All practice questions

1542 questions

All types1,542 Multiple choice782 Multiple select746 Ordering14

A developer is building a serverless application and needs to configure Amazon EventBridge to route custom application events to a target AWS Lambda function. The events must be filtered so that only events with a `detail-type` of `OrderCreated` and a `status` of `completed` are forwarded to the function. Which two configurations are required to accomplish this? (Select TWO.)

Select all that apply

Deploy the target Lambda function into a private VPC subnet with no NAT Gateway or VPC endpoint to allow private event ingestion.

Create an EventBridge rule with an event pattern that matches the custom event source and the status field under the detail object.

Modify the trust policy of the Lambda function's execution role to allow the EventBridge service principal to assume the role.

Add the Lambda function as a target to the EventBridge rule and configure a resource-based policy on the function to allow the EventBridge service principal to invoke it.

Configure the EventBridge rule to use a static partition key so that all incoming events are distributed evenly across matching targets.

Show answer & explanation

Answer: Create an EventBridge rule with an event pattern that matches the custom event source and the status field under the detail object.; Add the Lambda function as a target to the EventBridge rule and configure a resource-based policy on the function to allow the EventBridge service principal to invoke it.

Answer

The correct configurations are creating an EventBridge rule with an event pattern matching the custom detail-type and status, and adding the Lambda function as a target while allowing EventBridge to invoke it via a resource-based policy.

To route specific events to a target in EventBridge, a rule must be created with an event pattern that filters incoming JSON events. Additionally, EventBridge needs permissions to invoke the target Lambda function, which is granted using a Lambda resource-based policy.

Step-by-Step Solution

Define an EventBridge rule with a pattern.

An EventBridge rule is created that filters events by matching specific JSON fields.

This ensures only matching events (detail-type: OrderCreated and status: completed) are processed.

Add the target and set permissions.

The Lambda function is linked as the rule's target, and permission is granted.

EventBridge must have explicit permission to execute the target Lambda function using a resource-based policy.

Key Concept

Routing events using EventBridge rules, custom event patterns, and Lambda resource-based invoke permissions.

Question 1482Question →

A developer is building a ticket reservation system where booking and payment events must be processed in the exact order they are received per booking, and duplicate events must be ignored. The developer uses an Amazon SNS FIFO topic that fans out to multiple Amazon SQS FIFO queues. Which two parameters or configurations must the developer specify when publishing events to the SNS FIFO topic to ensure message ordering and deduplication? (Select TWO.)

Select all that apply

A unique MessageGroupId for each booking to group messages and ensure they are processed sequentially.

A MessageDeduplicationId for each event (or enable Content-Based Deduplication on the topic) to prevent duplicate messages from being processed within the deduplication interval.

A visibility timeout of 0 seconds on the SQS FIFO queues to allow immediate reprocessing of messages that fail.

Hardcoded AWS access keys and secret keys inside the SNS client initialization to speed up message publishing throughput.

A visibility timeout on the SQS FIFO queue that is exactly equal to the timeout of the downstream consumer Lambda function.

Show answer & explanation

Answer: A unique MessageGroupId for each booking to group messages and ensure they are processed sequentially.; A MessageDeduplicationId for each event (or enable Content-Based Deduplication on the topic) to prevent duplicate messages from being processed within the deduplication interval.

Answer

Configure a unique MessageGroupId for each booking and provide a MessageDeduplicationId (or enable Content-Based Deduplication) when publishing events to the SNS FIFO topic.

To achieve ordering and deduplication in an SNS/SQS FIFO setup, the developer must specify the MessageGroupId (to group messages by a unique identifier like booking ID to guarantee ordering) and MessageDeduplicationId (or enable Content-Based Deduplication to prevent duplicates).

Step-by-Step Solution

Identify the ordering requirements.

Since booking and payment events must be processed in the exact order they are received per booking, a grouping identifier is needed. Grouping messages by booking ID using MessageGroupId ensures strict ordering within each booking.

SQS and SNS FIFO require MessageGroupId to determine which group of messages must be processed sequentially.

Identify the deduplication requirements.

To ignore duplicate events, a deduplication mechanism is required. Providing a MessageDeduplicationId or enabling Content-Based Deduplication ensures that identical messages published within the 5-minute deduplication window are treated as duplicates and discarded.

MessageDeduplicationId is the parameter used by AWS FIFO features to identify and eliminate duplicate messages.

Key Concept

Amazon SQS and SNS FIFO queues/topics maintain message ordering using MessageGroupId and guarantee exactly-once processing using MessageDeduplicationId.

Question 1483Question →

A developer is writing a producer application that sends temperature telemetry data from thousands of IoT devices to an Amazon Kinesis data stream with multiple shards. The developer wants to ensure that the data is distributed evenly across all available shards to prevent write throttling. Which strategy should the developer use when specifying the partition key for the PutRecord API call?

Use a static string such as 'sensor_data' as the partition key for all records.

Deploy the producer application in a private VPC subnet without a NAT Gateway to restrict access to a single shard.

Use a unique device identifier or a generated UUID as the partition key for each record.

Configure the consumer Lambda function to run with the default 3-second timeout to force faster shard polling.

Show answer & explanation

Answer: Use a unique device identifier or a generated UUID as the partition key for each record.

Answer

Use a unique device identifier or a generated UUID as the partition key for each record.

Using a partition key with high entropy (such as a unique device identifier or a generated UUID) ensures that the MD5 hash of the partition key is distributed evenly across the hash ranges of all shards in the Kinesis stream. This prevents a single shard from receiving a disproportionate volume of data (hot shards) and avoids write throttling.

Step-by-Step Solution

Analyze how Amazon Kinesis uses partition keys to distribute records across shards.

Kinesis applies an MD5 hash function to the partition key of each record to determine which shard the record is assigned to.

Understanding the hashing mechanism helps determine the necessary characteristics of a partition key for even distribution.

Compare the entropy of the partition key options.

A unique device identifier or UUID provides high entropy, whereas a static string ('sensor_data') provides zero entropy.

High entropy results in an even distribution of hash values across the entire shard space, preventing hot shards.

Key Concept

Partition key entropy and shard distribution in Amazon Kinesis

Question 1484Question →

A developer is writing a backend AWS Lambda function that must parse a $5\text{ MB}$ static lookup table stored in Amazon S3. The lookup table is updated only once a week, but the Lambda function is invoked thousands of times per hour. The developer wants to optimize the function's execution time and minimize Amazon S3 data retrieval costs. Which of the following is the most efficient design pattern for the developer to implement?

Write the downloaded lookup table directly to the function's deployment package directory (`./`) during the first run to persist it for all future invocations.

Download the lookup table to the `/tmp` space and load it into a global variable outside of the Lambda handler function, reusing the cached data for subsequent warm starts.

Deploy the Lambda function inside a private subnet of a VPC to download the lookup table from Amazon S3 on every invocation, without configuring a NAT Gateway or a VPC endpoint.

Store the lookup table in AWS Secrets Manager and initialize the AWS SDK client inside the handler function to retrieve the data on each invocation.

Show answer & explanation

Answer: Download the lookup table to the `/tmp` space and load it into a global variable outside of the Lambda handler function, reusing the cached data for subsequent warm starts.

Answer

Download the lookup table to the `/tmp` space and load it into a global variable outside of the Lambda handler function, reusing the cached data for subsequent warm starts.

By downloading the lookup table to the `/tmp` space and parsing it into a global variable outside the handler function, the initialization code executes only during a cold start. Subsequent invocations that reuse the warm execution context skip this download and parse phase entirely, accessing the cached data directly from memory. This provides sub-millisecond access times and minimizes S3 API charges.

Step-by-Step Solution

Identify the data access pattern and constraints.

The lookup table is

5\text{ MB}

, static, updated once a week, and read frequently by thousands of invocations per hour.

To design an optimal caching strategy, we must understand the data size, mutability, and invocation frequency.

Evaluate the caching capabilities of the AWS Lambda execution environment.

Lambda execution context reuse allows files in the `/tmp` directory and memory-bound global/static variables to persist across warm invocations.

Reusing the execution context avoids downloading the lookup table on every single function execution.

Apply the best practice of initializing SDK clients and reading global state outside the handler function.

Downloading the lookup table during the cold start initialization phase (outside the handler) allows subsequent warm executions to immediately read the parsed data from memory.

This minimizes latency and eliminates redundant Amazon S3 GET requests and data retrieval costs.

Key Concept

Reusing the Lambda execution context (global variables and `/tmp` space) to cache static or rarely changing data across warm invocations.

Question 1485Question →

A developer is configuring a serverless application where an Amazon API Gateway REST API integrates with an AWS Lambda function using Lambda proxy integration. Which of the following requirements must be met to ensure successful request processing and client response delivery? (Select TWO.)

Select all that apply

The Lambda function receives the client's HTTP request details, such as headers, query parameters, and payload, directly as the input event object.

The developer must configure an integration request mapping template in API Gateway to transform the incoming request into the event format required by the Lambda function.

The Lambda function must return a JSON response containing a statusCode integer and, if returning a payload, a body string.

The developer must configure integration responses in API Gateway to map the return properties of the Lambda function to the final HTTP status codes.

The developer must implement a custom Lambda authorizer to extract and validate standard JSON Web Tokens (JWTs) issued by Amazon Cognito User Pools.

Show answer & explanation

Answer: The Lambda function receives the client's HTTP request details, such as headers, query parameters, and payload, directly as the input event object.; The Lambda function must return a JSON response containing a statusCode integer and, if returning a payload, a body string.

Answer

To configure a Lambda proxy integration successfully, the Lambda function receives the client's HTTP request details directly as the input event object, and it must return a properly structured JSON object that includes the statusCode and a stringified body.

The correct options state that the Lambda function receives the incoming request details directly in its event object and that it must return a JSON response with a statusCode and a body string. These are the core features of API Gateway's Lambda proxy integration.

Step-by-Step Solution

Analyze integration requirements for Lambda proxy integration.

Identify that API Gateway automatically maps the client request to the Lambda input event, so no request mapping templates are needed.

This is a fundamental behavior of Lambda proxy integration, where the full HTTP request details are passed directly to the backend.

Analyze response formatting requirements.

Confirm that the Lambda function must format its response output using a specific JSON structure (statusCode and body).

Because API Gateway does not map responses in proxy mode, the Lambda function itself must dictate the status code and payload directly.

Evaluate wrong options against the proxy integration model and authorization practices.

Discard options requiring request templates, custom integration responses, or unnecessary custom Lambda authorizers for Cognito.

Request/response mapping is associated with custom integrations, and standard Cognito JWT validation is natively supported by built-in authorizers.

Key Concept

API Gateway Lambda Proxy Integration behavior and requirements

Estimated Time:2m 0s

Question 1486Question →

A team is migrating an on-premises batch utility to run as an AWS Lambda function inside a custom VPC. The function must connect to a database running on an Amazon RDS instance within the private subnets of the VPC. Additionally, the function needs to fetch static configuration files from Amazon S3 and make API calls to an external payment processor over the internet. During initial testing, the Lambda function succeeds in connecting to the database but experiences connection timeouts when trying to access S3 and the external payment processor.

Which of the following actions should the developer take to resolve these connectivity issues? (Select two.)

Select all that apply

Configure a NAT Gateway in a public subnet of the VPC, and update the private subnet's route table to route `

0.0.0.0/0

` traffic to the NAT Gateway.

Create a Gateway VPC Endpoint for Amazon S3, and associate it with the route table of the private subnet where the Lambda function resides.

Move the Lambda function configuration to a public subnet of the VPC and enable the auto-assign public IP setting on the function.

Update the Lambda function's trust policy to grant `s3:GetObject` permission for the S3 bucket configuration path.

Embed AWS access key credentials directly within the Lambda function code to bypass VPC routing for the S3 SDK client calls.

Show answer & explanation

Answer: Configure a NAT Gateway in a public subnet of the VPC, and update the private subnet's route table to route ` $0.0.0.0/0$ ` traffic to the NAT Gateway.; Create a Gateway VPC Endpoint for Amazon S3, and associate it with the route table of the private subnet where the Lambda function resides.

Answer

To resolve the connectivity issues, the developer must configure a NAT Gateway in a public subnet to allow internet-bound traffic from the private subnet, and create a Gateway VPC Endpoint for Amazon S3 to enable private direct communication with S3.

To allow the Lambda function in the private subnet to connect to external services over the internet, a NAT Gateway must be deployed in a public subnet and the private subnet's route table updated to route internet-bound traffic (represented by the `

0.0.0.0/0

` route) to the NAT Gateway. Additionally, to access Amazon S3 without routing traffic through the NAT Gateway (which incurs extra cost and processing overhead), a Gateway VPC Endpoint for Amazon S3 should be created and associated with the private subnet's route table. This enables direct, private connectivity to S3.

Step-by-Step Solution

Analyze the VPC deployment model for the Lambda function.

The Lambda function is associated with private subnets in the VPC, which allows it to connect to the Amazon RDS instance in the same VPC but isolates it from external networks, including the internet and default public AWS endpoints.

Understanding why the connection timeouts are occurring is the first step in troubleshooting VPC networking.

Establish internet access for the Lambda function to reach the external payment processor.

By placing a NAT Gateway in a public subnet and routing the private subnet's `

0.0.0.0/0

` traffic to the NAT Gateway, the Lambda function can securely send egress traffic to the internet.

Lambda functions inside private subnets cannot communicate with the internet directly and require a NAT device to map private IPs to a public IP.

Establish direct private connectivity to Amazon S3.

By creating a Gateway VPC Endpoint for Amazon S3 and linking it to the private subnet's route table, traffic destined for S3 is routed directly to the S3 service within the AWS network.

Using a VPC endpoint avoids sending S3 traffic through the NAT Gateway, which saves costs and prevents potential network bandwidth bottlenecks.

Key Concept

VPC Networking for AWS Lambda and Private Service Access

Estimated Time:2m 0s

Question 1487Question →

A developer is building a serverless application that publishes events to an Amazon EventBridge event bus. The developer needs to route all events to an Amazon Kinesis Data Firehose delivery stream for long-term archiving, and route only events with a status of "CANCELLED" to an AWS Lambda function for real-time alerting. Which two configurations should the developer implement to meet these requirements? (Select TWO.)

Select all that apply

Create an EventBridge rule with an event pattern that filters for a status of "CANCELLED" and associate it with the Lambda function target.

Create an EventBridge rule that matches all events and associate it with the Kinesis Data Firehose delivery stream target.

Configure the producer application to use a static partition key of "CANCELLED" for all events sent to EventBridge to prioritize processing.

Configure a short timeout on the Lambda function, assuming EventBridge will automatically pause and resume the Lambda execution context if the processing takes too long.

Modify the IAM trust policy of the AWS Lambda execution role to allow the EventBridge service to assume it directly.

Show answer & explanation

Answer: Create an EventBridge rule with an event pattern that filters for a status of "CANCELLED" and associate it with the Lambda function target.; Create an EventBridge rule that matches all events and associate it with the Kinesis Data Firehose delivery stream target.

Answer

To archive all events and send only cancelled events to Lambda, the developer should create one EventBridge rule that matches all events with Kinesis Data Firehose as the target, and a second EventBridge rule with a JSON pattern filtering for a status of "CANCELLED" with the Lambda function as the target.

The correct options involve creating two separate rules on the EventBridge event bus. The first rule matches all incoming events using a broad event pattern and targets the archiving Kinesis Data Firehose stream. The second rule uses a structured JSON event pattern to filter for events where the status field is "CANCELLED" and targets the alerting Lambda function.

Step-by-Step Solution

Analyze the requirement for archiving all events.

Identified that an EventBridge rule matching all events is needed, routed to Kinesis Data Firehose.

Archiving requires capturing the entire stream of events without filtering.

Analyze the requirement for real-time alerting on cancellation events.

Identified that an EventBridge rule with a filter pattern matching status "CANCELLED" is needed, routed to the Lambda function.

Alerting is only required for specific events, necessitating content-based filtering.

Key Concept

Event routing and filtering in Amazon EventBridge rules using event patterns.

Question 1488Question →

A developer is creating an AWS Lambda function that processes files uploaded to an Amazon S3 bucket. The developer creates an IAM role named `S3ProcessRole` with the required S3 permission policies. However, when trying to assign the role to the Lambda function, the developer receives an error indicating that the role cannot be assumed by Lambda. The developer inspects the role's trust policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::987654321098:root"
},
"Action": "sts:AssumeRole"
}
]
}

Which modification to the trust policy is required to resolve this error?

Update the Principal block in the trust policy to specify "Service": "lambda.amazonaws.com".

Add the required s3:GetObject and s3:PutObject permissions to the Action block of the trust policy.

Change the Action in the trust policy from sts:AssumeRole to lambda:InvokeFunction.

Initialize the AWS SDK client inside the Lambda function code using hardcoded AWS access keys to bypass the role assignment.

Show answer & explanation

Answer: Update the Principal block in the trust policy to specify "Service": "lambda.amazonaws.com".

Answer

Update the Principal block in the trust policy to specify the Lambda service principal.

The correct answer is to modify the Principal block to allow the AWS Lambda service principal (lambda.amazonaws.com) to assume the role. When Lambda runs a function, it must assume the execution role via the sts:AssumeRole action. For this to succeed, the role's trust policy must explicitly trust the Lambda service principal.

Step-by-Step Solution

Identify the cause of the failure: the trust policy limits assumption of the role to the root of AWS account 987654321098, preventing the AWS Lambda service from assuming it.

Discovered that the Principal specifies the account root rather than the Lambda service principal.

Before a service can assume an IAM role, the trust policy must explicitly permit that specific service principal.

Locate the Principal block in the trust policy JSON.

Isolated the 'Principal': { 'AWS': 'arn:aws:iam::987654321098:root' } block.

This is the segment governing who is trusted to assume the role.

Change the Principal from the AWS account root to the Lambda service principal, lambda.amazonaws.com, and keep the Action as sts:AssumeRole.

The Lambda service principal is now trusted, allowing the function to execute with the role's permissions.

This establishes the necessary trust relationship for the AWS Lambda service.

Key Concept

IAM Role Trust Policies vs. Permissions Policies

Estimated Time:1m 30s

Question 1489Question →

A developer is implementing a backend processing system using an Amazon SQS queue and an AWS Lambda function. The Lambda function processes messages in batches and has its timeout configured to 30 seconds. During peak hours, the developer notices that some messages are being processed multiple times by the Lambda function, despite the function successfully completing without errors. The developer also wants to ensure that messages that fail to process after 3 attempts are moved to a dead-letter queue (DLQ). Which two configurations must the developer implement to resolve the duplicate processing issue and properly configure the DLQ? (Choose two.)

Select all that apply

Increase the visibility timeout of the SQS queue to at least 180 seconds.

Define a redrive policy on the source SQS queue that references the DLQ ARN and sets the maxReceiveCount to 3.

Define a redrive policy on the DLQ that references the source SQS queue ARN and sets the maxReceiveCount to 3.

Increase the SQS queue's visibility timeout to 35 seconds and increase the Lambda function's timeout to 45 seconds.

Configure the SQS queue with a Delivery Delay of 180 seconds to allow Lambda sufficient execution buffer time.

Show answer & explanation

Answer: Increase the visibility timeout of the SQS queue to at least 180 seconds.; Define a redrive policy on the source SQS queue that references the DLQ ARN and sets the maxReceiveCount to 3.

Answer

Increase the visibility timeout of the SQS queue to at least 180 seconds, and define a redrive policy on the source SQS queue that references the DLQ ARN and sets the maxReceiveCount to 3.

To prevent SQS from returning messages to the queue while a Lambda function is still processing them, the source queue's visibility timeout should be set to at least 6 times the timeout of the Lambda function. Since the Lambda function has a timeout of 30 seconds, the SQS visibility timeout must be configured to at least 180 seconds (

6 \times 30

). Additionally, to configure a dead-letter queue (DLQ) for failed messages, a redrive policy must be defined on the source SQS queue (not the DLQ itself) specifying the target DLQ ARN and a maxReceiveCount of 3.

Step-by-Step Solution

Calculate the recommended SQS visibility timeout based on the Lambda function's timeout.

The visibility timeout should be at least 6 times the Lambda timeout:

6 \times 30 = 180

seconds.

This prevents the queue from delivering the message to other consumers while the Lambda function is still processing or retrying.

Identify where the redrive policy must be configured for a dead-letter queue (DLQ).

The redrive policy must be configured on the source SQS queue, pointing to the DLQ ARN.

Configuring it on the source queue directs SQS to move messages to the DLQ after the maximum receive count is reached.

Set the maxReceiveCount attribute in the redrive policy.

Set maxReceiveCount to 3.

This configuration matches the requirement to send messages to the DLQ after 3 failed processing attempts.

Key Concept

SQS Visibility Timeout and DLQ Redrive Policy Configuration with Lambda Consumers

Question 1490Question →

A developer is building a smart agriculture application. An Amazon SNS topic receives soil moisture alerts, which are subscribed to by an Amazon SQS queue. An AWS Lambda function is configured to process messages from this SQS queue. The Lambda function has a timeout of 30 seconds. The SQS queue has a Default Visibility Timeout of 15 seconds. During testing, the developer notices that some alerts are being processed multiple times, even though the Lambda function executes successfully in 20 seconds. Which action should the developer take to prevent these duplicate invocations?

Increase the visibility timeout of the SQS queue to at least 180 seconds.

Decrease the SQS queue's visibility timeout to 5 seconds.

Increase the Lambda function's timeout to 120 seconds while keeping the SQS queue's visibility timeout at 15 seconds.

Modify the Lambda function's SDK client configuration to use hardcoded AWS credentials for deleting the processed messages.

Show answer & explanation

Answer: Increase the visibility timeout of the SQS queue to at least 180 seconds.

Answer

Increase the visibility timeout of the SQS queue to at least 180 seconds.

The correct action is to increase the SQS queue's visibility timeout to at least 180 seconds. AWS recommends setting the visibility timeout of an SQS queue to at least 6 times the timeout of the subscribing Lambda function (6 * 30 seconds = 180 seconds). This configuration ensures that the message is not visible to other consumers while the function is running or retrying.

Step-by-Step Solution

Analyze the execution time of the Lambda consumer relative to the SQS visibility timeout.

The Lambda function takes 20 seconds to process a message, but the SQS queue's visibility timeout is only 15 seconds.

When a message is pulled from SQS, it becomes invisible for 15 seconds. Since the function takes 20 seconds to complete, the message becomes visible again after 15 seconds, allowing another execution context to retrieve it and cause duplicate processing.

Apply AWS best practices for SQS and Lambda integrations.

The visibility timeout of the source SQS queue must be set to at least 6 times the timeout of the Lambda function.

Setting the visibility timeout to at least 6 times the Lambda timeout (6 * 30 seconds = 180 seconds) ensures that if the function is throttled or needs to retry, other consumers do not pull the message concurrently.

Key Concept

AWS Lambda integration with Amazon SQS requires setting the SQS queue's visibility timeout to at least 6 times the Lambda function's timeout to prevent duplicate message processing during execution and retries.

Question 1491Question →

A development team is deploying a monitoring agent to forward application performance logs from multiple web servers to Amazon Kinesis Data Streams. The logs must be partitioned so that all logs from a specific web server are ordered sequentially within a single shard. Additionally, logs containing critical errors must be routed to an Amazon EventBridge event bus to trigger automated recovery tasks.

Which of the following configurations should the developer implement? (Select TWO.)

Select all that apply

Use a unique identifier for each web server, such as the server host name, as the partition key when publishing log records to the Kinesis Data Stream.

Define an EventBridge routing rule containing a JSON event pattern that matches logs where the severity level is equal to critical error.

Use a single, constant string value as the partition key for all log records to ensure they are processed by a single consumer group.

Set the execution timeout of the downstream AWS Lambda function that processes the EventBridge events to 3 seconds, assuming that connection pools and execution contexts are automatically cleaned up immediately after each event delivery.

Deploy the downstream AWS Lambda consumer in a private VPC subnet without a NAT Gateway or VPC Endpoint to process events and send recovery alerts to an external third-party webhook.

Show answer & explanation

Answer: Use a unique identifier for each web server, such as the server host name, as the partition key when publishing log records to the Kinesis Data Stream.; Define an EventBridge routing rule containing a JSON event pattern that matches logs where the severity level is equal to critical error.

Answer

To achieve ordering per server and filter error events, the developer should use a unique identifier like the server host name as the partition key in Kinesis, and define an EventBridge routing rule with a JSON event pattern matching critical error logs.

The correct configurations involve using a unique server host name as the partition key to ensure message ordering per server within a shard, and setting up an EventBridge rule with a JSON event pattern matching critical error severity to filter events.

Step-by-Step Solution

Select a partition key strategy for Amazon Kinesis Data Streams that groups logs by server.

Using the server host name maps logs from the same server to the same shard, guaranteeing sequential order of delivery to the consumer.

Kinesis guarantees order within a shard, and records with the same partition key are routed to the same shard.

Determine the EventBridge routing mechanism for filtering logs.

Define an EventBridge rule with a JSON pattern to match only logs where the severity level is equal to critical error.

EventBridge rules evaluate the JSON structure of incoming events to route them to targets based on patterns.

Key Concept

Partitioning in Kinesis Data Streams for ordering and event filtering in EventBridge.

Question 1492Question →

A developer is building a producer application that sends real-time traffic sensor data to an Amazon Kinesis data stream consisting of multiple shards. The developer wants to ensure that the data is distributed evenly across all available shards to prevent write throttling. Which partition key strategy should the developer implement?

Use a high-entropy identifier, such as the unique sensor ID, as the partition key for each record.

Use a single, constant string value like 'sensor_data' as the partition key for all records.

Use a static partition key and increase the processing Lambda function's execution timeout.

Use the private subnet ID of the producer's VPC as the partition key.

Show answer & explanation

Answer: Use a high-entropy identifier, such as the unique sensor ID, as the partition key for each record.

Answer

Use a high-entropy identifier, such as the unique sensor ID, as the partition key for each record.

The correct strategy is to use a high-entropy identifier, such as the unique sensor ID. Amazon Kinesis distributes incoming records to shards by hashing the partition key. A high-entropy partition key ensures that records are evenly distributed across all shards, minimizing the risk of hot shards and ingestion throttling.

Step-by-Step Solution

Determine how Amazon Kinesis routes records to specific shards.

Amazon Kinesis applies an MD5 hash function to the partition key to assign the record to a shard.

This is the fundamental routing mechanism of Kinesis Data Streams.

Evaluate the entropy of the partition keys.

Using a high-entropy partition key (like a unique sensor ID) yields a wide spread of hash values, while low-entropy keys (like static values) hash to the same value.

High entropy ensures that records are distributed evenly across the shards rather than overloading a single shard.

Key Concept

Kinesis Data Streams Shard Distribution and Partition Keys

Question 1493Question →

A developer is configuring a system where web application clickstream events are sent to an Amazon Kinesis Data Stream. The developer also needs to route user purchase events to an Amazon EventBridge custom event bus. Which two configurations should the developer implement to meet these requirements?

Select all that apply

Use a unique session identifier as the partition key when writing records to the Kinesis Data Stream.

Configure an Amazon EventBridge rule with a JSON-based event pattern to filter and route only the purchase events.

Use a constant string such as 'web_logs' as the partition key for all records sent to the Kinesis Data Stream.

Deploy the consumer AWS Lambda function in a private VPC subnet with no NAT Gateway or VPC endpoints to process the stream events.

Update the IAM trust policy of the custom event bus to grant permissions for writing data directly to Amazon DynamoDB.

Show answer & explanation

Answer: Use a unique session identifier as the partition key when writing records to the Kinesis Data Stream.; Configure an Amazon EventBridge rule with a JSON-based event pattern to filter and route only the purchase events.

Answer

Use a unique session identifier as the partition key when writing records to the Kinesis Data Stream, and configure an Amazon EventBridge rule with a JSON-based event pattern to filter and route only the purchase events.

The correct options are to use a unique session identifier as the partition key and to configure an EventBridge rule with a JSON event pattern. A high-entropy partition key ensures records are distributed evenly across shards, while EventBridge filters and routes events based on JSON structure matching.

Step-by-Step Solution

Select the Kinesis partition key strategy.

Using a unique session ID distributes traffic evenly across all shards, avoiding throttling.

Kinesis routes records to specific shards based on the hash of the partition key.

Determine the routing mechanism for purchase events.

Define an EventBridge rule with a JSON event pattern matching purchase events.

EventBridge evaluates incoming JSON payloads against defined rules to filter and route matching events to targets.

Key Concept

Partition key selection in Amazon Kinesis Data Streams for data distribution, and event routing via JSON pattern matching in Amazon EventBridge.

Question 1494Question →

A developer is running an application on an Amazon EC2 instance in Account $123456789012$ . The EC2 instance is associated with an IAM instance profile that uses a role named `EC2InstanceRole`. The application needs to perform temporary tasks by assuming an IAM role named `DataProcessorRole` in the same account.

The developer runs a script on the instance using the AWS SDK to assume `DataProcessorRole`, but the operation fails with an `AccessDenied` error.

The trust policy of `DataProcessorRole` is currently configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which of the following configuration changes must the developer make to resolve this issue? (Select TWO.)

Select all that apply

Update the trust policy of `DataProcessorRole` to specify the ARN of `EC2InstanceRole` as the Principal.

Attach an IAM permissions policy to `EC2InstanceRole` that allows the `sts:AssumeRole` action on `arn:aws:iam::123456789012:role/DataProcessorRole`.

Update the trust policy of `EC2InstanceRole` to define `DataProcessorRole` as a trusted Principal.

Attach an IAM permissions policy to `DataProcessorRole` that allows the `sts:AssumeRole` action on all resources (`*`).

Modify the application script to hardcode the AWS access key and secret access key of a high-privilege IAM user.

Show answer & explanation

Answer: Update the trust policy of `DataProcessorRole` to specify the ARN of `EC2InstanceRole` as the Principal.; Attach an IAM permissions policy to `EC2InstanceRole` that allows the `sts:AssumeRole` action on `arn:aws:iam::123456789012:role/DataProcessorRole`.

Answer

To resolve the issue, the developer must modify the trust policy of the target role (DataProcessorRole) to trust the assuming identity (EC2InstanceRole) as a principal, and attach a permissions policy to the assuming identity (EC2InstanceRole) that permits the sts:AssumeRole action on the target role's resource ARN.

For an application running on an EC2 instance to assume another IAM role, the target role's trust policy must explicitly trust the IAM identity of the calling application (the option recommending modifying the trust policy of the target role to reference the EC2 instance role ARN). Furthermore, the caller's identity-based policies must authorize it to make the call (the option recommending attaching a permissions policy allowing the assume role operation to the instance role).

Step-by-Step Solution

Analyze the execution caller and error condition.

The SDK script runs as the EC2InstanceRole principal. The current trust policy of DataProcessorRole only trusts the service principal 'ec2.amazonaws.com'.

When EC2 software assumes a role via SDK, the direct caller is the IAM role associated with the instance, not the EC2 service itself.

Correct the trust relationship of the target role.

Update the trust policy of DataProcessorRole so its Principal block contains the ARN of EC2InstanceRole.

This establishes that DataProcessorRole trusts the EC2InstanceRole principal to assume it.

Configure permissions for the calling identity.

Attach a permissions policy to EC2InstanceRole allowing the 'sts:AssumeRole' action on 'arn:aws:iam::123456789012:role/DataProcessorRole'.

Even when the target role trusts the caller, the caller must have client-side identity permissions authorizing it to make the AssumeRole API call.

Key Concept

Delegation via IAM AssumeRole requires permissions on both sides: the trust policy of the target role must trust the caller, and the permission policy of the calling role must allow sts:AssumeRole on the target.

Question 1495Question →

A developer is designing a real-time transaction processing pipeline. The architecture uses Amazon Kinesis Data Streams to ingest high-volume transaction records from retail merchants, followed by an AWS Lambda function that processes the stream and publishes suspicious transactions to an Amazon EventBridge custom event bus for fraud detection. The Lambda function is deployed inside a private VPC subnet to securely query a database.

During peak sales events, the developer notices two issues:
1. The producer application receives ProvisionedThroughputExceededException errors on the Kinesis stream, even though the total throughput is well below the stream's aggregate limits. The records are currently partitioned using the MerchantID.
2. The Lambda function frequently runs into execution timeouts when attempting to publish events to the EventBridge bus, failing to forward the fraud alerts.

Which two changes should the developer make to resolve these issues?

Select all that apply

Update the producer to use a composite partition key by appending a high-entropy transaction identifier to the MerchantID.

Create an interface VPC endpoint (AWS PrivateLink) for EventBridge in the VPC and ensure the Lambda security group allows outbound traffic to it.

Use a static partition key for all incoming transaction records to ensure sequential order of processing across all shards.

Configure a NAT Gateway in the private VPC subnet and update the route table of the same subnet to route 0.0.0.0/0 traffic through it.

Increase the execution timeout of the Lambda function to 15 minutes to handle the increased API response times from EventBridge.

Show answer & explanation

Answer: Update the producer to use a composite partition key by appending a high-entropy transaction identifier to the MerchantID.; Create an interface VPC endpoint (AWS PrivateLink) for EventBridge in the VPC and ensure the Lambda security group allows outbound traffic to it.

Answer

Updating the producer to use a composite partition key by appending a high-entropy transaction identifier to the MerchantID, and creating an interface VPC endpoint for EventBridge in the VPC.

Updating the producer to use a composite key by appending a high-entropy transaction identifier to the merchant identifier ensures that write operations are evenly distributed across all available Kinesis shards. This prevents hot shards when a single merchant has a transaction spike. Additionally, creating an interface VPC endpoint for EventBridge allows the Lambda function in the private subnet to securely communicate with the EventBridge service privately over the AWS network, resolving the connection timeout issues.

Step-by-Step Solution

Analyze the Kinesis streaming issue where some shards are throttled while total stream throughput is low.

Identify that using MerchantID as the partition key causes uneven distribution (hot shards) when a merchant has a high volume of transactions.

To resolve hot shards, the partition key must have high entropy, which can be achieved by using a composite key.

Analyze the Lambda timeout issue when attempting to write to EventBridge.

Identify that the Lambda function is in a private VPC subnet and lacks a route to public AWS endpoints like EventBridge.

To establish connectivity, the VPC requires either a NAT Gateway in a public subnet or an interface VPC endpoint for EventBridge in the private subnet.

Select the options that correctly implement these solutions.

The composite partition key implementation and the interface VPC endpoint configuration satisfy both requirements securely and correctly.

These actions resolve the performance bottleneck on Kinesis and the networking boundary issue for VPC-bound Lambda.

Key Concept

Stream partition key design and private VPC networking for AWS Lambda integrations.

Estimated Time:3m 0s

Question 1496Question →

A developer is using an AWS Lambda function to process messages from an Amazon SQS standard queue. The Lambda function processes each message by calling a third-party API, which usually takes $10\text{ seconds}$ but can take up to $50\text{ seconds}$ under high load. The SQS queue's visibility timeout is configured to $30\text{ seconds}$ , and the Lambda function's timeout is set to $60\text{ seconds}$ . The developer notices that when the third-party API is slow, messages are processed multiple times, resulting in duplicate database entries. Which change should the developer make to resolve this duplicate processing issue?

Increase the SQS queue's visibility timeout to

360\text{ seconds}

or more.

Decrease the SQS queue's visibility timeout to

10\text{ seconds}

to match the average API response time.

Increase the Lambda function's timeout to

300\text{ seconds}

while keeping the SQS visibility timeout at

30\text{ seconds}

Initialize the AWS SDK client inside the Lambda handler using hardcoded AWS access keys.

Show answer & explanation

Answer: Increase the SQS queue's visibility timeout to $360\text{ seconds}$ or more.

Answer

Increase the SQS queue's visibility timeout to

360\text{ seconds}

or more.

The correct answer is to increase the SQS queue's visibility timeout to

360\text{ seconds}

or more. If the queue's visibility timeout is shorter than the Lambda function's timeout, SQS will make the message visible to other consumers while the active execution is still running. AWS recommends configuring the queue's visibility timeout to at least 6 times the Lambda function's timeout to ensure proper handling and retries.

Step-by-Step Solution

Analyze the relationship between the SQS visibility timeout and the Lambda function timeout.

The current SQS visibility timeout (

30\text{ seconds}

) is less than the Lambda function's timeout (

60\text{ seconds}

) and the maximum API response time (

50\text{ seconds}

When the visibility timeout is shorter than the execution time, SQS assumes the consumer failed and makes the message visible to other consumers before the current Lambda function finishes, causing duplicates.

Apply the AWS recommended best practice for SQS-Lambda integrations.

Determine that the SQS visibility timeout should be at least 6 times the Lambda function's timeout.

Setting the visibility timeout to at least

6 \times \text{Lambda timeout}

(

6 \times 60\text{ seconds} = 360\text{ seconds}

) prevents concurrent processing of the same message and allows adequate time for processing and potential retries.

Key Concept

SQS Visibility Timeout vs. Consumer Processing Time

Question 1497Question →

A developer is implementing a retail order processing pipeline. A producer application writes order updates to an Amazon Kinesis data stream using the customer's country code as the partition key. An AWS Lambda function, configured within a private VPC subnet without internet access, processes the stream and must route orders exceeding $10,000$ USD to an external system via an Amazon EventBridge custom event bus.

During high-traffic events, the developer observes two issues:
1. The Kinesis stream experiences `ProvisionedThroughputExceededException` errors on a single shard, even though overall stream throughput is well below the stream limits.
2. The Lambda function times out and fails to publish the filtered high-value events to the EventBridge event bus.

Which combination of actions will resolve both issues?

Change the Kinesis producer to use a high-entropy value such as the unique order ID as the partition key, and create an interface VPC endpoint (AWS PrivateLink) for EventBridge in the Lambda function's VPC subnets.

Increase the number of shards in the Kinesis stream to distribute the load, and assign a public IP address to the Lambda function's ENIs to allow it to communicate with EventBridge directly over the internet.

Update the Kinesis producer to use a static, constant string as the partition key to ensure order preservation, and update the trust policy of the Lambda execution role to allow the EventBridge service to publish events.

Keep the country code partition key but increase the Lambda batch size to process more records per invocation, and increase the Lambda function's timeout limit to allow the network calls to EventBridge to complete.

Show answer & explanation

Answer: Change the Kinesis producer to use a high-entropy value such as the unique order ID as the partition key, and create an interface VPC endpoint (AWS PrivateLink) for EventBridge in the Lambda function's VPC subnets.

Answer

The correct answer resolves both the database streaming bottleneck and the VPC connectivity bottleneck. By using a high-entropy key like a unique order ID, records are distributed uniformly across all Kinesis shards, resolving the hot shard throttling. By deploying an interface VPC endpoint (PrivateLink) for EventBridge inside the VPC, the Lambda function can route its API calls locally to the endpoint, enabling event routing without requiring public internet routing.

Step-by-Step Solution

Analyze the Kinesis throttling root cause.

The producer uses the country code as the partition key. Because country codes have low cardinality/entropy, some countries with high order volumes will flood a single shard, causing a 'hot shard' and resulting in ProvisionedThroughputExceededException errors even if the overall stream capacity is sufficient.

Kinesis routes records to shards based on the hash of the partition key; high-entropy keys ensure uniform distribution.

Select a proper partition key strategy.

Change the partition key to a high-entropy identifier like a unique order ID to distribute writes evenly across all available shards.

This fixes the uneven write distribution and prevents the ProvisionedThroughputExceededException on individual shards.

Identify the Lambda connectivity issue to EventBridge.

The Lambda function is running in a private VPC subnet with no internet access. Since EventBridge endpoints are public by default, the Lambda function cannot resolve or reach the EventBridge service, causing the function to time out.

VPC-enabled Lambda functions without a NAT Gateway or VPC endpoint cannot access public AWS service endpoints.

Resolve the VPC network connectivity.

Create an interface VPC endpoint (AWS PrivateLink) for EventBridge (com.amazonaws.region.events) inside the Lambda function's VPC.

This establishes private connectivity, allowing the Lambda function to publish events to EventBridge securely without traversing the public internet.

Key Concept

Kinesis partition key entropy design and VPC Lambda networking with EventBridge PrivateLink.

Question 1498Question →

A developer is configuring an Amazon API Gateway REST API to send incoming event data directly to an Amazon Kinesis data stream using a service proxy integration. To authorize this integration, the developer creates an IAM role named `APIGatewayKinesisRole` with a permissions policy that allows `kinesis:PutRecord` on the target stream. However, when testing the API Gateway integration, the developer receives an error indicating that API Gateway is not authorized to assume the role. The developer inspects the trust policy of `APIGatewayKinesisRole`, which is configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "kinesis.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

How should the developer resolve this authorization error?

Change the Service principal in the trust policy to apigateway.amazonaws.com.

Change the Action in the trust policy to kinesis:PutRecord and keep kinesis.amazonaws.com as the principal.

Generate temporary access keys using AWS Security Token Service (STS) and hardcode them in the API Gateway integration request mapping template.

Attach an identity-based policy to APIGatewayKinesisRole that allows sts:AssumeRole on the API Gateway REST API resource.

Show answer & explanation

Answer: Change the Service principal in the trust policy to apigateway.amazonaws.com.

Answer

Change the Service principal in the trust policy to apigateway.amazonaws.com.

To resolve the authorization issue, the service principal in the trust policy must be changed to apigateway.amazonaws.com. This tells IAM that the API Gateway service is trusted to assume the role. When API Gateway executes the integration, it calls sts:AssumeRole on the specified role to get temporary credentials with the permissions defined in the attached policy (which allows kinesis:PutRecord).

Step-by-Step Solution

Analyze the error message and the configuration.

The error indicates that API Gateway is unable to assume the role. The trust policy defines the principal as kinesis.amazonaws.com.

To find why the assume role action fails, we must verify if the correct entity is allowed to assume the role.

Identify the service executing the action.

Amazon API Gateway is the service that needs to assume the role to send data to the Kinesis data stream.

The trust policy principal must designate the service requesting the role assumption.

Correct the principal in the trust policy.

Change the principal from kinesis.amazonaws.com to apigateway.amazonaws.com.

This allows the API Gateway service to successfully call sts:AssumeRole and acquire temporary credentials.

Key Concept

IAM trust policy service principal configuration

Question 1499Question →

A developer is configuring a REST API in Amazon API Gateway that integrates with an AWS Lambda function. The Lambda function must access the client's source IP address, a query string parameter named `storeId`, and a custom HTTP header named `X-Client-Device` from incoming requests. The developer wants to implement this with minimal configuration overhead and without writing mapping templates. Which two actions must the developer take to meet these requirements? (Select TWO.)

Select all that apply

Configure the API Gateway integration type as Lambda Proxy Integration.

Define a Velocity Template Language (VTL) mapping template in the Integration Request to pass parameters.

Create a custom Lambda Authorizer to extract the custom header and client IP and inject them into the request context.

Access the client IP, query string parameter, and custom header directly from the event object inside the Lambda function code.

Configure an API Gateway Integration Response mapping template to parse and format the return payload from the Lambda function.

Show answer & explanation

Answer: Configure the API Gateway integration type as Lambda Proxy Integration.; Access the client IP, query string parameter, and custom header directly from the event object inside the Lambda function code.

Answer

The developer should configure the API Gateway integration type as Lambda Proxy Integration and access the client IP, query string parameter, and custom header directly from the event object inside the Lambda function code.

Configuring the API Gateway integration type as Lambda Proxy Integration is correct because it passes all request metadata—including query string parameters, headers, and client connection context—directly to the backend Lambda function. Accessing these parameters from the event object inside the Lambda function handler is correct because the proxy integration formats the request as a structured JSON object, allowing direct extraction of the data within the function code without writing any VTL mapping templates.

Step-by-Step Solution

Analyze API Gateway integration options to meet the minimal configuration and zero-mapping template requirements.

Lambda Proxy integration is selected because it forwards the raw HTTP request directly to the Lambda function without mapping templates.

Lambda Custom integration requires manually defining request mapping templates, which increases configuration overhead.

Determine how the backend Lambda function accesses the forwarded parameters under a proxy integration.

The parameters are read from the handler's event parameter: the IP from the requestContext object, the header from the headers object, and the query string from the queryStringParameters object.

Lambda Proxy integration structures the incoming request into a standard JSON event schema containing all request metadata.

Key Concept

API Gateway Lambda Proxy Integration vs Lambda Custom Integration

Estimated Time:1m 30s

Question 1500Question →

A developer is configuring an AWS Lambda function to process a real-time data stream from Amazon Kinesis. During testing under high load, the Lambda function frequently times out because it cannot process the large batch of stream records within its configured execution time limit. Which action should the developer take to resolve this processing timeout issue?

Decrease the batch size (BatchSize) in the Lambda event source mapping configuration.

Change the partition key on the producer to a single static string to consolidate all records into one shard.

Move the Lambda function into a private VPC subnet with no NAT Gateway to decrease network latency.

Modify the trust policy of the Lambda execution role to allow the Kinesis service to assume the role.

Show answer & explanation

Answer: Decrease the batch size (BatchSize) in the Lambda event source mapping configuration.

Answer

Decrease the batch size (BatchSize) in the Lambda event source mapping configuration.

Decreasing the batch size in the event source mapping limits the number of stream records sent to the Lambda function during a single invocation. This directly reduces the computational load and time required to execute the function, preventing it from hitting the execution time limit.

Step-by-Step Solution

Identify the root cause of the Lambda function timeout when processing stream records.

The function is attempting to process too many records at once, exceeding the execution time limit.

Lambda polls Kinesis and retrieves records up to the configured BatchSize.

Adjust the BatchSize parameter in the event source mapping.

Fewer records are delivered to the Lambda function per invocation.

This reduces the total processing work per invocation, ensuring the function completes before timing out.

Key Concept

Configuring Kinesis event source mapping parameters for AWS Lambda to optimize stream processing.

Estimated Time:1m 0s

PreviousPage 75 / 78Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept