All practice questions

1542 questions

All types1,542 Multiple choice782 Multiple select746 Ordering14

A developer needs to configure an Amazon Kinesis Data Stream to ingest telemetry data from thousands of IoT devices. To ensure that data is distributed evenly across all shards, which TWO values should the developer select to use as the partition key? (Select TWO.)

Select all that apply

A unique device identifier (device_id)

A timestamp representing the hour the event occurred

A randomly generated transaction UUID

A static string indicating the device manufacturer name

The source country code of the device location

Show answer & explanation

Answer: A unique device identifier (device_id); A randomly generated transaction UUID

Answer

The correct options are the unique device identifier (device_id) and the randomly generated transaction UUID.

Amazon Kinesis Data Streams use the partition key to determine which shard a record is sent to. By using high-cardinality, high-entropy values like a unique device identifier or a randomly generated UUID, the hash values are distributed evenly across the stream's shards, ensuring balanced throughput.

Step-by-Step Solution

Analyze how Kinesis Data Streams route records to shards using partition keys.

Kinesis applies an MD5 hash function to the partition key, mapping the hash value to a specific shard range.

Understanding the routing mechanism helps evaluate how different keys affect partition distribution.

Evaluate the cardinality and entropy of each proposed partition key option.

High-cardinality keys like unique device IDs and randomly generated UUIDs result in an even distribution of hash values across shards. Low-cardinality keys (like static names, hour timestamps, or country codes) concentrate writes on a small number of shards.

Selecting high-cardinality keys prevents ProvisionedThroughputExceededException caused by hot shards.

Key Concept

Partition key cardinality and shard distribution in Amazon Kinesis Data Streams

Question 1502Question →

A developer is designing an online bookstore's catalog system where inventory updates and search queries must be highly optimized. The application writes $40$ book metadata updates per second to an Amazon DynamoDB table, with each write payload size averaging $2.7\text{ KB}$ . To support real-time inventory dashboards, the application runs $15$ strongly consistent `Query` operations per second. Each `Query` returns a list of $12$ book items associated with a specific publisher (the partition key), and each book item has an average size of $1.5\text{ KB}$ . Which of the following represents the minimum provisioned read capacity units (RCUs) and write capacity units (WCUs) required to support this workload?

75\text{ RCUs}

and

120\text{ WCUs}

180\text{ RCUs}

and

120\text{ WCUs}

38\text{ RCUs}

and

120\text{ WCUs}

75\text{ RCUs}

and

108\text{ WCUs}

Show answer & explanation

Answer: $75\text{ RCUs}$ and $120\text{ WCUs}$

Answer

The correct answer is

75\text{ RCUs}

and

120\text{ WCUs}

The correct answer is

75\text{ RCUs}

and

120\text{ WCUs}

. Each write payload of

2.7\text{ KB}

is rounded up to

3\text{ KB}

. Writing

40

items per second requires

40 \times 3 = 120\text{ WCUs}

. For reads, a single Query returns

12

items of

1.5\text{ KB}

each, totaling

18\text{ KB}

of data. This cumulative size is rounded up to the nearest

4\text{ KB}

boundary, which is

20\text{ KB}

. Since strongly consistent reads require

1\text{ RCU}

per

4\text{ KB}

block, each Query consumes

20\text{ KB} / 4\text{ KB} = 5\text{ RCUs}

. Executing

15

queries per second requires

15 \times 5 = 75\text{ RCUs}

Step-by-Step Solution

Calculate the Write Capacity Units (WCUs) needed per second.

Each write payload of

2.7\text{ KB}

is rounded up to the nearest

1\text{ KB}

boundary, which is

3\text{ KB}

. Since the application performs

40

writes per second, the total write capacity required is

40 \times 3\text{ KB} = 120\text{ WCUs}

One WCU supports one write per second for items up to

1\text{ KB}

Calculate the cumulative size of retrieved items per `Query` operation.

Each `Query` returns

12

items with an average size of

1.5\text{ KB}

each. The cumulative size is

12 \times 1.5\text{ KB} = 18\text{ KB}

For Query and Scan operations, DynamoDB calculates read capacity based on the cumulative size of all items returned rather than rounding up each item individually.

Round up the cumulative query size and calculate the RCUs per Query.

The cumulative size of

18\text{ KB}

is rounded up to the nearest

4\text{ KB}

boundary, which is

20\text{ KB}

. For a strongly consistent read, each

4\text{ KB}

requires

1\text{ RCU}

, so each query consumes

20\text{ KB} / 4\text{ KB} = 5\text{ RCUs}

Read capacity for strongly consistent reads is calculated by dividing the rounded cumulative size in KB by

4\text{ KB}

Calculate the total Read Capacity Units (RCUs) needed per second.

The application performs

15

queries per second. The total read capacity required is

15 \times 5\text{ RCUs} = 75\text{ RCUs}

Multiplying the RCUs consumed per query by the number of queries per second gives the total provisioned read throughput.

Key Concept

Calculation of DynamoDB Read and Write Capacity Units (RCUs and WCUs) for Batch/Query Operations

Question 1503Question →

A developer is implementing a background processing application on Amazon EC2 instances that retrieves and processes data batches from an Amazon SQS standard queue. Each batch processing operation takes approximately $5$ minutes to complete. During testing, the developer observes that multiple EC2 instances are processing the same data batches, causing duplicate records in the database. The SQS queue is currently using the default configuration values. Which of the following actions will resolve the duplicate processing issue?

Increase the visibility timeout of the SQS queue to at least

6

minutes.

Decrease the visibility timeout of the SQS queue to

0

seconds.

Redesign the application to run on AWS Lambda with a function execution timeout set to

3

minutes.

Hardcode an IAM user's secret access key and access key ID within the SDK client initialization code to authenticate requests faster.

Show answer & explanation

Answer: Increase the visibility timeout of the SQS queue to at least $6$ minutes.

Answer

Increase the visibility timeout of the SQS queue to at least

6

minutes.

Increasing the SQS queue's visibility timeout ensures that a message remains invisible to other consumers for the entire duration of the processing logic (

5

minutes). Setting the timeout to a value greater than the processing time (such as

6

minutes) allows the processing instance sufficient time to complete its task and delete the message from the queue.

Step-by-Step Solution

Analyze the message lifecycle and identify the mismatch between the processing duration and the queue's default settings.

The default SQS visibility timeout is

30

seconds, but the background job requires

5

minutes (

300

seconds) to process.

Because the processing time exceeds the visibility timeout, the message becomes visible to other consumers before the active EC2 instance can complete processing and delete it.

Determine the required visibility timeout duration to prevent concurrent consumption.

The visibility timeout must be set to a value greater than the maximum processing time, meaning at least

5

minutes (e.g.,

6

minutes).

This guarantees that no other consumers can pull the same message from the queue during the

5

-minute execution window.

Identify security and architectural anti-patterns in the remaining choices.

Decreasing the timeout to

0

seconds makes messages immediately visible; a

3

-minute Lambda execution timeout fails the

5

-minute execution requirement; and hardcoding credentials presents security risks.

These actions do not resolve the message visibility problem and introduce new operational or security failures.

Key Concept

SQS Visibility Timeout vs Consumer Processing Duration

Question 1504Question →

A developer is setting up an Amazon S3 Batch Operations job to execute an AWS Lambda function on millions of objects in an Amazon S3 bucket. The developer creates an IAM role to grant the necessary permissions. However, the S3 Batch Operations job fails to run during initialization, resulting in an authorization failure. The developer inspects the trust policy attached to the role:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "s3.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which two actions should the developer take to resolve this authorization failure and successfully run the batch job? (Select TWO.)

Select all that apply

Update the service principal in the trust policy to batchoperations.s3.amazonaws.com

Attach a permissions policy to the IAM role that allows the lambda:InvokeFunction action on the target Lambda function's ARN

Change the Action in the trust policy from sts:AssumeRole to lambda:InvokeFunction to allow direct execution of the function

Configure the Lambda function code to manually call sts:AssumeRole to retrieve temporary credentials for the S3 Batch Operations service

Attach a resource-based policy to the S3 bucket that allows the sts:AssumeRole action for the s3.amazonaws.com principal

Show answer & explanation

Answer: Update the service principal in the trust policy to batchoperations.s3.amazonaws.com; Attach a permissions policy to the IAM role that allows the lambda:InvokeFunction action on the target Lambda function's ARN

Answer

Update the service principal in the trust policy to batchoperations.s3.amazonaws.com and attach a permissions policy to the IAM role that allows the lambda:InvokeFunction action on the target Lambda function's ARN.

To fix the authorization error, the trust policy must explicitly allow the S3 Batch Operations service to assume the role. The correct service principal is batchoperations.s3.amazonaws.com. Additionally, the role needs a permissions policy attached to it that permits the lambda:InvokeFunction action on the specific Lambda function being run.

Step-by-Step Solution

Identify the service attempting to assume the IAM role.

The service is S3 Batch Operations, which uses the specific service principal batchoperations.s3.amazonaws.com.

The standard s3.amazonaws.com principal is used for basic features like replication and event notifications, but not for batch operations.

Modify the trust policy principal accordingly.

The trust policy allows batchoperations.s3.amazonaws.com to perform sts:AssumeRole.

This establishes trust between the S3 Batch Operations service and the IAM role.

Determine the necessary operational permissions.

The role requires permission to run the Lambda function, which corresponds to the lambda:InvokeFunction action.

Trust policies only control delegation; standard IAM permissions policies must be attached to the role to authorize downstream actions.

Key Concept

Separation of Trust Policies and Permissions Policies

Question 1505Question →

A developer is designing the backend for an IoT vehicle tracking application. The application processes telemetry data from $15,000$ active vehicles. The data is written to an Amazon DynamoDB table using `VehicleId` as the partition key and `Timestamp` as the sort key.

The application must support the following access patterns:
1. Retrieve only the single most recent telemetry record for a specific vehicle.
2. Retrieve all telemetry records across all vehicles that have returned a status of `Error` within the last $24$ hours.

Which two actions should the developer take to meet these requirements with the lowest latency and cost? (Select TWO.)

Select all that apply

Perform a `Query` operation on the main table with `VehicleId` as the partition key, set `ScanIndexForward` to `false`, and set the `Limit` parameter to

1

Create a Global Secondary Index (GSI) with `ErrorStatus` (a sparse attribute only present when the status is an error) as the partition key and `Timestamp` as the sort key, and query this GSI using a key condition expression.

Perform a `Scan` operation on the main table with a FilterExpression to find the most recent telemetry record for a specific vehicle.

Initialize the DynamoDB client inside the AWS Lambda function code by hardcoding a temporary IAM user's credentials to authenticate the API calls.

Increase the table's provisioned write capacity units (WCUs) to resolve any `ProvisionedThroughputExceededException` errors caused by reading telemetry data from a small number of frequently accessed vehicles.

Show answer & explanation

Answer: Perform a `Query` operation on the main table with `VehicleId` as the partition key, set `ScanIndexForward` to `false`, and set the `Limit` parameter to $1$ .; Create a Global Secondary Index (GSI) with `ErrorStatus` (a sparse attribute only present when the status is an error) as the partition key and `Timestamp` as the sort key, and query this GSI using a key condition expression.

Answer

The correct options are performing a Query operation on the main table with VehicleId as the partition key, ScanIndexForward set to false, and a Limit of 1; and creating a Global Secondary Index with ErrorStatus as the partition key and Timestamp as the sort key, and querying it using a key condition expression.

To retrieve the single most recent telemetry record for a specific vehicle with the lowest latency and cost, a Query operation is the most efficient choice because it target-scans a single partition. By setting ScanIndexForward to false, the results are returned in descending order of the sort key (Timestamp), and setting the Limit parameter to 1 ensures that only the newest single item is read and returned, minimizing Read Capacity Unit (RCU) consumption. To retrieve all error records across all vehicles within the last 24 hours, a Global Secondary Index (GSI) is required since the query must span multiple vehicle partitions. Defining a GSI with ErrorStatus (a sparse attribute only present on error records) as the partition key and Timestamp as the sort key ensures that only error records are indexed, and queries can filter on the Timestamp in the key condition expression rather than post-query.

Step-by-Step Solution

Optimize the retrieval of the most recent record for a specific vehicle.

A query operation is formulated on the primary key (VehicleId) with the sort key (Timestamp) sorted in descending order (ScanIndexForward=false) and a limit of 1.

This reads only the single most recent item, consuming minimal read capacity.

Optimize the retrieval of error records across all vehicles.

A Global Secondary Index (GSI) is configured with ErrorStatus as the partition key and Timestamp as the sort key.

Since ErrorStatus is only populated on error records, the index is sparse, reducing storage/indexing costs and allowing fast queries across all vehicle partition keys using the sort key.

Ensure secure access to DynamoDB from the Lambda function.

The DynamoDB SDK client is initialized without hardcoded credentials, utilizing the environment's IAM execution role.

This adheres to the principle of least privilege and avoids exposing static credentials.

Key Concept

DynamoDB Query vs Scan optimization and credential management in SDK clients

Estimated Time:2m 0s

Question 1506Question →

A developer is designing a system for an online gaming platform where player score updates must be processed in the exact order they occur. The platform must also fan out these updates to both a leaderboard service and an archiving service, ensuring each service receives a copy of every update. Which combination of configurations will meet these requirements? (Select TWO.)

Select all that apply

Publish the score updates to an Amazon SNS FIFO topic.

Subscribe two Amazon SQS FIFO queues to the SNS FIFO topic, one for each consumer service.

Publish the score updates to an Amazon SNS standard topic and enable raw message delivery on the subscriptions.

Subscribe two Amazon SQS standard queues to the SNS FIFO topic, as SNS FIFO topics can deliver messages in an ordered sequence to standard queues.

Set the visibility timeout of the SQS queues to

0

seconds to ensure that consumer instances immediately receive the next ordered message in the queue.

Show answer & explanation

Answer: Publish the score updates to an Amazon SNS FIFO topic.; Subscribe two Amazon SQS FIFO queues to the SNS FIFO topic, one for each consumer service.

Answer

Publish the score updates to an Amazon SNS FIFO topic, and subscribe two Amazon SQS FIFO queues to the SNS FIFO topic, with one queue dedicated to each consumer service.

To achieve ordered processing and message fanout, the developer must use an Amazon SNS FIFO topic combined with Amazon SQS FIFO queues. SNS FIFO topics preserve the order of messages, and when SQS FIFO queues are subscribed to them, the ordering is maintained end-to-end. By creating two SQS FIFO queues (one for the leaderboard and one for archiving), both services receive every message in the correct sequence.

Step-by-Step Solution

Select the appropriate messaging topic type that supports message ordering.

An Amazon SNS FIFO topic is chosen to ensure that message ordering and deduplication are maintained at the ingress point.

Standard SNS topics do not guarantee first-in-first-out (FIFO) delivery or message deduplication.

Configure SQS queues to preserve message ordering and support fanout from the SNS FIFO topic.

Two SQS FIFO queues are created and subscribed to the SNS FIFO topic, one for the leaderboard service and one for the archiving service.

Standard SQS queues cannot guarantee message ordering. Subscribing two SQS FIFO queues to the SNS FIFO topic enables a fanout pattern while preserving message ordering for each consumer service.

Key Concept

End-to-end message ordering using Amazon SNS FIFO and Amazon SQS FIFO fanout integration.

Question 1507Question →

A developer has configured an Amazon DynamoDB table with DynamoDB Streams enabled to trigger an AWS Lambda function. The stream has a single active shard. During load testing, a high volume of database writes causes significant lag in stream processing because the Lambda function cannot keep up with the rate of incoming records. The developer needs to reduce the processing latency and resolve the lag while maintaining the order of processed records per partition key. Which configuration change will resolve the stream processing lag?

Increase the Lambda function's execution timeout to ensure the execution context remains warm and automatically processes all subsequent batches in the stream.

Increase the Parallelization Factor in the event source mapping configuration to process multiple batches from the shard concurrently.

Increase the visibility timeout of the DynamoDB stream event source mapping to match the Lambda function's processing time.

Configure the Lambda function to run inside a private VPC subnet to access the DynamoDB stream endpoint via a gateway VPC endpoint.

Show answer & explanation

Answer: Increase the Parallelization Factor in the event source mapping configuration to process multiple batches from the shard concurrently.

Answer

Increase the Parallelization Factor in the event source mapping configuration to process multiple batches from the shard concurrently.

The correct answer is to increase the Parallelization Factor in the event source mapping configuration. By default, Lambda processes only one batch per shard in parallel. Increasing the Parallelization Factor allows Lambda to poll and execute up to 10 concurrent batches from a single shard in parallel. Order is still guaranteed at the partition-key level, which satisfies all requirements of the scenario.

Step-by-Step Solution

Analyze the bottleneck in stream processing where a single shard is experiencing processing lag due to high write volumes.

The default Lambda stream integration processes a maximum of one batch per shard in parallel, limiting throughput when the processing time of a single batch exceeds the arrival rate of new records.

Understanding the baseline concurrency behavior of Lambda event source mappings for stream sources is necessary to identify how to scale them.

Evaluate configuration properties on the Lambda event source mapping that control concurrency per shard.

The Parallelization Factor setting allows Lambda to process up to 10 concurrent batches from a single shard simultaneously.

This configuration allows scaling out horizontal processing of a stream shard without requiring database resharding.

Confirm that the solution meets the requirement to maintain in-order processing of records per partition key.

Lambda preserves in-order processing at the partition-key level even when the Parallelization Factor is greater than 1.

Ensuring data integrity and partition-key ordering is a strict requirement of the design scenario.

Key Concept

Scaling stream processing throughput in Lambda event source mappings using Parallelization Factor.

Estimated Time:1m 30s

Question 1508Question →

A developer is deploying an application on Amazon ECS using the AWS Fargate launch type. The application container needs to read messages from an Amazon SQS queue. The developer creates an IAM role with the correct SQS permissions, but the ECS task fails to start, returning an error that the task role could not be assumed. The developer inspects the trust policy currently associated with the IAM role:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ecs.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which modification to the trust policy will resolve this issue and allow the ECS task to assume the role?

Change the "Service" value in the "Principal" block to "ecs-tasks.amazonaws.com".

Change the "Action" value from "sts:AssumeRole" to "sts:AssumeRoleWithWebIdentity".

Add "ec2.amazonaws.com" to the "Service" list under the "Principal" block.

Generate temporary AWS credentials using the AWS CLI and pass them to the task via environment variables.

Show answer & explanation

Answer: Change the "Service" value in the "Principal" block to "ecs-tasks.amazonaws.com".

Answer

Change the "Service" value in the "Principal" block to "ecs-tasks.amazonaws.com".

The correct option is correct because the Amazon ECS container agent requires the trust policy to specify the 'ecs-tasks.amazonaws.com' service principal. This allows ECS Fargate to assume the role and associate its permissions with the containers running in the task.

Step-by-Step Solution

Identify the service attempting to assume the IAM role.

The ECS task container agent needs to assume the role to run the task.

Understanding which entity is requesting the role helps determine the correct service principal.

Analyze the existing trust policy principal.

The principal is currently set to "ecs.amazonaws.com".

This principal is for the ECS service scheduler (used for task registration and ELB interactions), not the tasks themselves.

Update the trust policy service principal to allow ECS tasks to assume the role.

Change the principal to "ecs-tasks.amazonaws.com".

This allows the ECS container agent to successfully assume the role on behalf of the container.

Key Concept

IAM Trust Policies and Service Principals for ECS Tasks

Question 1509Question →

A developer is implementing a transaction processing service for a financial ledger application. The application tracks transactions in an Amazon DynamoDB table with the following schema:
- Partition Key: ` $AccountId$ ` (string)
- Sort Key: ` $TransactionId$ ` (string)
- Attributes: ` $Amount$ ` (number), ` $TransactionTimestamp$ ` (number), ` $Status$ ` (string)

The application currently retrieves all transactions for a given ` $AccountId$ ` that are in a 'PENDING' status. During peak traffic, the application experiences high latency and receives `ProvisionedThroughputExceededException` errors, even though the total Read Capacity Units (RCUs) provisioned are sufficient for the workload. Furthermore, during a security audit, it was discovered that the ECS tasks running this microservice are configured with hardcoded AWS credentials in the container environment variables.

Which two actions should the developer take to resolve the latency, throughput, and security issues?

Select all that apply

Create a Local Secondary Index (LSI) with `

Status

` as the sort key, and execute a `Query` operation specifying the `

AccountId

` and the `

Status

` key condition.

Use a `Scan` operation with a `FilterExpression` on the base table to retrieve items matching the `

AccountId

` and a `

Status

` of 'PENDING'.

Associate an IAM policy granting DynamoDB access to the ECS Task Role by specifying the `taskRoleArn` in the task definition, and configure the SDK client to retrieve credentials automatically.

Hardcode the AWS access key and secret key in the application's SDK client initialization code to bypass role resolution latency.

Attach the DynamoDB access policy to the ECS Task Execution Role using the `executionRoleArn` property to grant the running container permission to perform data plane operations.

Show answer & explanation

Answer: Create a Local Secondary Index (LSI) with ` $Status$ ` as the sort key, and execute a `Query` operation specifying the ` $AccountId$ ` and the ` $Status$ ` key condition.; Associate an IAM policy granting DynamoDB access to the ECS Task Role by specifying the `taskRoleArn` in the task definition, and configure the SDK client to retrieve credentials automatically.

Answer

Create a Local Secondary Index (LSI) with `

Status

` as the sort key, and execute a `Query` operation specifying the `

AccountId

` and the `

Status

` key condition, and associate an IAM policy granting DynamoDB access to the ECS Task Role by specifying the `taskRoleArn` in the task definition, configuring the SDK client to retrieve credentials automatically.

The correct combination of actions optimizes performance and meets security guidelines. Creating a Local Secondary Index (LSI) with `

Status

` as the sort key permits using the `Query` operation to retrieve only pending items for a given partition key, preventing high RCU consumption. Using the ECS Task Role (`taskRoleArn`) is the standard secure pattern to grant credentials to containers at runtime, avoiding hardcoding.

Step-by-Step Solution

Analyze the table schema and query pattern to address RCU usage and latency.

The current query filters by `

Status

` on a table partitioned by `

AccountId

`. Without an index on `

Status

`, the developer must either scan the table or query all items for a partition and filter them. Creating a Local Secondary Index (LSI) with `

Status

` as the sort key allows a direct query on both attributes.

LSIs are efficient for querying attributes other than the base table's sort key for a single partition key value.

Select the correct API call to perform the query.

The developer should use the `Query` API on the LSI instead of a `Scan` on the base table.

Using `Query` restricts the search to a specific partition key and sort key range, while `Scan` inspects all items in the table/index, wasting RCUs.

Address the security finding regarding hardcoded container credentials.

The hardcoded credentials must be removed, and the ECS Task Definition must define the `taskRoleArn` with an IAM role containing DynamoDB access permissions.

The Task Role gives the application containers permissions to call AWS APIs, whereas the Task Execution Role only provides the container agent permissions to pull images and stream logs.

Key Concept

Optimizing DynamoDB queries using Local Secondary Indexes (LSIs) and securing containerized applications using ECS Task Roles.

Question 1510Question →

An online education company uses an Amazon DynamoDB table named `CourseProgress` to track student progress. The table uses `StudentID` as the partition key and `CourseID` as the sort key. Over time, students accumulate thousands of records, but only a small fraction of these courses are fully completed. A dashboard frequently retrieves only the completed courses for a specific student. As the volume of in-progress course records grows, the dashboard queries become slower and consume a significant number of Read Capacity Units (RCUs). Which database design pattern or operation should a developer implement to retrieve the completed courses in the most cost-effective and performant manner?

Create a Global Secondary Index (GSI) with `StudentID` as the partition key and a new attribute `CompletedDate` as the sort key. Only populate the `CompletedDate` attribute in the base table when a course is completed, and query the GSI to retrieve the records.

Perform a Scan operation on the base table with a FilterExpression that filters the results where the partition key matches the target student and the progress status is 'Completed'.

Query the base table using the `StudentID` partition key with a FilterExpression for completed courses, and increase the table's provisioned Read Capacity Units (RCUs) to prevent ProvisionedThroughputExceededException errors during peak times.

Implement parallel Scan operations using the AWS SDK, initializing the client with hardcoded IAM credentials that have read-only access to speed up the data retrieval process.

Show answer & explanation

Answer: Create a Global Secondary Index (GSI) with `StudentID` as the partition key and a new attribute `CompletedDate` as the sort key. Only populate the `CompletedDate` attribute in the base table when a course is completed, and query the GSI to retrieve the records.

Answer

Create a Global Secondary Index (GSI) with StudentID as the partition key and a new attribute CompletedDate as the sort key. Only populate the CompletedDate attribute in the base table when a course is completed, and query the GSI to retrieve the records.

Creating a Global Secondary Index (GSI) with the student identifier as the partition key and a completion date as the sort key, and only populating this completion date when the course is finished, creates a sparse index. In Amazon DynamoDB, items that do not contain the GSI's sort key attribute are not indexed. As a result, the GSI only contains records for completed courses, allowing the application to perform highly efficient Queries against the GSI that consume Read Capacity Units (RCUs) only for the completed courses, rather than reading and filtering all in-progress records.

Step-by-Step Solution

Analyze the table structure and access patterns.

The table has StudentID as partition key and CourseID as sort key. The requirement is to fetch only completed courses for a specific student.

Understanding the base schema helps identify why standard queries become inefficient when filtering on non-key attributes.

Evaluate the impact of DynamoDB FilterExpressions.

A FilterExpression on a Query or Scan does not reduce RCU consumption because DynamoDB reads the items first and then filters them.

This explains why querying the base table and filtering is not cost-effective.

Design a sparse Global Secondary Index (GSI).

Create a GSI with StudentID as partition key and CompletedDate as sort key. Only write CompletedDate when a course is finished.

Since DynamoDB only indexes items where the GSI keys are present, this creates a sparse index containing only completed courses, optimizing both query performance and cost.

Key Concept

DynamoDB Sparse Indexes and Query Optimization

Question 1511Question →

A developer is designing an integration for an e-commerce platform's inventory and shipping services. When a customer places an order, both the inventory service and the shipping service must receive the order details. The services must process orders in the exact order they were placed to maintain correct inventory levels and shipping sequences. If processing fails for a specific customer's order, it must not block the processing of orders for other customers. Which combination of actions will meet these requirements? (Select TWO.)

Select all that apply

Publish the order events to an Amazon SNS FIFO topic, and subscribe two Amazon SQS FIFO queues to the topic to fan out the messages.

Use the customer ID as the MessageGroupId when publishing the order events.

Use a single standard Amazon SQS queue, and configure both the inventory and shipping services as competing consumers.

Configure the SQS visibility timeout to be shorter than the downstream consumer's processing time.

Configure the downstream Lambda function's timeout to be greater than the SQS queue's visibility timeout.

Show answer & explanation

Answer: Publish the order events to an Amazon SNS FIFO topic, and subscribe two Amazon SQS FIFO queues to the topic to fan out the messages.; Use the customer ID as the MessageGroupId when publishing the order events.

Answer

Publish the order events to an Amazon SNS FIFO topic, subscribe two Amazon SQS FIFO queues to the topic to fan out the messages, and use the customer ID as the MessageGroupId when publishing the order events.

Publishing the order events to an Amazon SNS FIFO topic and subscribing two Amazon SQS FIFO queues allows for ordered fanout, ensuring both downstream services receive every message in the correct sequence. Using the customer ID as the MessageGroupId ensures that messages belonging to the same customer are processed in the order they were received, while messages for different customers are processed in parallel without causing head-of-line blocking.

Step-by-Step Solution

Select the messaging services that support fanout and ordering.

Amazon SNS FIFO and Amazon SQS FIFO queues are selected because standard queues do not guarantee strict ordering or support ordered fanout.

To send the same order event to both the inventory and shipping services while preserving order, a combination of an SNS FIFO topic and SQS FIFO queues is required.

Configure the partition and ordering context using message headers.

Set the MessageGroupId to the customer ID.

Using the customer ID ensures that ordering is strictly maintained per customer (avoiding head-of-line blocking for other customers) rather than globally across all orders.

Key Concept

FIFO Fanout with SNS and SQS using MessageGroupId for logical partitioning

Question 1512Question →

An organization has deployed a retail processing system where an AWS Lambda function must verify transactions against a third-party payment vendor's HTTPS API. The function retrieves the vendor API keys from AWS Systems Manager Parameter Store. During load testing, the team notices latency spikes and hits the rate limit for Parameter Store API requests. Which implementation strategy will resolve these issues while maintaining security best practices?

Retrieve the API keys from Parameter Store outside the Lambda handler function during the initialization phase, and store them in a global variable for subsequent invocations to reuse.

Call the Parameter Store API inside the Lambda handler function on every invocation, relying on Lambda to automatically cache and deduplicate these external requests within the same execution context.

Store the API keys in plain text within the Lambda function's environment variables and initialize the AWS SDK client inside the handler on every invocation.

Configure the Lambda function to run inside a private VPC subnet without a NAT Gateway or VPC endpoints to isolate the database queries and secure the payment vendor calls.

Show answer & explanation

Answer: Retrieve the API keys from Parameter Store outside the Lambda handler function during the initialization phase, and store them in a global variable for subsequent invocations to reuse.

Answer

Retrieve the API keys from Parameter Store outside the Lambda handler function during the initialization phase, and store them in a global variable for subsequent invocations to reuse.

The correct strategy is to retrieve the API keys from Parameter Store outside the Lambda handler function during the initialization phase, and store them in a global variable. When AWS Lambda executes a function, it initializes the execution environment and runs the code outside the handler. When the function is invoked multiple times, Lambda reuses the same execution environment (warm starts), preserving variables declared in the global scope. This reduces the number of API calls to Parameter Store, prevents hitting API rate limits, and decreases the function's overall execution latency.

Step-by-Step Solution

Analyze the scope of the variable initialization in the Lambda function.

Variables initialized outside the handler function (in the global scope) are preserved when the execution context is reused across multiple warm invocations.

Understanding Lambda's execution environment lifecycle helps identify where to place code that does not need to run on every invocation.

Move the Systems Manager Parameter Store API call to the global initialization block.

The API key is fetched once during the function's cold start (initialization phase) instead of on every invocation.

This avoids repeating API calls to Parameter Store, preventing rate limiting and lowering execution latency for subsequent requests.

Ensure secure storage and network paths are maintained.

The credentials remain securely stored in Parameter Store, and the Lambda function retains outbound internet access to call the third-party payment gateway.

Storing credentials securely and ensuring proper network configurations are critical for production serverless applications.

Key Concept

AWS Lambda Execution Context Reuse

Estimated Time:1m 30s

Question 1513Question →

A developer is configuring an Amazon EventBridge Scheduler schedule to send messages to an Amazon SQS queue named OrderProcessingQueue in the same AWS account. The schedule is failing to deliver messages, and execution metrics show access denied errors.

Which two configurations are required to resolve this permissions issue? (Select TWO.)

Select all that apply

Configure the trust policy of the EventBridge Scheduler IAM execution role to allow the scheduler.amazonaws.com service principal to assume the role using the sts:AssumeRole action.

Attach a permissions policy to the EventBridge Scheduler IAM execution role that allows the sqs:SendMessage action on the arn:aws:sqs:us-east-1:123456789012:OrderProcessingQueue resource.

Configure the trust policy of the EventBridge Scheduler IAM execution role to allow the sqs.amazonaws.com service principal to assume the role using the sts:AssumeRole action.

Attach a permissions policy to the EventBridge Scheduler IAM execution role that allows the sts:AssumeRole action on the arn:aws:sqs:us-east-1:123456789012:OrderProcessingQueue resource.

Configure the EventBridge Scheduler target payload to pass temporary credentials by setting the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables inside the message body.

Show answer & explanation

Answer: Configure the trust policy of the EventBridge Scheduler IAM execution role to allow the scheduler.amazonaws.com service principal to assume the role using the sts:AssumeRole action.; Attach a permissions policy to the EventBridge Scheduler IAM execution role that allows the sqs:SendMessage action on the arn:aws:sqs:us-east-1:123456789012:OrderProcessingQueue resource.

Answer

To resolve the permissions issue, the developer must configure a trust policy on the IAM role that allows the EventBridge Scheduler service principal (scheduler.amazonaws.com) to assume the role, and attach an IAM permissions policy to that execution role that allows the sqs:SendMessage action on the specific target SQS queue resource.

For Amazon EventBridge Scheduler to deliver messages to Amazon SQS, it must assume an execution role. This requires a trust policy allowing the Scheduler service principal (scheduler.amazonaws.com) to assume the role, and a permissions policy attached to the role that grants the sqs:SendMessage permission on the target SQS queue.

Step-by-Step Solution

Identify the service principal that needs to assume the role.

The service principal scheduler.amazonaws.com requires trust permission to assume the role.

Since EventBridge Scheduler is running the task, it must be allowed to assume the IAM role to perform actions on your behalf.

Configure the trust relationship on the IAM role.

Add scheduler.amazonaws.com to the trust policy with the sts:AssumeRole action.

This establishes trust between IAM and the Scheduler service.

Grant SQS permissions to the execution role.

Attach an IAM permissions policy to the role that allows sqs:SendMessage on the specific SQS queue ARN.

This gives the assumed role the required permissions to deliver the messages to the SQS queue.

Key Concept

IAM execution roles require both a trust policy (allowing the service principal to assume the role) and a permissions policy (granting the role access to target resources).

Question 1514Question →

An enterprise e-commerce platform publishes high-volume checkout transaction events to a custom Amazon EventBridge event bus. A developer needs to route a subset of these events (specifically where the payment status is 'approved' and transaction amount exceeds $\$10,000$ ) to an Amazon Kinesis Data Stream containing $10$ shards for real-time analytics. An AWS Lambda function is configured to process these records from the Kinesis stream. The developer must ensure that events from the same customer are processed sequentially in the correct order, and that EventBridge has the necessary permissions to write to the Kinesis stream.

Which combination of configuration steps should the developer perform to meet these requirements? (Select two.)

Select all that apply

Configure the Kinesis Data Stream as the target for the EventBridge rule, and set the PartitionKeyPath to `$.detail.customerId` in the target configuration settings.

Configure the EventBridge rule's execution IAM role with a trust policy that allows the `events.amazonaws.com` service principal to assume the role, and an identity-based policy that grants `kinesis:PutRecord` or `kinesis:PutRecords` permissions on the target stream.

Configure the EventBridge target with a static string partition key constant, such as `'HighValueTransactions'`, to ensure that all forwarded events are grouped and processed together in a single shard.

Configure the EventBridge rule's IAM role with a trust policy that allows the `kinesis.amazonaws.com` service principal to assume the role, granting the target stream permission to pull events from the event bus.

Configure the Kinesis Event Source Mapping for the Lambda function with a batch size of

10,000

and set the Lambda function's timeout to

3

seconds to maximize record throughput.

Show answer & explanation

Answer: Configure the Kinesis Data Stream as the target for the EventBridge rule, and set the PartitionKeyPath to `$.detail.customerId` in the target configuration settings.; Configure the EventBridge rule's execution IAM role with a trust policy that allows the `events.amazonaws.com` service principal to assume the role, and an identity-based policy that grants `kinesis:PutRecord` or `kinesis:PutRecords` permissions on the target stream.

Answer

The developer should configure the Kinesis Data Stream as the EventBridge target with the PartitionKeyPath set to the customer ID path, and configure the execution role to trust the EventBridge service principal with permissions to write to the Kinesis stream.

Configuring the target with the `PartitionKeyPath` set to `$.detail.customerId` ensures customer-level ordering. Configuring the EventBridge execution role with a trust policy for `events.amazonaws.com` and permission for `kinesis:PutRecord` or `kinesis:PutRecords` enables the service to deliver events securely.

Step-by-Step Solution

Determine the partition key strategy to ensure strict chronological order per customer across Kinesis shards.

Identify that the partition key must resolve dynamically to each customer's ID rather than a static string, using the `PartitionKeyPath` property set to `$.detail.customerId`.

Kinesis routes records to specific shards based on the hash of the partition key. Using the customer ID ensures all records for a given customer are sent to the same shard, maintaining their ordering, while distributed customer IDs balance the overall workload across all 10 shards.

Configure the IAM permissions required for EventBridge to publish events directly to Kinesis.

Establish a trust policy allowing `events.amazonaws.com` to assume the role, and attach a policy allowing `kinesis:PutRecord` or `kinesis:PutRecords` on the stream.

EventBridge is the service initiating the action, so it must be trusted to assume the role. The permissions policy must explicitly grant writing capabilities to the specific target stream resource.

Analyze the Lambda consumer event source mapping and timeout configuration.

Recognize that a large batch size of

10,000

combined with a very short timeout of

3

seconds is highly likely to cause function timeouts, which would disrupt sequential shard processing.

Processing large batches takes time. If a timeout occurs, the event source mapping retries the batch, blocking downstream processing on that shard and potentially creating duplicates.

Key Concept

Configuring secure EventBridge target delivery to Kinesis with dynamic partitioning to preserve ordering.

Question 1515Question →

A developer is developing an AWS Lambda function that processes incoming file uploads from an Amazon S3 bucket. The processed data is then written to an Amazon DynamoDB table. During performance testing, the developer identifies two issues:

1. During peak traffic, the function scales rapidly and consumes all available concurrency in the AWS Region, causing other critical Lambda functions in the account to be throttled.
2. The function experiences elevated latency because it establishes a new connection to DynamoDB on every single invocation.

Which two actions should the developer take to resolve these issues? (Select two.)

Select all that apply

Configure reserved concurrency on the S3-triggered Lambda function to limit the maximum number of concurrent instances it can scale to.

Initialize the DynamoDB client outside of the Lambda handler function to reuse the execution context's connection across multiple invocations.

Configure provisioned concurrency on the S3-triggered Lambda function to prevent it from exceeding the account's concurrency limits.

Re-initialize the DynamoDB client inside the Lambda handler function on each invocation and call the client's close method at the end of the handler.

Hardcode temporary IAM security credentials directly into the DynamoDB client configuration within the Lambda function to bypass IAM role assumption overhead.

Show answer & explanation

Answer: Configure reserved concurrency on the S3-triggered Lambda function to limit the maximum number of concurrent instances it can scale to.; Initialize the DynamoDB client outside of the Lambda handler function to reuse the execution context's connection across multiple invocations.

Answer

Configure reserved concurrency on the S3-triggered Lambda function and initialize the DynamoDB client outside of the Lambda handler function.

The correct options recommend configuring reserved concurrency to prevent the function from scaling past a designated threshold and utilizing execution context reuse by initializing the DynamoDB client outside the handler. Reserved concurrency directly addresses account-level throttling by acting as a hard concurrency cap on the function. Placing the DynamoDB client initialization in the initialization phase (outside the handler function) ensures that the database connection persists in the container and is reused for subsequent warm invocations, avoiding the latency of establishing a new connection on every call.

Step-by-Step Solution

Analyze the first issue regarding unreserved concurrency exhaustion.

Identify that reserving a specific concurrency limit for the S3-triggered function prevents it from scaling indefinitely and consuming the entire account-level pool.

Reserved concurrency acts as a maximum limit for the specific function and guarantees a minimum slice of concurrency, protecting both the function itself and other functions in the account from throttling.

Analyze the second issue regarding DynamoDB connection establishment overhead.

Determine that placing the client initialization logic in the global scope (outside the handler) allows the connection to be kept alive and reused across invocations in the same execution context.

AWS Lambda preserves the global scope of the execution context during container reuse, so code executed outside the handler does not run again on warm starts, preventing the creation of new client connections on every request.

Key Concept

AWS Lambda concurrency limits (Reserved vs Provisioned) and execution context reuse for optimizing downstream database connections.

Question 1516Question →

A developer is implementing an AWS Lambda function that processes transaction records and stores them in an Amazon RDS database. The developer wants to optimize the database connection management to avoid connection overhead on subsequent invocations, while ensuring that the function does not exhaust the database's max connection limit during scaling. Which configuration and coding pattern should the developer implement?

Initialize the database connection pool outside the Lambda handler function to enable execution context reuse, and set the function's reserved concurrency to limit the maximum number of concurrent executions.

Initialize the database connection pool inside the Lambda handler function, relying on AWS Lambda to automatically close and clean up idle database connections when the invocation completes.

Configure the Lambda function to run inside the public subnets of the VPC where the RDS database is located, and configure the RDS security group to allow inbound traffic from the Lambda function's elastic network interfaces (ENIs).

Add an IAM trust policy to the database credentials stored in AWS Secrets Manager that permits the Lambda function's IAM execution role to assume the RDS service role to manage the connection pool.

Show answer & explanation

Answer: Initialize the database connection pool outside the Lambda handler function to enable execution context reuse, and set the function's reserved concurrency to limit the maximum number of concurrent executions.

Answer

The correct answer is to initialize the connection pool outside the handler and configure reserved concurrency. Declaring the database client/pool in the initialization code (outside the handler) allows the function to reuse existing TCP connections during subsequent invocations (warm starts), minimizing connection setup latency. Furthermore, relational databases like Amazon RDS have a maximum limit on concurrent connections. Since Lambda scales out horizontally by spawning new execution environments, configuring reserved concurrency on the Lambda function restricts the maximum number of concurrent executions, thereby capping the total number of active connections the Lambda function can open to the database.

Step-by-Step Solution

Analyze the requirements for database connection reuse and concurrency management in AWS Lambda.

Identified that reusing database connections requires utilizing execution context reuse (declaring the connection client/pool outside the handler method).

Variables declared outside the handler function remain initialized in the execution environment and can be reused in subsequent warm starts.

Determine how to protect the downstream relational database (Amazon RDS) from connection exhaustion during high-concurrency events.

Identified that setting reserved concurrency on the Lambda function establishes a hard limit on the number of concurrent execution environments.

Since each execution environment can only process one event at a time and maintains its own connection pool, limiting the concurrency limits the total number of connections to the database.

Key Concept

AWS Lambda execution context reuse and reserved concurrency.

Estimated Time:1m 30s

Question 1517Question →

A developer is implementing a medical report analysis service where PDF files are processed by a consumer application. The application retrieves processing tasks from an Amazon SQS queue. Each task takes exactly $40$ seconds to complete. The developers observe that the same reports are frequently processed multiple times, causing duplicate entries in the database. Which configuration change will prevent these duplicate processing events?

Increase the SQS visibility timeout to a value greater than

40

seconds.

Decrease the SQS visibility timeout to

20

seconds to allow faster retries.

Increase the execution timeout of the consumer application without changing the queue settings.

Store long-lived AWS credentials inside the consumer application code to reduce authorization overhead.

Show answer & explanation

Answer: Increase the SQS visibility timeout to a value greater than $40$ seconds.

Answer

Increase the SQS visibility timeout to a value greater than

40

seconds.

Increasing the SQS visibility timeout to a value greater than the message processing time (in this case, greater than

40

seconds) ensures that the message remains invisible to other consumers while the active consumer is processing it. This prevents other consumers from retrieving and processing the same message simultaneously, resolving the duplicate processing issue.

Step-by-Step Solution

Analyze the cause of duplicate processing in SQS.

The message becomes visible to other consumers before the active consumer finishes processing.

When a message is received from a queue, it remains in the queue but is hidden for the duration of the visibility timeout. If processing takes longer than this timeout, the message becomes visible again and can be processed by another consumer.

Compare the processing duration with the current configuration constraints.

The visibility timeout must be set to a duration longer than the

40

seconds required for task execution.

To prevent other consumers from picking up the message, the visibility timeout must cover the entire processing window plus some buffer.

Select the correct option to modify the queue's settings.

Configure the visibility timeout of the SQS queue to be greater than

40

seconds.

This configuration directly addresses the root cause of duplicate processing without modifying application timeouts or using insecure credentials.

Key Concept

SQS visibility timeout configuration relative to consumer processing time.

Estimated Time:1m 30s

Question 1518Question →

A developer is building a REST API in Amazon API Gateway that integrates with a backend AWS Lambda function. The API must secure its endpoints by validating custom JSON Web Tokens (JWTs) issued by an external, third-party identity provider. If the token is valid, the API must pass the verified user identity details to the backend Lambda function; otherwise, it must block the request before it reaches the backend. Which API Gateway configuration should the developer use to satisfy these requirements?

Configure a Lambda authorizer to validate the JWT and return an IAM policy along with a context object containing the user identity details.

Configure a built-in Amazon Cognito User Pool authorizer and map the external token claims to the backend using mapping templates.

Use a Lambda Proxy Integration and configure the backend Lambda function to extract, validate, and parse the JWT from the raw request event.

Create an Amazon Cognito Identity Pool to authenticate users and enable IAM authorization on the API Gateway method.

Show answer & explanation

Answer: Configure a Lambda authorizer to validate the JWT and return an IAM policy along with a context object containing the user identity details.

Answer

Configure a Lambda authorizer to validate the JWT and return an IAM policy along with a context object containing the user identity details.

The correct option is to use a Lambda authorizer. A Lambda authorizer intercepts incoming requests, executes custom validation code for third-party tokens, and returns an IAM policy. It can also return a custom context map containing verified user details that API Gateway passes directly to the backend integration.

Step-by-Step Solution

Determine validation requirements for third-party identity providers

Identify that built-in Cognito User Pool authorizers cannot be used because the token is not issued by Cognito.

Cognito User Pool authorizers only accept Cognito-issued tokens.

Select the correct authorizer type to execute custom validation logic

Choose a Lambda authorizer (custom authorizer) to run the code necessary to validate the third-party JWT signature and claims.

Lambda authorizers allow developers to implement custom authentication and validation logic.

Configure the authorizer response payload to pass context downstream

Ensure the Lambda authorizer returns an IAM policy along with a context map containing key-value pairs representing the user identity details.

API Gateway automatically forwards key-value pairs in the context map to the backend integration, allowing the backend Lambda function to access the user context.

Key Concept

API Gateway Lambda Authorizers

Estimated Time:1m 30s

Question 1519Question →

A developer is designing a REST API in Amazon API Gateway. The API uses request validation with a model schema to ensure incoming client payloads are correctly structured. If a client sends an invalid request body or fails to provide a valid API key, API Gateway rejects the request before it reaches the backend integration. The developer wants to customize these gateway-level error responses to return a standard JSON error structure and inject a custom tracking header (X-Request-Tracking-Id) into the HTTP response.

Which two configurations should the developer implement in API Gateway to meet these requirements? (Select TWO.)

Select all that apply

In the API configuration, customize the Gateway Responses for the specific error types, such as Bad Request Body and Unauthorized, and define the custom JSON body templates.

Under the Gateway Responses configuration, use response parameters to define the custom header mapping for the desired error types.

Configure an Integration Response for the API methods to capture client validation failures and map the response header and template.

Create a custom Lambda Authorizer that validates the request body schema and returns a serialized JSON error response with the custom tracking header.

Modify the Method Response settings of the resource to define the mapping templates and header mappings for 400 and 403 status codes.

Show answer & explanation

Answer: In the API configuration, customize the Gateway Responses for the specific error types, such as Bad Request Body and Unauthorized, and define the custom JSON body templates.; Under the Gateway Responses configuration, use response parameters to define the custom header mapping for the desired error types.

Answer

To customize gateway-level errors in Amazon API Gateway, the developer should customize the Gateway Responses for the specific error types (such as Bad Request Body and Unauthorized) with custom JSON body templates, and use response parameters under the Gateway Responses settings to define the custom tracking header.

Gateway Responses are generated directly by API Gateway before the request is sent to the integration backend (e.g., when request validation fails or authentication fails). A developer can customize these responses at the API level by modifying the response templates for specific Gateway Response types (such as Bad Request Body or Unauthorized) to return custom JSON. In addition, the developer can add custom headers using response parameters, mapping them to context variables or static values.

Step-by-Step Solution

Identify where the request validation and authentication failures are processed.

The failures occur at the gateway level (before forwarding to backend integration).

This determines that Gateway Responses, rather than Integration Responses or Method Responses, must be configured.

Configure the custom JSON response body for these gateway-level failures.

Modify the Gateway Responses configuration for the API, selecting specific response types (e.g., BAD_REQUEST_BODY, UNAUTHORIZED) and defining the application/json template.

This ensures the client receives a structured JSON payload instead of the default API Gateway error message.

Configure the custom tracking header in the response.

Add response parameters inside the target Gateway Responses to map the custom header (X-Request-Tracking-Id) to a static value or a context variable.

This ensures the header is appended to the response returned directly from API Gateway.

Key Concept

API Gateway Gateway Responses customization for error handling

Estimated Time:1m 30s

Question 1520Question →

A developer is building a telemetry ingestion pipeline where an Amazon EventBridge rule routes custom device events to an Amazon Kinesis Data Stream target. The event payloads contain a nested JSON structure like the following:

{
"version": "2026-07-15",
"detail-type": "DeviceTelemetry",
"source": "my.company.iot",
"detail": {
"device_id": "dev-98765",
"region": "us-west-2",
"metrics": {
"temperature": 42.5
}
}
}

During load testing, the developer observes two issues:
1. All events are being routed to a single shard in the Kinesis stream, causing write throttling (`ProvisionedThroughputExceededException`).
2. Some events are dropped entirely with delivery failures, and the EventBridge target invocation logs show access denied errors.

Which combination of configuration changes will resolve both the write throttling and the event delivery failures?

Configure the EventBridge rule target with a Partition Key Path of `$.detail-type`. Attach an IAM role to the EventBridge rule that has a trust policy allowing the `events.amazonaws.com` service principal to assume the role, and an identity-based policy allowing the `kinesis:PutRecord` action on the target stream.

Route the EventBridge rule to an intermediate AWS Lambda function deployed in a private VPC subnet without a NAT Gateway or VPC endpoint to write the events to Kinesis. Attach an IAM role to the Lambda function with a trust policy allowing the `lambda.amazonaws.com` service principal to assume the role.

Configure the EventBridge rule target with a Partition Key Path of `$.detail.device_id`. Attach an IAM role to the EventBridge rule that has a trust policy allowing the `events.amazonaws.com` service principal to assume the role, and an identity-based policy allowing the `kinesis:PutRecord` action on the target stream.

Configure the EventBridge rule target with a Partition Key Path of `$.detail.device_id`. Attach an IAM role to the EventBridge rule that has a trust policy allowing the `kinesis.amazonaws.com` service principal to assume the role, and an identity-based policy allowing the `kinesis:PutRecord` action on the target stream.

Show answer & explanation

Answer: Configure the EventBridge rule target with a Partition Key Path of `$.detail.device_id`. Attach an IAM role to the EventBridge rule that has a trust policy allowing the `events.amazonaws.com` service principal to assume the role, and an identity-based policy allowing the `kinesis:PutRecord` action on the target stream.

Answer

Configure the EventBridge rule target with a Partition Key Path of `$.detail.device_id`, and attach an IAM role to the EventBridge rule with a trust policy that allows `events.amazonaws.com` to assume the role and an identity-based policy that allows the `kinesis:PutRecord` action.

Extracting the unique `device_id` using the JSONPath `$.detail.device_id` ensures high-entropy partition keys, distributing writes evenly across all shards to prevent throttling. Setting the trust policy to allow `events.amazonaws.com` permits EventBridge to assume the role and execute the `kinesis:PutRecord` action on the target stream.

Step-by-Step Solution

Analyze the Kinesis Data Stream throttling issue.

Identify that Kinesis uses partition keys to determine which shard receives a record. A low-entropy partition key (such as a constant or the event type) routes all traffic to a single shard, causing a hot shard and throttling.

To distribute records evenly, we must extract a high-entropy attribute from the payload, such as `device_id`.

Configure the Partition Key Path in the EventBridge rule target.

Use JSONPath `$.detail.device_id` to dynamically resolve to the unique device ID of each telemetry event.

This guarantees that events are distributed across all available shards based on the hash of the device ID, resolving the `ProvisionedThroughputExceededException`.

Resolve the delivery permission errors.

Attach an IAM role to the EventBridge rule. The trust policy must trust `events.amazonaws.com` (EventBridge service) so that it can assume the role. The role's permissions must allow the `kinesis:PutRecord` action on the target Kinesis Data Stream.

EventBridge needs temporary credentials via AWS STS to write records directly to the Kinesis stream on your behalf.

Key Concept

Configuring EventBridge rule targets for Kinesis Data Streams requires setting high-entropy partition keys using JSONPath and establishing proper IAM cross-service assume role permissions.

PreviousPage 76 / 78Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept