All practice questions

1542 questions

All types1,542 Multiple choice782 Multiple select746 Ordering14

A developer is configuring an AppSpec file in YAML format for an AWS CodeDeploy deployment targeting Amazon ECS. The developer needs to run a validation Lambda function immediately after the replacement task set is created, but before any traffic shifts to the new version. Which of the following configurations correctly implements this requirement?

Under the hooks section, define the AfterInstall lifecycle event and specify the ARN of the validation Lambda function.

Under the hooks section, define the ValidateService lifecycle event and specify the file path of a shell script to run the tests.

Under the files section, map the source file path to the ECS container path, and specify the ApplicationStart hook to trigger the Lambda function.

Under the hooks section, define the AfterInstall lifecycle event and use AWS Systems Manager Parameter Store to reference and execute the test script.

Show answer & explanation

Answer: Under the hooks section, define the AfterInstall lifecycle event and specify the ARN of the validation Lambda function.

Answer

Under the hooks section, define the AfterInstall lifecycle event and specify the ARN of the validation Lambda function.

For an Amazon ECS deployment using AWS CodeDeploy, the AppSpec file defines lifecycle hooks under the hooks section that trigger AWS Lambda functions. The AfterInstall hook is executed after the replacement task set is created but before any traffic is routed to it. This makes it the correct place to run validation tests.

Step-by-Step Solution

Identify the target compute platform for the CodeDeploy deployment.

The target platform is Amazon ECS, which uses an AppSpec file containing Resources and Hooks sections.

AppSpec file structures and valid lifecycle hooks differ significantly between Amazon ECS, AWS Lambda, and EC2/on-premises compute platforms.

Determine the correct lifecycle hook for the validation timing requirement.

The requirement is to validate after the replacement task set is created but before any traffic shifts. The AfterInstall hook corresponds to this stage.

In ECS deployments, AfterInstall is the hook that runs immediately after the new task set is provisioned.

Identify how validation tasks are executed on Amazon ECS.

Validation tasks are executed by specifying a Lambda function ARN under the target lifecycle hook.

Unlike EC2 deployments which run shell scripts, ECS deployments use Lambda functions to execute validation checks.

Key Concept

AWS CodeDeploy AppSpec lifecycle hooks for Amazon ECS

Question 1422Question →

A company runs a critical web application on AWS Elastic Beanstalk. The application must maintain $100\%$ of its capacity to handle peak traffic during updates. Additionally, if the new version fails post-deployment, the developer must be able to roll back to the previous version immediately with minimal service impact and without triggering a new application deployment.

Which two Elastic Beanstalk deployment strategies meet these requirements? (Select TWO).

Select all that apply

Blue/Green deployment

Immutable deployment

Rolling with additional batch deployment

Rolling deployment

All-at-once deployment

Show answer & explanation

Answer: Blue/Green deployment; Immutable deployment

Answer

Blue/Green deployment and Immutable deployment

Blue/Green deployment and Immutable deployment are correct because both strategies keep the original, healthy application instances running at

100\%

capacity while the new version is deployed and verified. In Blue/Green, a CNAME swap directs traffic to the new environment, and rolling back is as simple as swapping CNAMEs back. In Immutable, a temporary Auto Scaling group is created, and if the deployment fails, the temporary instances are terminated, instantly reverting traffic to the original instances without needing a new deployment.

Step-by-Step Solution

Analyze the capacity requirement.

Since the application must maintain

100\%

capacity, strategies that take existing instances offline without first adding capacity (such as Rolling and All-at-once) are ruled out.

To identify strategies that prevent latency spikes under peak load.

Analyze the rollback requirement.

The requirement specifies rollback without triggering a new deployment. In-place strategies (like Rolling with additional batch) require deploying the old version package again. Only strategies that keep the old environment/instances completely intact (Blue/Green and Immutable) support immediate rollback by swapping CNAMEs or terminating the new Auto Scaling group.

To identify strategies that avoid the overhead and time of redeploying the previous version in a failure scenario.

Key Concept

Elastic Beanstalk deployment strategies and their trade-offs regarding capacity and rollback mechanics.

Estimated Time:1m 30s

Question 1423Question →

A software company operates a multi-tenant SaaS application that stores client organization profiles in an Amazon DynamoDB table. To minimize read latency for authorization checks, the developer deployed an Amazon DynamoDB Accelerator (DAX) cluster. However, an administrative microservice updates these organization profiles by writing directly to the DynamoDB table. Consequently, users report that profile updates take up to five minutes to reflect in the main application. Which of the following developer actions will resolve this cache staleness issue most efficiently?

Configure the administrative microservice to perform write operations through the DAX cluster client rather than directly to the DynamoDB table.

Modify the main application to perform a full Scan operation on the DAX cluster every five minutes to refresh the cache for all client organization profiles.

Increase the provisioned read capacity units (RCUs) and write capacity units (WCUs) of the underlying DynamoDB table to handle the direct updates without partition throttling.

Configure the Lambda functions in the main application to initialize a new DAX client connection on every request rather than reusing the client across execution contexts.

Show answer & explanation

Answer: Configure the administrative microservice to perform write operations through the DAX cluster client rather than directly to the DynamoDB table.

Answer

Configure the administrative microservice to perform write operations through the DAX cluster client rather than directly to the DynamoDB table.

Directing writes through the DAX cluster client ensures that DAX performs a write-through operation. This updates the DAX cache (item cache) synchronously while writing to the DynamoDB table, so subsequent reads immediately see the updated configuration.

Step-by-Step Solution

Analyze the cache staleness behavior.

Identified that writes bypassing the DAX cluster do not invalidate or update the item cache in DAX, leading to stale reads until the Time to Live (TTL) expires.

Understanding how DAX maintains cache consistency is necessary to troubleshoot staleness issues.

Determine the write pattern needed for DAX.

DAX is designed as a write-through cache. Directing write operations through the DAX client updates both the cache and the underlying DynamoDB table.

Using a write-through pattern ensures the cache remains consistent with the database immediately after writes.

Key Concept

DAX Cache Consistency and Write-Through Strategy

Question 1424Question →

A developer is configuring an AWS CodeBuild project to deploy an infrastructure stack using AWS CloudFormation. The deployment process requires CloudFormation to assume a specific IAM service role named `CFNDeploymentRole` to create resources. The CodeBuild build container runs under an IAM role named `CodeBuildExecutionRole`.

Which two configuration steps must the developer perform to ensure the deployment succeeds? (Select two.)

Select all that apply

Attach an IAM policy to `CodeBuildExecutionRole` that grants the `iam:PassRole` action on the `CFNDeploymentRole` resource ARN.

Configure the trust policy of `CFNDeploymentRole` to allow the `cloudformation.amazonaws.com` service principal to assume the role.

Configure the trust policy of `CFNDeploymentRole` to allow the `codebuild.amazonaws.com` service principal to assume the role.

Attach an IAM policy to `CFNDeploymentRole` that grants `iam:AssumeRole` permission for the `CodeBuildExecutionRole` ARN.

Store the AWS access key ID and secret access key of an administrative IAM user as environment variables in the CodeBuild project configuration.

Show answer & explanation

Answer: Attach an IAM policy to `CodeBuildExecutionRole` that grants the `iam:PassRole` action on the `CFNDeploymentRole` resource ARN.; Configure the trust policy of `CFNDeploymentRole` to allow the `cloudformation.amazonaws.com` service principal to assume the role.

Answer

To ensure successful deployment, the developer must attach an IAM policy to `CodeBuildExecutionRole` granting `iam:PassRole` on `CFNDeploymentRole`, and configure `CFNDeploymentRole`'s trust policy to allow `cloudformation.amazonaws.com` to assume it.

To successfully deploy the stack, two main configurations are required. First, the CodeBuild execution role must have the authority to pass the deployment role to AWS CloudFormation, which is accomplished via the `iam:PassRole` permission. Second, the deployment role must allow CloudFormation to assume it, which is configured by adding `cloudformation.amazonaws.com` to the trust policy of the deployment role.

Step-by-Step Solution

Identify that the CodeBuild environment must pass the deployment role to AWS CloudFormation.

Determine that the build execution role (`CodeBuildExecutionRole`) requires `iam:PassRole` permissions on the deployment role.

When passing service roles to other AWS services, the calling entity must have the `iam:PassRole` permission.

Determine which service principal needs to assume the deployment role.

Identify that the trust policy of the deployment role (`CFNDeploymentRole`) must trust `cloudformation.amazonaws.com`.

Since AWS CloudFormation is the service executing the stack creation, it must be allowed to assume the service role.

Key Concept

IAM Role delegation and the use of the `iam:PassRole` permission to pass service roles to AWS services.

Question 1425Question →

An IoT telemetry collection service named FleetVibe writes real-time status updates from delivery trucks to an Amazon DynamoDB table. The table is configured with provisioned write capacity and uses the FleetDivision attribute (e.g., 'US-East', 'EU-West') as the partition key. During peak hours, the application experiences write throttling and throws ProvisionedThroughputExceededException errors, even though the total consumed write capacity is well below the table's provisioned limit. Application logs reveal that the client application immediately fails and drops data upon receiving the throttling errors. Which TWO actions should the developer take to resolve the write throttling and prevent data loss? (Select TWO.)

Select all that apply

Update the application schema to append a random numerical suffix to the FleetDivision partition key before writing, and adjust the read logic to query across the suffixes.

Configure the AWS SDK client in the application to use exponential backoff with jitter for automatic retries when throttling errors occur.

Increase the overall provisioned Write Capacity Units (WCUs) of the table to scale up the throughput limits.

Place an Amazon SQS queue in front of the table and set the SQS message visibility timeout to a low value like 2 seconds to force rapid retries.

Modify the client application to retrieve records using a sequential Scan operation with a FilterExpression on FleetDivision to bypass partition limits.

Show answer & explanation

Answer: Update the application schema to append a random numerical suffix to the FleetDivision partition key before writing, and adjust the read logic to query across the suffixes.; Configure the AWS SDK client in the application to use exponential backoff with jitter for automatic retries when throttling errors occur.

Answer

The correct solutions are to append a random numerical suffix to the partition key to distribute write traffic, and to configure the AWS SDK client to use exponential backoff with jitter to handle retries.

The correct actions are to append a random numerical suffix (sharding) to the FleetDivision partition key and to configure the AWS SDK client to use exponential backoff with jitter. Appending a random suffix distributes write requests across multiple physical partitions, which mitigates hot partition issues caused by low-entropy keys. Updating the SDK client to use exponential backoff and jitter ensures that the application handles transient throttling errors gracefully by retrying them over increasing, randomized intervals, preventing immediate failures and data loss.

Step-by-Step Solution

Identify the cause of throttling by comparing consumed throughput with provisioned throughput.

Throttling is localized to specific partition keys (hot partition issue) because overall consumed capacity is below the table limit.

Before applying fixes, the developer must determine if the bottleneck is a hot key design rather than overall table limit exhaustion.

Redesign the partition key schema to introduce entropy.

The application appends a random suffix to the FleetDivision partition key, distributing the write workload across multiple physical partitions.

Distributing the writes prevents any single partition from exceeding the 1,000 WCUs per second hard limit.

Enable robust retry logic in the AWS SDK client configuration.

The application retries transient failures using exponential backoff and jitter, preventing immediate client-side data loss.

Transient throttling can still occur during spikes; exponential backoff avoids overwhelming the database while ensuring all writes eventually succeed.

Key Concept

Resolving DynamoDB throttling issues requires distributing the workload evenly using partition key sharding (random suffixes) and handling client-side retries with exponential backoff and jitter.

Question 1426Question →

A developer is designing a smart-home mobile application that allows authenticated users to read their device telemetry data directly from an Amazon DynamoDB table. The solution must minimize backend server management and allow the mobile app to make direct, secure SDK calls to DynamoDB using temporary AWS credentials, restricting users to only access their own data. Which architecture should the developer implement to meet these requirements?

Configure an Amazon Cognito User Pool for user authentication and directory services, and an Amazon Cognito Identity Pool to exchange the User Pool tokens for temporary AWS credentials. Associate an IAM role with the Identity Pool that uses a policy with a dynamodb:LeadingKeys condition matching the Cognito identity ID.

Configure an Amazon Cognito User Pool for user authentication. Have the mobile application send the User Pool ID token directly in the authorization header of the AWS SDK client to perform DynamoDB operations.

Configure an Amazon Cognito User Pool for user authentication. Set up Amazon API Gateway with a custom Lambda Authorizer that parses the JWT, validates it against the User Pool, and performs the DynamoDB operations directly within the authorizer function.

Configure an Amazon Cognito Identity Pool as the user directory to manage user sign-ups and logins. Configure the mobile application to use the Identity Pool credentials to access DynamoDB, relying on application-side logic to filter data access.

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool for user authentication and directory services, and an Amazon Cognito Identity Pool to exchange the User Pool tokens for temporary AWS credentials. Associate an IAM role with the Identity Pool that uses a policy with a dynamodb:LeadingKeys condition matching the Cognito identity ID.

Answer

The correct architecture uses Cognito User Pools to authenticate the users, and Cognito Identity Pools to exchange those tokens for temporary AWS credentials. By applying a policy with a dynamodb:LeadingKeys condition matching the Cognito identity ID on the IAM role assumed via the Identity Pool, the developer achieves direct, fine-grained access control to the DynamoDB table with minimal operational overhead.

Step-by-Step Solution

Determine the authentication and directory mechanism.

Implement an Amazon Cognito User Pool to act as the identity provider, managing user registration, sign-in, and authentication tokens.

User Pools are specifically designed for user directories, handling authentication, and generating JSON Web Tokens (JWTs).

Determine the authorization and credential retrieval mechanism.

Implement an Amazon Cognito Identity Pool, configuring the User Pool as an authentication provider.

Identity Pools are designed to exchange authentication tokens (such as User Pool JWTs) for temporary, limited-privilege AWS credentials needed for direct SDK calls.

Apply fine-grained access control in the authorized IAM role.

Attach a policy to the Identity Pool's authenticated IAM role with a dynamodb:LeadingKeys condition set to the user's Cognito identity ID.

Using the dynamodb:LeadingKeys condition ensures that the authenticated user is restricted to reading and writing items in the DynamoDB table where the partition key matches their unique Cognito identity ID.

Key Concept

Integration of Amazon Cognito User Pools and Identity Pools for direct, fine-grained access to AWS services.

Estimated Time:2m 0s

Question 1427Question →

A developer is configuring a third-party SaaS monitoring application to collect performance metrics from Amazon EC2 instances in their AWS account. The SaaS vendor's application runs in AWS account 123456789012. The vendor requires a secure delegation mechanism using an external ID value of VendorTokenXYZ.

The developer creates an IAM role named SaaSMonitoringRole with the following trust policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
},
"Action": "sts:AssumeRole"
}
]
}

And attaches the following permissions policy to the role:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "ec2:Describe*",
"Resource": "*",
"Condition": {
"StringEquals": {
"sts:ExternalId": "VendorTokenXYZ"
}
}
}
]
}

However, the third-party application is unable to retrieve the EC2 metrics. Which of the following changes will resolve the authorization issue and follow security best practices?

Move the sts:ExternalId condition block from the permissions policy to the condition block of the trust policy.

Add the Principal element directly to the permissions policy and declare the third-party AWS account ID within it.

Modify the trust policy to change the allowed action from sts:AssumeRole to sts:AssumeRoleWithWebIdentity.

Create an IAM user with administrative permissions, generate access keys, and configure the third-party application to use these long-term credentials.

Show answer & explanation

Answer: Move the sts:ExternalId condition block from the permissions policy to the condition block of the trust policy.

Answer

Move the sts:ExternalId condition block from the permissions policy to the condition block of the trust policy.

The correct action is to move the sts:ExternalId condition block from the permissions policy to the trust policy of the IAM role. The sts:ExternalId context key is only populated during the AssumeRole operation handled by AWS STS. Once the role is assumed and the caller makes subsequent calls to Amazon EC2, the sts:ExternalId context key is no longer available, causing any policy checking this context key during EC2 operations to fail. Evaluating it in the trust policy ensures that the external ID is verified at the moment of role assumption.

Step-by-Step Solution

Analyze the IAM policies to identify where the sts:ExternalId condition is evaluated.

The sts:ExternalId context key is currently placed inside the identity-based permissions policy attached to the role.

This is incorrect because sts:ExternalId is only present in the request context during the sts:AssumeRole API call, not during subsequent calls to services like Amazon EC2.

Determine the proper location for the sts:ExternalId condition.

The condition must be placed within the trust policy of the IAM role.

The trust policy governs who can call sts:AssumeRole to obtain temporary credentials for the role. Placing the condition here allows AWS STS to validate the External ID when the SaaS application attempts to assume the role.

Modify the policies to follow standard security practices.

The permissions policy is updated to allow ec2:Describe* without the sts:ExternalId condition, and the trust policy is updated to include the Condition block checking the External ID.

This ensures successful role assumption and resource authorization while protecting against the confused deputy problem.

Key Concept

IAM trust policies vs permissions policies and the usage of External ID during AssumeRole operations

Estimated Time:1m 30s

Question 1428Question →

A sports media website uses Amazon DynamoDB to store and retrieve live match statistics. During high-profile matches, a sudden surge in read requests for a small set of popular matches results in DynamoDB throttling and increased latency. A developer decides to implement an Amazon DynamoDB Accelerator (DAX) cluster to optimize read performance. Which of the following developer actions are required to successfully cache these read operations and resolve the bottleneck? (Select two.)

Select all that apply

Configure the application to use the DAX SDK client to route API calls to the DAX cluster endpoint.

Ensure the application performs eventually consistent reads rather than strongly consistent reads for cached items.

Configure DynamoDB auto-scaling to dynamically increase the provisioned Read Capacity Units (RCUs) of the table during peak hours.

Refactor the read logic to perform a Scan operation with a filter expression instead of a Query to retrieve match statistics.

Implement AWS Systems Manager Parameter Store to manage and automatically rotate the IAM credentials used by the DAX cluster nodes.

Show answer & explanation

Answer: Configure the application to use the DAX SDK client to route API calls to the DAX cluster endpoint.; Ensure the application performs eventually consistent reads rather than strongly consistent reads for cached items.

Answer

Configure the application to use the DAX SDK client to route API calls to the DAX cluster endpoint, and ensure the application performs eventually consistent reads rather than strongly consistent reads for cached items.

To cache DynamoDB read requests using DAX, the application must interact with the cluster via the DAX client SDK. Additionally, DAX is designed to cache eventually consistent read operations in its item cache, whereas strongly consistent reads are forwarded directly to DynamoDB, bypassing the cache.

Step-by-Step Solution

Select the correct SDK client for caching operations.

The application code is updated to instantiate the DAX client SDK rather than the default DynamoDB client SDK, directing requests to the DAX cluster.

The standard SDK will bypass DAX entirely and communicate directly with DynamoDB, preventing caching from occurring.

Adjust the consistency model of read requests.

Ensure all read requests targeting cached items are set to eventually consistent (which is the default).

Strongly consistent reads are passed directly to the DynamoDB database by DAX and do not populate or read from the DAX item cache.

Key Concept

DynamoDB Accelerator (DAX) client configuration and read consistency caching rules

Question 1429Question →

A fitness tracking application named FitPulse records real-time workout metrics from users' smartwatches into an Amazon DynamoDB table. The table is configured with provisioned read and write capacity. The partition key is `WorkoutDate` (formatted as YYYY-MM-DD), and the sort key is `UserId`. During peak hours (e.g., weekday evenings), the application experiences a high volume of write failures, and the backend logs display `ProvisionedThroughputExceededException` errors, even though the total consumed write capacity is well below the table's provisioned limit. Which combination of actions will resolve this issue? (Select TWO options.)

Select all that apply

Redesign the partition key schema by appending a random suffix to the WorkoutDate to distribute writes across multiple partitions.

Configure the AWS SDK client in the application to use exponential backoff and jitter for write retries.

Increase the provisioned write capacity units (WCUs) of the DynamoDB table to accommodate the total aggregate throughput.

Modify the application to use a Scan operation instead of a Query operation to retrieve existing records before performing the write.

Increase the SQS queue's visibility timeout to give write consumers more time to retry throttling errors before message visibility expires.

Show answer & explanation

Answer: Redesign the partition key schema by appending a random suffix to the WorkoutDate to distribute writes across multiple partitions.; Configure the AWS SDK client in the application to use exponential backoff and jitter for write retries.

Answer

Redesign the partition key schema by appending a random suffix to the WorkoutDate to distribute writes across multiple partitions, and configure the AWS SDK client in the application to use exponential backoff and jitter for write retries.

The application is encountering partition throttling because using a low-cardinality value like WorkoutDate as the partition key concentrates all writes on the same day to a single physical partition (a hot key issue). Appending a random suffix to the WorkoutDate distributes writes across multiple partitions. Additionally, configuring the AWS SDK with exponential backoff and jitter helps the application gracefully handle transient throttling errors and retry requests.

Step-by-Step Solution

Analyze the error and metrics.

The ProvisionedThroughputExceededException occurs despite total consumed capacity being below provisioned limits, indicating a hot partition key issue where writes are concentrated on a single partition key (WorkoutDate).

Identifying the root cause is necessary before applying the correct optimization strategy.

Select a partition key distribution strategy.

By appending a random suffix to WorkoutDate, the data is distributed across multiple partitions, resolving the hot partition issue.

DynamoDB partitions are based on the partition key hash value; higher entropy prevents hot spots.

Configure application retry mechanisms.

Implementing exponential backoff and jitter in the SDK configuration allows the application to retry failed requests efficiently without overwhelming the database.

Transient network spikes or minor partition adjustments can still cause momentary throttling, which retries can mitigate.

Key Concept

Partition key sharding and SDK retry strategies are used to resolve DynamoDB partition-level throttling issues caused by hot keys.

Question 1430Question →

A developer is configuring an Amazon ECS task definition to deploy a containerized application on AWS Fargate. The application running inside the container needs to write records to an Amazon Kinesis data stream. During task startup, the Amazon ECS container agent must pull the private container image from Amazon Elastic Container Registry (Amazon ECR) and retrieve a database password from AWS Secrets Manager.

The developer creates an IAM role named AppTaskRole to grant the application access to the Kinesis data stream. However, when attempting to run the task, the container agent fails to pull the image and cannot retrieve the secret.

Which TWO actions must the developer perform to resolve this issue?

Select all that apply

Configure the task definition by specifying an IAM role with policies that allow ECR image pull and Secrets Manager read permissions as the Task Execution Role (executionRoleArn).

Configure the task definition by specifying the AppTaskRole, which contains Kinesis write permissions, as the Task Role (taskRoleArn).

Attach the ECR image pull and Secrets Manager read permissions directly to AppTaskRole and omit the Task Execution Role configuration in the task definition.

Modify the trust policy of the IAM roles to allow the ecs.amazonaws.com service principal to assume the roles.

Inject static AWS access keys and secret keys as container environment variables in the task definition to authenticate the application client.

Show answer & explanation

Answer: Configure the task definition by specifying an IAM role with policies that allow ECR image pull and Secrets Manager read permissions as the Task Execution Role (executionRoleArn).; Configure the task definition by specifying the AppTaskRole, which contains Kinesis write permissions, as the Task Role (taskRoleArn).

Answer

Specify an IAM role with ECR and Secrets Manager permissions as the Task Execution Role, and associate the AppTaskRole with Kinesis permissions as the Task Role in the task definition.

The correct configurations describe the separate roles required by ECS Fargate tasks: the Task Execution Role (executionRoleArn) is used by the ECS container agent to pull ECR images and retrieve Secrets Manager secrets, while the Task Role (taskRoleArn) is assumed by the application code running inside the container to make AWS API requests like writing to a Kinesis data stream.

Step-by-Step Solution

Differentiate between container agent tasks and application container tasks.

The ECS agent performs the image pull and secret resolution before container startup. The application container performs the Kinesis write operations during execution.

ECS Fargate separates operations performed by the infrastructure agent from operations performed by the application code itself.

Assign the appropriate role to the executionRoleArn configuration parameter.

The ECS agent is authorized to pull ECR images and read Secrets Manager secrets.

The Task Execution Role provides credentials to the ECS container agent.

Assign the AppTaskRole to the taskRoleArn configuration parameter.

The application code running inside the container receives credentials to write to the Kinesis data stream.

The Task Role provides credentials directly to the containerized application.

Key Concept

Distinguishing ECS Task Role from ECS Task Execution Role

Question 1431Question →

A developer is building a user management module for a web application. The user data is stored in an Amazon DynamoDB table where the partition key is $UserID$ . The developer needs to support two new query patterns: retrieving all users in a specific city ( $City$ ) sorted by their registration date ( $RegistrationDate$ ), and retrieving a user's details by their unique email address ( $Email$ ). The solution must optimize read latency and minimize consumed capacity. Which two actions should the developer take to meet these requirements?

Select all that apply

Create a global secondary index (GSI) with

City

as the partition key and

RegistrationDate

as the sort key.

Create a global secondary index (GSI) with

Email

as the partition key.

Create a local secondary index (LSI) with

Email

as the sort key.

Perform a Scan operation on the base table using a FilterExpression on the

Email

attribute.

Perform a Scan operation on the base table filtering by the

City

attribute, and then sort the results in the application code.

Show answer & explanation

Answer: Create a global secondary index (GSI) with $City$ as the partition key and $RegistrationDate$ as the sort key.; Create a global secondary index (GSI) with $Email$ as the partition key.

Answer

Create a global secondary index (GSI) with City as the partition key and RegistrationDate as the sort key, and create a GSI with Email as the partition key.

To support queries on attributes other than the base table partition key without executing full scans, the developer must use Global Secondary Indexes (GSIs). A GSI with City as the partition key and RegistrationDate as the sort key directly satisfies the city-based lookup and sorts the data efficiently. A GSI with Email as the partition key allows lookups by email without needing the UserID.

Step-by-Step Solution

Analyze the access pattern for retrieving users by City sorted by RegistrationDate.

Identify that because City is not the base table partition key, a Global Secondary Index (GSI) must be created with City as the partition key and RegistrationDate as the sort key to allow sorted queries.

GSIs support partition and sort keys that differ from the base table, and DynamoDB automatically sorts index items by the sort key within each partition.

Analyze the access pattern for retrieving user details by Email.

Identify that Email is a unique attribute but not the base table partition key. Creating a GSI with Email as the partition key allows direct, low-latency lookups.

A Local Secondary Index (LSI) cannot be used because querying it still requires the base table partition key (UserID), which is not available in an email-only lookup.

Evaluate and reject Scan operations.

Discard scan-based solutions since they read the entire table, leading to linear cost scaling and high latency.

Using Query operations on GSIs is the most efficient and cost-effective approach for these access patterns.

Key Concept

Using Global Secondary Indexes (GSIs) to support query patterns that use partition keys different from the base table primary key, avoiding expensive Scan operations.

Question 1432Question →

An agricultural IoT application named 'CropSense' collects hourly soil moisture data from thousands of sensors in a region. The sensor data is written to an Amazon DynamoDB table. The table is configured with a partition key of `SensorType` (which has only three distinct values: 'Moisture', 'Temperature', and 'Acidity') and a sort key of `Timestamp`. During peak reporting windows, the application experiences a high volume of `ProvisionedThroughputExceededException` errors, even though the total read/write capacity units consumed are well below the table's allocated capacity. Which of the following actions is the most appropriate way to resolve this throttling issue?

Increase the table's provisioned write capacity units (WCUs) to scale up the overall write throughput limit of the table.

Increase the visibility timeout of the upstream Amazon SQS queue to allow more time for the application to process each write request.

Redesign the partition key schema by appending a random or calculated numeric suffix to the partition key (e.g., Moisture_N, where

N

is a random integer between

1

and

10

) to distribute write operations across multiple partition keys.

Hardcode the AWS access keys directly within the SDK client initialization configuration to eliminate credential provider chain lookup latency.

Show answer & explanation

Answer: Redesign the partition key schema by appending a random or calculated numeric suffix to the partition key (e.g., Moisture_N, where $N$ is a random integer between $1$ and $10$ ) to distribute write operations across multiple partition keys.

Answer

Redesign the partition key schema by appending a random or calculated numeric suffix to the partition key (e.g., Moisture_N, where

N

is a random integer between

1

and

10

) to distribute write operations across multiple partition keys.

The throttling is caused by a hot partition key because the partition key (SensorType) has low cardinality (only three values). This concentrates writes on a small number of physical partitions, exceeding the partition-level throughput limits. Appending a random or calculated numeric suffix to the partition key distributes the write operations across a larger number of logical keys, solving the partition-level bottleneck.

Step-by-Step Solution

Analyze the DynamoDB table design and identify the partition key cardinality.

The partition key has only three distinct values: 'Moisture', 'Temperature', and 'Acidity'.

This low cardinality causes all writes to be directed to only three logical partitions, creating a hot partition issue.

Differentiate between table-level capacity limits and partition-level throughput limits.

Throttling occurs because the write volume to one of the three partitions exceeds the partition limit (e.g.,

1000

WCUs per second), even if the overall table capacity is not exceeded.

Scaling up total capacity (WCUs) will not help if individual partition limits are exceeded.

Implement write sharding by adding a suffix to the partition key.

Using a schema like `SensorType_N` distributes the data across multiple partitions.

This evenly distributes the write throughput workload, resolving the ProvisionedThroughputExceededException errors.

Key Concept

Write sharding (appending a suffix to partition keys) to distribute highly skewed workloads in Amazon DynamoDB.

Question 1433Question →

A developer is building a document conversion system that uses an Amazon SQS standard queue to trigger an AWS Lambda function. The Lambda function processes documents in batches of $10$ . During testing, the developer observes that if a single document in a batch fails to process due to a timeout, all $10$ documents in that batch are retried, causing duplicate processing for the successfully completed documents. Which configuration change should the developer make to ensure only the failed documents are reprocessed?

Decrease the SQS queue's visibility timeout to be lower than the Lambda function's timeout so that messages are returned to the queue faster.

Store the IDs of successfully processed documents in a global variable in the Lambda function's execution context to prevent them from being reprocessed when the function is reused.

Configure the event source mapping with ReportBatchItemFailures in the FunctionResponseTypes, and update the Lambda function to return the IDs of the failed messages in the response payload.

Initialize the Amazon SQS client within the Lambda function handler using hardcoded long-term AWS credentials of a user with SQS permissions, and manually delete each message as it finishes processing.

Show answer & explanation

Answer: Configure the event source mapping with ReportBatchItemFailures in the FunctionResponseTypes, and update the Lambda function to return the IDs of the failed messages in the response payload.

Answer

Configure the event source mapping with ReportBatchItemFailures in the FunctionResponseTypes, and update the Lambda function to return the IDs of the failed messages in the response payload.

By enabling ReportBatchItemFailures in the FunctionResponseTypes of the Lambda event source mapping, the Lambda service understands when only a subset of messages in a batch fails. The function returns a JSON payload containing the identifiers of the failed messages, allowing SQS to make only those specific messages visible again in the queue while successfully processed messages are deleted from the queue automatically.

Step-by-Step Solution

Identify the cause of batch reprocessing in SQS-Lambda integrations.

When a Lambda function returns an error or times out, the default behavior of the SQS event source mapping is to treat the entire batch as failed, returning all messages to the queue.

This is necessary to understand why successful messages are being reprocessed.

Select the native AWS mechanism for handling partial batch failures.

The ReportBatchItemFailures option allows the function to report specific message failures rather than failing the entire batch.

This avoids duplicate processing by letting the Lambda service delete the successfully processed messages.

Configure the Lambda function response format.

Return a JSON structure containing an array of object structures with the itemIdentifier key pointing to the failed message's MessageId.

This is the contract required by AWS Lambda when ReportBatchItemFailures is enabled.

Key Concept

Handling partial batch failures in SQS-Lambda event source mappings using ReportBatchItemFailures

Question 1434Question →

A developer is creating an AWS Lambda function that must write logs to Amazon CloudWatch Logs and read objects from an Amazon S3 bucket. The developer creates an IAM role with the necessary permissions policy attached. However, when the developer tries to create the Lambda function and associate it with this IAM role, the operation fails with an authorization error. The developer reviews the trust policy currently associated with the IAM role:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which action will resolve this issue and allow the Lambda function to run with the required permissions?

Modify the trust policy of the IAM role to change the Action element from sts:AssumeRole to cloudwatch:PutLogEvents and s3:GetObject.

Modify the trust policy of the IAM role to change the service principal in the Principal block to lambda.amazonaws.com.

Add the lambda:InvokeFunction permission directly to the Action element of the trust policy, and specify the Lambda function's ARN in the Principal block.

Initialize the AWS SDK clients inside the Lambda function code by passing the AWS access key ID and secret access key of an IAM admin user.

Show answer & explanation

Answer: Modify the trust policy of the IAM role to change the service principal in the Principal block to lambda.amazonaws.com.

Answer

Modify the trust policy of the IAM role to change the service principal in the Principal block to lambda.amazonaws.com.

The trust policy of an IAM role defines which security principal (in this case, an AWS service) is allowed to assume the role using the Security Token Service (STS). For an AWS Lambda function to assume the role, the service principal must be set to 'lambda.amazonaws.com'. Changing the principal from 'ec2.amazonaws.com' to 'lambda.amazonaws.com' resolves the authorization failure.

Step-by-Step Solution

Analyze the error message and the trust policy.

The trust policy allows the service principal 'ec2.amazonaws.com' to assume the role.

To determine why the Lambda service is unauthorized to assume the role.

Identify the required service principal for the Lambda function.

The AWS Lambda service needs to assume the role, which requires the principal 'lambda.amazonaws.com'.

Different AWS services require different service principals in their trust policies to assume execution roles.

Change the Principal.Service value in the trust policy.

Update the trust policy to allow 'lambda.amazonaws.com' to assume the role.

This allows the Lambda service to successfully assume the execution role when running the function.

Key Concept

IAM Trust Policies define which entities (such as AWS services) are allowed to assume an IAM role. A permissions policy defines what actions the assumed role can perform.

Question 1435Question →

A news publishing platform named 'PressPulse' records real-time article view events in an Amazon DynamoDB table. The table is configured with provisioned write capacity and uses ArticleCategory as the partition key. During breaking news events, views for a single category spike dramatically, resulting in ProvisionedThroughputExceededException errors, even though the total consumed capacity is well below the table's total provisioned threshold. Additionally, the application's SDK client fails immediately without retrying when a write request is throttled. Which TWO actions should the developer take to resolve the throttling and improve application resilience? (Select TWO.)

Select all that apply

Append a random integer suffix to the partition key value before writing to distribute the write load across multiple partition keys.

Configure the AWS SDK client to use exponential backoff and jitter for retrying throttled write requests.

Increase the visibility timeout of the Amazon SQS queue that buffers incoming page view events.

Execute a Scan operation with a filter expression on the backend to distribute read and write capacity usage.

Hardcode credentials for a secondary IAM user with full DynamoDB permissions in the SDK client configuration to bypass limits.

Show answer & explanation

Answer: Append a random integer suffix to the partition key value before writing to distribute the write load across multiple partition keys.; Configure the AWS SDK client to use exponential backoff and jitter for retrying throttled write requests.

Answer

To resolve the throttling and improve resilience, append a random integer suffix to the partition key value (write sharding) and configure the AWS SDK client to use exponential backoff and jitter for retries.

Appending a random integer suffix to the partition key (such as ArticleCategory) distributes the write load across multiple partition keys and physical partitions, alleviating the hot partition throttling issue. Configuring the AWS SDK client with exponential backoff and jitter allows the application to handle transient throttling errors gracefully by spreading out retry attempts.

Step-by-Step Solution

Analyze the cause of the ProvisionedThroughputExceededException.

Identify that a single ArticleCategory (the partition key) is receiving disproportionate traffic, creating a hot partition key.

Throttling occurs at the partition level when a single partition key's throughput limit is exceeded, even if the overall table capacity is not.

Implement write sharding by modifying the partition key schema.

Append a random integer suffix (e.g., ArticleCategory_1, ArticleCategory_2) to distribute writes across multiple partition keys.

This spreads the traffic across multiple physical partitions, resolving the hot partition issue.

Configure client-side error handling.

Modify the AWS SDK client settings to enable exponential backoff and jitter for failed requests.

This allows the client to retry throttled requests gracefully rather than failing immediately, smoothing out traffic spikes.

Key Concept

Resolving DynamoDB throttling issues caused by hot partition keys using write sharding and configuring client-side SDK retry logic with backoff and jitter.

Question 1436Question →

A software engineer is building a REST API using Amazon API Gateway. They set up the API to route incoming client requests directly to an AWS Lambda function using the proxy integration type. Which two statements correctly describe how data is exchanged between API Gateway and the backend function in this configuration? (Select TWO.)

Select all that apply

API Gateway passes the raw HTTP request details, including headers and query string parameters, directly to the Lambda function inside the event object.

API Gateway requires the developer to define Integration Request velocity templates to map query parameters into JSON before invoking the function.

The Lambda function must return its output in a specific JSON format containing fields such as statusCode, headers, and body.

API Gateway automatically wraps any custom string or raw object returned by the Lambda function in an HTTP 200 OK response.

API Gateway requires a custom Lambda authorizer to authenticate requests when utilizing a Lambda proxy integration.

Show answer & explanation

Answer: API Gateway passes the raw HTTP request details, including headers and query string parameters, directly to the Lambda function inside the event object.; The Lambda function must return its output in a specific JSON format containing fields such as statusCode, headers, and body.

Answer

In a Lambda proxy integration, API Gateway passes the raw HTTP request directly to the Lambda function inside the event object, and the Lambda function must return its response in a structured JSON payload containing the statusCode, headers, and body fields.

In a Lambda proxy integration, API Gateway passes the raw HTTP request (headers, query parameters, path variables, and body) directly to the backend function as a JSON event. Additionally, the backend function must return its response in a specific JSON structure with statusCode, headers, and body fields so that API Gateway can correctly format the HTTP response to the client.

Step-by-Step Solution

Analyze how request parameters and payloads are forwarded from API Gateway to Lambda in a proxy integration.

Confirm that the proxy integration passes the incoming request directly as the JSON event object to the function, without requiring integration mapping templates.

To identify that raw request details are directly available in the event parameter of the handler function.

Examine the output format required by the Lambda function for API Gateway to correctly construct the HTTP response.

Determine that the function must return a JSON payload with specific fields: statusCode, headers, and body.

To ensure API Gateway can map the function's output to a valid HTTP response instead of failing with a 502 Bad Gateway error.

Key Concept

The behavior and payload requirements of Amazon API Gateway Lambda Proxy Integration.

Question 1437Question →

A developer is deploying a new AWS Lambda function that must write log data to an Amazon DynamoDB table. To keep the code reusable across multiple environments (such as staging and production), the developer must avoid hardcoding the DynamoDB table name. Additionally, the Lambda function must be authorized to write data to the DynamoDB table. Which two configurations should the developer use to meet these requirements? (Select two.)

Select all that apply

Configure environment variables for the function to dynamically specify the DynamoDB table name.

Assign an IAM execution role to the Lambda function that contains permissions to write to the DynamoDB table.

Store the DynamoDB table name and AWS access keys directly within the function's code initialization.

Attach an IAM trust policy to the Lambda function that permits the DynamoDB service to assume the function's role.

Deploy the Lambda function inside a private subnet and configure a security group to block outbound internet traffic.

Show answer & explanation

Answer: Configure environment variables for the function to dynamically specify the DynamoDB table name.; Assign an IAM execution role to the Lambda function that contains permissions to write to the DynamoDB table.

Answer

To configure the function correctly, configure environment variables for the DynamoDB table name and assign an IAM execution role to the function with DynamoDB write permissions.

To dynamically change the target table name across different stages without redeploying code, the developer must use environment variables. To grant write permissions to the DynamoDB table, the developer must assign an IAM execution role to the Lambda function containing the correct policy permissions.

Step-by-Step Solution

Determine how to pass configuration metadata like table names dynamically to the function code.

Use Lambda environment variables to pass the DynamoDB table name, avoiding code changes when moving between staging and production environments.

This complies with serverless development best practices of separation of configuration from code.

Determine the mechanism to authorize the Lambda function to execute operations on DynamoDB.

Create an IAM role containing DynamoDB write permissions and configure it as the Lambda function's execution role.

Lambda requires an execution role to perform API calls against other AWS resources under its execution context.

Key Concept

Lambda Environment Variables and IAM Execution Roles

Question 1438Question →

A developer has an application that consumes messages from an Amazon SQS queue. The consumer application takes approximately 30 seconds to process each message. However, the developer notices that other consumers are picking up the same messages and processing them concurrently, leading to duplicate processing. Which configuration change should the developer make to resolve this duplicate processing issue?

Increase the visibility timeout of the SQS queue to a value greater than 30 seconds.

Decrease the visibility timeout of the SQS queue to a value less than 30 seconds.

Configure the SQS queue's SDK client with hardcoded AWS credentials to bypass message processing delays.

Increase the execution timeout of the consumer AWS Lambda function while keeping the SQS queue visibility timeout at 15 seconds.

Show answer & explanation

Answer: Increase the visibility timeout of the SQS queue to a value greater than 30 seconds.

Answer

Increase the visibility timeout of the SQS queue to a value greater than 30 seconds.

Increasing the SQS queue's visibility timeout to a value greater than the maximum message processing time (30 seconds) ensures that the message remains hidden from other consumers until the current consumer completes processing and deletes it from the queue.

Step-by-Step Solution

Analyze the time required by the consumer to process a message.

The consumer requires 30 seconds to process a message.

This establishes the minimum time the message must remain invisible to other consumers.

Compare the processing time with the default or configured SQS visibility timeout.

If the visibility timeout is shorter than 30 seconds, the message becomes visible to other consumers before the current consumer completes processing.

To identify why duplicate processing is occurring.

Adjust the SQS visibility timeout parameter.

Setting the visibility timeout to a value greater than 30 seconds ensures the consumer can process and delete the message.

This prevents other consumers from retrieving the message while it is being actively processed.

Key Concept

Amazon SQS Visibility Timeout

Question 1439Question →

A payment service in a microservices application publishes transaction events to an Amazon SNS topic. An invoice service and a shipping service are subscribed to this topic using Amazon SQS queues. The developer needs to ensure that the shipping service only processes messages where the transaction status is marked as 'Success', without modifying the code of the payment service. Which approach should the developer take to meet this requirement?

Decrease the visibility timeout of the SQS queue for the shipping service below the average message processing time to reject unwanted messages.

Deploy a Lambda consumer to inspect the events, using a shared global array in the execution context to track and filter states across distinct invocations.

Configure a custom Lambda function to intercept and filter the messages by initializing the AWS SDK client with hardcoded AWS access keys.

Configure an Amazon SNS subscription filter policy on the subscription for the shipping service queue.

Show answer & explanation

Answer: Configure an Amazon SNS subscription filter policy on the subscription for the shipping service queue.

Answer

Configure an Amazon SNS subscription filter policy on the subscription for the shipping service queue.

An Amazon SNS subscription filter policy is the correct mechanism because it enables message filtering natively at the subscription layer. By defining a filter policy on the SQS queue's subscription to the SNS topic, Amazon SNS will only deliver messages that have attributes matching the policy (e.g., status is 'Success'). This completely avoids modifying the payment service (publisher) and does not require deploying additional intermediate resources.

Step-by-Step Solution

Analyze the requirement to route messages selectively to a specific SQS queue without modifying the publisher's code.

Identify that the publishing service (payment service) sends all messages to an SNS topic, and the shipping service's queue is subscribed to this topic.

Understanding the current message flow helps determine where to apply the filtering logic.

Evaluate the native filtering capabilities of Amazon SNS and SQS.

Amazon SNS supports subscription filter policies, which allow subscribers to receive only a subset of messages based on message attributes.

Applying the filter at the subscription level avoids introducing extra components like Lambda or modifying the publisher code.

Configure the filter policy on the subscription representing the SQS queue for the shipping service.

The shipping service queue will only receive events where the status attribute matches 'Success', completing the requirement.

This implements the filter natively, efficiently, and securely.

Key Concept

Amazon SNS Subscription Filter Policies

Estimated Time:50s

Question 1440Question →

An e-commerce application uses a REST API in Amazon API Gateway to retrieve product inventory. The developer decides to transition the integration type of the GET method from a Lambda custom integration to a Lambda proxy integration. Following this change, clients receive an HTTP 502 Bad Gateway error. The Amazon CloudWatch logs for the integrated AWS Lambda function confirm that the function executes successfully and returns the raw inventory data. Which modification should the developer make to resolve this error?

Configure a Velocity Template Language (VTL) mapping template in the API Gateway Integration Response to format the response payload.

Format the Lambda function's output as a JSON object containing a `statusCode` integer, a `headers` object, and a stringified JSON `body`.

Configure a custom Lambda authorizer in API Gateway to intercept the execution result and map it to the correct Method Response.

Define the required response structure in the Method Response settings of the API Gateway console to automatically parse the raw Lambda return value.

Show answer & explanation

Answer: Format the Lambda function's output as a JSON object containing a `statusCode` integer, a `headers` object, and a stringified JSON `body`.

Answer

Format the Lambda function's output as a JSON object containing a `statusCode` integer, a `headers` object, and a stringified JSON `body`.

In a Lambda proxy integration, API Gateway does not map the response automatically or apply integration response templates. The Lambda function itself must return a JSON object with specific keys: `statusCode` (integer), `headers` (object), and `body` (string). If the Lambda function returns raw data or any other structure, API Gateway fails to parse it and returns a 502 Bad Gateway error to the client. Formatting the function's output with these keys resolves the error.

Step-by-Step Solution

Identify that the GET method uses a Lambda proxy integration.

Realize that under Lambda proxy integration, API Gateway passes the request and response through without integration mapping templates.

This determines that API Gateway expects the backend Lambda function to strictly conform to the required proxy response payload format.

Analyze the error (HTTP 502 Bad Gateway) and CloudWatch log success status.

Determine that the Lambda function itself runs fine but returns raw inventory data instead of the required envelope structure.

API Gateway requires the proxy return format (with keys like statusCode and body) to parse the response and map it to an HTTP client response.

Update the Lambda function's return statement to output the proper JSON response structure.

Modify the return value to be a JSON object with a statusCode integer (e.g., 200) and the inventory data as a stringified JSON body.

This matches the expected schema, allowing API Gateway to correctly parse the payload and return the inventory to the client.

Key Concept

Lambda Proxy Integration Response Format

Estimated Time:1m 30s

PreviousPage 72 / 78Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept