All practice questions

1542 questions

All types1,542 Multiple choice782 Multiple select746 Ordering14

A developer is updating a serverless API backend running on AWS Lambda. The deployment must minimize user-facing impact by routing $10\%$ of the incoming traffic to the new Lambda version for a test window of $10$ minutes, while monitoring a CloudWatch alarm. If the alarm remains green, the remaining $90\%$ of traffic must shift to the new version immediately. If the alarm is triggered, the deployment must revert to the original version. Which AWS CodeDeploy configuration meets these requirements?

CodeDeployDefault.LambdaLinear10PercentEvery10Minutes

CodeDeployDefault.LambdaCanary10Percent10Minutes

CodeDeployDefault.LambdaCanary10Percent15Minutes

CodeDeployDefault.LambdaAllAtOnce

Show answer & explanation

Answer: CodeDeployDefault.LambdaCanary10Percent10Minutes

Answer

CodeDeployDefault.LambdaCanary10Percent10Minutes

The configuration CodeDeployDefault.LambdaCanary10Percent10Minutes routes 10% of traffic to the new Lambda version, waits 10 minutes, and then immediately routes the remaining 90% if no alarms are triggered. This perfectly aligns with the requirement for a 10-minute test window at 10% traffic followed by an immediate shift of the remaining traffic.

Step-by-Step Solution

Analyze the traffic shifting requirement

The deployment requires routing 10% of traffic initially, waiting for a specific test duration, and then routing the remaining 90% immediately.

This behavior corresponds to a Canary deployment strategy rather than a Linear or All-At-Once deployment strategy.

Identify the required test window duration

The test window duration is specified as 10 minutes.

This requires a configuration that specifies a 10-minute wait time.

Select the matching pre-defined AWS CodeDeploy configuration

The configuration CodeDeployDefault.LambdaCanary10Percent10Minutes meets both the 10% initial shift and 10-minute duration criteria.

CodeDeployDefault.LambdaCanary10Percent10Minutes routes 10% of traffic first and shifts the remaining 90% after 10 minutes if health checks pass.

Key Concept

AWS CodeDeploy Canary vs Linear configurations for serverless deployments

Estimated Time:1m 30s

Question 1242Question →

A developer is running a Python application locally using the AWS SDK for Python (Boto3) to retrieve objects from an Amazon S3 bucket.

The developer's local terminal has the following environment variables configured:

bash
export AWS_ACCESS_KEY_ID=AKIA111111111EXAMPLE
export AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
export AWS_PROFILE=staging

The shared AWS credentials file (`~/.aws/credentials`) contains:

ini
[staging]
aws_access_key_id = AKIA222222222EXAMPLE
aws_secret_access_key = userSecretKeyStagingExample

The application code is initialized as follows:

python
import boto3
s3 = boto3.client('s3')
response = s3.list_objects_v2(Bucket='my-staging-bucket')

When the developer runs the application, it fails with an `AccessDenied` error. The IAM user represented by `AKIA111111111EXAMPLE` does not have access to the S3 bucket, but the IAM user in the `staging` profile (`AKIA222222222EXAMPLE`) has full S3 permissions.

What is the reason for this failure, and how should the developer resolve it?

The default credential provider chain ignores environment variables when a profile is specified. The developer must modify the application code to hardcode the credentials by passing the aws_access_key_id and aws_secret_access_key parameters directly to the client constructor.

The staging profile credentials cannot be used locally because the IAM user has not configured a trust policy that allows the local workstation's IP address. The developer must add a trust policy to the IAM user permitting access from the local public IP.

The default credential provider chain evaluates the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables before evaluating AWS_PROFILE. The developer should unset the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables in the terminal.

The SDK requires local developer credentials to be retrieved dynamically from Systems Manager Parameter Store with automatic rotation configured. The developer must migrate the local credentials to Parameter Store and fetch them in the code.

Show answer & explanation

Answer: The default credential provider chain evaluates the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables before evaluating AWS_PROFILE. The developer should unset the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables in the terminal.

Answer

The correct answer explains that the AWS SDK's default credential provider chain resolves explicit credentials set in environment variables (such as AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) prior to checking the profile configuration via the AWS_PROFILE environment variable. Unsetting the direct credential environment variables allows the SDK to process the rest of the provider chain, falling back to the credentials file to load the staging profile's authorized keys.

Step-by-Step Solution

Analyze the SDK's credential provider chain precedence.

The AWS SDK checks credentials in a specific order: first direct client parameters, then environment variables (AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY), and then the shared credentials file using the profile set in AWS_PROFILE.

To identify which credentials the Boto3 client is actually loading at runtime.

Identify the conflict between active environment variables.

Because AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are set, the SDK uses them immediately and never looks at the staging profile specified by AWS_PROFILE.

To explain why the unauthorized credentials (AKIA111111111EXAMPLE) are being used instead of the staging credentials.

Remove the overriding environment variables.

Unsetting AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY in the terminal forces the credential provider chain to fall back to reading ~/.aws/credentials for the 'staging' profile.

To resolve the credential conflict and allow the application to authenticate using the correct credentials.

Key Concept

AWS SDK Default Credential Provider Chain Precedence

Estimated Time:1m 30s

Question 1243Question →

A developer is setting up an AWS CodeBuild project for a microservice located in a subdirectory (`services/order-service`) of a monorepo. The build process needs to run tests that require a database password stored in AWS Secrets Manager, and it must use a custom build specification file located at `services/order-service/buildspec.yml`. During the initial build run, the build fails immediately because the build specification file cannot be found, and the developer realizes that the application also lacks permission to fetch the database password.

Which combination of actions must the developer take to resolve these issues? (Select two.)

Select all that apply

Configure the buildspec file path in the CodeBuild project settings to point to services/order-service/buildspec.yml.

Add the secretsmanager:GetSecretValue permission to the IAM service role associated with the CodeBuild project.

Move the buildspec file to the root of the repository and rename it to buildspec-order.yml without updating the project settings.

Update the trust policy of the CodeBuild service role to allow the Secrets Manager service (secretsmanager.amazonaws.com) to assume the role.

Retrieve the database password in the buildspec env block using the parameter-store reference type.

Show answer & explanation

Answer: Configure the buildspec file path in the CodeBuild project settings to point to services/order-service/buildspec.yml.; Add the secretsmanager:GetSecretValue permission to the IAM service role associated with the CodeBuild project.

Answer

Configure the buildspec file path in the CodeBuild project settings to point to services/order-service/buildspec.yml, and add the secretsmanager:GetSecretValue permission to the IAM service role associated with the CodeBuild project.

To fix the buildspec resolution issue, the developer must update the CodeBuild project settings to specify the custom path services/order-service/buildspec.yml, since CodeBuild expects buildspec.yml in the repository root by default. To resolve the permission issue, the developer must add the secretsmanager:GetSecretValue permission to the IAM service role associated with the CodeBuild project so that it is authorized to retrieve the database credentials.

Step-by-Step Solution

Configure the CodeBuild project settings with the custom buildspec location.

CodeBuild searches for the buildspec at services/order-service/buildspec.yml instead of the default root path, successfully finding and executing it.

By default, CodeBuild expects the buildspec file to be named buildspec.yml and located in the root of the repository source directory. Any other configuration must be specified in the project settings.

Update the IAM service role permissions policy for the CodeBuild project.

The project gains permission to fetch the secret from Secrets Manager.

CodeBuild assumes a service role during execution. This role must have an identity-based policy allowing secretsmanager:GetSecretValue in order to read the credentials.

Key Concept

AWS CodeBuild buildspec configuration and IAM service role permissions.

Question 1244Question →

A developer is building an enterprise web application. The application must authenticate corporate users using an external SAML 2.0 Identity Provider (IdP) and provide them with access to two resources: a secure REST API hosted on Amazon API Gateway, and a private Amazon S3 bucket for uploading reports directly from the client.

Which TWO configurations are required to meet these requirements? (Select TWO.)

Select all that apply

Configure an Amazon Cognito User Pool with the external SAML Identity Provider (IdP) to handle user authentication, and set up an API Gateway Cognito Authorizer using the User Pool's tokens.

Configure an Amazon Cognito Identity Pool that uses the User Pool as an identity provider, and assign an authenticated IAM role with write permissions to the Amazon S3 bucket.

Configure an API Gateway Lambda Authorizer to validate the SAML token and generate temporary IAM credentials to allow the client to upload files to the Amazon S3 bucket.

Configure the Amazon Cognito User Pool to directly issue temporary AWS credentials to the client application upon successful SAML federation.

Configure a Cognito User Pool resource server with custom OAuth 2.0 scopes to authorize direct file uploads to the Amazon S3 bucket.

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool with the external SAML Identity Provider (IdP) to handle user authentication, and set up an API Gateway Cognito Authorizer using the User Pool's tokens.; Configure an Amazon Cognito Identity Pool that uses the User Pool as an identity provider, and assign an authenticated IAM role with write permissions to the Amazon S3 bucket.

Answer

Configure an Amazon Cognito User Pool with the external SAML Identity Provider (IdP) to handle user authentication, and set up an API Gateway Cognito Authorizer using the User Pool's tokens. In addition, configure an Amazon Cognito Identity Pool that uses the User Pool as an identity provider, and assign an authenticated IAM role with write permissions to the Amazon S3 bucket.

The correct architecture uses an Amazon Cognito User Pool to federate authentication with the SAML Identity Provider (IdP) and secures the API Gateway using a Cognito Authorizer with the generated JWT. It also uses an Amazon Cognito Identity Pool (Federated Identities) to exchange the User Pool JWT for temporary AWS credentials defined by an authenticated IAM role, enabling the client application to upload reports directly to Amazon S3.

Step-by-Step Solution

Federate SAML 2.0 IdP with Cognito User Pool

Users can authenticate against the corporate directory, and Cognito User Pool issues ID and access JWT tokens to the client.

This establishes user identity and generates tokens to verify the user's session.

Secure the API Gateway REST API with a Cognito User Pool Authorizer

API Gateway automatically validates the Cognito JWT token on incoming requests.

This verifies that the caller has been authenticated by the User Pool before forwarding the request to downstream services.

Configure a Cognito Identity Pool linked to the User Pool

The Identity Pool validates the User Pool ID token and maps the authenticated user to an IAM role.

This enables the exchange of the Cognito JWT for temporary, limited-privilege AWS credentials (access key, secret key, session token) which are required to write objects directly to the Amazon S3 bucket.

Key Concept

Integration of Cognito User Pools for user directory/federation and Cognito Identity Pools for temporary AWS credential delegation.

Question 1245Question →

A developer is troubleshooting an AWS Lambda function that is configured to access an Amazon RDS DB instance inside a private subnet of a custom VPC. The function also needs to call an external billing API over the public internet. During testing, the developer observes two issues: the function cannot establish a connection to the external billing API, and the database experiences connection exhaustion due to a high volume of database connections being created during peak traffic. Which two actions should the developer take to resolve these configuration and performance issues? (Select TWO.)

Select all that apply

Configure a NAT Gateway in a public subnet of the VPC and add a route pointing to it in the private subnet's route table.

Initialize the database connection client outside of the Lambda handler function to reuse connections across execution contexts.

Deploy the Lambda function in a public subnet and enable the public IP assignment configuration on the function.

Create a Gateway VPC Endpoint for the external billing API and associate it with the private subnet's route table.

Add code inside the Lambda handler to explicitly close the connection and force execution context recycling after every invocation.

Show answer & explanation

Answer: Configure a NAT Gateway in a public subnet of the VPC and add a route pointing to it in the private subnet's route table.; Initialize the database connection client outside of the Lambda handler function to reuse connections across execution contexts.

Answer

Configure a NAT Gateway in a public subnet of the VPC, add a route pointing to it in the private subnet's route table, and initialize the database connection client outside of the Lambda handler function.

To enable internet access for a Lambda function in a private VPC subnet, a NAT Gateway must be set up in a public subnet, and the private subnet's route table must route traffic bound for the internet to the NAT Gateway. Additionally, database connection clients should be declared globally outside the handler function to allow reuse of existing connections across subsequent warm executions of the same Lambda container instance.

Step-by-Step Solution

Analyze the network configuration of the Lambda function.

The Lambda function is inside a private subnet and cannot access the public internet directly.

To connect to the external billing API, the private subnet requires a route to a NAT Gateway located in a public subnet.

Analyze the database connection lifecycle within the Lambda function code.

Database connections are currently created inside the handler function on every invocation.

Declaring the database client globally (outside the handler) allows the connection to be reused across multiple warm execution context invocations, mitigating database connection exhaustion.

Key Concept

VPC Lambda internet access configurations and execution context reuse strategies.

Question 1246Question →

A development team manages their application infrastructure using an AWS CloudFormation stack. A developer needs to update the stack to change the instance type of an Amazon EC2 instance. However, drift detection reveals that the security group attached to the EC2 instance was manually modified out-of-band in the AWS Management Console to allow traffic on port $8080$ . In addition, the developer needs to reference a database password that must be automatically rotated.

Which combination of steps should the developer take to resolve the drift and retrieve the password securely and cost-effectively? (Select TWO.)

Select all that apply

Update the CloudFormation template to match the drifted security group configuration (allowing port

8080

) before proceeding with the stack update.

Use a dynamic reference in the CloudFormation template to retrieve the database password from AWS Secrets Manager.

Perform the stack update with the drift synchronization option enabled to automatically rewrite the CloudFormation template based on the live resource configuration.

Use a dynamic reference in the CloudFormation template to retrieve the database password from AWS Systems Manager Parameter Store.

Initiate a stack update rollback using the AWS Command Line Interface (AWS CLI) to revert the drifted security group rules to their template-defined values.

Show answer & explanation

Answer: Update the CloudFormation template to match the drifted security group configuration (allowing port $8080$ ) before proceeding with the stack update.; Use a dynamic reference in the CloudFormation template to retrieve the database password from AWS Secrets Manager.

Answer

Update the CloudFormation template to match the drifted security group configuration before proceeding with the stack update, and use a dynamic reference in the CloudFormation template to retrieve the database password from AWS Secrets Manager.

To resolve the configuration drift where port

8080

was manually allowed, the developer must update the template to match this state before performing subsequent updates. Additionally, retrieving an automatically rotated database credential is best achieved by storing the credential in AWS Secrets Manager and accessing it using a dynamic reference in the template.

Step-by-Step Solution

Analyze the drift detection results for the security group resource.

Identify that port

8080

was manually allowed out-of-band.

Before performing stack updates, drift must be resolved to prevent update failures or configuration overwrites.

Modify the CloudFormation template to include the port

8080

configuration in the security group resource definition.

The template now matches the live resource configuration.

This aligns the template with the drifted state, resolving the drift status.

Implement a dynamic reference using the Secrets Manager resolver pattern in the template to access the database password.

The template references the secret securely without hardcoding it.

Secrets Manager provides native support for automated credential rotation, unlike Systems Manager Parameter Store.

Key Concept

CloudFormation drift resolution and dynamic references for rotated secrets

Question 1247Question →

A developer is troubleshooting a serverless application where an Amazon API Gateway stage triggers an AWS Lambda function written in Python. The function processes incoming requests and retrieves secrets from AWS Secrets Manager using the `boto3` library. Active tracing is enabled on both the API Gateway stage and the Lambda function. However, the AWS X-Ray trace map shows the segments for API Gateway and the Lambda function, but does not display any segments for the calls to AWS Secrets Manager. How should the developer resolve this issue to ensure the Secrets Manager calls are visible in the trace map?

Initialize the Secrets Manager client by hardcoding temporary AWS access keys and session tokens in the `boto3.client` constructor.

Increase the Lambda function's execution timeout to ensure the background thread of the X-Ray SDK has sufficient time to flush the tracing segments.

Import the AWS X-Ray SDK for Python and call `patch_all()` or `patch(['boto3'])` before initializing the Secrets Manager client.

Change the API Gateway integration type to a custom integration and use a mapping template to inject the tracing header into the Lambda event payload.

Show answer & explanation

Answer: Import the AWS X-Ray SDK for Python and call `patch_all()` or `patch(['boto3'])` before initializing the Secrets Manager client.

Answer

Import the AWS X-Ray SDK for Python and call `patch_all()` or `patch(['boto3'])` before initializing the Secrets Manager client.

To trace downstream calls made by the AWS SDK (such as `boto3` in Python) within an AWS Lambda function, the developer must instrument the SDK. Using the AWS X-Ray SDK for Python to patch `boto3` (using `patch_all()` or `patch(['boto3'])`) intercepts all downstream calls to AWS services, records the segment details, and propagates the tracing context.

Step-by-Step Solution

Analyze the missing segments in the X-Ray trace map.

The trace map only displays the nodes for API Gateway and the Lambda function, but is missing the node for AWS Secrets Manager.

Although active tracing is enabled on Lambda, the AWS SDK client inside the function code must be explicitly instrumented or patched to generate downstream trace segments.

Use the AWS X-Ray SDK for Python to patch the boto3 library.

The boto3 library is dynamically patched at startup, wrapping all client operations with X-Ray interceptors.

Patching ensures that all subsequent AWS SDK calls created via boto3 automatically capture metadata and create subsegments linked to the parent execution context.

Redeploy the function and execute a test request.

The updated trace map shows the complete end-to-end flow, including the AWS Secrets Manager calls.

The instrumented boto3 client successfully transmits the subsegment data to the X-Ray daemon, which is then sent to AWS X-Ray.

Key Concept

AWS SDK instrumentation using the AWS X-Ray SDK for Python to trace downstream calls.

Question 1248Question →

A developer is configuring a build project in AWS CodeBuild to package an application. The build process requires retrieving a non-sensitive database port number that rarely changes, and a database password that must be automatically rotated every 30 days. To optimize for cost, operational efficiency, and security, which configuration should the developer implement?

Store the database port in AWS Systems Manager Parameter Store and the database password in AWS Secrets Manager, and retrieve them using the parameter-store and secrets-manager blocks under the env section of the buildspec.yml file.

Store both the database port and the database password in AWS Secrets Manager, and retrieve them using the secrets-manager block under the env section of the buildspec.yml file.

Store both the database port and the database password in AWS Systems Manager Parameter Store, and retrieve them using the parameter-store block under the env section of the buildspec.yml file.

Store the database port in AWS Systems Manager Parameter Store and the database password in AWS Secrets Manager, and add the required read permissions to the trust relationship policy document of the AWS CodeBuild service role.

Show answer & explanation

Answer: Store the database port in AWS Systems Manager Parameter Store and the database password in AWS Secrets Manager, and retrieve them using the parameter-store and secrets-manager blocks under the env section of the buildspec.yml file.

Answer

Storing the port in Parameter Store is cost-effective because standard parameters are free. Storing the password in Secrets Manager meets the security requirement for automatic rotation. Referencing them in the parameter-store and secrets-manager blocks of the env section in the root buildspec.yml file allows CodeBuild to automatically fetch the values and inject them as environment variables during the build execution.

Step-by-Step Solution

Identify the security and operational requirements of the two variables.

The database port is non-sensitive and static, while the database password is sensitive and requires automatic rotation every 30 days.

This classification determines the most cost-effective and secure AWS service to store each parameter.

Select the appropriate storage service for each parameter type.

AWS Systems Manager Parameter Store is chosen for the database port to avoid costs. AWS Secrets Manager is chosen for the database password to support automatic rotation.

Parameter Store does not natively support rotation of secrets, while Secrets Manager is expensive for non-sensitive parameters.

Configure the retrieval mechanism in the build specification.

Reference the variables under their respective blocks (parameter-store and secrets-manager) in the env section of the root buildspec.yml file.

AWS CodeBuild natively supports retrieving values from both services during the build lifecycle when configured in the buildspec.

Key Concept

Retrieving configuration data and secrets in AWS CodeBuild using AWS Systems Manager Parameter Store and AWS Secrets Manager

Estimated Time:1m 30s

Question 1249Question →

A developer is designing a high-traffic web application that will be deployed on Amazon ECS. The application requires a highly available session state store that can handle complex data structures, such as lists and sets, with sub-millisecond latency. The session data must be replicated across multiple Availability Zones, and any session that is inactive for more than 2 hours must be automatically removed.

Which TWO solutions or configurations should the developer implement to meet these requirements?

Select all that apply

Use Amazon ElastiCache for Redis with a multi-node cluster configuration across multiple Availability Zones.

Use the Redis EXPIRE command to set a Time to Live (TTL) of 7200 seconds on each session key when it is created or updated.

Use Amazon Cognito Identity Pools to store and synchronize the user session state data directly across the ECS tasks.

Store the session states in an Amazon DynamoDB table and implement a scheduled AWS Lambda function that performs a Scan operation every hour to locate and delete expired sessions.

Store the session states in Amazon Systems Manager Parameter Store and configure Parameter Store policies to delete the parameters after 2 hours.

Show answer & explanation

Answer: Use Amazon ElastiCache for Redis with a multi-node cluster configuration across multiple Availability Zones.; Use the Redis EXPIRE command to set a Time to Live (TTL) of 7200 seconds on each session key when it is created or updated.

Answer

Use Amazon ElastiCache for Redis with a multi-node cluster configuration across multiple Availability Zones, and use the Redis EXPIRE command to set a Time to Live (TTL) of 7200 seconds on each session key.

The developer should use Amazon ElastiCache for Redis and the Redis EXPIRE command. Amazon ElastiCache for Redis is an in-memory database that natively supports complex data structures (like lists and sets), features multi-AZ replication for high availability, and provides sub-millisecond latencies. Setting a TTL of 7200 seconds (2 hours) using the Redis EXPIRE command handles the automatic expiration of inactive sessions cleanly and natively within the cache.

Step-by-Step Solution

Evaluate key data store requirements: sub-millisecond latency, replication across multiple Availability Zones, and support for complex data structures like lists and sets.

Identify that Amazon ElastiCache for Redis meets all these criteria, whereas Memcached lacks native multi-AZ replication for session states, and DynamoDB is not suited for sub-millisecond caching without DAX.

Redis is a high-performance in-memory data store that natively supports replication, clustering, and rich data structures.

Address the session expiration requirement of 2 hours (7200 seconds) of inactivity.

Determine that setting a Time to Live (TTL) using the Redis EXPIRE command is the optimal, low-overhead way to automatically clean up expired keys.

The Redis EXPIRE command ensures that keys are automatically evicted from memory after the specified duration, freeing up resources without application-side polling.

Key Concept

Selecting ElastiCache for Redis for high-availability session caching with complex data structures and managing expiration via TTL.

Question 1250Question →

A developer is creating an AWS CloudFormation template to deploy a web application. The application requires access to two configuration values:

1. A database connection password that must support automatic rotation every 30 days.
2. A public API endpoint URL for a third-party service that is non-sensitive and updated infrequently.

To follow security best practices and optimize costs, how should the developer store and reference these values in the CloudFormation template?

Store both the database password and the API endpoint URL in AWS Secrets Manager, and reference both using Secrets Manager dynamic references.

Store both the database password and the API endpoint URL in AWS Systems Manager Parameter Store as SecureString parameters, and reference both using Parameter Store dynamic references.

Store the database password in AWS Secrets Manager and reference it using a Secrets Manager dynamic reference. Store the API endpoint URL in AWS Systems Manager Parameter Store as a String parameter and reference it using a Parameter Store dynamic reference.

Hardcode both the database password and the API endpoint URL as default values in the template's Parameters section, and update them manually in the AWS Console after deployment.

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and reference it using a Secrets Manager dynamic reference. Store the API endpoint URL in AWS Systems Manager Parameter Store as a String parameter and reference it using a Parameter Store dynamic reference.

Answer

Store the database password in AWS Secrets Manager and reference it using a Secrets Manager dynamic reference, and store the API endpoint URL in AWS Systems Manager Parameter Store as a String parameter and reference it using a Parameter Store dynamic reference.

Storing the database password in AWS Secrets Manager and referencing it via a dynamic reference satisfies the security and automatic rotation requirements. Storing the non-sensitive public API endpoint URL in Systems Manager Parameter Store standard parameters satisfies the cost-efficiency constraint because Parameter Store standard parameters are free, and using a dynamic reference allows secure integration without exposure.

Step-by-Step Solution

Determine the storage requirements for the database password.

The password requires automatic rotation every 30 days, which points to AWS Secrets Manager as the appropriate service because it integrates with AWS Lambda for automated credential rotation.

Systems Manager Parameter Store does not offer native automatic rotation for secrets.

Determine the storage requirements for the non-sensitive public API endpoint.

The endpoint URL is non-sensitive and updated infrequently, making Systems Manager Parameter Store standard parameters the most cost-effective choice since they are free.

Using Secrets Manager for non-sensitive data incurs unnecessary monthly costs.

Identify the proper CloudFormation integration method.

Use dynamic references to resolve the values dynamically at runtime (e.g., {{resolve:secretsmanager:...}} and {{resolve:ssm:...}}).

Dynamic references allow CloudFormation to securely retrieve external values during deployment without hardcoding them in the template.

Key Concept

Selecting and referencing the appropriate parameter store or secrets service in CloudFormation based on security, rotation, and cost requirements.

Estimated Time:1m 30s

Question 1251Question →

VoltMetric is a utility analytics platform that processes electricity usage metrics from millions of smart meters. The application writes high-frequency meter readings to an Amazon DynamoDB table configured with provisioned write throughput. The table uses `ZipCode` as the partition key and `Timestamp` as the sort key. During a heatwave, the application experiences a surge in writes from a highly populated urban zip code, leading to numerous `ProvisionedThroughputExceededException` errors in the ingest client logs. An analysis reveals that the total table write capacity is underutilized, but requests to this specific zip code are being throttled.

Which TWO actions should a developer take to resolve the write throttling and optimize the table's performance? (Select TWO.)

Select all that apply

Append a calculated hash or a random integer suffix to the ZipCode partition key before writing new items to the table.

Configure the ingest client SDK to use exponential backoff and jitter for request retries.

Increase the visibility timeout of the Amazon SQS queue that buffers incoming readings to give the table more time to write.

Perform a parallel Scan operation across the table partitions to distribute the write throughput consumption.

Create a Global Secondary Index with ZipCode as the partition key to offload write operations from the main table.

Show answer & explanation

Answer: Append a calculated hash or a random integer suffix to the ZipCode partition key before writing new items to the table.; Configure the ingest client SDK to use exponential backoff and jitter for request retries.

Answer

To resolve the write throttling, the developer should append a calculated hash or a random integer suffix to the ZipCode partition key and configure the application SDK client to implement exponential backoff with jitter.

The correct options are appending a random suffix to the partition key (write sharding/salting) and configuring the client SDK to use exponential backoff with jitter. Appending a suffix distributes the writes across multiple logical partitions, preventing a single hot partition key from exceeding the partition-level limit of

1000

WCU. Implementing exponential backoff and jitter handles transient throttling by spreading retry attempts over time, reducing collision rates.

Step-by-Step Solution

Analyze the ProvisionedThroughputExceededException errors and determine if the workload is unevenly distributed.

Identify that the total write capacity is underutilized, but certain partition keys (ZipCode values representing high-density areas) are throttled, pointing to a hot partition issue.

To confirm that the root cause is a key distribution issue (hot partition) rather than a table-wide capacity limitation.

Apply a write sharding strategy to partition keys by appending a calculated hash or random suffix.

The writes are distributed across multiple physical partitions, raising the throughput limit for that logical partition.

DynamoDB partitions have a hard limit of

1000

Write Capacity Units (WCUs). Appending a suffix (e.g., from

1

N

) splits the hot key into multiple distinct partition keys.

Configure the AWS SDK client with exponential backoff and jitter.

The client retries throttled requests with progressively longer delay intervals that contain randomized offsets.

To handle transient throttling gracefully and prevent retry storms, ensuring that retried requests do not collide and cause further throttling.

Key Concept

Resolving DynamoDB Hot Partitions and Implementing Retry Backoff

Question 1252Question →

A gaming company is experiencing high read latency on a metadata table in Amazon DynamoDB, which is causing slow response times in their mobile leaderboard application. The read latency needs to be reduced from single-digit milliseconds to microseconds to support a real-time user experience. Which of the following caching solutions is the most appropriate to resolve this latency bottleneck?

Deploy an Amazon DynamoDB Accelerator (DAX) cluster to serve as an in-memory cache directly in front of the DynamoDB table.

Schedule periodic Scan operations on the DynamoDB table and cache the returned items in an Amazon ElastiCache for Memcached cluster.

Increase the provisioned Read Capacity Units (RCUs) on the DynamoDB table and implement write-key salting to handle hot partitions.

Store the DynamoDB read query results in AWS Secrets Manager and configure a custom cache rotation window.

Show answer & explanation

Answer: Deploy an Amazon DynamoDB Accelerator (DAX) cluster to serve as an in-memory cache directly in front of the DynamoDB table.

Answer

Deploy an Amazon DynamoDB Accelerator (DAX) cluster to serve as an in-memory cache directly in front of the DynamoDB table.

Deploying a DynamoDB Accelerator (DAX) cluster is the correct approach because DAX provides a fully managed, highly available, in-memory cache directly in front of DynamoDB tables. It reduces read latency to microseconds and is API-compatible, meaning developers can use it without changing client-side logic.

Step-by-Step Solution

Identify the database latency requirement.

The target latency is in the microsecond range, down from single-digit milliseconds.

This determines that an in-memory database cache is required.

Evaluate DynamoDB-specific caching technologies.

Amazon DynamoDB Accelerator (DAX) is the native in-memory caching service designed specifically for DynamoDB.

DAX provides microsecond latency and is API-compatible, eliminating the need to rewrite application caching logic.

Key Concept

Amazon DynamoDB Accelerator (DAX) is the dedicated caching solution for DynamoDB, providing microsecond read performance without requiring application-side cache management code.

Estimated Time:45s

Question 1253Question →

A developer is troubleshooting a local Node.js application running inside a Docker container. The application uses the AWS SDK for JavaScript (v3) to read data from an Amazon DynamoDB table. The application is configured to run under a non-root user named `node` with a home directory at `/home/node`. The developer wants the containerized application to use the AWS credentials defined in the `dev-profile` profile from the host machine's `~/.aws/credentials` file. Which combination of actions will allow the application in the container to successfully authenticate using the `dev-profile` credentials? (Select TWO.)

Select all that apply

Mount the host machine's ~/.aws directory to /home/node/.aws inside the container.

Set the AWS_PROFILE environment variable to dev-profile inside the container.

Copy the host machine's ~/.aws/credentials file into the container image using a COPY instruction in the Dockerfile.

Mount the host machine's ~/.aws directory to /root/.aws inside the container.

Initialize the DynamoDB client in the application code by hardcoding the AWS access keys.

Show answer & explanation

Answer: Mount the host machine's ~/.aws directory to /home/node/.aws inside the container.; Set the AWS_PROFILE environment variable to dev-profile inside the container.

Answer

Mount the host machine's ~/.aws directory to /home/node/.aws inside the container and set the AWS_PROFILE environment variable to dev-profile inside the container.

The correct combination requires mounting the host's ~/.aws directory to the container user's home directory (/home/node/.aws) so that the AWS SDK running as the 'node' user can read the credentials file. Additionally, setting the AWS_PROFILE environment variable to dev-profile ensures that the SDK uses the specified profile instead of the default profile.

Step-by-Step Solution

Expose the host credentials to the container's non-root user context.

Mounting the host directory ~/.aws to /home/node/.aws makes the credentials accessible to the node user's default home directory path.

By default, the AWS SDK looks for credentials at ~/.aws/credentials in the current user's home directory. Since the container runs as 'node', it searches /home/node/.aws/credentials.

Configure the container environment to select the specific profile.

Setting the AWS_PROFILE environment variable to dev-profile tells the AWS SDK which configuration profile to load from the mounted credentials file.

By default, the SDK looks for the default profile. Setting AWS_PROFILE ensures the SDK loads the credentials associated with dev-profile.

Key Concept

Configuring AWS credentials in local containerized development environments for non-root users.

Question 1254Question →

A client-side Next.js web portal hosted on https://portal.ecocharge.net sends a POST request to an Amazon API Gateway REST API configured with a Lambda Proxy integration to register new users. The API Gateway has CORS enabled on the resource. The web portal console shows a CORS error stating that the 'Access-Control-Allow-Origin' header is missing on the requested resource after the browser successfully completes the OPTIONS preflight request. Which of the following is the correct action to resolve this issue?

Configure a custom Lambda Authorizer for the POST method and configure the authorizer's response payload to include the Access-Control-Allow-Origin header.

Configure a CORS policy on the Amazon S3 bucket hosting the web portal's static assets to allow incoming traffic from the API Gateway endpoint.

Modify the backend Lambda function's response to return a JSON object containing a 'headers' key with the 'Access-Control-Allow-Origin' header.

Modify the Lambda function to return a plain text response body, and configure API Gateway's Integration Response to map the CORS headers.

Show answer & explanation

Answer: Modify the backend Lambda function's response to return a JSON object containing a 'headers' key with the 'Access-Control-Allow-Origin' header.

Answer

Modify the backend Lambda function's response to return a JSON object containing a 'headers' key with the 'Access-Control-Allow-Origin' header.

For a Lambda Proxy integration in Amazon API Gateway, the backend Lambda function is responsible for returning the complete response structure, including the status code, body, and all HTTP headers. While enabling CORS in the API Gateway console configures the preflight OPTIONS method, the actual method response (such as the POST response) must return the 'Access-Control-Allow-Origin' header directly within the Lambda function's JSON response payload.

Step-by-Step Solution

Analyze the integration type configured on the API Gateway resource.

The resource uses Lambda Proxy integration.

Lambda Proxy integration requires the backend Lambda function to format its output as a specific JSON object containing status code, headers, and body.

Determine where the CORS headers must be added.

Since API Gateway CORS enabling only sets headers on the OPTIONS preflight method automatically, the actual method (POST) must return the CORS headers from the integration backend.

For Lambda Proxy integrations, API Gateway does not evaluate or inject headers for integration responses on non-OPTIONS methods.

Update the Lambda function's output dictionary format.

The Lambda function returns a payload containing: { 'statusCode': 200, 'headers': { 'Access-Control-Allow-Origin': '*' }, 'body': '...' }

This structural output satisfies the Lambda Proxy integration contract and includes the required CORS headers for the browser to accept the request.

Key Concept

Lambda Proxy Integration CORS Requirements

Estimated Time:1m 30s

Question 1255Question →

A developer needs to deploy a new version of an application to an active AWS Elastic Beanstalk environment. The application must maintain 100% of its instance capacity to handle traffic during the deployment process. The deployment must be completed within the existing environment without creating a second, separate Elastic Beanstalk environment. Which two deployment strategies will meet these requirements? (Select two.)

Select all that apply

Rolling with additional batch

Immutable

Rolling

All at once

Blue/Green (Environment Swap)

Show answer & explanation

Answer: Rolling with additional batch; Immutable

Answer

The correct strategies are 'Rolling with additional batch' and 'Immutable' because they both maintain full capacity throughout the deployment process and run entirely within the existing Elastic Beanstalk environment.

The correct strategies are the 'Rolling with additional batch' and 'Immutable' deployment strategies. The 'Rolling with additional batch' strategy launches a temporary batch of instances first, ensuring that the environment's capacity never drops below 100% during the rolling update. The 'Immutable' strategy launches a full set of new instances in a temporary Auto Scaling group, ensuring full capacity is maintained, and performs a clean switchover within the existing environment once health checks pass.

Step-by-Step Solution

Analyze the capacity requirement

The application must maintain 100% capacity. This rules out standard 'Rolling' (which reduces capacity by the batch size) and 'All at once' (which takes all instances offline).

Determining which deployment strategies preserve capacity.

Analyze the environment boundary constraint

The deployment must occur within the existing environment. This rules out 'Blue/Green (Environment Swap)' because it requires provisioning a new, separate Elastic Beanstalk environment.

Filtering out strategies that require multiple environments.

Identify matching strategies

'Rolling with additional batch' and 'Immutable' both run in the existing environment, provision temporary instances to maintain 100% capacity, and clean up the extra instances afterward.

Selecting the remaining compliant strategies.

Key Concept

Elastic Beanstalk deployment policies balance cost, deployment speed, capacity, and environmental overhead.

Estimated Time:1m 30s

Question 1256Question →

A developer is containerizing a Go application that retrieves messages from an Amazon SQS queue. For local testing, the application runs inside a Docker container on a local workstation. The developer has configured the AWS CLI on the host workstation with a default profile, and the CLI successfully connects to SQS. However, when the containerized application runs, it fails with a credentials provider error indicating that no credentials could be found. Which of the following is the most secure and appropriate way to resolve this credential error in the local development environment?

Pass the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables to the container at runtime using the docker run command with environment flags.

Mount the host machine's ~/.aws directory into the container and set the AWS_SDK_LOAD_CONFIG environment variable inside the container to true, so it reads the configuration from the global credentials file before looking at environment variables.

Hardcode the AWS Access Key ID and Secret Access Key into the Go SDK client initialization block of the application code specifically for the local testing phase.

Create an IAM role with the required SQS permissions and configure a trust policy that allows the local container's IP address to assume the role, then update the container's configuration file.

Show answer & explanation

Answer: Pass the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables to the container at runtime using the docker run command with environment flags.

Answer

Pass the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables to the container at runtime using the docker run command with environment flags.

Passing the environment variables to the container at runtime resolves the credentials error because container environments are isolated by default. The default credential provider chain in the AWS SDK checks environment variables first before checking configuration files or IAM roles, allowing the application to successfully retrieve credentials passed via the environment flags.

Step-by-Step Solution

Analyze the container execution environment and the SDK credential lookup sequence.

The Go application inside the container runs in an isolated environment and does not inherit environment variables or files from the host machine by default.

Understanding why the SDK is failing to locate credentials.

Evaluate the order of precedence in the AWS Default Credential Provider Chain.

The chain first looks for AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables before looking at config/credentials files or container/instance metadata endpoints.

Determining the cleanest and most standard way to inject credentials.

Select the option that correctly injects the credentials at runtime without violating security guidelines.

Passing the environment variables into the container via the docker run command's environment flags (-e or --env) provides the containerized SDK with the necessary credentials.

Selecting the correct resolution.

Key Concept

AWS SDK Default Credential Provider Chain and Container Environment Isolation

Estimated Time:1m 30s

Question 1257Question →

A developer is building a high-traffic e-commerce application that stores product catalog data in an Amazon DynamoDB table. The application experiences frequent spikes in read requests for a few highly popular products, causing a ProvisionedThroughputExceededException even though the total read capacity of the table is within limits. The product details are read-intensive and updated infrequently. The developer wants to resolve the throttling issues and reduce read latency to sub-millisecond levels with minimal code changes. Which solution should the developer implement?

Deploy an Amazon DynamoDB Accelerator (DAX) cluster and update the application to use the DAX SDK client.

Scale up the provisioned Read Capacity Units (RCUs) on the DynamoDB table to accommodate the read spikes.

Deploy an Amazon ElastiCache for Memcached cluster and configure the application to perform a nightly DynamoDB Scan operation to load the products into the cache.

Store the product catalog details as parameters in AWS Systems Manager Parameter Store and enable Parameter Store caching.

Show answer & explanation

Answer: Deploy an Amazon DynamoDB Accelerator (DAX) cluster and update the application to use the DAX SDK client.

Answer

Deploy an Amazon DynamoDB Accelerator (DAX) cluster and update the application to use the DAX SDK client.

Deploying an Amazon DynamoDB Accelerator (DAX) cluster and updating the application to use the DAX SDK client is the correct solution. DAX provides seamless, API-compatible, sub-millisecond in-memory caching that intercepts requests to DynamoDB, protecting the table from hot key read spikes and avoiding ProvisionedThroughputExceededException errors without requiring changes to the core application query logic.

Step-by-Step Solution

Identify the cause of the throttling.

Throttling is caused by hot partitions due to high-frequency reads on a small subset of popular items.

DynamoDB partitions data based on the partition key, and a high concentration of requests to specific keys can throttle those partitions even if the overall table capacity is not exceeded.

Compare caching options for DynamoDB.

DAX provides a write-through/read-through cache designed specifically for DynamoDB, whereas ElastiCache requires manual cache-aside logic.

Choosing DAX allows sub-millisecond read latency and prevents hot partition throttling with minimal code changes since DAX is API-compatible.

Select the correct SDK client.

Configure the application to initialize the DAX client instead of the default DynamoDB client.

This is the only code modification required to start routing queries through the cache.

Key Concept

Mitigating DynamoDB hot partition throttling and reducing read latency using DynamoDB Accelerator (DAX)

Estimated Time:1m 30s

Question 1258Question →

A developer is building a web application where users sign in via social identity providers. The application needs to call a backend REST API on Amazon API Gateway, and also allow users to upload user profile photos directly to a private Amazon S3 bucket.

Which Cognito configuration meets these requirements with the least operational overhead?

Configure a Cognito User Pool to handle user sign-in. Secure the REST API using an API Gateway Cognito user pool authorizer. Configure the private S3 bucket to allow public write access restricted by a bucket policy that validates the Cognito User Pool ID token.

Configure a Cognito User Pool to handle user sign-in. Configure a custom Lambda authorizer on API Gateway to validate the User Pool token and generate temporary AWS credentials to return to the client for S3 access.

Configure a Cognito User Pool to handle user sign-in and social provider federation. Secure the REST API using an API Gateway Cognito user pool authorizer. Use a Cognito Identity Pool to exchange the User Pool tokens for temporary AWS credentials to authorize direct S3 uploads.

Configure a Cognito Identity Pool to handle user sign-in and social identity federation. Use a custom Lambda authorizer on API Gateway to validate the Cognito Identity Pool tokens, and grant the REST API IAM permissions to write to the S3 bucket on behalf of the users.

Show answer & explanation

Answer: Configure a Cognito User Pool to handle user sign-in and social provider federation. Secure the REST API using an API Gateway Cognito user pool authorizer. Use a Cognito Identity Pool to exchange the User Pool tokens for temporary AWS credentials to authorize direct S3 uploads.

Answer

The correct configuration uses a Cognito User Pool for user sign-in and identity federation, securing API Gateway endpoints using a built-in Cognito authorizer which natively validates the JSON Web Tokens (JWTs). It then uses a Cognito Identity Pool to trade the authenticated User Pool token for temporary AWS IAM credentials, allowing the application client to perform direct uploads to S3 with minimal operational overhead.

Step-by-Step Solution

Identify the authentication and user management component.

A Cognito User Pool is selected to manage user profiles, sign-ins, and social identity provider federation.

User Pools act as the primary user directory and issue identity tokens.

Select the API authorization mechanism.

Use the built-in API Gateway Cognito user pool authorizer to validate the JWTs sent by the client.

This integration handles token validation automatically with zero custom code or Lambda overhead.

Determine how the client obtains credentials for direct S3 access.

Configure a Cognito Identity Pool that trusts the Cognito User Pool, allowing the client to exchange its user token for temporary AWS IAM credentials.

Amazon S3 requires AWS IAM credentials for secure client-side uploads, which is the primary purpose of Identity Pools.

Key Concept

Federating user sign-in with Cognito User Pools and obtaining temporary AWS credentials via Cognito Identity Pools for S3 access.

Question 1259Question →

A developer is configuring an AWS CodeBuild project that runs as a stage in an AWS CodePipeline. During the build execution, a script generates a dynamic version identifier based on the current git commit hash. The developer needs to pass this dynamically generated version identifier directly to a subsequent deployment stage in the pipeline without creating external dependencies. Which configuration in the `buildspec.yml` file will achieve this?

Define the variable name under the `exported-variables` sequence in the `env` block.

Define the variable under the `variables` mapping in the `env` block.

Write the version identifier to a temporary text file and declare it under the `files` sequence in the `artifacts` block.

Store the version identifier in AWS Systems Manager Parameter Store during the `post_build` phase and retrieve it in the deployment stage.

Show answer & explanation

Answer: Define the variable name under the `exported-variables` sequence in the `env` block.

Answer

Define the variable name under the `exported-variables` sequence in the `env` block.

Defining the variable name under the `exported-variables` sequence in the `env` block allows CodeBuild to export the value of environment variables that are dynamically set during the build execution. AWS CodePipeline captures these exported variables and makes them available to downstream pipeline actions as variables.

Step-by-Step Solution

Add the desired environment variable name to the `exported-variables` sequence under the `env` block in `buildspec.yml`.

CodeBuild is configured to monitor and capture this specific environment variable's value at the end of the build execution.

This registers the variable name so CodeBuild knows to export it.

Assign the dynamic commit-based value to the environment variable inside one of the build commands, such as using `export MY_VERSION=$(git rev-parse --short HEAD)`.

The variable is populated with the dynamically generated value during the build execution.

This updates the environment variable's value dynamically during runtime.

Reference the exported variable in downstream CodePipeline actions using the namespace syntax.

The subsequent stages in AWS CodePipeline can access the version identifier natively.

This completes the transfer of the dynamic variable across the pipeline without external API calls or storage.

Key Concept

AWS CodeBuild Exported Variables

Question 1260Question →

A developer is building a weather forecasting web application that retrieves current weather conditions from an Amazon DynamoDB table based on a postal code. The application experiences a large number of duplicate read requests for the same popular postal codes, resulting in high latency and read throttling. The developer wants to optimize the application's read performance with minimal changes to the application code. Which action should the developer take to resolve this issue?

Modify the application code to perform DynamoDB Scan operations instead of Query operations to retrieve the weather data.

Configure and deploy an Amazon DynamoDB Accelerator (DAX) cluster to cache the read requests from the DynamoDB table.

Increase the provisioned read capacity units (RCUs) on the DynamoDB table to absorb the spikes in read volume.

Store the retrieved weather data in AWS Systems Manager Parameter Store and enable automatic parameter rotation.

Show answer & explanation

Answer: Configure and deploy an Amazon DynamoDB Accelerator (DAX) cluster to cache the read requests from the DynamoDB table.

Answer

Configure and deploy an Amazon DynamoDB Accelerator (DAX) cluster to cache the read requests from the DynamoDB table.

Amazon DynamoDB Accelerator (DAX) is a fully managed, in-memory cache designed specifically for DynamoDB. It provides sub-millisecond response times for read-heavy workloads with minimal application code modifications, as the DAX client SDK is API-compatible with the standard DynamoDB client.

Step-by-Step Solution

Analyze the application's read pattern and latency requirement.

The application reads identical data keys (postal codes) repeatedly, resulting in read throttling and high latency.

Identifying that the workload has repetitive read patterns helps select an in-memory caching solution to offload the database.

Select the caching solution that integrates directly with DynamoDB without major code modifications.

Amazon DynamoDB Accelerator (DAX) is chosen because it acts as a seamless write-through/read-through cache.

DAX provides API-compatible caching, enabling sub-millisecond response times with minimal application change.

Key Concept

Using DynamoDB Accelerator (DAX) to optimize read performance and reduce latency for read-heavy workloads with minimal code changes.

PreviousPage 63 / 78Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept