WCUs). During end-of-month reconciliation, batch processing writes hundreds of thousands of transactions for the same calendar date within a 10-minute window. Even though the total write request rate is well below the table's overall provisioned 1,0001,000 WCUs, the application repeatedly encounters `ProvisionedThroughputExceededException` errors. Which of the following approaches is the most effective way to resolve this throughput issue while maintaining cost efficiency?

Show answer & explanation

Answer: Redesign the partition key schema by appending a calculated or random suffix to the date, distributing the write load across multiple logical partitions, and adjust queries to target those partitioned keys.

Answer

Redesign the partition key schema by appending a calculated or random suffix to the date, distributing the write load across multiple logical partitions, and adjust queries to target those partitioned keys.
The correct answer is correct because DynamoDB enforces a strict limit of 1,0001,000 Write Capacity Units (WCUs) per partition. When all incoming writes target a single partition key value (such as the same `TransactionDate`), they are directed to the same partition, exceeding its throughput limit and triggering `ProvisionedThroughputExceededException`. Appending a synthetic suffix (such as a random or calculated number) to the partition key distributes the write load across multiple logical keys and physical partitions, raising the effective throughput limit for that date while keeping the table cost-effective.

Step-by-Step Solution

1
Analyze the workload and table schema.
Identify that the partition key is `TransactionDate`. During reconciliation, all writes for a specific date target a single partition key value (e.g., '2026-06-30').
This concentrates all writes into a single logical partition key, creating a hot partition key.
2
Evaluate DynamoDB partition limits against the workload requirements.
Realize that a single partition key has a maximum throughput limitation of 1,0001,000 WCUs (or 1,0001,000 writes/sec). Total table capacity does not bypass this individual key limit.
Knowing this limit explains why provisioned throughput exceeded errors occur despite having sufficient overall capacity.
3
Apply a sharding strategy (adding a synthetic suffix) to partition keys.
Append a suffix (e.g., a random number between 11 and 1010) to `TransactionDate` before saving, yielding keys like `2026-06-30_1` to `2026-06-30_10`.
This distributes the writes across multiple logical partitions, allowing up to 10×1,000=10,00010 \times 1,000 = 10,000 WCUs for that day's data.

Key Concept

Mitigating DynamoDB hot partition key bottlenecks via write sharding (adding a synthetic suffix).
Estimated Time:2m 0s
Question 1240Question →

A gaming application uses an Amazon DynamoDB table to store real-time player profiles. During a global tournament, the application experiences a massive spike in read traffic, resulting in `ProvisionedThroughputExceededException` errors due to hot partitions on popular player profiles. The development team decides to deploy an Amazon DynamoDB Accelerator (DAX) cluster to resolve the throttling and improve read latency.

Which actions must the developers take to ensure the application successfully utilizes the DAX cluster to resolve the read throttling? (Select two.)

Select all that apply

Show answer & explanation

Answer: Update the application code to initialize and use the Amazon DynamoDB Accelerator (DAX) client SDK instead of the standard DynamoDB client.; Configure the read requests to use eventually consistent reads so that the data is served from the DAX item cache.

Answer

To successfully optimize read performance using DAX, the developers must use the DAX SDK client instead of the standard DynamoDB client, and configure read operations to use eventually consistent reads so that the results can be retrieved from the cache rather than bypassing it.
To successfully route and cache read operations through DAX, the standard DynamoDB client must be replaced with the DAX SDK client. In addition, the read requests must be configured as eventually consistent. Strongly consistent reads bypass the DAX cache and hit the DynamoDB table directly, which would fail to alleviate the hot partition throttling.

Step-by-Step Solution

1
Analyze the nature of the throttling error.
The error is caused by hot partitions on specific player profiles due to localized high read volume.
Identifying the root cause ensures that the caching solution is designed to offload reads from the hot partitions of the DynamoDB table.
2
Select the correct SDK client for DAX.
Initialize the DAX-specific client inside the application code.
DAX requires a custom SDK client to intercept calls and route them to the DAX cluster nodes instead of DynamoDB directly.
3
Adjust read consistency settings.
Modify DynamoDB read requests in the application to use eventually consistent reads.
DAX does not serve strongly consistent reads from its cache; strongly consistent reads are passed directly to DynamoDB, which would continue to throttle the hot partition.

Key Concept

DAX Caching Requirements and SDK Client
PreviousPage 62 / 78Next
All practice questions — AWS Certified Developer - Associate | Examkin