All practice questions

1542 questions

All types1,542 Multiple choice782 Multiple select746 Ordering14

A developer is troubleshooting a serverless application where an AWS Lambda function written in C# (.NET) processes order events. The Lambda function is invoked by an Amazon API Gateway REST API. The function makes downstream HTTP calls to a third-party payment gateway and performs read/write operations on an Amazon DynamoDB table. Active tracing is enabled on both the API Gateway stage and the Lambda function. However, when inspecting the AWS X-Ray console, the developer observes that while the API Gateway and Lambda function segments appear, the HTTP calls to the payment gateway and the DynamoDB operations are missing from the trace.

Which of the following actions should the developer take to record the downstream calls in the X-Ray traces?

Extract the X-Amzn-Trace-Id header from the API Gateway event inside the Lambda handler and manually assign it to the environment variables of the Lambda execution environment before invoking downstream services.

Use the AWS X-Ray SDK for .NET to call AWSSDKHandler.RegisterXRayForAllServices() at application startup, and initialize HttpClient using the HttpClientXRayTracingHandler class.

Hardcode an IAM user access key and secret key with the AWSXrayWriteOnlyAccess policy when initializing the DynamoDB client and HTTP clients to authenticate directly with the X-Ray daemon.

Increase the Lambda function's timeout configuration to allow enough time for the X-Ray daemon to flush segment data and implement client-side connection pooling to handle execution context reuse.

Show answer & explanation

Answer: Use the AWS X-Ray SDK for .NET to call AWSSDKHandler.RegisterXRayForAllServices() at application startup, and initialize HttpClient using the HttpClientXRayTracingHandler class.

Answer

Use the AWS X-Ray SDK for .NET to call AWSSDKHandler.RegisterXRayForAllServices() at application startup, and initialize HttpClient using the HttpClientXRayTracingHandler class.

To trace AWS SDK operations and standard HTTP calls in a .NET application, the developer must instrument them using the AWS X-Ray SDK for .NET. Calling AWSSDKHandler.RegisterXRayForAllServices() registers the tracing handler globally for all AWS service clients, and initializing HttpClient with HttpClientXRayTracingHandler ensures that outbound HTTP calls to the payment gateway are intercepted and traced as subsegments.

Step-by-Step Solution

Identify the missing components in the X-Ray trace.

The DynamoDB operations (AWS SDK calls) and the third-party payment gateway calls (HTTP requests) are missing.

By default, enabling active tracing on Lambda only creates the Lambda service segment, but downstream network libraries and AWS SDKs must be instrumented explicitly in code.

Instrument the AWS SDK calls.

Call AWSSDKHandler.RegisterXRayForAllServices() during application initialization.

This automatically registers a request pipeline handler with the AWS SDK to trace calls to all AWS services, including DynamoDB.

Instrument downstream HTTP calls.

Pass an instance of HttpClientXRayTracingHandler when creating the HttpClient.

This handler intercepts outgoing HTTP calls and injects the trace header while generating subsegments for downstream external API calls.

Key Concept

Instrumenting AWS SDK and HTTP clients in C# (.NET) with AWS X-Ray SDK.

Estimated Time:1m 30s

Question 1282Question →

A developer is setting up a blue/green deployment for a containerized application running on Amazon ECS using AWS CodeDeploy. The deployment must route $10\%$ of the production traffic to the new version of the application immediately. The remaining $90\%$ of the traffic must be routed to the new version only after a $15$ -minute validation period, during which the application's health is monitored. If any errors occur during this period, CodeDeploy must automatically roll back the deployment.

Which pre-defined CodeDeploy deployment configuration should the developer use to meet these requirements?

CodeDeployDefault.ECSCanary10Percent15Minutes

CodeDeployDefault.ECSCanary10Percent5Minutes

CodeDeployDefault.ECSLinear10PercentEvery15Minutes

CodeDeployDefault.LambdaCanary10Percent15Minutes

Show answer & explanation

Answer: CodeDeployDefault.ECSCanary10Percent15Minutes

Answer

CodeDeployDefault.ECSCanary10Percent15Minutes

The configuration CodeDeployDefault.ECSCanary10Percent15Minutes is correct because it is a pre-defined CodeDeploy deployment configuration designed for Amazon ECS. It shifts

10\%

of traffic to the replacement task set immediately, waits for

15

minutes for validation and monitoring, and then routes the remaining

90\%

of traffic to the new version.

Step-by-Step Solution

Identify the target compute platform.

The application runs on Amazon ECS, so the configuration name must begin with CodeDeployDefault.ECS.

CodeDeploy has separate pre-defined configurations for ECS, Lambda, and EC2/On-Premises.

Determine the traffic shifting pattern.

The requirement is to shift a small portion (

10\%

) and then the rest after a delay, which corresponds to a Canary deployment pattern.

Linear configurations shift traffic in equal increments at regular intervals, whereas Canary configurations shift an initial percentage, wait for a specified time, and then shift all remaining traffic.

Match the specified percentage and time interval parameters.

The parameters are

10\%

traffic shifted immediately and a

15

-minute wait time, which matches CodeDeployDefault.ECSCanary10Percent15Minutes.

This is a standard pre-defined deployment configuration provided by AWS CodeDeploy for ECS.

Key Concept

AWS CodeDeploy deployment configurations for ECS Blue/Green deployments control how traffic is shifted from the old task set to the new task set, allowing canary testing with built-in validation periods.

Question 1283Question →

A developer deployed an Amazon EC2 instance and an associated security group using an AWS CloudFormation stack. Later, a network administrator manually added an inbound rule allowing TCP port 3389 (RDP) directly via the Amazon VPC Console to troubleshoot a connection issue. The developer runs drift detection on the stack and confirms that the security group is in a drifted state. The developer wants to restore the security group to the exact configuration defined in the CloudFormation template. Which of the following is the correct method to resolve this drift?

Perform a stack update using the original CloudFormation template to force CloudFormation to overwrite the out-of-band changes and remove the RDP rule.

Initiate a stack rollback to the previous successful stack status to automatically revert the out-of-band security group changes.

Manually remove the unauthorized inbound RDP rule from the security group using the AWS Management Console or AWS CLI to match the expected template configuration.

Store the security group configuration in Systems Manager Parameter Store and enable automatic rotation to overwrite any out-of-band changes.

Show answer & explanation

Answer: Manually remove the unauthorized inbound RDP rule from the security group using the AWS Management Console or AWS CLI to match the expected template configuration.

Answer

Manually remove the unauthorized inbound RDP rule from the security group using the AWS Management Console or AWS CLI to match the expected template configuration.

Manually removing the out-of-band RDP rule is the correct way to resolve the drift. When a resource is modified out-of-band, CloudFormation drift detection flags the difference but does not automatically remediate it. To resolve the drift without changing the template, the resource must be manually modified to align back with the template definition.

Step-by-Step Solution

Analyze the source of the configuration drift.

Identify that the security group has an extra inbound RDP rule added manually.

To determine how the live resource differs from the CloudFormation template definition.

Evaluate whether a standard stack update using the original template can remediate the drift.

Determine that running an update with the same template does not overwrite manual changes because CloudFormation checks template differences, not live resource differences.

To rule out stack updates as an automatic remediation tool for unmodified templates.

Manually remove the unauthorized inbound RDP rule.

The security group configuration matches the CloudFormation template, resolving the drift.

To successfully restore the stack's resources to their expected template-defined state.

Key Concept

AWS CloudFormation Drift Detection and Remediation

Question 1284Question →

A developer is troubleshooting a Python application on a local development workstation. The application uses the AWS SDK for Python (Boto3) to interact with AWS resources.

The developer has configured two profiles in the local `~/.aws/credentials` file: a `default` profile and a `custom-dev` profile.

To test the application locally, the developer runs the following commands in the terminal:

bash
export AWS_PROFILE=custom-dev
export AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
export AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

When the developer runs the application, they notice that the SDK uses the IAM credentials from the environment variables rather than the configuration defined for `custom-dev` in the credentials file.

Why does the AWS SDK execute the requests using the environment variable credentials instead of the `custom-dev` profile?

The AWS SDK credential provider chain evaluates environment variables for explicit access keys before loading credentials from the shared credentials file.

The AWS_PROFILE environment variable is only recognized by the AWS CLI, whereas the AWS SDK ignores it and defaults to environment variables.

The shared credentials file is only read if the environment variables for AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are not set, but the configuration requires setting AWS_SDK_LOAD_CONFIG=true to prioritize the credentials file.

The AWS SDK requires the trust policy of the IAM role in the custom-dev profile to explicitly allow local execution before it can override environment variables.

Show answer & explanation

Answer: The AWS SDK credential provider chain evaluates environment variables for explicit access keys before loading credentials from the shared credentials file.

Answer

The AWS SDK credential provider chain evaluates environment variables for explicit access keys before loading credentials from the shared credentials file.

The AWS SDK default credential provider chain resolves credentials in a specific sequence. Environment variables containing explicit access keys (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) are checked before looking up the shared credentials file. As long as these environment variables are defined in the environment, the SDK will use them, ignoring the profile specified by AWS_PROFILE.

Step-by-Step Solution

Analyze the credentials configured in the environment and the shared credentials file.

The terminal has both environment variables (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) and the AWS_PROFILE environment variable set to select a profile from the credentials file.

Understanding which credential configurations are active is necessary to diagnose the lookup behavior.

Review the order of precedence in the AWS SDK default credential provider chain.

The chain searches environment variables first, then credentials from the shared credentials/config files (controlled by AWS_PROFILE).

The SDK resolves credentials by checking sources in a strict, pre-defined order.

Compare the precedence of the active credential sources.

Because AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are defined in the environment variables, they take precedence over the AWS_PROFILE setting.

This explains why the SDK ignores the profile configuration and uses the direct environment variables.

Key Concept

AWS SDK Default Credential Provider Chain Precedence

Question 1285Question →

A developer is building a serverless mobile application for fitness tracking. The application needs to authenticate users using an external OpenID Connect (OIDC) identity provider. Once authenticated, the application must allow users to call an Amazon API Gateway REST API and upload workout logs directly to their own private folders in an Amazon S3 bucket. Which TWO configurations should the developer implement to meet these requirements?

Select all that apply

Set up an Amazon Cognito User Pool and federate it with the OIDC identity provider. Configure the API Gateway REST API to use a Cognito authorizer linked to the User Pool.

Set up an Amazon Cognito Identity Pool and configure the Cognito User Pool as an identity provider. Associate an authenticated IAM role with the Identity Pool that allows s3:PutObject for the uploads/\${cognito-identity.amazonaws.com:sub}/ prefix.

Set up an Amazon Cognito User Pool and configure it to issue temporary AWS credentials to the mobile client using custom user attributes.

Configure an API Gateway Lambda Authorizer that parses the OIDC ID token, calls the Amazon Cognito Identity Pool to exchange it for IAM credentials, and returns an IAM policy to API Gateway.

Configure the Cognito User Pool with a client credentials grant type to directly generate temporary AWS IAM credentials for the client application.

Show answer & explanation

Answer: Set up an Amazon Cognito User Pool and federate it with the OIDC identity provider. Configure the API Gateway REST API to use a Cognito authorizer linked to the User Pool.; Set up an Amazon Cognito Identity Pool and configure the Cognito User Pool as an identity provider. Associate an authenticated IAM role with the Identity Pool that allows s3:PutObject for the uploads/\${cognito-identity.amazonaws.com:sub}/ prefix.

Answer

To meet the requirements, the developer must configure an Amazon Cognito User Pool federated with the OIDC provider to authenticate users and secure the API Gateway REST API with a Cognito authorizer. Additionally, the developer must configure an Amazon Cognito Identity Pool with the User Pool as an identity provider, associating an IAM role that grants permissions to the user's S3 folder using the cognito-identity.amazonaws.com:sub variable.

The correct approach integrates both Cognito User Pools and Identity Pools. The User Pool handles OIDC authentication and issues JWT tokens, which the API Gateway Cognito Authorizer verifies. The Identity Pool then takes the User Pool ID token and exchanges it for temporary IAM credentials. The attached IAM policy uses the dynamic variable to restrict S3 uploads to the authenticated user's prefix.

Step-by-Step Solution

Federate the OIDC provider with a Cognito User Pool and configure the API Gateway Cognito Authorizer.

Users can log in using their OIDC identity, and the User Pool will issue JWT tokens that API Gateway validates natively.

This establishes user authentication and secures the API Gateway backend without custom authorization code.

Configure a Cognito Identity Pool using the User Pool as an authentication provider.

The client app can exchange the User Pool tokens for temporary AWS IAM credentials.

This bridges user authentication with AWS resource authorization.

Attach a fine-grained IAM policy to the authenticated role of the Cognito Identity Pool.

The IAM policy allows s3:PutObject only to the prefix uploads/\${cognito-identity.amazonaws.com:sub}/.

This restricts users so they can only write files to their own individual S3 folders using secure temporary credentials.

Key Concept

Integrating Amazon Cognito User Pools for user authentication/federation and Cognito Identity Pools for authorizing direct access to AWS resources like Amazon S3 using temporary AWS credentials.

Question 1286Question →

A company is deploying a microservices-based application on Amazon Elastic Container Service (Amazon ECS). The application requires access to two types of data: database credentials for an Amazon RDS database that must be rotated automatically every 14 days, and a non-sensitive configuration setting indicating the application's logging level. The developer wants to implement a secure solution that minimizes both management overhead and overall cost. Which of the following actions should the developer take to meet these requirements? (Select TWO.)

Select all that apply

Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in integration for Amazon RDS.

Store the logging level configuration in Systems Manager Parameter Store as a Standard parameter to optimize costs.

Store both the database credentials and the logging level configuration in AWS Secrets Manager to centralize management and leverage automatic rotation for all settings.

Store the database credentials in a Systems Manager Parameter Store SecureString parameter and write a custom Lambda function triggered by Amazon EventBridge to rotate the RDS password.

Hardcode the database credentials within the Dockerfile environment variables and store the logging level configuration in Systems Manager Parameter Store.

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in integration for Amazon RDS.; Store the logging level configuration in Systems Manager Parameter Store as a Standard parameter to optimize costs.

Answer

Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in integration for Amazon RDS, and store the logging level configuration in Systems Manager Parameter Store as a Standard parameter to optimize costs.

The correct options involve storing the database credentials in AWS Secrets Manager and the logging level in Systems Manager Parameter Store. AWS Secrets Manager natively integrates with Amazon RDS to provide automatic credential rotation without manual overhead, which satisfies the 14-day rotation requirement. Systems Manager Parameter Store Standard parameters are free of charge, making them the most cost-effective choice for storing non-sensitive configuration settings like application logging levels.

Step-by-Step Solution

Evaluate the database credential requirements for automatic rotation.

AWS Secrets Manager is selected because it has built-in integration with Amazon RDS to rotate credentials automatically without manual coding.

This satisfies the security requirement for rotating credentials every 14 days with minimal administrative overhead.

Evaluate the configuration setting requirement for cost-effectiveness.

Systems Manager Parameter Store is selected because Standard parameters are free of charge and suitable for non-sensitive data.

This minimizes overall costs by avoiding the hosting fees associated with AWS Secrets Manager for non-sensitive configuration data.

Key Concept

Choosing between AWS Secrets Manager and Systems Manager Parameter Store based on rotation capabilities and cost optimization.

Estimated Time:1m 30s

Question 1287Question →

An application running on an Amazon EC2 instance is designed to fetch daily configuration files from a private Amazon S3 bucket. During deployment, the application throws an Access Denied exception when attempting to call the `s3:GetObject` API operation. The developer has attached a policy with the required S3 permissions to an IAM role called `S3ReaderRole`, which is associated with the instance profile. Upon inspecting the role's trust policy, the developer finds the following configuration:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which of the following modifications should the developer make to resolve this access issue?

Add a new statement to the S3ReaderRole's permissions policy that allows the sts:AssumeRole action for the ec2.amazonaws.com service principal.

Modify the trust policy of the S3ReaderRole to change the service principal in the Principal block to ec2.amazonaws.com.

Initialize the S3 client in the Java application code using hardcoded AWS access keys belonging to an IAM user with S3 read access.

Modify the S3ReaderRole's trust policy to change the Action element from sts:AssumeRole to s3:GetObject.

Show answer & explanation

Answer: Modify the trust policy of the S3ReaderRole to change the service principal in the Principal block to ec2.amazonaws.com.

Answer

Modify the trust policy of the S3ReaderRole to change the service principal in the Principal block to ec2.amazonaws.com.

Modifying the trust policy of the IAM role to change the service principal to ec2.amazonaws.com is correct because it grants the EC2 service permission to assume the role. The trust policy defines which entities (in this case, the EC2 service) are allowed to assume the role to obtain temporary credentials. Since the application is running on EC2, the role's trust policy must trust EC2, not Lambda.

Step-by-Step Solution

Identify the execution environment of the application and the resource it is attempting to access.

The application is running on an Amazon EC2 instance and needs to read files from an Amazon S3 bucket.

Understanding the execution context helps determine which service principal must assume the IAM role.

Examine the current IAM trust policy configuration of the role associated with the EC2 instance.

The trust policy currently has the Principal.Service set to lambda.amazonaws.com.

This principal only allows the AWS Lambda service to assume the role, preventing EC2 from obtaining the necessary temporary security credentials.

Update the trust policy to reference the correct service principal.

Change the Principal.Service element value to ec2.amazonaws.com.

This allows the EC2 service principal to assume the role, enabling the EC2 instance profile to fetch and hand over temporary credentials to the running application.

Key Concept

IAM Trust Policies vs. Permissions Policies

Question 1288Question →

A ticket booking application named TicketSwift records concert reservations in an Amazon DynamoDB table. The table uses ConcertID as the partition key and BookingTimestamp as the sort key. During major ticket releases, the application experiences a surge in ProvisionedThroughputExceededException errors, even though the total read and write capacity units (RCUs and WCUs) are auto-scaled and remain well below the table-level limits. An analysis shows that millions of requests are targeting a single popular concert within a few minutes. Which combination of actions will resolve this throttling issue and optimize key distribution? (Select TWO.)

Select all that apply

Redesign the partition key schema by appending a random numeric suffix to the ConcertID during high-volume booking events.

Configure the application SDK client to implement exponential backoff and jitter for retrying requests.

Modify the application's queries to use a Scan operation with a FilterExpression to retrieve booking records.

Increase the visibility timeout of the incoming SQS queue to allow consumers more time to write records.

Increase the table's overall provisioned write capacity units (WCUs) to distribute write workloads evenly.

Show answer & explanation

Answer: Redesign the partition key schema by appending a random numeric suffix to the ConcertID during high-volume booking events.; Configure the application SDK client to implement exponential backoff and jitter for retrying requests.

Answer

Redesigning the partition key schema by appending a random numeric suffix to the ConcertID and configuring the SDK to use exponential backoff and jitter.

Redesigning the partition key by appending a random numeric suffix (write sharding) distributes writes across multiple partitions, preventing a hot key issue. Implementing exponential backoff and jitter in the SDK handles transient throttling errors gracefully without overloading the database.

Step-by-Step Solution

Analyze the table schema and partition key design.

Identify that the ConcertID partition key results in a hot partition during popular ticket sales, because all writes for a concert hit the same physical partition.

DynamoDB partition capacity is limited, and high throughput on a single key leads to throttling despite table-level scaling.

Introduce sharding to the partition key.

Append a random numeric suffix (e.g., ConcertID_1, ConcertID_2) to distribute the write requests across multiple physical partitions.

This spreads the write load, increasing the aggregate throughput support for the concert writes.

Configure client-side error handling.

Implement exponential backoff and jitter in the application SDK for handling ProvisionedThroughputExceededException.

This prevents the client from overwhelming the database during transient spikes and ensures successful retries.

Key Concept

DynamoDB Partition Key Sharding and SDK Retries

Estimated Time:2m 0s

Question 1289Question →

A developer is troubleshooting a serverless application deployed on AWS Lambda. The application logs events in a structured JSON format to Amazon CloudWatch Logs. The developer needs to configure CloudWatch metric filters to monitor two separate issues:

1. Lambda function execution timeouts, which generate service-level log lines containing the string: `Task timed out after`
2. Application API failures, where the log events are JSON objects containing a key `statusCode` with a value of 500 or greater.

Which two configurations should the developer implement to achieve this? (Select TWO.)

Select all that apply

Create a metric filter for the execution timeouts using the filter pattern "Task timed out after".

Create a metric filter for the execution timeouts using the JSON filter pattern { $.errorMessage = "Task timed out after*" }.

Create a metric filter for the API failures using the JSON filter pattern { $.statusCode >= 500 }.

Create a metric filter for the API failures using the space-delimited filter pattern [..., status_code >= 500, ...].

Catch the timeout exception in the application code and publish a custom metric using the PutMetricData API call before the function terminates.

Show answer & explanation

Answer: Create a metric filter for the execution timeouts using the filter pattern "Task timed out after".; Create a metric filter for the API failures using the JSON filter pattern { $.statusCode >= 500 }.

Answer

The correct configurations are to create a metric filter for the execution timeouts using the filter pattern "Task timed out after" and to create a metric filter for the API failures using the JSON filter pattern { $.statusCode >= 500 }.

The correct options involve setting up a literal string filter pattern to match plain-text Lambda runtime log entries and a JSON path filter pattern to match structured JSON application log entries. Since Lambda service timeouts are logged as raw text lines, a literal string match is required. Since the application writes logs in JSON, the JSON path filter syntax allows matching numeric conditions on specific properties.

Step-by-Step Solution

Analyze the log format of the Lambda service execution timeouts.

The Lambda service logs execution timeouts as raw, unstructured text strings containing the pattern 'Task timed out after'.

Understanding the format of the log lines dictates the type of metric filter pattern needed.

Analyze the log format of the application API failures.

The application writes log events in a structured JSON format containing a statusCode field.

JSON logs require structured JSON query syntax to isolate specific property values.

Define the appropriate filter pattern syntax for each log type.

Use a literal string pattern '"Task timed out after"' for the text logs, and the JSON pattern '{ $.statusCode >= 500 }' for the JSON logs.

Applying the correct pattern ensures that the metric filter accurately parses the log stream and increments the metric.

Key Concept

Distinguishing between plain-text and structured JSON log streams when configuring Amazon CloudWatch metric filters.

Estimated Time:2m 0s

Question 1290Question →

A developer is writing an AWS CloudFormation template to deploy an Amazon EC2 instance that runs a web server. The developer wants to ensure that the EC2 instance is not marked as CREATE_COMPLETE until the web server application package is successfully installed and the service is started. If the installation fails or does not complete within 15 minutes, the stack creation should fail and rollback. Which TWO actions must the developer perform in the CloudFormation template and instance configuration to meet these requirements?

Select all that apply

Add a CreationPolicy attribute to the EC2 instance resource in the template and set the timeout property to 15 minutes.

Add an UpdatePolicy attribute to the EC2 instance resource in the template to define the wait time for the initial creation signals.

Execute the cfn-signal helper script in the instance's UserData after the installation and startup commands succeed.

Run the cfn-hup daemon inside UserData to monitor the installation logs and automatically trigger stack rollback on failure.

Retrieve a signal token by referencing a Systems Manager parameter using a Secrets Manager dynamic reference format in the UserData.

Show answer & explanation

Answer: Add a CreationPolicy attribute to the EC2 instance resource in the template and set the timeout property to 15 minutes.; Execute the cfn-signal helper script in the instance's UserData after the installation and startup commands succeed.

Answer

To meet the requirements, the developer must add a CreationPolicy attribute to the EC2 instance resource with a timeout of 15 minutes, and execute the cfn-signal helper script in the instance's UserData after the installation and startup commands succeed.

The correct actions are adding a CreationPolicy attribute to the EC2 instance resource in the template and executing the cfn-signal helper script in the instance's UserData. The CreationPolicy tells CloudFormation to wait for a signal before marking the instance as successfully created, and the cfn-signal script transmits that signal from the EC2 instance after setup steps finish.

Step-by-Step Solution

Identify the mechanism CloudFormation uses to pause stack creation for resource initialization.

The CreationPolicy attribute is used to block resource completion until a success signal is received.

This prevents the EC2 instance from transitioning to CREATE_COMPLETE immediately after VM provisioning.

Determine the tool used inside the EC2 instance to send the initialization status to CloudFormation.

The cfn-signal helper script is executed at the end of the bootstrap script (UserData).

This sends the success or failure signal back to AWS CloudFormation, satisfying the CreationPolicy wait condition.

Key Concept

AWS CloudFormation CreationPolicy and Helper Scripts

Estimated Time:2m 0s

Question 1291Question →

A developer is building a serverless orchestration workflow using AWS Step Functions. One of the workflow's task states invokes an AWS Lambda function that integrates with a third-party merchant API. The merchant API requires a secure API key for authentication. The company's security policy requires that this API key be rotated every 30 days. Which solution meets these requirements with the least operational overhead?

Store the API key in AWS Secrets Manager. Configure automatic rotation for the secret on a 30-day schedule using a rotation Lambda function, and configure the integration Lambda function to retrieve the secret at runtime.

Store the API key as a SecureString parameter in AWS Systems Manager Parameter Store. Create an Amazon EventBridge rule that runs a custom Lambda function every 30 days to generate a new key and update the parameter value.

Store the API key as an encrypted environment variable in the integration Lambda function's configuration using AWS Key Management Service (AWS KMS). Implement a custom helper function inside the application code to handle rotation.

Store the API key as a Standard parameter in AWS Systems Manager Parameter Store. Enable the native Parameter Store automatic rotation feature and configure it for a 30-day rotation interval.

Show answer & explanation

Answer: Store the API key in AWS Secrets Manager. Configure automatic rotation for the secret on a 30-day schedule using a rotation Lambda function, and configure the integration Lambda function to retrieve the secret at runtime.

Answer

The correct option is to use AWS Secrets Manager with its built-in automatic rotation feature, configured with a rotation Lambda function on a 30-day schedule. AWS Secrets Manager is specifically designed for managing, rotating, and retrieving secrets securely at runtime, which satisfies the requirements with the lowest operational overhead.

Step-by-Step Solution

Evaluate the need for encryption and automatic rotation of credentials.

Identify that AWS Secrets Manager is the standard service designed to handle secrets requiring automatic rotation natively.

Systems Manager Parameter Store does not offer native automatic rotation out of the box.

Compare Secrets Manager and Systems Manager Parameter Store for custom third-party secrets.

Choose Secrets Manager because it supports automatic rotation via custom Lambda functions, minimizing custom orchestration code.

Implementing rotation in Parameter Store requires custom EventBridge rules and manual orchestration, increasing operational overhead.

Ensure the integration Lambda function retrieves the secret at runtime.

Avoid hardcoding or environment variables that complicate rotation and compromise security.

Retrieving the secret at runtime ensures that rotation does not break the integration Lambda function.

Key Concept

Secrets Manager vs Systems Manager Parameter Store Rotation Capabilities

Estimated Time:1m 30s

Question 1292Question →

A developer is setting up an AWS Lambda function that needs to retrieve and write items to an Amazon DynamoDB table in the same AWS account. The developer creates an IAM role named `LambdaDbAccessRole` to be used as the function's execution role. However, when attempting to save the Lambda function configuration, the developer receives an error stating that the AWS Lambda service is not authorized to assume the role. The developer checks the trust policy currently attached to `LambdaDbAccessRole` and finds the following document:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"dynamodb:GetItem",
"dynamodb:PutItem"
],
"Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Products"
}
]
}

How should the developer resolve this issue to allow the Lambda function to execute and interact with the DynamoDB table?

Update the trust policy of `LambdaDbAccessRole` to allow the `lambda.amazonaws.com` service principal to perform the `sts:AssumeRole` action, and attach a separate identity-based permissions policy containing the DynamoDB actions to the role.

Modify the trust policy of `LambdaDbAccessRole` to add `"Principal": { "Service": "lambda.amazonaws.com" }` and `"Action": "sts:AssumeRole"` to the existing statement alongside the DynamoDB actions.

Configure the Lambda function to bypass the execution role by embedding the AWS access key and secret key of an IAM user with DynamoDB permissions directly in the function code.

Create a resource-based policy on the DynamoDB table that grants permission to `lambda.amazonaws.com` and use the AWS Account root user credentials to run the Lambda function.

Show answer & explanation

Answer: Update the trust policy of `LambdaDbAccessRole` to allow the `lambda.amazonaws.com` service principal to perform the `sts:AssumeRole` action, and attach a separate identity-based permissions policy containing the DynamoDB actions to the role.

Answer

Update the trust policy of the execution role to allow the AWS Lambda service principal to assume the role, and attach a separate permissions policy to the role for DynamoDB access.

The trust policy of an IAM role defines which principals are allowed to assume it. For AWS Lambda to assume the execution role, the trust policy must allow the `lambda.amazonaws.com` service principal to perform the `sts:AssumeRole` action. The permissions to read and write to the DynamoDB table must be defined in a separate identity-based permissions policy attached to the role.

Step-by-Step Solution

Analyze the error message showing that AWS Lambda is not authorized to assume the role.

Identify that the trust policy must explicitly allow the `lambda.amazonaws.com` service principal to perform `sts:AssumeRole`.

Before a Lambda function can execute, the AWS Lambda service must be allowed to assume its execution role.

Identify that the current trust policy document contains DynamoDB table actions instead of assumption actions.

Determine that these actions cannot remain in a trust policy because trust policies only control role assumption.

Trust policies are resource policies on the IAM role itself, meant only to authorize trusted principals to assume the role.

Separate trust relationships from identity permissions.

Move the DynamoDB actions to a standard identity-based permissions policy attached to the role, and configure the trust policy for `sts:AssumeRole`.

This configuration adheres to the AWS security model, where trust policies govern who can assume a role, and permissions policies govern what the assumed role can access.

Key Concept

Separation of IAM Trust Policies (defining which trust entities can assume the role) and Permissions Policies (defining access rights to AWS resources).

Question 1293Question →

A developer is configuring an AWS CodeBuild project to compile and package a Java application. The buildspec.yml file is placed in the root of the source repository and contains a valid artifacts section listing the target JAR file. The build execution completes with a status of SUCCEEDED, but no artifacts are uploaded to the destination Amazon S3 bucket. Which of the following is the most likely cause of this issue?

The artifact type in the CodeBuild project configuration is set to 'No artifacts'.

The buildspec.yml file is placed at the root of the source directory, but it must be moved to the target/ subdirectory where the JAR file is located.

The trust policy of the CodeBuild service role does not list the Amazon S3 service principal in the Principal element.

The target S3 bucket name is stored in Systems Manager Parameter Store, but the buildspec.yml retrieves it using the secrets-manager parameter type.

Show answer & explanation

Answer: The artifact type in the CodeBuild project configuration is set to 'No artifacts'.

Answer

The artifact type in the CodeBuild project configuration is set to 'No artifacts'.

The correct answer is correct because AWS CodeBuild requires the artifact output configuration to be enabled in the project configuration (e.g., set to Amazon S3) for it to upload the files specified in the buildspec.yml. When set to 'No artifacts', CodeBuild executes the build successfully but performs no upload actions.

Step-by-Step Solution

Analyze the build status and output.

The build status is SUCCEEDED, which means CodeBuild successfully executed all build phases defined in the buildspec.yml without encountering fatal errors.

Understanding the status helps rule out configuration errors that would cause execution failures, such as missing buildspec files or parameter retrieval errors.

Evaluate the artifact upload behavior in AWS CodeBuild.

CodeBuild relies on both the buildspec.yml file (which defines which files to upload) and the project configuration (which defines where to upload them).

If the project configuration is set to 'No artifacts', CodeBuild runs the build but does not look for or upload any output files.

Key Concept

AWS CodeBuild project configuration settings for artifacts override buildspec declarations.

Question 1294Question →

RideFlow is a ride-sharing platform that logs completed trips to an Amazon DynamoDB table. The table is configured with provisioned write capacity. The table's partition key is CityID and the sort key is TripTimestamp. During peak commute times, the platform experiences a high volume of writes for the city code NYC. As a result, the application logs ProvisionedThroughputExceededException errors, even though the total consumed write capacity units (WCUs) for the entire table are significantly below the provisioned threshold. Which strategy should a developer implement to resolve this throttling issue?

Modify the write logic to append a random numeric suffix to the CityID partition key, distributing the write workload across multiple partition keys.

Increase the visibility timeout of the upstream Amazon SQS queue that processes trip writes to allow the consumer more time to write to the table.

Modify the query logic to use a Scan operation with a filter expression on CityID and TripTimestamp to bypass partition level limits.

Hardcode the AWS credentials and configure a static retry limit of zero in the AWS SDK client configuration to prevent the SDK from retrying throttled requests.

Show answer & explanation

Answer: Modify the write logic to append a random numeric suffix to the CityID partition key, distributing the write workload across multiple partition keys.

Answer

Modify the write logic to append a random numeric suffix to the CityID partition key, distributing the write workload across multiple partition keys.

The correct solution is to modify the write logic to append a random numeric suffix to the CityID partition key. A single DynamoDB partition is limited to 1,000 WCUs. Since 'NYC' has a high volume of writes during peak times, it exceeds this partition-level limit even if the table's overall provisioned throughput is underutilized. Appending a random suffix distributes the writes across multiple partition keys (e.g., NYC_1, NYC_2) and thus across multiple physical partitions, resolving the hot partition throttling.

Step-by-Step Solution

Identify the cause of throttling from metrics

Determine that ProvisionedThroughputExceededException is occurring because writes are concentrated on a single partition key ('NYC') representing a hot partition.

DynamoDB partitions have a hard limit of 1,000 WCUs. Concentrating writes on a single key exhausts the partition's capacity even if the table's overall provisioned capacity is much higher.

Select a distribution mitigation strategy

Implement write sharding by appending a random suffix to the partition key.

By appending a random suffix (e.g., NYC_1, NYC_2), writes are distributed across multiple partition keys and therefore multiple physical partitions, avoiding the single-partition WCU limit.

Key Concept

Resolving hot partition keys and partition throttling via write sharding in DynamoDB.

Estimated Time:2m 0s

Question 1295Question →

An application deployed on Amazon ECS writes JSON-formatted logs to Amazon CloudWatch Logs. A sample log event is shown below:

{
"statusCode": 500,
"errorType": "DatabaseTimeoutException",
"message": "Connection to database timed out."
}

The developer needs to create a CloudWatch Metric Filter to count the occurrences of this specific database timeout error. Which filter pattern should the developer use to match logs where the statusCode is 500 and the errorType is exactly DatabaseTimeoutException?

{

.statusCode = 500 &&

.errorType = "DatabaseTimeoutException" }

[statusCode = 500, errorType = "DatabaseTimeoutException"]

{

.statusCode == 500 &&

.errorType == "DatabaseTimeoutException" }

fields statusCode, errorType | filter statusCode = 500 and errorType = "DatabaseTimeoutException"

Show answer & explanation

Answer: { $.statusCode = 500 &&$ .errorType = "DatabaseTimeoutException" }

Answer

The metric filter pattern {

.statusCode = 500 &&

.errorType = "DatabaseTimeoutException" } correctly filters JSON logs.

The correct metric filter pattern utilizes curly braces to specify a JSON log filter. Inside the braces, JSON properties are referenced using JSONPath-like notation starting with $. representing the root. The equality operator is a single = sign, and the logical combination uses &&.

Step-by-Step Solution

Identify the log format.

The log format is JSON.

Metric filters parse JSON logs differently than space-delimited text logs, requiring curly braces and JSON-path selectors like $. to parse key-value structures.

Determine the correct comparison operator and logical operator.

The comparison operator is = and the logical AND operator is &&.

AWS CloudWatch metric filters use a single = for equality checks and && for logical AND conditions.

Construct the final filter pattern.

{

.statusCode = 500 &&

.errorType = "DatabaseTimeoutException" }

This matches both properties in the JSON structure according to CloudWatch Metric Filter syntax specifications.

Key Concept

CloudWatch Logs Metric Filter JSON Syntax

Question 1296Question →

A software engineer is configuring security for a web application where clients send requests to a REST API hosted on Amazon API Gateway. The application uses an Amazon Cognito User Pool for user authentication. The engineer must restrict access to the REST API so that only authenticated users with a valid JSON Web Token (JWT) can call the endpoints, without writing custom code to decode or validate the tokens. Which solution meets these requirements with the least operational overhead?

Configure an Amazon Cognito authorizer on the API Gateway REST API, referencing the User Pool, and pass the identity token in the request header.

Configure a custom Lambda authorizer on the API Gateway REST API. In the Lambda function, fetch the JSON Web Key Set (JWKS), decode the token, and validate the token signature.

Configure an Amazon Cognito Identity Pool as the authorizer for the API Gateway REST API to automatically validate the user's JSON Web Token (JWT) token.

Create an IAM trust policy that allows API Gateway to assume an IAM role associated with the Amazon Cognito User Pool to validate each request.

Show answer & explanation

Answer: Configure an Amazon Cognito authorizer on the API Gateway REST API, referencing the User Pool, and pass the identity token in the request header.

Answer

Configure an Amazon Cognito authorizer on the API Gateway REST API, referencing the User Pool, and pass the identity token in the request header.

The correct solution uses an API Gateway Cognito authorizer linked to the Amazon Cognito User Pool. This is a built-in feature that automatically validates incoming JWT tokens (such as the ID token) without requiring any custom Lambda code, meeting all constraints with the lowest operational overhead.

Step-by-Step Solution

Identify the requirement to authenticate users using Amazon Cognito User Pools and authorize access to API Gateway without custom code.

Confirm that user identity validation must occur at the API Gateway layer without custom validation logic.

This helps narrow down the solutions to native integration options on API Gateway.

Evaluate built-in API Gateway authorizers and note that a Cognito Authorizer natively integrates with Cognito User Pools to validate tokens automatically.

Determine that the Amazon Cognito authorizer is the built-in mechanism designed for this specific scenario.

Using a native feature avoids the development and operational overhead of custom code or identity pools.

Pass the identity token (ID token) or access token generated by the User Pool in the request header (commonly Authorization) to the Cognito authorizer.

API Gateway automatically decodes, verifies, and validates the incoming token against the configured User Pool.

This ensures only authenticated clients with valid tokens are allowed to invoke the backend service.

Key Concept

API Gateway integration with Amazon Cognito User Pools using Cognito Authorizers

Estimated Time:1m 30s

Question 1297Question →

A developer is deploying a new version of a critical web application to AWS Elastic Beanstalk. The deployment must satisfy the following constraints:

- The application must maintain $100\%$ of its serving capacity throughout the deployment process to handle high user traffic without performance degradation.
- In the event of a deployment failure, the application must support an immediate rollback to the previous version without requiring a rolling update of the older version.
- The development team has approved a temporary increase in resource capacity to allow up to twice the normal instance count during the deployment.

Which deployment strategy will meet these requirements?

Immutable

Rolling with additional batch

Rolling

All-at-once

Show answer & explanation

Answer: Immutable

Answer

The Immutable deployment strategy satisfies all the constraints by maintaining full capacity during deployment, supporting immediate rollback, and utilizing a temporary doubling of instance resources.

The Immutable deployment strategy deploys the new version to a separate, temporary Auto Scaling group alongside the existing one. This preserves

100\%

capacity throughout the deployment. If health checks fail, the rollback is immediate because Elastic Beanstalk simply terminates the new Auto Scaling group without affecting the original instances. This strategy temporarily doubles the resource count, which is acceptable under the approved budget increase.

Step-by-Step Solution

Analyze the capacity requirement.

The application must maintain

100\%

capacity during the deployment. This rules out All-at-once (causes downtime) and Rolling (reduces capacity during deployment).

To identify strategies that can sustain the required traffic load without performance degradation.

Evaluate the rollback and budget constraints.

The rollback must be immediate and clean. Additionally, a temporary doubling of instance capacity is allowed. This matches the Immutable strategy, which deploys to a temporary Auto Scaling group and can be quickly terminated upon failure. Rolling with additional batch is ruled out because its rollback requires a slow rolling deployment of the older version.

To determine which of the remaining strategies satisfies both the recovery time objective and the resource availability parameters.

Key Concept

Understanding the trade-offs of AWS Elastic Beanstalk deployment strategies, specifically regarding capacity preservation, rollback mechanism, and temporary cost overhead.

Estimated Time:1m 30s

Question 1298Question →

A developer is containerizing a Go application that retrieves database credentials from AWS Secrets Manager using the AWS SDK for Go v2. During local development, the application is run in a Docker container using a non-root user (UID 1000) for security compliance. The developer mounts the host's `~/.aws` folder to `/home/appuser/.aws` inside the container. When the container starts, the application fails to authenticate with AWS and logs a credentials-not-found error.

*Security Notice: Writing plaintext credentials in code or container image definitions is strictly prohibited.*

Which action will resolve this local development credential issue?

Ensure the mounted host `.aws` directory and files have read permissions for UID 1000, and verify the `AWS_SHARED_CREDENTIALS_FILE` environment variable in the container is set to `/home/appuser/.aws/credentials`.

Modify the Go application source code to hardcode temporary credentials dynamically parsed from the CLI config output when initializing the SDK client config.

Modify the Secrets Manager resource policy to include an IAM assume role trust policy that automatically trusts the local container's Docker bridge network interface.

Store the database credentials in Systems Manager Parameter Store as standard parameters instead of Secrets Manager to bypass SDK authentication checks when running from a local environment.

Show answer & explanation

Answer: Ensure the mounted host `.aws` directory and files have read permissions for UID 1000, and verify the `AWS_SHARED_CREDENTIALS_FILE` environment variable in the container is set to `/home/appuser/.aws/credentials`.

Answer

The correct action is to ensure that the mounted host credentials directory is readable by the container's non-root user (UID 1000) and that the path to the credentials file is explicitly pointed to by the `AWS_SHARED_CREDENTIALS_FILE` environment variable. By default, host file permissions can block the non-root container user from accessing mounted credentials, causing credential resolution failures. Overriding the path via environment variables guarantees the SDK looks at the correct mount path.

Step-by-Step Solution

Analyze container execution context and permissions

Identify that the application runs inside the container under UID 1000, but the mounted host `.aws` directory may have host-specific permissions restricting read access to non-root container users.

Permissions of mounted directories from the host must match the container process user ID to allow file reading.

Configure SDK path overrides using standard environment variables

Set `AWS_SHARED_CREDENTIALS_FILE` to `/home/appuser/.aws/credentials` to explicitly direct the SDK client configuration loader to the mounted credentials location.

Overriding the shared credentials path ensures the default provider chain looks at the volume mount path regardless of system path resolutions.

Key Concept

AWS SDK credential lookup precedence and volume mount permissions in local containerized development.

Estimated Time:1m 30s

Question 1299Question →

A developer is configuring a blue/green deployment for an Amazon ECS service using AWS CodeDeploy. The developer wants to run a validation script to perform smoke tests before production traffic is routed to the new task set. The developer creates the following `appspec.yaml` file:

yaml
version: 0.0
Resources:
- TargetService:
Type: AWS::ECS::Service
Properties:
TaskDefinition: "arn:aws:ecs:us-east-1:123456789012:task-definition/my-app:1"
LoadBalancerInfo:
ContainerName: "my-app-container"
ContainerPort: 8080
Hooks:
- BeforeAllowTraffic:
- location: scripts/run-smoke-tests.sh
timeout: 300

During deployment, the CodeDeploy agent fails to parse the AppSpec file. How should the developer modify the AppSpec file to resolve this issue?

Replace the BeforeAllowTraffic script block with the Amazon Resource Name (ARN) of an AWS Lambda function that executes the validation logic.

Change the Resources section name to files and specify the destination path for the run-smoke-tests.sh script on the ECS container instances.

Update the IAM trust policy of the ECS Task Execution Role to allow the codedeploy.amazonaws.com service principal to assume the role.

Store the content of the validation script in AWS Systems Manager Parameter Store and reference the parameter path under the BeforeAllowTraffic hook.

Show answer & explanation

Answer: Replace the BeforeAllowTraffic script block with the Amazon Resource Name (ARN) of an AWS Lambda function that executes the validation logic.

Answer

Replace the BeforeAllowTraffic script block with the Amazon Resource Name (ARN) of an AWS Lambda function that executes the validation logic.

For Amazon ECS deployments, CodeDeploy AppSpec files require the hooks to reference the Amazon Resource Name (ARN) of an AWS Lambda function rather than a local file path. The script execution structure (location, timeout, runas) is only supported for Amazon EC2 and on-premises deployments. Replacing the script block with the Lambda ARN enables CodeDeploy to trigger the validation function properly.

Step-by-Step Solution

Analyze the target deployment platform and AppSpec configuration.

The target platform is Amazon ECS, and the AppSpec file defines Resources and Hooks sections.

Different compute platforms (EC2 vs ECS/Lambda) have different AppSpec validation schemas and lifecycle hook requirements.

Evaluate the syntax used under the BeforeAllowTraffic hook in the AppSpec file.

The developer specified a local script path ('location: scripts/run-smoke-tests.sh'), which is EC2-specific syntax.

For ECS deployments, CodeDeploy lifecycle hooks must map to an AWS Lambda function ARN rather than a local file path.

Select the correction that provides a valid AWS Lambda function ARN for the ECS hook.

Replacing the script block with a Lambda function ARN resolves the parser error.

This complies with the ECS AppSpec specification for Hook definitions.

Key Concept

For Amazon ECS and AWS Lambda deployments in CodeDeploy, AppSpec lifecycle hooks can only execute validation tests via AWS Lambda functions specified by their ARNs, not through local shell scripts.

Question 1300Question →

A company is updating an infrastructure stack deployed via AWS CloudFormation. The template contains an Amazon DynamoDB table that needs to be modified. The planned modification requires CloudFormation to replace the DynamoDB resource. The developer wants to ensure that the database's existing data is preserved and the resource is not deleted during this replacement, as well as if the stack is deleted in the future. Which configuration should the developer apply to the DynamoDB resource in the template?

Specify only DeletionPolicy with the Retain value, as this attribute automatically applies to both resource replacement updates and stack deletions.

Apply an UpdatePolicy attribute with the AutoSnapshot property set to true, and set the DeletionPolicy to Retain.

Specify both DeletionPolicy and UpdateReplacePolicy with the Retain value in the resource attributes.

Enable stack termination protection and configure a Systems Manager Parameter Store parameter to track the resource state.

Show answer & explanation

Answer: Specify both DeletionPolicy and UpdateReplacePolicy with the Retain value in the resource attributes.

Answer

Specify both DeletionPolicy and UpdateReplacePolicy with the Retain value in the resource attributes.

To protect a resource from being deleted during both stack updates (when a change requires resource replacement) and stack deletion, you must specify both the DeletionPolicy and UpdateReplacePolicy attributes and set their values to Retain (or Snapshot if supported). Setting DeletionPolicy only protects the resource when the stack is deleted or the resource is removed from the template, but does not prevent deletion of the old resource during a replacement update. UpdateReplacePolicy specifically controls the behavior when a resource is replaced during a stack update.

Step-by-Step Solution

Analyze the resource modification requirements in the AWS CloudFormation template.

Identify that the modification to the Amazon DynamoDB table will trigger a resource replacement during a stack update.

Certain property updates (such as changing a partition key) cannot be applied to an existing DynamoDB table and require CloudFormation to create a new table and delete the old one.

Evaluate resource protection attributes for both stack updates and stack deletion.

Determine that DeletionPolicy only protects resources when the stack is deleted or when the resource is removed from the template, while UpdateReplacePolicy protects resources when they are replaced during updates.

Using only DeletionPolicy would result in the deletion of the old DynamoDB table when it is replaced during a stack update.

Apply both attributes to the resource definition in the template.

Configure DeletionPolicy: Retain and UpdateReplacePolicy: Retain on the DynamoDB table resource.

This combination ensures the table is preserved (retained in the AWS account) during both resource replacement updates and stack deletion.

Key Concept

Managing resource lifecycle and preserving data during AWS CloudFormation stack updates and deletions using DeletionPolicy and UpdateReplacePolicy.

PreviousPage 65 / 78Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept