All practice questions

1542 questions

All types1,542 Multiple choice782 Multiple select746 Ordering14

A developer is implementing a decoupled transaction processing system. Transaction event messages are published to an Amazon SNS FIFO topic. An Amazon SQS FIFO queue is subscribed to the topic, and an AWS Lambda function consumes messages from the queue.

The system must satisfy these requirements:
- Transactions for the same bank account must be processed in the exact order they are received.
- If duplicate transactions with the exact same payload are published within a $5$ -minute window, only the first transaction should be processed.
- The AWS Lambda function takes up to $45$ seconds to process a single transaction.

During testing, the developer notices two issues:
1. Transactions for the same bank account are sometimes processed out of order.
2. Transactions that take longer than $30$ seconds to process are occasionally processed a second time by another Lambda invocation.

Which two of the following configuration changes will resolve these issues? (Select TWO.)

Select all that apply

Set the MessageGroupId of each published message to the unique bank account ID.

Set the Lambda function timeout to

45

seconds and configure the SQS queue's visibility timeout to at least

270

seconds.

Configure the SQS queue's visibility timeout to

15

seconds to ensure that any failed transaction processing is retried immediately.

Set the MessageDeduplicationId of each published message to the unique bank account ID.

Increase the Lambda function timeout to

45

seconds and reduce the SQS queue's visibility timeout to

30

seconds.

Show answer & explanation

Answer: Set the MessageGroupId of each published message to the unique bank account ID.; Set the Lambda function timeout to $45$ seconds and configure the SQS queue's visibility timeout to at least $270$ seconds.

Answer

Set the MessageGroupId of each published message to the unique bank account ID, and set the Lambda function timeout to

45

seconds and configure the SQS queue's visibility timeout to at least

270

seconds.

To resolve the ordering issue, the developer must set the MessageGroupId to the bank account ID. SQS FIFO uses the MessageGroupId to group messages that must be processed in sequence. Messages in the same group are processed one by one, while messages in different groups can be processed in parallel. To resolve the duplicate processing issue, the Lambda function timeout must be set to at least

45

seconds to accommodate the maximum processing duration. Furthermore, the SQS visibility timeout must be set to at least

6

times the Lambda function timeout (at least

270

seconds) to comply with AWS integration best practices, preventing premature message visibility resets during potential Lambda retries.

Step-by-Step Solution

Analyze the ordering requirement per bank account and select the proper SQS FIFO parameter.

Identify that the MessageGroupId must be set to the bank account ID to ensure that messages for the same bank account are processed sequentially by SQS FIFO.

SQS FIFO queues enforce ordering within a specific message group. Messages with different group IDs can be processed concurrently and out of order, which is desired, but messages with the same group ID are processed sequentially.

Address the duplicate processing issue caused by long-running transactions.

Determine the required Lambda function timeout and SQS visibility timeout values (

45

seconds and

270

seconds, respectively).

To prevent duplicate executions of messages that are still being processed, the Lambda function timeout must cover the maximum processing time (

45

seconds), and the SQS visibility timeout must be at least

6

times the Lambda timeout (

6 \times 45 = 270

seconds) per AWS integration guidelines.

Evaluate the duplicate detection requirement within a

5

-minute window.

Avoid configuring MessageDeduplicationId with high-collision values (like the bank account ID) or disabling deduplication.

Using the bank account ID as the MessageDeduplicationId would incorrectly block all transactions for that account for

5

minutes. SQS FIFO's content-based deduplication or a unique transaction ID should be used instead.

Key Concept

Message ordering, deduplication, and visibility timeout configurations in Amazon SQS FIFO and AWS Lambda integrations.

Estimated Time:2m 30s

Question 1442Question →

A developer is troubleshooting a serverless application where an AWS Lambda function is triggered by an Amazon SQS queue to process incoming batch jobs. The Lambda function has a configured timeout of $2$ minutes. The Amazon SQS queue has a visibility timeout of $30$ seconds. During testing, the developer observes that messages are frequently being processed multiple times by parallel Lambda invocations before being successfully deleted.

Which configuration change will resolve this issue?

Increase the visibility timeout of the Amazon SQS queue to at least

12

minutes.

Increase the timeout of the AWS Lambda function to

12

minutes.

Deploy the AWS Lambda function inside a private VPC subnet with no NAT Gateway.

Switch the SQS integration to use API Gateway Lambda Proxy integration to manage message routing.

Show answer & explanation

Answer: Increase the visibility timeout of the Amazon SQS queue to at least $12$ minutes.

Answer

Increase the visibility timeout of the Amazon SQS queue to at least

12

minutes.

Increasing the visibility timeout of the Amazon SQS queue to at least

12

minutes is the correct action. AWS recommends configuring the visibility timeout of the source SQS queue to at least

6

times the timeout of the Lambda function. Since the function has a timeout of

2

minutes, the queue's visibility timeout must be set to at least

12

minutes to ensure messages do not become visible to other concurrent invocations while the current execution is still running.

Step-by-Step Solution

Identify the relationship between the Lambda function timeout and the SQS visibility timeout.

The Lambda function timeout is

2

minutes (

120

seconds), whereas the SQS visibility timeout is only

30

seconds.

If the SQS visibility timeout is shorter than the Lambda function's processing time, the message becomes visible to other consumers before the current Lambda function finishes processing it, leading to duplicates.

Apply the AWS recommended formula for SQS visibility timeout when integrating with Lambda.

The SQS visibility timeout should be configured to at least

6

times the Lambda function timeout plus the batch window.

Calculating

6 \times 2 \text{ minutes} = 12 \text{ minutes}

ensures that the queue allows enough time for the Lambda function to process the batch and retry if necessary before making the message visible again.

Key Concept

Amazon SQS Visibility Timeout alignment with AWS Lambda Timeout

Question 1443Question →

An organization is exposing a database via a REST API using Amazon API Gateway. The developer configures an AWS Service Integration to retrieve user records directly from an Amazon DynamoDB table without using a compute layer like AWS Lambda. The API must receive requests containing a username path parameter, query the DynamoDB table, and return a simplified JSON payload to the client instead of the standard DynamoDB attribute-value JSON format. Which two configuration steps must the developer perform in API Gateway to meet these requirements?

Select all that apply

Create an Integration Request mapping template with an application/json Content-Type that uses Velocity Template Language (VTL) to format the payload for the DynamoDB GetItem action.

Configure an Integration Response mapping template with an application/json Content-Type to transform the DynamoDB attribute-value JSON response into the desired simplified client JSON schema.

Enable Integration Proxy settings on the API Gateway resource to allow automatic payload transformation and parameter mapping between API Gateway and DynamoDB.

Configure a Method Response mapping template to define the query parameters and payload schema sent to the DynamoDB integration endpoint.

Implement a Lambda Authorizer to validate the request credentials and rewrite the response payload received from the DynamoDB integration.

Show answer & explanation

Answer: Create an Integration Request mapping template with an application/json Content-Type that uses Velocity Template Language (VTL) to format the payload for the DynamoDB GetItem action.; Configure an Integration Response mapping template with an application/json Content-Type to transform the DynamoDB attribute-value JSON response into the desired simplified client JSON schema.

Answer

The correct configurations are to create an Integration Request mapping template using Velocity Template Language (VTL) to format the DynamoDB GetItem payload, and to configure an Integration Response mapping template to transform the DynamoDB attribute-value response into clean client-facing JSON.

For an AWS Service Integration directly communicating with a backend database like DynamoDB, API Gateway must translate the HTTP request into the database's native API structure, which is accomplished via an Integration Request mapping template. Similarly, the database's response must be transformed from the attribute-value layout to clean JSON via an Integration Response mapping template.

Step-by-Step Solution

Determine the type of integration needed.

Identify that a direct AWS Service Integration with DynamoDB is required, which utilizes custom mappings rather than a proxy integration.

Since there is no intermediate compute layer (like Lambda) and payload translation is needed, a non-proxy AWS Service Integration is the correct choice.

Configure the incoming data transformation.

Create an Integration Request mapping template using VTL to extract the path parameter and format the DynamoDB GetItem API payload.

DynamoDB APIs require a strict JSON structure containing keys and attribute type descriptors; the mapping template translates the REST client call into this structure.

Configure the outgoing data transformation.

Create an Integration Response mapping template to map the DynamoDB attribute-value response to simple JSON keys.

The database response contains raw DynamoDB JSON types (e.g., {'S': 'value'}). The template flattens this structure before delivering it to the client.

Key Concept

API Gateway AWS Service Integration mapping templates (Request and Response)

Estimated Time:2m 0s

Question 1444Question →

A smart-home application stores hourly temperature readings from thousands of devices in an Amazon DynamoDB table. The table is configured with DeviceID as the partition key and Timestamp as the sort key. A developer needs to retrieve all temperature readings for a specific device, 'device-123', that were recorded over the last 24 hours. Which DynamoDB API operation and configuration should the developer use to perform this retrieval with the lowest latency and cost?

Perform a Query operation with a key condition expression specifying the DeviceID and a range condition on the Timestamp.

Perform a Scan operation with a filter expression specifying the DeviceID and the range of Timestamp values.

Perform a Scan operation using an AWS SDK client that is initialized with hardcoded AWS access keys.

Increase the provisioned Read Capacity Units (RCUs) and perform a Scan operation across the entire table.

Show answer & explanation

Answer: Perform a Query operation with a key condition expression specifying the DeviceID and a range condition on the Timestamp.

Answer

Perform a Query operation with a key condition expression specifying the DeviceID and a range condition on the Timestamp.

A Query operation is the most efficient and cost-effective approach. Since the partition key (DeviceID) is known, a Query operation directly targets the partition containing the data. Using a range condition on the sort key (Timestamp) allows DynamoDB to read only the items within the desired 24-hour window, minimizing latency and the consumption of Read Capacity Units (RCUs).

Step-by-Step Solution

Analyze the table key schema and the retrieval requirements.

The table has a composite primary key consisting of a partition key (DeviceID) and a sort key (Timestamp), and we need to retrieve items matching a specific partition key value within a range of sort key values.

Understanding the key structure helps determine which DynamoDB retrieval operations are valid and efficient.

Evaluate DynamoDB API operations for efficiency.

The Query operation allows retrieving all items that share the same partition key and filters them based on the sort key condition, without scanning other partitions. The Scan operation reads all items across the entire table, which is highly inefficient.

Selecting the operation that reads the minimum amount of data ensures low latency and low RCU consumption.

Formulate the correct operation parameters.

Use the Query API with a key condition expression specifying DeviceID = 'device-123' and a range condition on Timestamp between the start and end of the 24-hour window.

This retrieves only the requested records directly from the specific partition.

Key Concept

Efficient item retrieval using DynamoDB Query instead of Scan.

Estimated Time:45s

Question 1445Question →

A logistics company uses a fleet of Amazon ECS tasks to process shipment tracking updates. The tasks poll messages from an Amazon SQS standard queue, retrieve the payload, and update an Amazon RDS database. The queue's default visibility timeout is configured to $45$ seconds. Most updates are processed within $15$ seconds; however, updates requiring complex database transactions can take up to $120$ seconds. During peak hours, the developer notices that complex updates are processed multiple times, causing duplicate entries in the database. Which solution will resolve this issue in the most efficient and resilient manner?

Modify the ECS task application to call the ChangeMessageVisibility API action using the message's receipt handle to extend the visibility timeout when processing exceeds the threshold.

Increase the default visibility timeout of the SQS queue to

150

seconds to accommodate the longest possible database transaction.

Convert the standard SQS queue to an SQS FIFO queue and enable content-based deduplication to prevent other consumers from receiving the same update.

Modify the ECS task application to delete the message from the queue immediately after retrieval, then process the database transaction.

Show answer & explanation

Answer: Modify the ECS task application to call the ChangeMessageVisibility API action using the message's receipt handle to extend the visibility timeout when processing exceeds the threshold.

Answer

Modify the ECS task application to call the ChangeMessageVisibility API action using the message's receipt handle to extend the visibility timeout when processing exceeds the threshold.

The correct answer is to modify the application code to call the ChangeMessageVisibility API action. When a consumer needs more time to process a message than the queue's default visibility timeout, calling ChangeMessageVisibility dynamically extends the timeout for that specific message using its receipt handle. This prevents other consumers from receiving it while it is actively being processed, without affecting the default visibility timeout of the queue. Keeping the default timeout at

45

seconds ensures that if other consumers fail during standard

15

-second updates, those messages will quickly become available for retry.

Step-by-Step Solution

Analyze the cause of duplicate processing.

Since complex updates take

120

seconds and the SQS default visibility timeout is only

45

seconds, the visibility timeout expires before the task completes and deletes the message. This makes the message visible to other ECS tasks, which retrieve and process it, leading to duplicates.

Understanding the mismatch between default visibility timeout and processing time is critical to selecting the correct resolution.

Evaluate the trade-offs of modifying queue configurations vs client-side changes.

Increasing the default visibility timeout statically to

150

seconds resolves the duplicates but slows down recovery for failed

15

-second tasks. Converting to FIFO doesn't solve consumption timeout issues.

Resolving the issue in a resilient and efficient manner requires avoiding configurations that negatively impact standard processing latency.

Apply dynamic visibility timeout management.

The application can monitor processing time and call ChangeMessageVisibility on demand using the message's receipt handle to extend visibility only for the specific complex tasks.

This is the AWS-recommended best practice for SQS queues with highly variable processing times.

Key Concept

Amazon SQS Visibility Timeout and ChangeMessageVisibility API

Question 1446Question →

A developer is configuring a REST API in Amazon API Gateway using an HTTP custom (non-proxy) integration to connect to a legacy backend HTTP service. The API must map the backend service's $503$ Service Unavailable response to a $504$ Gateway Timeout client response. Additionally, the backend service requires the client's IP address to be sent in a custom header named `X-Forwarded-For-IP` derived from the API Gateway context. Which TWO configuration steps must the developer perform in API Gateway to meet these requirements?

Select all that apply

In the Integration Request settings, add a header parameter mapping for `X-Forwarded-For-IP` with a source of `context.identity.sourceIp`.

In the Method Response settings, define a

504

HTTP status code, and in the Integration Response settings, create a mapping with an HTTP status regex of

503

mapping to the

504

method response status.

Enable HTTP Proxy integration and use an API Gateway request mapping template to map the `X-Forwarded-For-IP` header from `$context.identity.sourceIp`.

In the Integration Response settings, map the HTTP status regex of

503

to the

504

method response status, and define the

504

status code directly in the Integration Request settings.

Configure a custom Lambda authorizer to inject the `X-Forwarded-For-IP` header into the integration request and intercept the backend

503

response to modify the status code.

Show answer & explanation

Answer: In the Integration Request settings, add a header parameter mapping for `X-Forwarded-For-IP` with a source of `context.identity.sourceIp`.; In the Method Response settings, define a $504$ HTTP status code, and in the Integration Response settings, create a mapping with an HTTP status regex of $503$ mapping to the $504$ method response status.

Answer

In the Integration Request settings, add a header parameter mapping for `X-Forwarded-For-IP` with a source of `context.identity.sourceIp`. In the Method Response settings, define a

504

HTTP status code, and in the Integration Response settings, create a mapping with an HTTP status regex of

503

mapping to the

504

method response status.

To forward the client's IP, the developer must use the Integration Request settings to map `X-Forwarded-For-IP` to the context variable `context.identity.sourceIp`. To map the status code, the developer must declare the

504

response in the Method Response, and then create an Integration Response mapping with a regex of

503

to translate the backend error code to the client response code.

Step-by-Step Solution

Set up parameter mapping in the Integration Request.

The `X-Forwarded-For-IP` header is populated with the value of the client source IP (`context.identity.sourceIp`) and forwarded to the backend.

Custom integrations allow headers to be injected or overridden using context variables before calling the backend.

Configure the Method Response status code.

504

HTTP status is defined as a valid response code that the client can receive from this method.

API Gateway requires all status codes returned to the client to be declared in the Method Response first.

Map the backend status code to the Method Response in the Integration Response.

A backend

503

response matches the regex, triggering the mapping to return a

504

status code to the client.

This bridges the backend's response status code to the client's response status code.

Key Concept

API Gateway Custom HTTP Integration parameter and status mapping

Estimated Time:2m 30s

Question 1447Question →

A developer is writing an AWS Lambda function in Node.js to calculate order discounts. The developer declares a helper array, `appliedDiscounts`, outside of the handler function to store the discount codes applied during execution. During testing, the developer notices that subsequent invocations of the function return incorrect discounts because they contain discount codes from previous invocations. Which of the following actions should the developer take to resolve this issue?

Configure Provisioned Concurrency on the Lambda function to guarantee that each invocation runs in a newly created execution environment.

Set the `context.callbackWaitsForEmptyEventLoop` property to `false` to force the recycling of the execution environment after each invocation.

Move the initialization of the helper array inside the handler function.

Increase the visibility timeout of the incoming event source to automatically flush the global execution state between invocations.

Show answer & explanation

Answer: Move the initialization of the helper array inside the handler function.

Answer

Move the initialization of the helper array inside the handler function.

Moving the initialization of the helper array inside the handler function ensures that the array is declared and reset to empty on every execution. Since AWS Lambda frequently reuses execution contexts to optimize performance, variables declared globally (outside the handler) persist across invocations. For mutable data structures like arrays, this persistence leads to state leakage and incorrect calculations on subsequent invocations.

Step-by-Step Solution

Analyze the scope of the helper array variable.

The array is declared outside the handler function (globally).

Variables declared globally persist as long as the Lambda execution context is reused by subsequent invocations.

Identify the cause of incorrect discount calculations.

Subsequent executions append data to the same global array without resetting it.

Since the array is mutable and not cleared, state leaks from one execution to the next.

Determine the solution to reset the state for each request.

Move the array declaration and initialization inside the handler function.

Variables declared inside the handler are scoped to that specific execution and are fresh for every invocation.

Key Concept

AWS Lambda Execution Context Reuse and Variable Scoping

Estimated Time:1m 0s

Question 1448Question →

A developer is configuring an AWS Lambda function to process user upload notifications from an Amazon SQS standard queue. The Lambda function timeout is configured to $30$ seconds. However, the SQS queue's default visibility timeout is set to $10$ seconds. During performance tests, the developer notices that some upload messages are processed multiple times by different Lambda instances. Which action should the developer take to resolve this duplication issue?

Decrease the default visibility timeout of the Amazon SQS queue to

5

seconds.

Increase the Lambda function's timeout configuration to

180

seconds while leaving the queue's visibility timeout at

10

seconds.

Increase the default visibility timeout of the Amazon SQS queue to at least

180

seconds.

Hardcode temporary AWS credentials directly in the Lambda function's code to initialize the Amazon SQS SDK client and delete the message immediately upon invocation.

Show answer & explanation

Answer: Increase the default visibility timeout of the Amazon SQS queue to at least $180$ seconds.

Answer

Increase the default visibility timeout of the Amazon SQS queue to at least

180

seconds.

Increasing the SQS visibility timeout to at least 6 times the Lambda function's timeout (

180

seconds) ensures the Lambda function has enough time to finish processing the message and delete it from the queue before the message becomes visible to other concurrent Lambda invocations.

Step-by-Step Solution

Identify the cause of duplicate message processing.

The Lambda function's timeout of

30

seconds is longer than the SQS queue's visibility timeout of

10

seconds.

When processing takes longer than the visibility timeout, SQS makes the message visible to other consumers, leading to duplicate processing.

Apply the AWS recommendation for SQS visibility timeout when integrated with AWS Lambda.

The visibility timeout of the SQS queue should be configured to at least 6 times the timeout of the Lambda function.

This formula guarantees that even with retries or batch processing delays, the message remains hidden until Lambda finishes.

Calculate the required SQS visibility timeout value.

The minimum recommended visibility timeout is

6 \times 30 = 180

seconds.

Applying the multiplication factor gives the correct configuration value.

Key Concept

SQS Visibility Timeout configuration when integrated with AWS Lambda

Estimated Time:1m 0s

Question 1449Question →

A developer is deploying an AWS Lambda function that processes user sessions. The function must retrieve user profile data from an Amazon ElastiCache for Redis cluster located in a private subnet of a custom VPC. Additionally, the Lambda function needs to call the public AWS Secrets Manager API to retrieve database credentials. The developer configures the Lambda function's VPC settings with the private subnets and the security group of the VPC. During testing, the Lambda function successfully queries ElastiCache but times out when trying to call Secrets Manager. There are currently no VPC endpoints configured in the VPC.

How should the developer configure the VPC and Lambda settings to resolve this timeout issue?

Create an interface VPC endpoint for Secrets Manager within the private subnets, or configure a NAT Gateway in a public subnet and route outbound traffic from the private subnets through the NAT Gateway.

Configure the Lambda function to run in the public subnets of the VPC and ensure the VPC has an attached Internet Gateway to allow direct outbound communication to the Secrets Manager endpoint.

Assign a public IP address to the Lambda function by enabling the auto-assign public IP setting on the Elastic Network Interfaces (ENIs) created by the Lambda service in the private subnets.

Update the Lambda function's IAM execution role to include Secrets Manager as a trusted entity in the trust policy and grant the secretsmanager:GetSecretValue permission.

Show answer & explanation

Answer: Create an interface VPC endpoint for Secrets Manager within the private subnets, or configure a NAT Gateway in a public subnet and route outbound traffic from the private subnets through the NAT Gateway.

Answer

The correct answer states that the developer should create an interface VPC endpoint or configure a NAT Gateway. This is correct because the network timeout indicates the Lambda function running inside a private subnet does not have a network path to the public Secrets Manager endpoint. An interface VPC endpoint creates private network interfaces inside the private subnets for Secrets Manager. Alternatively, routing the private subnets' outbound traffic to a NAT Gateway located in a public subnet provides internet access to reach the public endpoint.

Step-by-Step Solution

Analyze the network timeout error during the Secrets Manager API call.

The Lambda function is deployed inside private subnets of a VPC and successfully communicates with the local ElastiCache cluster, indicating internal VPC routing is functional, but it cannot establish a route to the public internet.

Since the Lambda function resides inside a private subnet and has no access to the public internet or private endpoints for Secrets Manager, the outbound TCP handshake to the Secrets Manager public endpoint fails and times out.

Evaluate the subnet placement and IP constraints of AWS Lambda in a VPC.

Confirming that placing the Lambda function in public subnets will not resolve the issue, because Lambda functions do not receive public IPs and cannot route traffic through an Internet Gateway directly.

This rules out solutions that attempt to use public subnets or manually associate public IPs with the managed Elastic Network Interfaces.

Formulate a connectivity solution using either public egress or private endpoints.

Select either a NAT Gateway in a public subnet to route

0.0.0.0/0

outbound traffic from the private subnet to the internet, or provision an interface VPC endpoint (AWS PrivateLink) for Secrets Manager in the private subnets.

Both methods provide a valid routing path for the Lambda function to reach the Secrets Manager service endpoint without violating VPC security constraints.

Key Concept

AWS Lambda VPC networking and private endpoints

Question 1450Question →

An organization has a REST API exposed via Amazon API Gateway that routes client requests to a backend AWS Lambda function. To reduce Lambda invocation costs, the developer needs to validate that incoming JSON request payloads contain a required `accountId` string field before the requests are forwarded to the backend. If a request is invalid, API Gateway must return an HTTP 400 Bad Request response directly to the client without invoking the backend function.

Which configuration steps should the developer perform to meet these requirements?

Create a Model using JSON Schema to define the required `accountId` property, associate it with the method request body, and set the Method Request validator to validate the request body.

Configure a Lambda Proxy integration and use a Velocity Template Language (VTL) mapping template in the Integration Request to inspect the payload and reject invalid requests.

Configure a Lambda Authorizer to parse the incoming request body, validate the schema structure, and return an Allow policy only if the `accountId` field is present.

Set up a custom Gateway Response mapping template for the default Integration Response that validates the incoming payload before executing the integration.

Show answer & explanation

Answer: Create a Model using JSON Schema to define the required `accountId` property, associate it with the method request body, and set the Method Request validator to validate the request body.

Answer

Create a Model using JSON Schema to define the required `accountId` property, associate it with the method request body, and set the Method Request validator to validate the request body.

The correct option is to define a Model using JSON Schema, associate it with the request body in the Method Request settings, and enable the Request Validator to validate the request body. When request validation is enabled, API Gateway validates the request payload before forwarding it to the integration backend. If the validation fails, API Gateway immediately returns a 400 Bad Request response without invoking the integration (the backend Lambda function), minimizing Lambda executions and costs.

Step-by-Step Solution

Define a Model in API Gateway using a JSON Schema draft-4 structure that specifies `accountId` as a required property.

The API Gateway has a template to validate incoming payload structures against.

This establishes the validation contract for incoming payloads.

Go to the Method Request settings for the resource's POST/PUT method, configure the Request Body content type (e.g., application/json), and assign the created Model.

The method is now configured to expect payload structures adhering to the defined schema.

This links the model definition to the specific HTTP method request phase.

Set the Method Request's 'Request Validator' configuration to 'Validate body'.

API Gateway automatically validates the body against the Model before routing the request to the integration.

This ensures API Gateway blocks invalid requests at the method request layer, returning a 400 Bad Request without invoking the Lambda backend.

Key Concept

API Gateway Request Validation with Models

Estimated Time:2m 0s

Question 1451Question →

A developer is transitioning an Amazon API Gateway REST API from a Lambda custom (non-proxy) integration to a Lambda proxy integration. The backend Lambda function needs to access the client's IP address and a query string parameter named `version` that were previously mapped via a Velocity Template Language (VTL) mapping template. The Lambda function also must return a custom HTTP status code of `201 Created` along with a JSON payload.

Which TWO actions must the developer take to accomplish this transition successfully? (Select TWO.)

Select all that apply

Access the client's IP address from `event.requestContext.identity.sourceIp` and the query string parameter from `event.queryStringParameters.version` in the Lambda input event.

Update the Lambda function's return object to include a `statusCode` key with a value of `201` and a stringified JSON payload in the `body` key.

Configure an Integration Request mapping template in API Gateway to extract the IP address via `$context.identity.sourceIp` and pass it to the Lambda function.

Configure an Integration Response mapping template in API Gateway to map the custom JSON response keys to the HTTP `201` status code.

Deploy a Lambda Authorizer to validate the query string parameters and return the client's IP address inside the authorization context.

Show answer & explanation

Answer: Access the client's IP address from `event.requestContext.identity.sourceIp` and the query string parameter from `event.queryStringParameters.version` in the Lambda input event.; Update the Lambda function's return object to include a `statusCode` key with a value of `201` and a stringified JSON payload in the `body` key.

Answer

Access the client's IP address from the request context and the query string parameter from the query string parameters block in the Lambda input event, and update the Lambda function's return object to include a statusCode of 201 and a stringified JSON payload in the body.

In a Lambda proxy integration, Amazon API Gateway automatically maps the client request into a standard JSON event structure and passes it directly to the Lambda function. The developer can access the client's IP address from `event.requestContext.identity.sourceIp` and the query string parameter from `event.queryStringParameters.version`. Furthermore, the Lambda function is responsible for returning a response formatted according to the proxy integration contract, which requires an object containing a `statusCode` (such as `201`) and a stringified JSON payload in the `body` field.

Step-by-Step Solution

Analyze the change in request format from Custom to Proxy integration.

Identify that the Lambda input event is now a standardized proxy event payload instead of a custom JSON object created by a VTL template.

This determines where to look for the client's IP address and query string parameters.

Locate the client IP and query parameters in the proxy input event structure.

Find the client IP at `event.requestContext.identity.sourceIp` and the `version` parameter at `event.queryStringParameters.version`.

These locations are predefined in the AWS Lambda proxy integration event format.

Analyze the change in response format for Lambda proxy integration.

Identify that API Gateway bypasses Integration Response configurations and expects the Lambda function to return a structured JSON response.

This determines how the custom HTTP status code and response payload must be structured.

Structure the Lambda return object to match proxy integration requirements.

Return a JSON object containing the `statusCode` as `201` and the response payload as a stringified JSON string in the `body` field.

API Gateway will fail with a 502 Bad Gateway error if the response format does not match this structure.

Key Concept

Understanding the input and output payload contract for AWS Lambda Proxy integrations versus Custom integrations in Amazon API Gateway.

Question 1452Question →

A developer is implementing a financial ledger application where transaction updates must be processed in the exact order they are received, without duplicates. The developer configures a client application to publish transaction events to an Amazon SNS FIFO topic, which is subscribed to an Amazon SQS FIFO queue.

During testing, the developer observes that when a user performs two different transactions (a deposit followed by a withdrawal) within a $2$ -minute window, only the first transaction is successfully written to the ledger database. The second transaction message is never delivered to the SQS queue, and no errors are logged by the publisher or consumer. The SNS FIFO topic has Content-Based Deduplication disabled, and the developer is manually setting the `MessageDeduplicationId` to the user's account ID for both messages.

Which configuration change should the developer make to ensure that both transaction messages are successfully delivered and processed in the correct order?

Set the MessageDeduplicationId to a unique transaction ID for each message, and set the MessageGroupId to the user's account ID.

Increase the visibility timeout of the Amazon SQS FIFO queue to at least

5

minutes to prevent the second transaction from being hidden.

Set the MessageDeduplicationId to a static string like ledger_event and set the MessageGroupId to a unique transaction ID.

Increase the execution timeout of the consumer application to at least

5

minutes and configure the SQS FIFO queue to use content-based deduplication.

Show answer & explanation

Answer: Set the MessageDeduplicationId to a unique transaction ID for each message, and set the MessageGroupId to the user's account ID.

Answer

Set the MessageDeduplicationId to a unique transaction ID for each message, and set the MessageGroupId to the user's account ID.

Using a unique transaction ID as the MessageDeduplicationId ensures that different transactions within the

5

-minute window are recognized as distinct events and not discarded. Setting the MessageGroupId to the user's account ID ensures that all messages for that user are processed sequentially by the consumer.

Step-by-Step Solution

Analyze why the second message is being dropped without error.

The MessageDeduplicationId is set to the user's account ID. Amazon SNS/SQS FIFO topics and queues use the MessageDeduplicationId to discard duplicate messages sent within a

5

-minute window. Because both transactions share the same account ID, the second transaction is classified as a duplicate and silently discarded.

Understanding the deduplication mechanism of SNS/SQS FIFO is critical to identifying why messages fail to reach the consumer.

Determine the correct field values to achieve deduplication per transaction and ordering per user.

The MessageDeduplicationId must be unique for each distinct transaction (e.g., using a transaction ID). The MessageGroupId must be the same for messages that need to be processed sequentially (e.g., the user's account ID).

This configuration allows the system to deduplicate only actual duplicate retries while preserving the serial execution of transactions belonging to the same user.

Key Concept

FIFO message deduplication and message grouping using MessageDeduplicationId and MessageGroupId

Question 1453Question →

An application is running on an Amazon EC2 instance in Account A (111111111111). The application needs to read data from an Amazon DynamoDB table in Account B (222222222222) by assuming an IAM role named CrossAccountDynamoDBRole in Account B. The EC2 instance is launched with an IAM instance profile associated with the IAM role EC2AppRole in Account A.

Which IAM trust policy must be attached to the CrossAccountDynamoDBRole in Account B to allow the EC2 application to assume it?

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111111111111:role/EC2AppRole"
},
"Action": "sts:AssumeRole"
}
]
}

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111111111111:instance-profile/EC2AppInstanceProfile"
},
"Action": "sts:AssumeRole"
}
]
}

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111111111111:role/EC2AppRole"
},
"Action": "dynamodb:GetItem"
}
]
}

Show answer & explanation

Answer:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111111111111:role/EC2AppRole"
},
"Action": "sts:AssumeRole"
}
]
}

Answer

The trust policy that allows the IAM role EC2AppRole from Account A to assume the role in Account B using the action sts:AssumeRole.

The correct trust policy designates the IAM role in Account A (arn:aws:iam::111111111111:role/EC2AppRole) as the trusted principal and allows the sts:AssumeRole action. When the application on the EC2 instance calls AssumeRole, AWS STS verifies that the trust policy of the target role in Account B allows this specific role to assume it.

Step-by-Step Solution

Identify the principal that needs to perform the assume role action.

The identity calling sts:AssumeRole is the IAM role EC2AppRole associated with the EC2 instance in Account A (111111111111).

Since the application runs under the credentials of EC2AppRole, the trust policy in Account B must explicitly target this role's ARN as the principal.

Select the correct Action for the trust policy.

The action must be sts:AssumeRole.

Trust policies govern role assumption and must specify sts:AssumeRole as the allowed action.

Construct the trust policy JSON.

A policy statement containing Effect: Allow, Principal: AWS referencing the role ARN, and Action: sts:AssumeRole.

This structure satisfies both the principal identity and the STS action requirements.

Key Concept

Cross-account IAM role trust relationships

Estimated Time:1m 30s

Question 1454Question →

A developer is building a serverless data processing application. A Lambda function is triggered by an Amazon S3 object upload event. The function must download the uploaded file (which can be up to $4\text{ GB}$ in size), process the contents, and send the results to a third-party payment gateway endpoint on the public internet. The function also needs to log transaction details to an Amazon RDS PostgreSQL database instance located inside a private subnet of a custom VPC. To optimize performance and security, which of the following actions should the developer take when configuring and developing the Lambda function? (Select TWO.)

Select all that apply

Increase the ephemeral storage (/tmp) configuration of the Lambda function to at least

4\text{ GB}

to accommodate the downloaded files.

Deploy the Lambda function in the private subnets of the VPC and route outbound internet traffic through a NAT Gateway.

Store the database credentials as hardcoded strings inside the Lambda function handler code to minimize connection establishment overhead.

Deploy the Lambda function in the private subnets of the VPC without a NAT Gateway to ensure secure communication with both the private database and the public payment gateway.

Rely on the default ephemeral storage size, assuming that AWS Lambda automatically deletes files in /tmp immediately after each invocation completes to free up space.

Show answer & explanation

Answer: Increase the ephemeral storage (/tmp) configuration of the Lambda function to at least $4\text{ GB}$ to accommodate the downloaded files.; Deploy the Lambda function in the private subnets of the VPC and route outbound internet traffic through a NAT Gateway.

Answer

Increase the ephemeral storage (/tmp) configuration of the Lambda function to at least

4\text{ GB}

to accommodate the downloaded files, and deploy the Lambda function in the private subnets of the VPC and route outbound internet traffic through a NAT Gateway.

To process the

4\text{ GB}

file, the developer must increase the Lambda ephemeral storage (/tmp) configuration from its default of

512\text{ MB}

to at least

4\text{ GB}

. Furthermore, because the function needs to connect to an RDS database inside a private VPC subnet and call a public payment gateway, the function must be attached to the VPC private subnets with a NAT Gateway configured in a public subnet to route outbound internet traffic.

Step-by-Step Solution

Analyze storage requirements for the downloaded S3 files.

The file size can reach

4\text{ GB}

. The default Lambda ephemeral storage (/tmp) is only

512\text{ MB}

. Therefore, the configuration must be explicitly scaled up (up to

10\text{ GB}

is supported).

Ensures the Lambda function does not run out of local disk space during download and processing.

Analyze network connectivity requirements.

The function must access both a private RDS PostgreSQL instance (requiring VPC placement in private subnets) and a public payment gateway (requiring internet access). Routing private subnet traffic through a NAT Gateway satisfies both requirements.

Allows secure access to internal VPC resources while maintaining outbound internet connectivity.

Key Concept

AWS Lambda VPC networking configuration and ephemeral storage scaling.

Estimated Time:2m 0s

Question 1455Question →

An application processes file uploads from an Amazon S3 bucket using an AWS Lambda function. The function needs to write data to an Amazon RDS database located in a private subnet of an Amazon VPC, and also send status updates to an external third-party API. The function is configured to run inside the same private VPC subnet. During testing, the function successfully writes to the database but fails with network timeouts when calling the external API. Which configuration change will resolve this issue?

Configure the Lambda function to use private subnets that have a route to a NAT Gateway in a public subnet of the VPC.

Associate the Lambda function with the public subnets of the VPC to allow direct outbound access through the Internet Gateway.

Increase the execution timeout of the Lambda function to 15 minutes to allow sufficient time for the connection to the external API to establish.

Modify the trust policy of the Lambda function's IAM execution role to allow the external third-party API service to assume the role.

Show answer & explanation

Answer: Configure the Lambda function to use private subnets that have a route to a NAT Gateway in a public subnet of the VPC.

Answer

Configure the Lambda function to use private subnets that have a route to a NAT Gateway in a public subnet of the VPC.

When a Lambda function is configured to connect to a VPC, it does not have direct access to the internet. To allow the function to connect to both the RDS database in the private subnet and the external third-party API, the function must be configured to run in private subnets. The routing table for these private subnets must include a route directing internet-bound traffic (0.0.0.0/0) to a NAT Gateway that is situated in a public subnet of the VPC.

Step-by-Step Solution

Analyze the network configuration of the Lambda function.

The function is attached to a private subnet in a VPC to communicate with Amazon RDS. This configuration removes the default internet access path for the function.

Understanding the current network environment is necessary to diagnose why external endpoints are unreachable.

Determine the required route for internet access from within a VPC subnet.

For resources inside a private subnet to access the internet, outbound traffic must route through a NAT Gateway or NAT Instance placed in a public subnet, which in turn connects to the Internet Gateway.

This establishes a valid network egress path for the Lambda function's ENIs.

Apply the subnet routing rules to the Lambda function configuration.

Ensure the Lambda function is mapped to the private subnets, and that the routing table associated with these private subnets contains a route of 0.0.0.0/0 pointing to the NAT Gateway.

This configuration satisfies both requirements: local routing to the RDS database and egress routing to the external API.

Key Concept

AWS Lambda VPC networking and outbound internet access

Estimated Time:1m 30s

Question 1456Question →

A developer is configuring an Amazon API Gateway REST API with an HTTP custom (non-proxy) integration that connects to an on-premises backend service. The backend service always returns an HTTP 200 OK status code, even when an application-level error occurs. When such an error occurs, the backend JSON response body contains the field "errorCode": "INVALID_PARAMETERS". The developer needs the API Gateway to return an HTTP 400 Bad Request status code to the client instead of HTTP 200 OK when this error is present.

Which configuration strategy should the developer use to achieve this?

Deploy an intermediate AWS Lambda function using Lambda integration to call the backend service, inspect the response payload, and return the appropriate HTTP status code to API Gateway.

Create a Velocity Template Language (VTL) mapping template within the 200 OK Integration Response to dynamically override the method response status code to 400 if the payload contains the error code.

Create an Integration Response with an HTTP status regex pattern of .*INVALID_PARAMETERS.* to match the backend response body and map it to the HTTP 400 Method Response.

Configure a Lambda Authorizer in API Gateway to intercept the backend response, inspect the JSON payload, and return a response policy that overrides the HTTP status code to 400.

Show answer & explanation

Answer: Deploy an intermediate AWS Lambda function using Lambda integration to call the backend service, inspect the response payload, and return the appropriate HTTP status code to API Gateway.

Answer

Deploy an intermediate AWS Lambda function using Lambda integration to call the backend service, inspect the response payload, and return the appropriate HTTP status code to API Gateway.

The correct strategy is to deploy an intermediate AWS Lambda function. Because the backend service always returns an HTTP 200 OK status code, API Gateway cannot natively select a different integration response based on the JSON body content. By routing the request through a Lambda function, the function can inspect the legacy backend response body and return a response that allows API Gateway to map it to an HTTP 400 Bad Request client response.

Step-by-Step Solution

Analyze the limitations of native API Gateway HTTP custom integrations regarding response mapping.

Identify that in an HTTP custom integration, API Gateway evaluates the HTTP status code returned by the integration endpoint to select an Integration Response, not the JSON payload fields.

This rules out natively selecting a 400 response from a successful 200 OK HTTP integration based on JSON body parameters.

Evaluate the capabilities of VTL mapping templates in custom integrations.

Confirm that mapping templates are executed after the Integration Response selection phase and cannot be used to dynamically change the Method Response HTTP status code based on response body analysis.

This rules out configuring dynamic status overrides within mapping templates in REST APIs.

Select a solution that provides custom programming logic to process backend payloads.

Introduce an intermediate AWS Lambda function to intercept the backend response, parse the JSON payload, check for the error string, and structure a custom API Gateway response or raise a Lambda error.

Since API Gateway cannot natively perform content-based routing on HTTP backend responses, an intermediate compute layer like Lambda is required to inspect and map the response.

Key Concept

API Gateway custom integration response mapping constraints

Question 1457Question →

An enterprise transaction processing application uses a decoupled architecture where a core system publishes high-priority financial transaction messages to an Amazon SNS FIFO topic. Two downstream services consume these messages:

- Service A: Runs on AWS Lambda, consumes messages via an Amazon SQS FIFO queue subscribed to the SNS FIFO topic, and updates account balances in an Amazon DynamoDB table. The Lambda function has a maximum concurrency of 5 and can take up to 20 seconds to process a batch of messages.
- Service B: Runs on Amazon ECS Fargate and consumes messages via a separate Amazon SQS FIFO queue subscribed to the SNS FIFO topic for audit logging.

During peak transaction hours, the developer observes two issues:
1. Service A experiences occasional transaction processing failures due to DynamoDB ProvisionedThroughputExceededException. The developer wants to retry only the failed transactions within a batch rather than reprocessing the entire batch, while maintaining the processing order of the remaining messages.
2. Service B occasionally processes duplicate transaction logs. This happens because the publishing system retries sending messages to the SNS FIFO topic when it encounters temporary network timeouts before receiving a publish acknowledgment from SNS.

Which two actions should the developer take to resolve these issues? (Select TWO.)

Select all that apply

Configure the Lambda event source mapping for Service A with ReportBatchItemFailures enabled, and modify the Lambda function code to return the message IDs of the failed transactions in a batchItemFailures array.

Configure the publisher application to generate a consistent MessageDeduplicationId based on the unique transaction ID for each SNS FIFO publish request.

Configure the SQS FIFO queue for Service A with a visibility timeout that is shorter than the Lambda function timeout to ensure that failed messages are retried immediately by another Lambda container.

Modify the Lambda function for Service A to catch the ProvisionedThroughputExceededException and sleep until the function times out, allowing the SQS visibility timeout to naturally expire and retry the entire batch.

Replace the SQS FIFO queue for Service A with a DynamoDB Streams consumer, and query the stream using a Scan operation to find and retry only the failed transactions.

Show answer & explanation

Answer: Configure the Lambda event source mapping for Service A with ReportBatchItemFailures enabled, and modify the Lambda function code to return the message IDs of the failed transactions in a batchItemFailures array.; Configure the publisher application to generate a consistent MessageDeduplicationId based on the unique transaction ID for each SNS FIFO publish request.

Answer

To resolve the issues, the developer should configure the Lambda event source mapping for Service A with ReportBatchItemFailures enabled and modify the Lambda function code to return the message IDs of the failed transactions in a batchItemFailures array. Additionally, they should configure the publisher application to generate a consistent MessageDeduplicationId based on the unique transaction ID for each SNS FIFO publish request.

The correct solution uses partial batch responses and publisher deduplication. By enabling ReportBatchItemFailures on the SQS event source mapping and returning the failed transaction message IDs in the batchItemFailures array, the developer prevents successful messages from being retried while allowing SQS FIFO to maintain ordering. Additionally, by setting a consistent MessageDeduplicationId based on the transaction ID on the SNS FIFO topic, the publisher ensures that network retry attempts are deduplicated by SNS before reaching the downstream SQS FIFO queues.

Step-by-Step Solution

Address partial batch failures in Service A by enabling ReportBatchItemFailures.

This configures the Lambda event source mapping to accept partial batch success responses.

This allows SQS to retry only the failed items in the batch rather than the entire batch, maintaining strict FIFO order for the remaining messages.

Update the Service A Lambda function code response format.

The function now returns a JSON payload containing the batchItemFailures array populated with the messageId of each failed message.

This tells the SQS poller exactly which messages failed processing so only those are returned to the queue.

Mitigate publisher retries causing duplicates in Service B by implementing deduplication at the source.

The publishing system supplies a consistent MessageDeduplicationId based on the business transaction ID to the SNS FIFO topic.

SNS FIFO uses this ID to deduplicate retry attempts within a 5-minute window, ensuring only one unique message is delivered to the subscribed SQS queues.

Key Concept

Handling partial batch failures in SQS FIFO queues with AWS Lambda and deduplicating retries in Amazon SNS FIFO using MessageDeduplicationId.

Estimated Time:3m 0s

Question 1458Question →

A developer is building a serverless web portal for a medical scheduling system. Users must authenticate using their corporate Google Workspace accounts through OpenID Connect (OIDC). Once authenticated, the web portal must invoke private API routes hosted on Amazon API Gateway. The developer needs to validate the user session token at the API Gateway layer with the least operational overhead and without writing custom validation code.

Which solution meets these requirements?

Configure an Amazon Cognito User Pool federated with the Google Workspace OIDC provider, and set up an API Gateway Cognito authorizer that directly validates the identity tokens.

Configure an Amazon Cognito Identity Pool federated with the Google Workspace OIDC provider, enable AWS IAM authorization on API Gateway, and sign the client API requests using AWS Signature Version 4.

Configure an Amazon Cognito User Pool federated with the Google Workspace OIDC provider, and write a custom API Gateway Lambda authorizer to parse and validate the JSON Web Tokens (JWT) manually.

Configure an Amazon Cognito Identity Pool federated with the Google Workspace OIDC provider, and create an API Gateway Cognito authorizer linked to the Identity Pool to validate the client tokens.

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool federated with the Google Workspace OIDC provider, and set up an API Gateway Cognito authorizer that directly validates the identity tokens.

Answer

Configure an Amazon Cognito User Pool federated with the Google Workspace OIDC provider, and set up an API Gateway Cognito authorizer that directly validates the identity tokens.

The correct solution uses an Amazon Cognito User Pool to handle the OpenID Connect federation with Google Workspace, which issues standard JSON Web Tokens. By using the built-in API Gateway Cognito authorizer, API Gateway validates these tokens automatically, eliminating the need to write custom validation logic or perform complex request signing on the client.

Step-by-Step Solution

Determine if User Pools or Identity Pools are appropriate for the user federation and token generation requirement.

Amazon Cognito User Pools is chosen to act as the user directory and federated identity consumer for the OIDC provider (Google Workspace).

User Pools are used for authentication and directories, producing JSON Web Tokens (JWTs) such as identity and access tokens.

Select the API Gateway authorizer that validates the authentication tokens with the least operational overhead.

Select the built-in API Gateway Cognito authorizer.

API Gateway's native Cognito authorizer handles JWT validation out of the box, requiring zero custom code and removing the need to manage Lambda functions or sign requests using Signature Version 4.

Key Concept

Selecting the correct Cognito service and API Gateway authorizer type to minimize custom development when integrating external identity providers.

Estimated Time:1m 30s

Question 1459Question →

A developer is troubleshooting an application that processes message payloads from an Amazon SQS queue. The application requires an average of 45 seconds to successfully process and delete each message. Currently, the same messages are being received and processed multiple times by the application. Which configuration change will prevent this behavior?

Reduce the queue's Visibility Timeout parameter to 10 seconds to expedite message recycling.

Increase the execution timeout of the consumer's AWS Lambda function without modifying queue settings.

Modify the SQS queue settings to increase the Visibility Timeout parameter to a duration greater than 45 seconds.

Embed raw AWS IAM credentials directly in the application code to speed up SDK client initialization.

Show answer & explanation

Answer: Modify the SQS queue settings to increase the Visibility Timeout parameter to a duration greater than 45 seconds.

Answer

Modify the SQS queue settings to increase the Visibility Timeout parameter to a duration greater than 45 seconds.

The correct option is to modify the SQS queue settings to increase the Visibility Timeout parameter to a duration greater than 45 seconds. Amazon SQS uses the visibility timeout to prevent other consumers from processing a message while a current consumer is processing it. If the processing time is 45 seconds, the visibility timeout must be set to a value greater than 45 seconds (such as 60 seconds) to ensure the message is deleted before it becomes visible again.

Step-by-Step Solution

Analyze the relationship between processing duration and visibility timeout.

The message processing takes 45 seconds, which exceeds the default visibility timeout.

If visibility timeout is shorter than processing time, the message becomes visible to other consumers before the current consumer can delete it.

Identify the SQS configuration parameter that controls message visibility lock.

The Visibility Timeout parameter controls this duration.

Adjusting the Visibility Timeout guarantees that the message remains hidden until processing is complete.

Set the Visibility Timeout to a safe threshold.

The Visibility Timeout is set to a value greater than 45 seconds (e.g., 60 seconds).

This allows the application sufficient time to process and delete the message without duplicates.

Key Concept

SQS Visibility Timeout vs Message Processing Duration

Question 1460Question →

A developer is designing a REST API using Amazon API Gateway that routes client requests to an AWS Lambda backend. The API must satisfy the following development requirements:

1. Authenticate and validate JSON Web Tokens (JWTs) issued by an Amazon Cognito User Pool at the gateway level before forwarding requests.
2. Pass the complete HTTPS request details (including path parameters, headers, and query strings) directly to the Lambda function without the developer having to configure or maintain mapping templates.

Which two actions should the developer take to meet these requirements?

Select all that apply

Configure a Cognito User Pool Authorizer on the API Gateway resource method.

Use a Lambda Proxy Integration for the API Gateway integration type.

Create a custom Lambda Authorizer to validate the JWT and generate an IAM policy dynamically.

Use a Lambda Custom Integration and configure request mapping templates to format the incoming payload for the Lambda function.

Enable CORS at the API Gateway resource level and rely on API Gateway to append the Access-Control-Allow-Origin header to the Lambda proxy responses.

Show answer & explanation

Answer: Configure a Cognito User Pool Authorizer on the API Gateway resource method.; Use a Lambda Proxy Integration for the API Gateway integration type.

Answer

Configure a Cognito User Pool Authorizer on the API Gateway resource method, and use a Lambda Proxy Integration for the API Gateway integration type.

The correct options are configuring a Cognito User Pool Authorizer and using a Lambda Proxy Integration. A Cognito User Pool Authorizer natively validates JWT tokens at the gateway level without custom code. A Lambda Proxy Integration automatically passes the request context (headers, path parameters, query strings) directly to the Lambda function as a structured event payload, satisfying the requirement to avoid configuring mapping templates.

Step-by-Step Solution

Evaluate the authentication requirement.

Identify that the JWTs are issued by an Amazon Cognito User Pool and must be validated at the API Gateway level.

Since the token source is a Cognito User Pool, a built-in Cognito User Pool Authorizer is the most efficient and native choice, avoiding the overhead of custom Lambda code.

Evaluate the request routing and mapping requirement.

Determine the integration type that passes headers, path parameters, and query strings without manual mapping template configuration.

A Lambda Proxy Integration automatically packages the entire HTTP request into a single structured event object and passes it to the Lambda function, completely avoiding mapping templates.

Examine the remaining options for potential misconceptions.

Eliminate the custom Lambda Authorizer, Lambda Custom integration, and CORS console-only configuration options.

Custom authorizers introduce unnecessary code; custom integrations require mapping templates; console-configured CORS does not automatically inject headers into Lambda proxy responses.

Key Concept

Configuring API Gateway integrations and authorizers to optimize development overhead and maintain native features.

PreviousPage 73 / 78Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept