All practice questions

1542 questions

All types1,542 Multiple choice782 Multiple select746 Ordering14

An organization runs a critical web application on a fleet of Amazon EC2 instances managed by an Auto Scaling group. The developer needs to configure a deployment strategy for application updates that guarantees the application maintains 100% of its capacity throughout the deployment process. Additionally, if the new version fails health checks, the system must support the fastest possible rollback to the previous version with minimal operational overhead. The organization accepts the temporary additional cost of provisioning duplicate resources during the deployment.

Which two deployment strategies meet these requirements?

Select all that apply

Blue/green deployment

Immutable deployment

All-at-once deployment

Rolling deployment

Rolling with additional batch deployment

Show answer & explanation

Answer: Blue/green deployment; Immutable deployment

Answer

Blue/green deployment and Immutable deployment

Blue/green deployment and immutable deployment are the correct choices. Both strategies deploy the new version on new, separate resources while the original resources remain fully functional, ensuring 100% capacity is maintained. If a failure occurs, rollback is nearly instantaneous: traffic is directed back to the original instances (for blue/green) or the new resources are deleted (for immutable), requiring no redeployment overhead.

Step-by-Step Solution

Analyze capacity requirements.

The requirement specifies maintaining 100% capacity during deployment. This eliminates strategies that take existing instances offline, such as rolling deployment.

To ensure no performance degradation or downtime during the deployment.

Analyze rollback requirements.

The requirement specifies the fastest possible rollback. This eliminates strategies that require redeploying the old version in place, such as rolling with additional batch.

To minimize the mean time to recovery (MTTR) if a faulty version is deployed.

Evaluate remaining options against resource costs.

Both blue/green and immutable deployments deploy to new resources, maintaining 100% capacity of the old version and allowing instantaneous rollback (by switching DNS/routing or terminating new resources). Both meet the budget constraint because the organization accepts temporary duplicate resource costs.

To select the strategies that align with the cost profile and technical requirements.

Key Concept

Deployment strategies present different trade-offs among deployment time, capacity during deployment, rollback speed, and resource costs.

Question 1322Question →

A developer is configuring a blue/green deployment for an Amazon ECS service using AWS CodeDeploy. The deployment must execute a validation AWS Lambda function to verify the health of the new task set before shifting production traffic. The validation function requires access to a database password that must be automatically rotated every 30 days. Additionally, the CodeDeploy service itself requires permissions to manage the ECS deployment. Which combination of configurations should the developer use to meet these requirements?

Configure the BeforeAllowTraffic hook in the appspec.yaml file to invoke the validation Lambda function; store the database password in AWS Secrets Manager and enable automatic rotation; assign CodeDeploy a service role with a trust policy that allows codedeploy.amazonaws.com to assume the role.

Configure the BeforeInstall hook in the appspec.yaml file to invoke the validation Lambda function; store the database password in AWS Secrets Manager and enable automatic rotation; assign CodeDeploy a service role with a trust policy that allows codedeploy.amazonaws.com to assume the role.

Configure the BeforeAllowTraffic hook in the appspec.yaml file to invoke the validation Lambda function; store the database password in AWS Systems Manager Parameter Store as a SecureString parameter; assign CodeDeploy a service role with a trust policy that allows codedeploy.amazonaws.com to assume the role.

Show answer & explanation

Answer: Configure the BeforeAllowTraffic hook in the appspec.yaml file to invoke the validation Lambda function; store the database password in AWS Secrets Manager and enable automatic rotation; assign CodeDeploy a service role with a trust policy that allows codedeploy.amazonaws.com to assume the role.

Answer

The correct configuration uses the BeforeAllowTraffic hook in the appspec.yaml file to invoke the validation Lambda function, stores the database password in AWS Secrets Manager to support automatic rotation, and assigns CodeDeploy a service role with a trust policy that allows codedeploy.amazonaws.com to assume the role.

Step-by-Step Solution

Determine the correct CodeDeploy lifecycle hook in the appspec.yaml file for invoking validation tests on Amazon ECS.

The BeforeAllowTraffic hook is identified as the valid lifecycle hook for ECS deployments.

ECS deployments only support BeforeAllowTraffic and AfterAllowTraffic hooks for running validation Lambda functions, whereas BeforeInstall is an EC2 hook.

Select the AWS service to store the database password with automatic 30-day rotation support.

AWS Secrets Manager is selected.

AWS Secrets Manager natively supports automatic rotation of database credentials, whereas Systems Manager Parameter Store does not provide built-in automatic rotation.

Verify the trust policy configuration for the IAM role assumed by AWS CodeDeploy.

The trust policy must allow the codedeploy.amazonaws.com service principal to assume the role.

AWS CodeDeploy needs permission to interact with ECS on the developer's behalf. The trust relationship must be with codedeploy.amazonaws.com, not ecs-tasks.amazonaws.com.

Key Concept

AWS CodeDeploy deployment configuration for ECS including AppSpec lifecycle hooks, Secrets Manager integration, and IAM trust policies.

Estimated Time:1m 30s

Question 1323Question →

A developer has deployed a Java application on an Amazon EC2 instance. The application logs details, including multi-line stack traces, to a local file at `/var/log/app/output.log`. The developer has configured the unified Amazon CloudWatch agent on the instance to stream these logs to a CloudWatch Logs log group. However, when viewing the logs in the CloudWatch console, each line of a single Java stack trace appears as a separate log event, making troubleshooting difficult. Which action should the developer take to group each multi-line stack trace into a single log event?

Modify the CloudWatch Logs log group settings in the AWS Management Console to enable multi-line log detection.

Configure the `multi_line_start_pattern` parameter in the Amazon CloudWatch agent configuration file to define a regular expression matching the start of each logical log message.

Configure a CloudWatch metric filter with a regular expression that aggregates multiple incoming log streams based on a timeout value.

Attach an IAM policy to the EC2 instance role that grants the `logs:PutLogEvents` permission with a condition that enforces multi-line formatting.

Show answer & explanation

Answer: Configure the `multi_line_start_pattern` parameter in the Amazon CloudWatch agent configuration file to define a regular expression matching the start of each logical log message.

Answer

Configure the `multi_line_start_pattern` parameter in the Amazon CloudWatch agent configuration file to define a regular expression matching the start of each logical log message.

Configuring the `multi_line_start_pattern` parameter in the CloudWatch agent configuration file allows the agent to identify the start of a new log event using a regular expression (e.g., matching a timestamp). Any subsequent lines that do not match the pattern are treated as part of the current log event, ensuring that multi-line stack traces are correctly grouped and ingested as a single event.

Step-by-Step Solution

Identify where the log grouping needs to occur.

Determine that log grouping must happen at ingestion time on the source instance (EC2) rather than inside CloudWatch Logs.

Once logs are transmitted as separate events, CloudWatch Logs does not provide a feature to merge them back into a single event.

Locate the Amazon CloudWatch agent configuration file on the EC2 instance.

Access the JSON configuration file, typically located at `/opt/aws/amazon-cloudwatch-agent/bin/config.json`.

The agent configuration controls how log files are read and streamed.

Add the `multi_line_start_pattern` setting to the log file configuration section.

Specify a regex pattern (e.g., matching the timestamp format of the log) that indicates the beginning of a new log entry.

The agent will group all lines that do not match the start pattern into the current log entry, maintaining the integrity of the stack trace.

Key Concept

Handling multi-line log events with the CloudWatch Agent configuration

Estimated Time:1m 30s

Question 1324Question →

A developer is configuring a microservices application running on Amazon Elastic Kubernetes Service (Amazon EKS). The application needs to retrieve database credentials to connect to an Amazon RDS for Microsoft SQL Server database. The company's security policy requires that these credentials be encrypted at rest and automatically rotated every 30 days without manual intervention or application redeployment. Which TWO steps should the developer perform to meet these requirements securely? (Select TWO.)

Select all that apply

Store the database credentials in AWS Secrets Manager.

Configure AWS Secrets Manager to automatically rotate the credentials every 30 days using an AWS Lambda rotation function.

Store the database credentials in AWS Systems Manager Parameter Store as a SecureString parameter.

Configure an Amazon EventBridge scheduled rule to trigger a custom script that rotates the database password and updates the parameter in Systems Manager Parameter Store.

Hardcode the database credentials within the application's codebase and decrypt them at runtime using the AWS SDK and a customer managed key in AWS KMS.

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager.; Configure AWS Secrets Manager to automatically rotate the credentials every 30 days using an AWS Lambda rotation function.

Answer

Store the database credentials in AWS Secrets Manager and configure AWS Secrets Manager to automatically rotate the credentials every 30 days using an AWS Lambda rotation function.

Storing the database credentials in AWS Secrets Manager is correct because Secrets Manager is designed for storing sensitive data like database credentials and supports automatic rotation natively. Configuring Secrets Manager to use an AWS Lambda rotation function to update the database credentials every 30 days fulfills the rotation requirement with minimal operational overhead, since AWS provides pre-built Lambda templates for RDS database credential rotation.

Step-by-Step Solution

Select the appropriate credential storage service.

Choose AWS Secrets Manager over Systems Manager Parameter Store because only Secrets Manager natively supports managed automatic rotation.

Parameter Store does not have native automatic rotation features, which makes Secrets Manager the correct choice for credential rotation requirements.

Configure the secret rotation mechanism.

Associate the secret with a Lambda rotation function that updates both the database and the Secrets Manager secret value.

AWS Secrets Manager uses a Lambda function to perform the steps required to securely rotate database credentials on a schedule.

Key Concept

AWS Secrets Manager vs Systems Manager Parameter Store for credentials requiring rotation

Estimated Time:1m 30s

Question 1325Question →

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The template defines an AWS::Serverless::Function resource that needs to read and write items in an Amazon DynamoDB table defined in the same template. During initial testing, the function fails to access the table due to missing permissions. The developer wants to resolve this issue by applying the principle of least privilege using the most operationally efficient method that native AWS SAM features support. Which configuration should the developer add to the template to resolve the permission issue?

Add the Policies property to the AWS::Serverless::Function resource and reference the DynamoDBCrudPolicy policy template, passing the name of the DynamoDB table as a parameter.

Add an AssumeRolePolicyDocument property to the function's properties that grants dynamodb:PutItem and dynamodb:GetItem permissions, listing the DynamoDB service principal dynamodb.amazonaws.com as the trusted entity.

Create a separate standard AWS CloudFormation AWS::IAM::Role resource with the required DynamoDB permissions and attach it to the function, and remove the Transform: AWS::Serverless-2016-10-31 line from the top of the template to avoid resource parsing conflicts.

Store the required IAM policy JSON statement in AWS Systems Manager Parameter Store as a SecureString parameter, and use a dynamic reference in the function's Role property to fetch and apply the policy at runtime.

Show answer & explanation

Answer: Add the Policies property to the AWS::Serverless::Function resource and reference the DynamoDBCrudPolicy policy template, passing the name of the DynamoDB table as a parameter.

Answer

Add the Policies property to the AWS::Serverless::Function resource and reference the DynamoDBCrudPolicy policy template, passing the name of the DynamoDB table as a parameter.

The correct answer provides the most secure and operationally efficient configuration. Specifying the DynamoDBCrudPolicy policy template under the Policies property of the AWS::Serverless::Function resource allows SAM to generate a scoped IAM policy for the function that only permits read/write actions on the designated DynamoDB table.

Step-by-Step Solution

Analyze the permission requirements for the Lambda function.

The function requires read and write (CRUD) operations on a specific DynamoDB table.

This establishes the scope of permissions needed to satisfy the principle of least privilege.

Evaluate the native AWS SAM features for handling function permissions.

AWS SAM provides built-in policy templates (such as DynamoDBCrudPolicy) that allow developers to reference pre-defined permission scopes with minimal configuration.

Using native policy templates reduces template complexity compared to writing custom IAM policies.

Apply the policy template in the function's Properties block.

The DynamoDBCrudPolicy is added under the Policies attribute, specifying the target TableName.

This automatically creates the execution role with the correct permissions scoped only to the target table.

Key Concept

AWS SAM Policy Templates

Estimated Time:1m 30s

Question 1326Question →

A development team needs to deploy an update to an Amazon ECS service running on an EC2-backed cluster. The service currently runs 4 tasks. Due to strict budget limits, the cluster has no additional EC2 instance capacity to run extra tasks during the deployment. However, the service must maintain at least 50% of its capacity at all times to handle the baseline request volume. Which ECS service deployment configuration should the developer specify to meet these requirements?

Set the minimum healthy percent to 50% and the maximum percent to 100%.

Set the minimum healthy percent to 100% and the maximum percent to 200%.

Set the minimum healthy percent to 100% and the maximum percent to 150%.

Set the minimum healthy percent to 0% and the maximum percent to 100%.

Show answer & explanation

Answer: Set the minimum healthy percent to 50% and the maximum percent to 100%.

Answer

Set the minimum healthy percent to 50% and the maximum percent to 100%.

The correct option sets the minimum healthy percent to 50% and the maximum percent to 100%. This ensures that at least 2 tasks remain running at all times to handle baseline traffic. Because the maximum percent is 100%, ECS will not attempt to exceed 4 tasks at any point, meaning it will first terminate 2 old tasks to free up space on the existing EC2 hosts before launching 2 new tasks.

Step-by-Step Solution

Analyze the service configuration and constraints.

Current tasks = 4. Target minimum capacity = 50% (2 tasks). Additional EC2 capacity = 0.

To ensure no extra EC2 capacity is used, the maximum percent must not exceed 100%.

Evaluate the rolling update deployment parameter mathematical constraints.

Maximum percent of 100% means the service cannot exceed 4 concurrent tasks. Minimum healthy percent of 50% means at least 2 tasks must remain active.

This forces ECS to stop 2 tasks first, freeing up slot capacity on existing instances, and then start 2 new tasks.

Select the matching configuration option.

Minimum healthy percent = 50%, Maximum percent = 100%.

This is the only configuration that maintains the baseline service capacity without requiring extra EC2 instances.

Key Concept

Amazon ECS Rolling Update deployment parameters (minimumHealthyPercent and maximumPercent) control the task lifecycle and capacity requirements during a deployment.

Estimated Time:1m 30s

Question 1327Question →

A developer is implementing an AWS Lambda function in Account A (111122223333) that needs to retrieve sensitive configuration data from an Amazon S3 bucket located in Account B (444455556666). The developer wants to use the AWS Security Token Service (STS) to assume an IAM role named CrossAccountS3Reader in Account B to access the bucket. The Lambda function runs under an execution role named LambdaExecutionRole in Account A.

Which of the following actions must the developer perform to establish this cross-account access? (Select TWO.)

Select all that apply

Modify the trust policy of the CrossAccountS3Reader role in Account B to allow the LambdaExecutionRole ARN from Account A to perform the sts:AssumeRole action.

Attach a permissions policy to the LambdaExecutionRole in Account A that grants sts:AssumeRole permission on the CrossAccountS3Reader role ARN in Account B.

Hardcode the AWS access key ID and secret access key of an IAM user created in Account B directly into the Lambda function's initialization code.

Update the trust policy of the CrossAccountS3Reader role in Account B to specify the service principal lambda.amazonaws.com as the trusted entity.

Attach a resource policy to the Lambda function in Account A that allows the CrossAccountS3Reader role in Account B to push credentials to the function.

Show answer & explanation

Answer: Modify the trust policy of the CrossAccountS3Reader role in Account B to allow the LambdaExecutionRole ARN from Account A to perform the sts:AssumeRole action.; Attach a permissions policy to the LambdaExecutionRole in Account A that grants sts:AssumeRole permission on the CrossAccountS3Reader role ARN in Account B.

Answer

Modifying the trust policy of the target role in Account B to trust the execution role in Account A, and attaching an STS assume role policy to the execution role in Account A.

The correct options state that you must modify the trust policy of the destination role in the target account to trust the source execution role, and attach a policy to the source execution role in the origin account allowing it to assume the destination role. Both parts are mandatory to establish cross-account trust.

Step-by-Step Solution

Configure the target role trust relationship

The trust policy of the CrossAccountS3Reader role in Account B is updated to list the ARN of LambdaExecutionRole from Account A as a principal and allow the sts:AssumeRole action.

This establishes trust from the destination account's perspective, permitting the identity from the source account to assume the role.

Grant assume role permissions to the source identity

An identity-based permissions policy is attached to LambdaExecutionRole in Account A, allowing the sts:AssumeRole action on the ARN of the CrossAccountS3Reader role.

This grants the source identity the necessary API permission to invoke the AWS STS assume role command.

Key Concept

Establishing cross-account IAM role assumption requires configuring both the trust policy on the target role to trust the source identity, and the identity permissions policy on the source identity to allow the AssumeRole call.

Question 1328Question →

A developer is building a mobile gaming application that requires authenticated users to save their game progress files directly to an Amazon S3 bucket. The game progress files must be stored in a folder path specific to each user. Additionally, the application needs to call a secure REST API hosted on Amazon API Gateway to post high scores. The developer wants to use Amazon Cognito for authentication and authorization with the least operational overhead.

Which TWO configurations must the developer implement to meet these requirements?

Select all that apply

Create an Amazon Cognito Identity Pool, configure the Cognito User Pool as an identity provider, and map authenticated users to an IAM role that grants access to the S3 bucket using the cognito-identity.amazonaws.com:sub variable in the resource path policy.

Configure an API Gateway Cognito Authorizer on the REST API methods, and configure the mobile app to include the Cognito User Pool identity token in the Authorization header of the requests.

Enable S3 bucket policies that grant read and write permissions to the Cognito User Pool client ID, and configure the mobile app to pass the Cognito access token directly to S3 APIs.

Deploy a custom Lambda Authorizer in API Gateway to parse the JSON Web Token, verify the cryptographic signature, and return an IAM policy allowing access to the REST API.

Implement a backend database routine to dynamically provision individual IAM Users and temporary access keys for each authenticated client, storing these access keys on the mobile device's local storage.

Show answer & explanation

Answer: Create an Amazon Cognito Identity Pool, configure the Cognito User Pool as an identity provider, and map authenticated users to an IAM role that grants access to the S3 bucket using the cognito-identity.amazonaws.com:sub variable in the resource path policy.; Configure an API Gateway Cognito Authorizer on the REST API methods, and configure the mobile app to include the Cognito User Pool identity token in the Authorization header of the requests.

Answer

Create an Amazon Cognito Identity Pool to exchange User Pool tokens for temporary AWS credentials with user-specific S3 paths, and configure an API Gateway Cognito Authorizer to validate the Cognito identity token.

To secure the mobile game progress files in S3 and restrict access to user-specific folders, the developer must use Cognito Identity Pools to exchange User Pool tokens for temporary AWS IAM credentials. By defining an IAM policy using the cognito-identity.amazonaws.com:sub variable, the app enforces path-based access control. Concurrently, to validate incoming User Pool JWT tokens at API Gateway with minimal overhead, the developer should configure the built-in Cognito Authorizer on the REST API resources.

Step-by-Step Solution

Configure user authentication using an Amazon Cognito User Pool.

The mobile app can authenticate users, obtaining JSON Web Tokens (JWTs) including identity and access tokens.

This establishes user identities and handles authentication securely.

Integrate the Amazon Cognito User Pool with API Gateway.

An API Gateway Cognito Authorizer is configured to inspect the Authorization header and validate incoming identity tokens.

This secures API Gateway REST endpoints with minimal operational overhead.

Integrate the Amazon Cognito User Pool with a Cognito Identity Pool.

Authenticated users can exchange their JWTs for temporary AWS IAM credentials.

This allows the mobile client to make direct, secure API calls to Amazon S3.

Apply an IAM role policy to the Identity Pool's authenticated role using the cognito-identity.amazonaws.com:sub variable.

Users are restricted to accessing only S3 objects within their specific folder path.

This ensures data isolation and enforces the principle of least privilege.

Key Concept

Amazon Cognito User Pools handle user directory and authentication, whereas Cognito Identity Pools provide authorization to AWS resources by granting temporary IAM credentials. API Gateway Cognito Authorizers easily validate User Pool JWTs without custom code.

Question 1329Question →

A developer is setting up an automated canary deployment for an AWS Lambda function using AWS CodeDeploy. The deployment is defined by the following `appspec.yml` template fragment:

yaml
version: 0.0
Resources:
- MyLambdaFunction:
Type: AWS::Lambda::Function
Properties:
Name: "MyLambdaFunction"
Alias: "live"
CurrentVersion: "1"
TargetVersion: "2"

The developer needs to modify this configuration to execute a validation Lambda function before traffic shifting begins, and must configure the CodeDeploy service role with the correct trust relationship and permissions.

Which two actions should the developer take to meet these requirements? (Select TWO.)

Select all that apply

In the AppSpec file, add a Hooks section under the root level and configure the BeforeAllowTraffic lifecycle event to point to the validation Lambda function.

Configure the IAM service role used by AWS CodeDeploy with a trust policy that permits codedeploy.amazonaws.com to assume the role, and attach the AWSCodeDeployRoleForLambda managed policy.

In the AppSpec file, add a hooks section under the root level and configure the BeforeInstall lifecycle event to run a shell script that performs validation.

Configure the IAM service role used by AWS CodeDeploy with a trust policy that permits lambda.amazonaws.com to assume the role.

Configure the validation Lambda function to retrieve database credentials from AWS Systems Manager Parameter Store with automatic rotation enabled.

Show answer & explanation

Answer: In the AppSpec file, add a Hooks section under the root level and configure the BeforeAllowTraffic lifecycle event to point to the validation Lambda function.; Configure the IAM service role used by AWS CodeDeploy with a trust policy that permits codedeploy.amazonaws.com to assume the role, and attach the AWSCodeDeployRoleForLambda managed policy.

Answer

Add a Hooks section with BeforeAllowTraffic pointing to the validation Lambda function, and configure the IAM service role for AWS CodeDeploy with a trust policy that permits codedeploy.amazonaws.com to assume the role.

For AWS Lambda deployments, the AppSpec file uses the 'Hooks' section to trigger Lambda functions during lifecycle events. The 'BeforeAllowTraffic' event runs validation functions before the traffic shifting begins. Additionally, AWS CodeDeploy requires an IAM service role with a trust policy that allows the 'codedeploy.amazonaws.com' service to assume the role via 'sts:AssumeRole' so it can execute deployments on your behalf.

Step-by-Step Solution

Identify the correct AppSpec schema and lifecycle hooks for AWS Lambda deployments.

Confirm that the 'Hooks' section is used at the root level and 'BeforeAllowTraffic' is the valid event to run validation tests before shifting traffic.

Ensure validation logic is executed at the correct lifecycle stage for serverless deployments.

Configure the IAM trust policy for the CodeDeploy service role.

Ensure the trust policy allows the 'codedeploy.amazonaws.com' service to assume the role.

Allows AWS CodeDeploy to assume the role and execute the deployment operations.

Verify credentials storage and rotation configuration.

Avoid choosing Parameter Store for secrets that require native automatic rotation capabilities.

Avoid common configuration mistakes related to credential security.

Key Concept

AWS CodeDeploy Lambda Deployment Lifecycle Hooks and Service Role configuration

Estimated Time:2m 0s

Question 1330Question →

A developer is building a serverless web application that utilizes Amazon Cognito User Pools for user authentication and Amazon API Gateway REST APIs for backend services. The developer needs to secure the API Gateway endpoints so that only authenticated users can access them. The solution must validate the JSON Web Tokens (JWTs) provided by the client with the least amount of custom code and lowest operational overhead. Which solution should the developer implement to meet these requirements?

Configure an Amazon Cognito Identity Pool to exchange the User Pool token for temporary AWS credentials, and secure the API Gateway REST API using IAM authorization.

Create a custom API Gateway Lambda Authorizer that fetches the JSON Web Key Set (JWKS), validates the incoming token signature, and returns an IAM policy.

Configure an API Gateway Cognito User Pool Authorizer to directly validate the identity token passed in the request header.

Set up an API Gateway Lambda Authorizer that checks the user's group membership by making a synchronous DescribeUser API call to the User Pool on every request.

Show answer & explanation

Answer: Configure an API Gateway Cognito User Pool Authorizer to directly validate the identity token passed in the request header.

Answer

Configure an API Gateway Cognito User Pool Authorizer to directly validate the identity token passed in the request header.

Configuring an API Gateway Cognito User Pool Authorizer is the most efficient approach because it is a built-in feature of API Gateway. It automatically validates the identity token passed in the request header against the configured Cognito User Pool client, requiring no custom Lambda function or custom code validation.

Step-by-Step Solution

Identify the primary requirement

The goal is to authorize API Gateway REST API requests using JWTs issued by Amazon Cognito User Pools with minimal custom code and latency.

This establishes the constraints of the system (no custom code, low overhead).

Evaluate the native capabilities of API Gateway

API Gateway features a built-in Cognito User Pool authorizer.

The built-in authorizer natively processes incoming authorization headers containing Cognito tokens without requiring custom Lambda functions or IAM credential exchanges.

Select the optimal configuration

Configure the Cognito Authorizer on the API Gateway method and set the identity source to the Authorization header.

This configuration meets all criteria by delegating JWT validation directly to API Gateway, requiring zero code and incurring no additional execution overhead.

Key Concept

Amazon API Gateway Cognito User Pool Authorizers

Question 1331Question →

A developer is deploying a containerized application to Amazon ECS on AWS Fargate. The application code is designed to use the AWS SDK to retrieve database credentials from AWS Secrets Manager at startup.

The ECS task definition is configured with the following parameters:
- taskRoleArn set to ecs-app-task-role
- executionRoleArn set to ecs-app-execution-role

The developer attached an IAM policy allowing secretsmanager:GetSecretValue to the ecs-app-execution-role. However, when the container starts, the application throws an AccessDeniedException when executing the GetSecretValue SDK call.

What should the developer do to resolve this authorization failure?

Update the trust policy of the ecs-app-execution-role to allow the Secrets Manager service principal (secretsmanager.amazonaws.com) to assume the role.

Attach the IAM policy allowing secretsmanager:GetSecretValue to the ecs-app-task-role.

Configure the container application to retrieve credentials directly from the ECS Task Execution Role metadata endpoint.

Hardcode the AWS access key and secret key of a dedicated IAM user with Secrets Manager access in the application's SDK client initialization.

Show answer & explanation

Answer: Attach the IAM policy allowing secretsmanager:GetSecretValue to the ecs-app-task-role.

Answer

Attach the IAM policy allowing secretsmanager:GetSecretValue to the ecs-app-task-role.

The correct action is to attach the permission policy allowing secretsmanager:GetSecretValue to the ECS Task Role (ecs-app-task-role). When an application runs inside an ECS container and makes calls to AWS services using the AWS SDK, the SDK retrieves credentials from the task's credential provider, which are associated with the ECS Task Role. The ECS Task Execution Role is only used by the ECS container agent to perform lifecycle tasks on behalf of the container, such as pulling container images from Amazon ECR or writing logs to Amazon CloudWatch.

Step-by-Step Solution

Analyze the source of the API call.

The application code itself is using the AWS SDK at runtime to execute the GetSecretValue action.

This determines whether the task role or the execution role needs the permission.

Differentiate between the ECS Task Role and the ECS Task Execution Role.

The Task Role (taskRoleArn) provides permissions for the application container's SDK calls. The Task Execution Role (executionRoleArn) provides permissions for the ECS agent (e.g., pulling images, logging, or injecting secrets into environment variables).

Correctly routing permissions requires understanding which IAM entity is executing the action.

Reassign the permission policy.

Move or attach the IAM policy allowing secretsmanager:GetSecretValue to the ecs-app-task-role.

This resolves the authorization failure because the SDK client will assume the task role and successfully authenticate.

Key Concept

Distinction between ECS Task Role and ECS Task Execution Role for resolving runtime SDK authorization failures.

Question 1332Question →

A developer is updating a critical serverless application and needs to configure traffic shifting for a new version of an AWS Lambda function using AWS CodeDeploy. The deployment must meet the following requirements:

* Route exactly $10\%$ of traffic to the new version in the first increment.
* Allow at least $10$ minutes of monitoring for errors before shifting any additional traffic or completing the deployment.

Which two AWS CodeDeploy deployment configurations should the developer select to meet these requirements?

Select all that apply

CodeDeployDefault.LambdaCanary10Percent5Minutes

CodeDeployDefault.LambdaCanary10Percent10Minutes

CodeDeployDefault.LambdaLinear10PercentEvery1Minute

CodeDeployDefault.LambdaLinear10PercentEvery10Minutes

CodeDeployDefault.LambdaAllAtOnce

Show answer & explanation

Answer: CodeDeployDefault.LambdaCanary10Percent10Minutes; CodeDeployDefault.LambdaLinear10PercentEvery10Minutes

Answer

The correct configurations are CodeDeployDefault.LambdaCanary10Percent10Minutes and CodeDeployDefault.LambdaLinear10PercentEvery10Minutes.

The configurations CodeDeployDefault.LambdaCanary10Percent10Minutes and CodeDeployDefault.LambdaLinear10PercentEvery10Minutes both satisfy the requirements. The canary configuration shifts

10\%

of the traffic to the new version initially and waits

10

minutes before shifting the remaining

90\%

. The linear configuration shifts

10\%

initially and waits

10

minutes before shifting the next

10\%

increment, which allows the required

10

minutes of monitoring in both cases.

Step-by-Step Solution

Analyze the requirement for initial traffic allocation.

The configuration must shift exactly

10\%

of the traffic in the first increment. This rules out CodeDeployDefault.LambdaAllAtOnce, which shifts

100\%

immediately.

Identifying the initial increment size helps narrow down the candidates to Canary

10\%

and Linear

10\%

configurations.

Evaluate the monitoring window constraint of at least

10

minutes before shifting more traffic.

CodeDeployDefault.LambdaCanary10Percent5Minutes shifts the remaining traffic after

5

minutes, and CodeDeployDefault.LambdaLinear10PercentEvery1Minute shifts more traffic after

1

minute. Both fail the

10

-minute threshold.

Eliminating configurations that shift traffic too quickly ensures the deployment meets the safety window constraint.

Confirm the configurations that meet both constraints.

CodeDeployDefault.LambdaCanary10Percent10Minutes (shifts

10\%

and waits

10

minutes) and CodeDeployDefault.LambdaLinear10PercentEvery10Minutes (shifts

10\%

and waits

10

minutes before each subsequent shift) both satisfy the requirements.

Both configurations guarantee a

10\%

initial traffic split and a minimum of

10

minutes of evaluation time before further traffic modification.

Key Concept

AWS CodeDeploy deployment configurations for AWS Lambda functions specify how traffic is shifted between the original and new versions. Canary configurations shift a specified percentage in one increment and then shift the rest after a delay. Linear configurations shift traffic in equal increments at regular intervals.

Estimated Time:1m 30s

Question 1333Question →

A React Single Page Application (SPA) hosted on `https://portal.dev-ops-metrics.net` attempts to retrieve project status reports by sending an HTTP `GET` request to an Amazon API Gateway REST API. The API uses a Lambda proxy integration. Although the Lambda function executes successfully and returns a payload, the client application receives an HTTP `502 Bad Gateway` error with a response body of `{"message": "Internal server error"}`. The API Gateway CloudWatch execution logs display: `Execution failed due to configuration error: Malformed Lambda proxy response`. Which modification to the Lambda function's return payload will resolve this error?

Return a JSON object containing the `status` key with a numeric value and the `payload` key containing the raw data structure.

Return the raw data structure directly from the handler function, as API Gateway automatically wraps it in a standard HTTP response.

Return a JSON object containing the `statusCode` key with an integer value and the `body` key containing a stringified JSON representation of the data.

Return a JSON object containing the `statusCode` key and a `headers` key containing the `Access-Control-Allow-Origin` header set to `*`, omitting the `body` key.

Show answer & explanation

Answer: Return a JSON object containing the `statusCode` key with an integer value and the `body` key containing a stringified JSON representation of the data.

Answer

The Lambda function must return a JSON object containing the `statusCode` key with an integer value and the `body` key containing a stringified JSON representation of the data.

In an Amazon API Gateway REST API with Lambda Proxy integration, the backend Lambda function is responsible for constructing the complete HTTP response. The response returned by the Lambda function must be a JSON object (or dictionary) with specific keys, including `statusCode` (which must be an integer or string representing one) and `body` (which must be a string, often a stringified JSON object). Returning a response in this exact format allows API Gateway to successfully parse the result and return a valid HTTP response to the client application.

Step-by-Step Solution

Analyze the CloudWatch execution log error: `Execution failed due to configuration error: Malformed Lambda proxy response`.

Identify that the integration type is Lambda Proxy, which expects a specific JSON format from the backend Lambda function.

API Gateway requires the backend response to match a strict schema in proxy integrations to automatically construct the HTTP response.

Review the output structure required by API Gateway Lambda Proxy integration.

The output must contain the keys `statusCode` (an integer or stringified integer) and `body` (a stringified representation of the response data).

If these specific keys are missing or formatted incorrectly, API Gateway cannot parse the response and throws an HTTP 502 error.

Modify the Lambda function response return statement to conform to the required JSON schema.

Construct a response dictionary containing `statusCode` and a serialized JSON string in `body`, then return it.

This satisfies the API Gateway proxy schema, allowing it to correctly construct and return an HTTP 200 response to the client.

Key Concept

Lambda Proxy Integration Response Format

Estimated Time:1m 30s

Question 1334Question →

A developer is configuring a blue/green deployment for an Amazon ECS service using AWS CodeDeploy. The deployment must execute an AWS Lambda function to run validation tests on the replacement task set after test traffic is routed, but before production traffic is shifted. The validation tests require a database password that must be rotated automatically every 30 days. Additionally, CodeDeploy requires an IAM service role to perform the deployment. Which configuration should the developer implement?

Configure the CodeDeploy service role trust policy to allow ecs-tasks.amazonaws.com to assume the role, store the password in AWS Secrets Manager, and define the validation Lambda function under the AfterAllowTestTraffic hook in the AppSpec file.

Configure the CodeDeploy service role trust policy to allow codedeploy.amazonaws.com to assume the role, store the password as a standard parameter in Systems Manager Parameter Store, and define the validation Lambda function under the AfterAllowTestTraffic hook in the AppSpec file.

Configure the CodeDeploy service role trust policy to allow codedeploy.amazonaws.com to assume the role, store the password in AWS Secrets Manager, and define the validation Lambda function under the AfterAllowTestTraffic hook in the AppSpec file.

Show answer & explanation

Answer: Configure the CodeDeploy service role trust policy to allow codedeploy.amazonaws.com to assume the role, store the password in AWS Secrets Manager, and define the validation Lambda function under the AfterAllowTestTraffic hook in the AppSpec file.

Answer

The correct configuration requires the AWS CodeDeploy service role to have a trust policy allowing codedeploy.amazonaws.com to assume it. For storing credentials that need automatic rotation, AWS Secrets Manager is the appropriate service as it has native integration for rotation (unlike Systems Manager Parameter Store). In Amazon ECS deployments, validation tests are run using the AfterAllowTestTraffic lifecycle hook in the AppSpec file, which runs after test traffic is routed but before production traffic is allowed. ValidateService is an EC2-specific lifecycle hook and is not supported in ECS deployments.

Step-by-Step Solution

Determine the required IAM trust policy principal for the CodeDeploy service role.

The trust policy must allow the principal codedeploy.amazonaws.com to assume the role.

CodeDeploy requires permission to assume the service role to orchestrate the deployment on behalf of the developer.

Identify the proper storage service for a database password requiring automatic rotation.

AWS Secrets Manager must be used instead of Systems Manager Parameter Store.

Secrets Manager natively supports automatic rotation (e.g., every 30 days) via built-in integration, whereas Parameter Store does not support automatic rotation natively.

Select the correct lifecycle hook for running validation tests on an ECS blue/green deployment.

The validation Lambda function must be defined under the AfterAllowTestTraffic hook in the AppSpec file.

ECS blue/green deployments support validation tests after test traffic is routed using the AfterAllowTestTraffic hook. ValidateService is an EC2-specific hook and cannot be used in ECS deployments.

Key Concept

AWS CodeDeploy deployment configuration, IAM service roles, secret rotation, and ECS lifecycle hooks.

Estimated Time:2m 0s

Question 1335Question →

A developer is using AWS SAM to build and deploy a serverless application. The application consists of an Amazon API Gateway HTTP API that triggers an AWS Lambda function. During the initial deployment of the template using the AWS SAM CLI, the deployment fails with an error stating that the resource type 'AWS::Serverless::Function' is unrecognized. After addressing the deployment failure, the developer tests the API endpoint but receives a 502 Bad Gateway error, even though Amazon CloudWatch Logs show that the Lambda function executed successfully and returned the correct data. Which two actions must the developer take to resolve these issues?

Select all that apply

Add the Transform: AWS::Serverless-2016-10-31 declaration at the root of the template file.

Format the Lambda function's return value to be a JSON object containing the statusCode and body keys.

Modify the template to use a Lambda Custom Integration and configure a default integration response in API Gateway.

Update the Lambda function's IAM execution role trust policy to allow the apigateway.amazonaws.com service principal to assume the role.

Increase the Timeout property of the function under the Globals section of the template.

Show answer & explanation

Answer: Add the Transform: AWS::Serverless-2016-10-31 declaration at the root of the template file.; Format the Lambda function's return value to be a JSON object containing the statusCode and body keys.

Answer

The developer must add the Transform: AWS::Serverless-2016-10-31 declaration at the root of the template file and format the Lambda function's return value to be a JSON object containing the statusCode and body keys.

The deployment error is caused by the missing Transform header, which instructs CloudFormation to run the AWS SAM translator macro. The runtime 502 error is caused by the Lambda function returning a response format that API Gateway cannot parse for its proxy integration, requiring the output to be structured as a JSON object with statusCode and body.

Step-by-Step Solution

Diagnose the CloudFormation deployment failure.

Identify that the error 'AWS::Serverless::Function is unrecognized' indicates that CloudFormation does not know how to parse the SAM-specific resource.

AWS CloudFormation requires the Transform header to invoke the SAM translation service.

Add the Transform declaration.

Add 'Transform: AWS::Serverless-2016-10-31' at the root of the template.

This enables successful compilation and deployment of the SAM resources.

Diagnose the 502 Bad Gateway runtime error.

A 502 Bad Gateway error when the Lambda logs indicate success points to a response parsing failure by API Gateway.

In Lambda Proxy integrations, API Gateway expects a specific schema from the Lambda response, containing the status code and body.

Format the Lambda response.

Ensure the function returns a JSON response matching the proxy integration structure.

This allows API Gateway to successfully parse the response and return it to the client.

Key Concept

AWS SAM Template Validation and API Gateway Lambda Proxy Response Schema

Question 1336Question →

A developer is troubleshooting an application where an Amazon API Gateway REST API is secured using a custom Lambda authorizer. The authorizer validates a JSON Web Token (JWT) in the request header and returns an IAM policy. The Lambda authorizer has caching enabled with a Time to Live (TTL) of $300$ seconds, using the client's `Authorization` header as the cache key.

A client application makes a request to `GET /orders/1` with a valid token and successfully retrieves the resource. Immediately afterward, the same client sends a request to `POST /orders` using the same token. The client receives a HTTP 403 Forbidden response with the message `{"message":"User is not authorized to access this resource"}`. The CloudWatch logs show that the Lambda authorizer was not invoked for the second request.

Which of the following actions should the developer take to resolve this authorization failure? (Select TWO.)

Select all that apply

Update the Lambda authorizer function to return an IAM policy that specifies a wildcard in the resource path (e.g., `arn:aws:execute-api:region:account:apiId/stage/*`) to cover all methods and resources the client is permitted to access.

Disable authorization caching by setting the TTL to

0

seconds in the API Gateway console for the Lambda authorizer.

Replace the Lambda authorizer with an API Gateway Cognito User Pool authorizer and pass the same JWT token in the `Authorization` header.

Update the trust relationship of the Lambda function's execution role to allow the `apigateway.amazonaws.com` service principal to assume the role.

Configure the API Gateway API method authorization to require Cognito Identity Pool credentials, and update the client application to sign requests using AWS Signature Version 4.

Show answer & explanation

Answer: Update the Lambda authorizer function to return an IAM policy that specifies a wildcard in the resource path (e.g., `arn:aws:execute-api:region:account:apiId/stage/*`) to cover all methods and resources the client is permitted to access.; Disable authorization caching by setting the TTL to $0$ seconds in the API Gateway console for the Lambda authorizer.

Answer

Update the Lambda authorizer function to return an IAM policy with a wildcard in the resource path, and disable authorization caching by setting the TTL to

0

seconds in the API Gateway console.

The correct options are to update the Lambda authorizer function to use a wildcard in the resource path of the returned IAM policy, and to disable authorization caching by setting the TTL to

0

seconds. When caching is enabled, API Gateway caches the policy matching the cache key (the token). If the policy restricts access to the exact resource path of the first request (`GET /orders/1`), subsequent requests to other endpoints will fail with a 403 error because the cached policy does not authorize access to the new path. Using a wildcard in the resource path allows the cached policy to authorize other paths, while disabling caching altogether forces API Gateway to run the authorizer for every request.

Step-by-Step Solution

Analyze the HTTP 403 response and the CloudWatch logs.

The 403 Forbidden error indicates an authorization failure, and the logs show that the Lambda authorizer was not invoked for the second request, meaning API Gateway is using a cached policy from the first request.

Since the first request succeeded and caching is enabled with a TTL of

300

seconds, API Gateway cached the policy generated for the `GET /orders/1` resource.

Identify why the cached policy blocks the second request.

The cached policy restricts access to the resource of the first request (`GET /orders/1`). When the client attempts to access `POST /orders`, API Gateway evaluates the cached policy and blocks the request because the resource does not match.

By default, API Gateway caches the entire policy for the configured TTL under the specified cache key (the `Authorization` header).

Select the correct remediation strategies.

Updating the authorizer code to return a wildcard resource ARN (e.g., `arn:aws:execute-api:region:account:apiId/stage/*`) or disabling caching (setting TTL to

0

) resolves the issue.

Wildcards allow the cached policy to apply to all resources in the stage, while disabling caching forces API Gateway to evaluate each request dynamically.

Key Concept

API Gateway Lambda Authorizer Caching Behavior

Estimated Time:2m 0s

Question 1337Question →

A company is developing a mobile application that allows users to sign in using their enterprise SAML identity provider. After successful authentication, the mobile application needs to upload user-specific profile images directly to an Amazon S3 bucket, and make secure API calls to a backend REST API hosted on Amazon API Gateway. Which TWO configurations must the developer implement to meet these requirements?

Select all that apply

Configure an Amazon Cognito user pool with SAML federation for user authentication, and associate it with an Amazon Cognito identity pool to obtain temporary AWS credentials for Amazon S3 uploads.

Configure the API Gateway REST API to use a Cognito user pool authorizer to validate the ID or access tokens sent by the application.

Configure an Amazon Cognito user pool to generate temporary AWS IAM credentials and attach an IAM policy to the user pool to permit direct S3 uploads.

Create a custom API Gateway Lambda authorizer to extract, decode, and manually validate the signature of the Cognito JSON Web Tokens (JWT) for standard API access.

Create an IAM role with write permissions to the Amazon S3 bucket, hardcode its access keys in the mobile application, and use API Gateway resource policies to control API access.

Show answer & explanation

Answer: Configure an Amazon Cognito user pool with SAML federation for user authentication, and associate it with an Amazon Cognito identity pool to obtain temporary AWS credentials for Amazon S3 uploads.; Configure the API Gateway REST API to use a Cognito user pool authorizer to validate the ID or access tokens sent by the application.

Answer

Configure an Amazon Cognito user pool with SAML federation for user authentication, and associate it with an Amazon Cognito identity pool to obtain temporary AWS credentials for Amazon S3 uploads; and configure the API Gateway REST API to use a Cognito user pool authorizer to validate the ID or access tokens sent by the application.

The correct configurations involve using an Amazon Cognito user pool federated with the SAML provider for authentication, and integrating it with an Amazon Cognito identity pool to supply temporary AWS credentials to the client for Amazon S3 uploads. Additionally, the developer should secure the API Gateway REST API using the built-in Cognito user pool authorizer to validate user tokens.

Step-by-Step Solution

Set up federated authentication with SAML by configuring an Amazon Cognito user pool to manage the user directory.

Users can log in via their enterprise identity provider and receive Cognito JSON Web Tokens (JWTs) representing their authenticated session.

This establishes the identity of the users using the existing SAML identity provider.

Configure an Amazon Cognito identity pool, link the user pool as an identity provider, and map authenticated users to an IAM role with S3 write access.

The client application can exchange the user pool tokens for temporary AWS IAM credentials with permissions restricted to the user's specific S3 folder.

This enables secure direct uploads from the mobile application to S3 without exposing permanent credentials or routing uploads through an intermediary backend.

Configure the API Gateway REST API with a Cognito User Pool Authorizer pointing to the created user pool.

API Gateway automatically intercepts incoming API requests, extracts the authorization header token, and validates it against the user pool before forwarding the request to downstream integrations.

This secures the REST API endpoints using the built-in, low-overhead Cognito authorization mechanism.

Key Concept

Combining Amazon Cognito User Pools for authentication and Identity Pools for AWS resource authorization, alongside built-in API Gateway Cognito Authorizers for securing REST endpoints.

Question 1338Question →

A development team is deploying an updated AWS Lambda function using AWS CodeDeploy with a linear traffic-shifting configuration. Before any production traffic is routed to the new function version, the deployment process must run a separate validation Lambda function to perform smoke tests.

Which lifecycle hook must be specified in the `Hooks` section of the `appspec.yml` file to execute the validation function?

BeforeInstall

BeforeAllowTestTraffic

BeforeAllowTraffic

ValidateService

Show answer & explanation

Answer: BeforeAllowTraffic

Answer

BeforeAllowTraffic

The BeforeAllowTraffic lifecycle hook is one of the two hooks supported for AWS Lambda deployments in AWS CodeDeploy. It executes before traffic routing to the new Lambda version starts, which is the correct phase to run a validation function.

Step-by-Step Solution

Identify the target compute platform for the AWS CodeDeploy deployment.

The target compute platform is AWS Lambda.

Deployment lifecycle hooks in AWS CodeDeploy are platform-specific and differ between EC2/on-premises, Amazon ECS, and AWS Lambda.

Determine the required phase of the deployment for running the validation test.

The validation test must run before any production traffic is shifted to the new Lambda version.

Running tests early prevents routing production traffic to a broken or misconfigured version.

Select the appropriate Lambda-supported lifecycle hook from the available options.

The BeforeAllowTraffic hook is the correct hook that executes before traffic shifting begins.

AWS Lambda deployments in CodeDeploy support only BeforeAllowTraffic and AfterAllowTraffic hooks.

Key Concept

AWS CodeDeploy supports a specific set of deployment lifecycle hooks for AWS Lambda, which are different from those used for Amazon ECS and EC2. Specifically, only BeforeAllowTraffic and AfterAllowTraffic are valid for Lambda deployments.

Estimated Time:1m 0s

Question 1339Question →

A software team is designing a serverless microservice using the AWS Serverless Application Model (SAM). The architecture requires an API Gateway HTTP API that triggers a backend AWS Lambda function. The function must securely fetch database credentials at runtime and also publish messages to an Amazon SQS queue.

Which two configuration steps must be implemented to ensure the deployment succeeds and the function operates correctly?

Select all that apply

Declare the 'Transform' header with the value 'AWS::Serverless-2016-10-31' at the root of the template file to instruct CloudFormation to process the SAM syntax.

Under the function's Properties block in the template, define the 'Policies' key referencing the 'SQSSendMessagePolicy' SAM policy template with the target queue name.

Define a custom IAM execution role for the function and modify its trust policy to specify the SQS service principal ('sqs.amazonaws.com') as the trusted entity.

Store the database password in AWS Systems Manager Parameter Store as a standard string parameter, and reference it directly in the environment variables block.

Configure the Lambda function to return a plain text string payload, because API Gateway proxy integrations automatically format raw string return values into standard JSON responses.

Show answer & explanation

Answer: Declare the 'Transform' header with the value 'AWS::Serverless-2016-10-31' at the root of the template file to instruct CloudFormation to process the SAM syntax.; Under the function's Properties block in the template, define the 'Policies' key referencing the 'SQSSendMessagePolicy' SAM policy template with the target queue name.

Answer

The correct configurations are to declare the 'Transform' header with the value 'AWS::Serverless-2016-10-31' at the root of the template, and define the 'Policies' key referencing the 'SQSSendMessagePolicy' SAM policy template under the function's properties block.

Declaring the 'Transform' header with 'AWS::Serverless-2016-10-31' is mandatory for AWS SAM templates to convert serverless resource declarations into standard CloudFormation resources. Additionally, using the 'SQSSendMessagePolicy' template under the function's 'Policies' block is the standard, secure way in SAM to grant write permissions to an SQS queue without writing a full, custom IAM policy.

Step-by-Step Solution

Ensure the AWS SAM template contains the required header to parse SAM resource types.

The template includes 'Transform: AWS::Serverless-2016-10-31' at the root, enabling CloudFormation to recognize AWS::Serverless resource types.

Without this transform declaration, CloudFormation will fail to deploy, treating SAM resources as invalid.

Grant the Lambda function permission to send messages to the SQS queue using SAM policy templates.

The 'Policies' property under the Lambda function resource is configured with the 'SQSSendMessagePolicy' template pointing to the queue.

Using built-in SAM policy templates is the recommended method to grant granular permissions to a function efficiently.

Verify and avoid common security and integration misconfigurations.

IAM trust policies are set to 'lambda.amazonaws.com', database secrets are stored securely in Secrets Manager (not standard SSM parameter strings), and the function returns the correct proxy response format.

This prevents runtime integration failures, permission issues, and credential leakage.

Key Concept

AWS SAM templates require a Transform declaration at the root and support SAM policy templates to securely grant AWS resource permissions to serverless functions.

Estimated Time:2m 0s

Question 1340Question →

An application running on Amazon EC2 writes log events to a local file in a space-delimited text format. The CloudWatch agent is configured to send these logs to an Amazon CloudWatch Logs log group. A typical log event looks like this:

`2026-07-14 WARN req-8812 450 502`

The positions of the values represent `[timestamp, log_level, request_id, latency_ms, status_code]`.

A developer wants to create a metric filter to capture the latency of requests that result in either a `WARN` or `ERROR` log level. The metric filter must extract the `latency_ms` value to publish a custom metric. The developer's initial attempt at configuring the metric filter pattern is `{ $.log_level == "WARN" ||$ .log_level == "ERROR" }` with a metric value of `$.latency_ms`. This configuration does not match any log events and fails to publish the metric.

Which of the following changes must the developer make to the metric filter configuration to correctly parse the logs and extract the latency metric? (Select TWO.)

Select all that apply

Define the filter pattern using square brackets to name the fields, such as: `[timestamp, log_level = "WARN" || log_level = "ERROR", request_id, latency_ms, status_code]`

Specify the metric value as `$latency_ms` to reference the extracted field.

Define the filter pattern using curly braces to parse the fields, such as: `{

.log_level = "WARN" ||

.log_level = "ERROR" }`

Specify the metric value as `$.latency_ms` in the metric value field to match the JSON path syntax.

Reference the metric value as `latency_ms` without any prefix, as CloudWatch automatically maps the variable name from the pattern.

Show answer & explanation

Answer: Define the filter pattern using square brackets to name the fields, such as: `[timestamp, log_level = "WARN" || log_level = "ERROR", request_id, latency_ms, status_code]`; Specify the metric value as `$latency_ms` to reference the extracted field.

Answer

The filter pattern must be defined using square brackets to map the fields of the space-delimited log, and the metric value must reference the extracted variable using a dollar sign prefix.

To create a metric filter for space-delimited text logs (non-JSON), the filter pattern must use square brackets `[]` to define the positions of the fields, rather than curly braces `{}` which are reserved for JSON log formats. Additionally, when extracting a value to publish as a custom metric, the metric value field must reference the defined field name using a dollar sign prefix (e.g., `

latency_ms`) instead of JSON path dot notation (e.g., `

.latency_ms`).

Step-by-Step Solution

Identify the format of the application logs.

The log event is space-delimited, not JSON.

Understanding the log format determines whether to use JSON syntax (curly braces) or space-delimited syntax (square brackets).

Formulate the correct filter pattern syntax.

The filter pattern must use square brackets and single equal signs, resulting in `[timestamp, log_level = "WARN" || log_level = "ERROR", request_id, latency_ms, status_code]`.

Square brackets instruct CloudWatch to parse the log line as space-delimited tokens, and a single equals sign is used for comparison.

Determine the correct metric value reference syntax.

The metric value must be specified as `$latency_ms`.

For space-delimited logs, CloudWatch Logs requires variable references to be prefixed with a dollar sign to distinguish them from literal strings.

Key Concept

CloudWatch Logs Metric Filter pattern syntax differences between JSON and space-delimited log formats

Estimated Time:2m 0s

PreviousPage 67 / 78Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept