Examkin

All practice questions

1542 questions

All types1,542Multiple choice782Multiple select746Ordering14
Question 161Question →

An online learning platform stores quiz questions and metadata in an Amazon DynamoDB table. During exams, a surge in user traffic causes high read latency and ProvisionedThroughputExceededException errors when the application retrieves quiz details. The developer wants to introduce Amazon DynamoDB Accelerator (DAX) to optimize query performance with minimal latency and minimal application rewrite. The application currently retrieves quiz details using strongly consistent reads and executes frequent Scan operations to populate list views. Which combination of actions should the developer take to resolve the latency and throttling issues? (Select two.)

Select all that apply

Show answer & explanation

Answer: Modify the application's read requests to use eventually consistent reads so that the DynamoDB Accelerator (DAX) client can serve them from the item cache.; Replace the Scan operations with Query operations to allow DAX to store and serve the retrieved quiz details from the query cache.

Answer

The correct actions are to modify the read requests to use eventually consistent reads and to replace Scan operations with Query operations.
To resolve the read throttling and latency issues, the developer must configure the read requests to use eventually consistent reads, because DynamoDB Accelerator (DAX) only caches eventually consistent reads; strongly consistent reads are passed directly through to DynamoDB and do not benefit from caching. Additionally, replacing Scan operations with Query operations ensures that the retrieved data is cached in the DAX query cache, which dramatically improves performance compared to executing expensive Scan operations.

Step-by-Step Solution

1
Analyze the consistency requirements for caching with DAX.
Identify that strongly consistent reads bypass the DAX cache, meaning the application must be modified to use eventually consistent reads to leverage DAX.
DAX only caches eventually consistent reads in its item and query caches.
2
Evaluate the retrieval method used in the application.
Identify that Scan operations are inefficient and do not populate the item cache; they should be replaced with Query operations.
Query operations are more efficient, target specific partition keys, and populate the DAX query cache.

Key Concept

DAX Caching Behavior and Query Optimization
Estimated Time:2m 0s
Question 162Question →

A developer is implementing a mobile e-commerce application. The application requires a secure user sign-up and sign-in system. Once authenticated, the application must make secure REST API requests to an Amazon API Gateway backend to fetch order history. The developer wants to use a managed user directory and ensure that API Gateway automatically validates the JSON Web Tokens (JWT) sent in the request header without maintaining custom authentication code or custom backend validation logic.

Which setup meets these requirements with the lowest operational complexity?

Show answer & explanation

Answer: Use an Amazon Cognito User Pool to handle user registration and sign-in. Configure a Cognito User Pool Authorizer on the API Gateway REST API method to validate the ID or access token sent by the mobile application.

Answer

Use an Amazon Cognito User Pool to handle user registration and sign-in. Configure a Cognito User Pool Authorizer on the API Gateway REST API method to validate the ID or access token sent by the mobile application.
The correct option is to use an Amazon Cognito User Pool to manage sign-in and sign-up, and configure a Cognito User Pool Authorizer on API Gateway. Cognito User Pools natively handle the user directory and issue JWTs (ID/access tokens) upon authentication. API Gateway's built-in Cognito Authorizer directly validates these JWTs without requiring custom Lambda code, which reduces development effort and operational overhead.

Step-by-Step Solution

1
Determine the service needed for user directory management, registration, and sign-in.
Identify Amazon Cognito User Pools as the service that manages user directories and issues JSON Web Tokens (JWTs) upon successful authentication.
Cognito User Pools serve as the identity provider (IdP) for user management, whereas Identity Pools are used for exchanging tokens for AWS credentials.
2
Evaluate the method for securing the API Gateway REST API using these Cognito tokens without writing custom validation code.
Select the built-in Cognito User Pool Authorizer in API Gateway.
The Cognito User Pool Authorizer natively integrates with API Gateway, extracting and validating the JWT from the request headers automatically, thus eliminating the need for a custom Lambda authorizer.

Key Concept

Amazon Cognito User Pools provide authentication and token issuance, which can be natively validated at API Gateway using a built-in Cognito User Pool Authorizer to secure API endpoints with minimal operational overhead.
Question 163Question →

A developer is building a serverless application where an AWS Lambda function processes messages from an Amazon SQS queue. The function is configured to connect to an Amazon RDS MySQL database located in a private VPC subnet, and it also needs to make HTTPS requests to an external payment gateway API. The Lambda function's timeout is set to 15 seconds, and the SQS queue's visibility timeout is set to 10 seconds. During testing, the developer observes that messages are frequently being processed multiple times by the function, and all outbound requests to the payment gateway API fail due to network timeouts. Which configuration changes should the developer implement to resolve these issues?

Show answer & explanation

Answer: Increase the Amazon SQS queue visibility timeout to at least 90 seconds, and deploy the Lambda function in private subnets with a route to a NAT Gateway in a public subnet.

Answer

Increase the Amazon SQS queue visibility timeout to at least 90 seconds, and deploy the Lambda function in private subnets with a route to a NAT Gateway in a public subnet.
The correct option successfully addresses the two core configuration issues. To prevent duplicate message processing, the SQS visibility timeout must be set to at least 6 times the function timeout (15 seconds×6=9015 \text{ seconds} \times 6 = 90 seconds). To grant the Lambda function internet access while keeping database connectivity, it must be deployed in private subnets with a route pointing to a NAT Gateway in a public subnet.

Step-by-Step Solution

1
Address duplicate message processing by comparing the SQS visibility timeout with the Lambda function timeout.
Identify that the current SQS visibility timeout (10 seconds) is shorter than the Lambda execution timeout (15 seconds), meaning messages become visible again while still processing.
According to AWS best practices, the SQS visibility timeout should be configured to at least 6 times the Lambda function timeout (15 seconds×6=9015 \text{ seconds} \times 6 = 90 seconds) to prevent duplicate processing from failures or retries.
2
Resolve the internet connectivity timeout issue for the VPC-attached Lambda function.
Route the outbound internet traffic from the private subnets hosting the Lambda function through a NAT Gateway located in a public subnet.
Lambda functions configured to run inside a VPC do not receive public IP addresses. Therefore, placing them in a public subnet with an Internet Gateway does not grant them internet access; they must use a NAT Gateway or VPC endpoint.

Key Concept

Configuring SQS visibility timeout relative to Lambda timeout and routing outbound Lambda VPC network traffic.
Question 164Question →

A developer is building a logistics tracking application that records real-time updates for delivery packages. The system uses an Amazon DynamoDB table where the partition key is `DeliveryDate` (formatted as `YYYY-MM-DD`) and the sort key is `TransitTimestamp#PackageId`. During peak hours, the application experiences a high volume of package status updates, resulting in frequent `ProvisionedThroughputExceededException` errors, even though the total consumed write capacity is well below the table's overall provisioned capacity. Which approach should the developer implement to resolve the write throttling issue while maintaining the ability to retrieve items by date?

Show answer & explanation

Answer: Append a calculated sharding suffix (such as a random integer between 00 and 99) to the `DeliveryDate` partition key when writing items, and query across all sharded partitions to retrieve data for a specific date.

Answer

The approach of appending a calculated sharding suffix (such as a random integer between 00 and 99) to the `DeliveryDate` partition key when writing items, and querying across all sharded partitions to retrieve data for a specific date.
The correct approach is to append a calculated sharding suffix to the `DeliveryDate` partition key. This distributes the write operations across multiple partition keys (and therefore physical partitions), successfully avoiding the physical partition limit of 1,0001,000 WCUs.

Step-by-Step Solution

1
Analyze the root cause of the `ProvisionedThroughputExceededException` errors when overall table write throughput is below provisioned limits.
Identify that the issue is due to a hot partition key (`DeliveryDate`), where all writes for a given day target the same DynamoDB partition, exceeding the 1,0001,000 WCU partition limit.
DynamoDB partitions have individual throughput limits (1,0001,000 WCUs for write and 3,0003,000 RCUs for read) that cannot be exceeded regardless of the table's total provisioned capacity.
2
Design a write sharding strategy to distribute the writes across multiple partition keys.
Add a suffix (e.g., `-0` to `-9`) to the `DeliveryDate` partition key when inserting or updating items.
This distributes the requests across multiple distinct partition keys, spreading the write workload across multiple physical partitions.
3
Adjust the read query pattern to retrieve all items for a given date.
Query all sharded partitions (e.g., `2026-07-15-0` through `2026-07-15-9`) in parallel and merge the results.
Since the data is now distributed across multiple partition keys, the application must query all possible shards to reconstruct the complete dataset for a specific date.

Key Concept

Partition key design and write sharding to prevent hot partitions
Question 165Question →

A developer is building a serverless application. An AWS Lambda function is configured to run in the private subnets of a VPC to retrieve data from a private Amazon Aurora PostgreSQL DB cluster. The Lambda function also needs to call a public web service to retrieve reference data. Currently, the Lambda function can connect to the database but cannot connect to the public web service. Which two actions must the developer take to allow the function to connect to the public web service while maintaining access to the private database? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure a NAT Gateway in a public subnet of the VPC and update the route tables of the private subnets to route traffic destined for 0.0.0.0/0 through the NAT Gateway.; Ensure the Lambda function's IAM execution role has the permissions defined in the AWSLambdaVPCAccessExecutionRole managed policy.

Answer

To allow the Lambda function to access the public web service while keeping database access, configure a NAT Gateway in a public subnet of the VPC, update the private subnets' route tables to route outbound traffic through it, and ensure the Lambda function's execution role has the permissions defined in the AWSLambdaVPCAccessExecutionRole policy.
To route outbound internet traffic from a VPC-enabled Lambda function, the function must be deployed in private subnets, and the subnet route tables must route 0.0.0.0/0 through a NAT Gateway. In addition, the Lambda function requires the AWSLambdaVPCAccessExecutionRole managed policy to allow it to provision the necessary network interfaces (ENIs) inside the customer VPC.

Step-by-Step Solution

1
Add a NAT Gateway to a public subnet in the VPC.
The NAT Gateway is provisioned with a public IP address and has an outbound path to the Internet Gateway.
This establishes a bridge between the private subnet and the public internet.
2
Update the route table of the private subnets where the Lambda function resides to route 0.0.0.0/0 to the NAT Gateway.
Internet-bound traffic from the private subnets is successfully forwarded to the NAT Gateway.
This enables resources within the private subnets, including the Lambda function, to route requests to the public API.
3
Attach the AWSLambdaVPCAccessExecutionRole managed policy to the Lambda execution role.
The role obtains the necessary ec2:CreateNetworkInterface, ec2:DescribeNetworkInterfaces, and ec2:DeleteNetworkInterface permissions.
This allows the Lambda service to create Elastic Network Interfaces (ENIs) inside the customer VPC for database access.

Key Concept

AWS Lambda VPC networking, ENI provisioning, and NAT Gateway routing for internet access from private subnets.
Estimated Time:2m 0s
Question 166Question →

A developer is optimizing a reporting dashboard for a logistics application. The application tracks shipment updates in an Amazon DynamoDB table with ShipmentIDShipmentID as the partition key and TimestampTimestamp as the sort key. The dashboard needs to retrieve all shipments that are currently in 'Delayed' status and have a weight exceeding 100100 kg. This query must run efficiently across millions of shipments. Which two actions should the developer take to retrieve this data with the lowest latency and minimal Read Capacity Unit (RCU) consumption? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a Global Secondary Index (GSI) with a partition key of Status and a sort key of Weight.; Perform a Query operation on the new Global Secondary Index using a key condition expression for Status and Weight.

Answer

Create a Global Secondary Index (GSI) with a partition key of Status and a sort key of Weight, and perform a Query operation on the new GSI using a key condition expression.
To retrieve the delayed shipments with a weight exceeding 100100 kg efficiently, a Global Secondary Index (GSI) must be created using Status as the partition key and Weight as the sort key. This allows the application to execute a Query operation, which directly targets only the relevant items in the index, minimizing Read Capacity Unit (RCU) consumption and reducing latency.

Step-by-Step Solution

1
Analyze the query requirements.
The query needs to filter on Status (equality comparison) and Weight (range comparison, greater than 100100). The base table's partition key is ShipmentID, which does not allow efficient filtering on these attributes.
Understanding the access pattern is necessary to choose the correct indexing strategy.
2
Design the index structure.
A Global Secondary Index (GSI) is designed with Status as the partition key (to group delayed items) and Weight as the sort key (to enable inequality comparisons on weight).
A GSI allows querying on non-key attributes from the base table.
3
Select the correct DynamoDB API operation.
The Query operation is selected to retrieve matching items from the GSI using a key condition expression.
Query operations are much more efficient than Scan operations as they only read the matching partition and sort keys instead of scanning the entire index/table.

Key Concept

Using Global Secondary Indexes (GSIs) and Query operations instead of Scans to retrieve filtered datasets efficiently.
Question 167Question →

A developer is implementing a serverless data import service. An AWS Lambda function is triggered by an Amazon SQS queue to process batches of user records. The Lambda function is configured with a batch size of 10, and processing a single batch takes an average of 120 seconds. The SQS queue has a default visibility timeout of 30 seconds. During testing, the developer observes that many user records are processed multiple times by parallel Lambda invocations. Which of the following changes will prevent this duplicate processing?

Show answer & explanation

Answer: Increase the Amazon SQS queue's visibility timeout to a value that is at least 6 times the Lambda function's timeout, and set the Lambda function's timeout to exceed the maximum batch processing time.

Answer

Increasing the SQS queue's visibility timeout to at least 6 times the Lambda function's timeout and configuring the Lambda timeout to exceed the maximum batch processing time.
To prevent duplicate processing of messages in an SQS-triggered Lambda function, the queue's visibility timeout must be set to at least 6 times the Lambda function's timeout. Additionally, the Lambda function's timeout must be configured to be greater than the maximum expected processing time for a batch of messages. Since processing takes 120 seconds, setting the Lambda timeout to at least 150 seconds and setting the SQS visibility timeout to at least 6 times that value (900 seconds) allows the Lambda function sufficient time to complete execution and delete the messages from the queue before they become visible to other invocations.

Step-by-Step Solution

1
Analyze the relationship between batch processing time and the SQS visibility timeout.
The batch processing time (120 seconds) is longer than the SQS visibility timeout (30 seconds), meaning messages become visible in the queue before processing completes.
This mismatch causes other Lambda instances to fetch and process the same messages, resulting in duplicate executions.
2
Determine the necessary Lambda timeout configuration.
The Lambda function timeout must be set to a value greater than the average processing time of 120 seconds (e.g., 150 seconds) to ensure the batch can finish processing.
If the Lambda function times out before processing completes, the messages will not be deleted from the queue.
3
Apply the AWS recommendation for SQS-Lambda visibility timeout configuration.
The SQS queue's visibility timeout must be set to at least 6 times the Lambda function's timeout.
This safety margin prevents messages from returning to the queue while the Lambda function is still executing or during retries.

Key Concept

SQS Visibility Timeout configuration when integrated as an AWS Lambda event source.
Question 168Question →

A developer is building a customer support ticketing portal. The application stores tickets in an Amazon DynamoDB table with `CustomerID` as the partition key and `TicketID` as the sort key. The developer needs to implement a dashboard view that displays all tickets with a status of `Open` across all customers, sorted by the date they were created. Which strategy should the developer use to retrieve this data with the lowest latency and minimal Read Capacity Unit (RCU) consumption?

Show answer & explanation

Answer: Create a Global Secondary Index (GSI) using Status as the partition key and CreatedAt as the sort key, and then perform a Query operation on the GSI.

Answer

Create a Global Secondary Index (GSI) using Status as the partition key and CreatedAt as the sort key, and then perform a Query operation on the GSI.
Creating a Global Secondary Index (GSI) with Status as the partition key and CreatedAt as the sort key allows the application to query all open tickets across all customers. A Query operation on the GSI reads only the items that match the key condition, minimizing Read Capacity Unit (RCU) consumption and reducing latency.

Step-by-Step Solution

1
Analyze the query requirement to determine if the base table keys can support it.
The query needs to retrieve records by Status across all CustomerIDs, but the base table's partition key is CustomerID, making a Query on the base table impossible for this access pattern.
Since the partition key is CustomerID, we can only query within a single customer partition at a time.
2
Evaluate the secondary index options to enable queries across all partitions.
A Global Secondary Index (GSI) can be created with Status as the partition key and CreatedAt as the sort key.
GSIs allow query operations across all base table partitions by defining a new partition key.
3
Determine the optimal operation to run on the secondary index.
Run a Query operation against the GSI targeting Status = 'Open'.
Query operations are highly efficient because they only read items that match the key condition, minimizing RCU usage compared to a full Scan.

Key Concept

Using a Global Secondary Index (GSI) to support query access patterns across all partition keys of a base DynamoDB table.
Estimated Time:1m 30s
Question 169Question →

A developer is designing a smart utility monitoring application that stores hourly meter readings in an Amazon DynamoDB table. The base table uses `DeviceID` as the partition key and `ReadingTimestamp` as the sort key. The application must support two new requirements:

1. Retrieve all readings across all devices for a specific day, sorted by energy consumption in descending order.
2. Retrieve all error events for a specific `DeviceID`, sorted by the event's timestamp.

Which two configurations should the developer implement to meet these requirements with optimal query performance and security? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a Global Secondary Index (GSI) with `ReadingDate` as the partition key and `EnergyConsumption` as the sort key.; Create a Local Secondary Index (LSI) with `DeviceID` as the partition key and `ErrorTimestamp` as the sort key.

Answer

Create a Global Secondary Index (GSI) with ReadingDate as the partition key and EnergyConsumption as the sort key, and create a Local Secondary Index (LSI) with DeviceID as the partition key and ErrorTimestamp as the sort key.
To retrieve readings across all devices for a specific day sorted by energy consumption, a Global Secondary Index (GSI) is required because the query spans multiple base table partitions. The GSI uses the daily date as the partition key and the energy consumption as the sort key. To retrieve error events for a specific device sorted by the event timestamp, a Local Secondary Index (LSI) is appropriate because it shares the same partition key as the base table (DeviceID) but uses a different sort key (ErrorTimestamp), allowing fast and efficient queries within a single device partition.

Step-by-Step Solution

1
Analyze the first requirement: Querying readings across all devices for a specific day, sorted by energy consumption.
Identify that because the query spans multiple devices (multiple partition keys), a Global Secondary Index (GSI) must be defined with ReadingDate as the partition key and EnergyConsumption as the sort key.
GSIs allow queries to cross partition boundaries of the base table, and setting EnergyConsumption as the sort key allows DynamoDB to return the results pre-sorted.
2
Analyze the second requirement: Querying error events for a specific DeviceID, sorted by the event's timestamp.
Identify that since the query is restricted to a single device (the same partition key as the base table), a Local Secondary Index (LSI) can be defined with DeviceID as the partition key and ErrorTimestamp as the sort key.
LSIs must use the same partition key as the base table but allow a different sort key to enable alternative sorting on that partition's data.
3
Evaluate and discard inefficient operations (Scan) and insecure authentication practices.
Discard options suggesting Scan operations or hardcoded credentials.
Scan operations read all items in the database and are extremely inefficient for lookup queries, while hardcoded credentials violate basic security practices.

Key Concept

Choosing between Global Secondary Indexes (GSI) and Local Secondary Indexes (LSI) for query optimization in DynamoDB, and avoiding full table scans.
Question 170Question →

A logistics company operates a fleet of delivery trucks. Each truck publishes GPS telemetry events as JSON payloads to a custom Amazon EventBridge event bus. A developer is configuring an EventBridge rule to route these events directly to an Amazon Kinesis Data Stream for real-time tracking. A downstream AWS Lambda function is configured as the consumer of the Kinesis Data Stream. The developer wants to ensure that telemetry events from the same truck are routed to the same Kinesis shard to maintain order, and that the EventBridge rule has the necessary permissions to publish to the stream. Which two configurations must the developer perform to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Configure the Kinesis Data Stream target in the EventBridge rule with a PartitionKeyPath pointing to the truck ID field in the event payload, such as $.detail.truck_id.; Create an IAM role for the EventBridge target that contains a trust policy allowing the events.amazonaws.com service principal to assume the role.

Answer

Configure the Kinesis Data Stream target in the EventBridge rule with a PartitionKeyPath pointing to the truck ID (e.g., $.detail.truck_id), and create an IAM role for the EventBridge target with a trust policy that allows the events.amazonaws.com service principal to assume the role.
To route EventBridge events to Kinesis Data Streams while preserving chronological order for each truck, a partition key must be dynamically extracted from each event. The PartitionKeyPath property (e.g., $.detail.truck_id) allows EventBridge to read the truck ID from the event payload and assign it as the partition key. Furthermore, EventBridge requires an IAM role with permission to perform kinesis:PutRecord on the stream, and the role's trust policy must allow the events.amazonaws.com service principal to assume it.

Step-by-Step Solution

1
Specify the partition key path for the Kinesis target.
The EventBridge target uses the PartitionKeyPath parameter (e.g., $.detail.truck_id) to extract the partition key from the JSON event payload.
This guarantees that events belonging to the same truck use the same partition key, routing them to the same Kinesis shard and maintaining their chronological order.
2
Configure the IAM execution role's trust relationships.
The trust policy of the IAM role includes events.amazonaws.com under the Principal block.
This allows the Amazon EventBridge service to assume the IAM role and invoke the target (Kinesis Data Stream) on behalf of the developer.

Key Concept

Routing events from Amazon EventBridge to Amazon Kinesis Data Streams with dynamic partition keys (PartitionKeyPath) and configuring correct service trust relationships.
Estimated Time:1m 30s
Question 171Question →

A developer is configuring an AWS Lambda function to process customer registration events. The function must query an Amazon RDS MySQL database located in private VPC subnets. The database credentials are securely stored in AWS Secrets Manager. The developer wants to ensure the Lambda function can securely access the secret and connect to the database efficiently without causing database connection exhaustion or network timeouts. Which of the following configurations should the developer implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Initialize the database connection pool outside of the Lambda handler function to enable connection reuse across multiple invocations.; Associate the Lambda function with the private subnets of the VPC, and configure an interface VPC endpoint (AWS PrivateLink) for Secrets Manager in the VPC.

Answer

To optimize database connection handling and ensure secure, private network access, the developer should initialize the database connection pool outside of the Lambda handler function, and associate the Lambda function with the private VPC subnets while configuring an interface VPC endpoint (AWS PrivateLink) for Secrets Manager.
Initializing the database connection pool outside the Lambda handler function leverages execution context reuse, enabling subsequent warm invocations to share the active connection pool. Additionally, associating the function with private subnets enables connectivity to the RDS instance, while configuring an interface VPC endpoint for Secrets Manager provides a secure, private route to fetch secrets without routing requests through the public internet.

Step-by-Step Solution

1
Analyze the database connection lifecycle within serverless environments.
Initializing database connections inside the handler function executes the setup on every single invocation. Moving the connection logic outside the handler to the global scope preserves the connection object across warm starts, preventing database resource exhaustion.
Ensures Lambda execution context reuse is leveraged properly for database connection management.
2
Evaluate network connectivity requirements for VPC-bound resources and public endpoints.
The Lambda function needs to communicate with the RDS database in the private VPC subnet. However, a VPC-configured Lambda function cannot access external public endpoints (like Secrets Manager) without a NAT Gateway or an interface VPC endpoint. Deploying an interface VPC endpoint for Secrets Manager allows the function to access the service privately.
Establishes a secure and private network routing mechanism to retrieve database secrets.
3
Differentiate between IAM role policy types for execution privileges.
IAM trust policies define which entity can assume the role, whereas IAM permissions policies define the target actions allowed. The Lambda function requires a permissions policy allowing the secrets retrieval action.
Configures correct security authorization structure without misinterpreting the role trust policy.

Key Concept

AWS Lambda VPC networking, execution context reuse, and AWS Secrets Manager integration.
Question 172Question →

A developer is implementing an AWS Lambda function that retrieves user profile records from a MongoDB database hosted on an Amazon EC2 instance in a private VPC subnet. After processing the records, the Lambda function publishes notifications to an Amazon SNS topic. The Lambda function is configured to access resources inside the same private VPC subnet.

During integration testing, the developer identifies two issues:
1. The Lambda function times out with network errors when attempting to publish messages to the public Amazon SNS endpoint.
2. The function experiences significant latency because it initiates a new database connection for every incoming request.

Which two configuration changes or development practices should the developer implement to resolve these issues? (Select two.)

Select all that apply

Show answer & explanation

Answer: Initialize the MongoDB client and connection pool outside of the Lambda handler function.; Create an interface VPC endpoint for Amazon SNS and associate it with the VPC subnets used by the Lambda function.

Answer

Initialize the MongoDB client and connection pool outside of the Lambda handler function, and create an interface VPC endpoint for Amazon SNS and associate it with the VPC subnets used by the Lambda function.
Reusing database connections via execution context reuse (by declaring the client outside the handler) and creating an interface VPC endpoint for Amazon SNS are AWS-recommended best practices for Lambda functions that need secure database access and public service access within a VPC.

Step-by-Step Solution

1
Address the connection latency issue by reusing the database connection client across invocations.
Declaring and initializing the MongoDB client outside of the Lambda handler function ensures that the connection pool remains active in the execution context and is reused for subsequent warm invocations.
This avoids the latency overhead of performing a database connection handshake on every request.
2
Address the public internet access issue for publishing to Amazon SNS from a private subnet.
Creating an interface VPC endpoint for Amazon SNS in the VPC provides a private route using AWS PrivateLink to reach the SNS API directly from the private subnet.
Lambda functions in private subnets cannot reach public AWS service endpoints without a NAT Gateway or a VPC endpoint.

Key Concept

AWS Lambda VPC networking and execution context reuse best practices.
Estimated Time:2m 0s
Question 173Question →

A retail company's developer is designing a real-time inventory tracking system. Point of Sale (POS) terminals publish checkout events as JSON payloads containing a store_id attribute to a custom Amazon EventBridge event bus. The developer wants to route these events directly to an Amazon Kinesis Data Stream for stream processing. To ensure accurate inventory aggregation, all events originating from the same store must be processed in the exact chronological order in which they were generated. Which configuration should the developer apply to satisfy these requirements?

Show answer & explanation

Answer: Configure the Kinesis Data Stream as the target of the EventBridge rule and set the PartitionKeyPath parameter to $.detail.store_id.

Answer

Configure the Kinesis Data Stream as the target of the EventBridge rule and set the PartitionKeyPath parameter to $.detail.store_id.
The correct approach is to set the Kinesis Data Stream as the EventBridge target and utilize the PartitionKeyPath parameter with the JSONPath expression $.detail.store_id. This dynamically extracts the store identifier from each event payload and sets it as the Kinesis partition key. Since Kinesis guarantees ordering within a single shard, and hash-partitioning maps the same key to the same shard, this satisfies the requirement of in-order processing per store.

Step-by-Step Solution

1
Identify the requirement for maintaining event ordering per store in Kinesis Data Streams.
Realize that events must be routed to the same shard based on the store identifier.
In Kinesis, ordering is guaranteed only within a single shard, and records with the same partition key are mapped to the same shard.
2
Determine the mechanism EventBridge uses to assign partition keys when routing directly to Kinesis.
Use the PartitionKeyPath property to specify a JSONPath expression that extracts the store ID from the event payload.
This allows EventBridge to dynamically assign partition keys per event using fields in the JSON payload (e.g., $.detail.store_id).
3
Verify that the selected target configuration and IAM roles are authorized for the EventBridge service.
Ensure the EventBridge service (events.amazonaws.com) is trusted by the IAM role used to write to the Kinesis stream.
If the trust policy points to a different service like Lambda, EventBridge will be unable to assume the role and publish the events.

Key Concept

Partitioning in Amazon Kinesis via Amazon EventBridge target configurations.
Estimated Time:1m 30s
Question 174Question →

A developer is configuring a new API endpoint using Amazon API Gateway that integrates with a backend AWS Lambda function using a Lambda proxy integration. Which two requirements must be met to ensure that client requests are correctly processed and the API returns valid responses? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The Lambda function must return a JSON payload containing the 'statusCode', 'headers', and 'body' fields to API Gateway.; API Gateway automatically formats the client request details into a single JSON object and passes it to the Lambda function.

Answer

The Lambda function must return a JSON payload containing the 'statusCode', 'headers', and 'body' fields to API Gateway, and API Gateway automatically formats the client request details into a single JSON object and passes it to the Lambda function.
With Lambda proxy integration, API Gateway automatically packages the incoming HTTP request details (headers, query parameters, stage variables, path parameters, and request body) into a single JSON object and passes it as the event payload to the backend Lambda function. In return, the Lambda function must return a JSON response structured with 'statusCode', 'headers', and 'body' fields so that API Gateway can map them to the corresponding client HTTP response.

Step-by-Step Solution

1
Understand the behavior of Lambda proxy integration in API Gateway.
In a Lambda proxy integration, the incoming request is passed directly to the Lambda function as a structured JSON object, meaning no mapping templates are needed.
This establishes that API Gateway handles request forwarding automatically without developer-defined templates.
2
Identify the response requirements for Lambda proxy integration.
The Lambda function must return a specific JSON response format including 'statusCode', 'headers', and 'body' so that API Gateway can parse it and formulate the HTTP response.
Failing to return this format results in a 502 Bad Gateway error from API Gateway.
3
Determine the correct choices based on these integration principles.
The two correct answers are that API Gateway automatically formats request details into a JSON object, and the Lambda function must return a JSON payload with 'statusCode', 'headers', and 'body' fields.
These choices accurately describe the input and output requirements for Lambda proxy integration.

Key Concept

API Gateway Lambda Proxy Integration Requirements
Question 175Question →

A developer is configuring an Amazon API Gateway REST API that integrates with an AWS Lambda function. To support multiple environments, the developer wants to use API Gateway stage variables to dynamically route requests to the correct Lambda function alias (such as dev or prod) corresponding to the deployed stage. Which two steps must the developer perform to configure this routing and ensure successful invocations?

Select all that apply

Show answer & explanation

Answer: Define the stage variable in each API Gateway stage to specify the alias name, and reference the stage variable in the Lambda function integration as MyFunction:${stageVariables.aliasName}.; Add the lambda:InvokeFunction permission to the resource-based policy of each Lambda function alias to authorize API Gateway to invoke it.

Answer

Define the stage variable in each API Gateway stage and reference it in the Lambda function integration as MyFunction:${stageVariables.aliasName}, and manually add the lambda:InvokeFunction permission to the resource-based policy of each Lambda function alias.
Defining the stage variable in each stage and referencing it in the Lambda function integration allows API Gateway to dynamically route requests based on the stage. However, because the console cannot determine the backend function ARN beforehand, the console cannot automatically assign the necessary invoke permissions. Therefore, the developer must manually add lambda:InvokeFunction permission to the resource-based policy of each Lambda function alias.

Step-by-Step Solution

1
Define stage variables in the API Gateway Stage configuration.
Variables like lambdaAlias are assigned values such as 'dev' or 'prod' for each stage.
This establishes the environment-specific values that API Gateway will resolve at runtime.
2
Reference the stage variable in the API Gateway Lambda integration.
The integration points to MyFunction:${stageVariables.lambdaAlias}.
This tells API Gateway to dynamically construct the target ARN using the stage variable.
3
Manually add the lambda:InvokeFunction permission to each Lambda function alias using the AWS CLI.
Resource-based policies are updated to trust apigateway.amazonaws.com.
Since the console cannot determine the target ARN dynamically during setup, it cannot automatically grant invoke permissions, requiring manual configuration.

Key Concept

API Gateway Stage Variables and Dynamic Lambda Routing Permissions
Question 176Question →

A developer is maintaining a digital library catalog system that retrieves book details from an Amazon DynamoDB table using GetItem operations. To reduce read latency and minimize Read Capacity Units (RCUs) consumption during peak hours, the developer deploys an Amazon DynamoDB Accelerator (DAX) cluster. The application code is updated to initialize the DAX SDK client and point to the DAX cluster endpoint. However, monitoring shows that read latency remains unchanged and the DynamoDB table continues to consume RCUs at the same rate. The developer verifies that the read requests are configured as strongly consistent reads.

What should the developer do to resolve this issue and achieve the desired caching benefits?

Show answer & explanation

Answer: Modify the application's read request configuration to use eventually consistent reads instead of strongly consistent reads.

Answer

Modify the application's read request configuration to use eventually consistent reads instead of strongly consistent reads.
Amazon DynamoDB Accelerator (DAX) is designed to cache eventually consistent read requests. When a strongly consistent read is requested, DAX passes the request directly through to DynamoDB without caching the result or serving it from the cache. Therefore, modifying the read operations to be eventually consistent allows DAX to serve the requests from its item cache, reducing latency and avoiding RCU consumption on the underlying table.

Step-by-Step Solution

1
Analyze how Amazon DynamoDB Accelerator (DAX) processes read consistency settings.
Identify that DAX is designed to cache eventually consistent reads. Strongly consistent reads are not cached and are always passed through directly to the underlying DynamoDB table.
This behavior ensures that applications requesting strong consistency always receive the most up-to-date data directly from the source of truth, but it bypasses the performance and cost benefits of DAX.
2
Identify the read consistency configuration of the application's GetItem requests.
The application currently performs strongly consistent reads, causing DAX to forward all requests directly to DynamoDB.
This explains why the read latency is not decreasing and the table continues to consume RCUs at the original rate.
3
Update the application code configuration to request eventually consistent reads.
Subsequent identical read requests will hit the DAX item cache, resulting in sub-millisecond latency and zero RCU consumption on DynamoDB for cache hits.
Eventually consistent reads allow DAX to serve data from its local cache.

Key Concept

DAX caching behavior and read consistency requirements
Estimated Time:1m 30s
Question 177Question →

A developer is writing a Node.js ingestion service that runs on AWS Fargate to receive telemetry events from IoT devices and write them to an Amazon SQS standard queue. Currently, the service invokes the SendMessage API for each event immediately. During peak hours, the service experiences high latency and increased costs due to the volume of API calls. The developer wants to optimize the application to minimize both API costs and network overhead when publishing messages. How should the developer configure the SDK client or application logic to achieve this?

Show answer & explanation

Answer: Implement client-side buffering to group events and write them to the queue using the SendMessageBatch API with a maximum batch size of 10 messages.

Answer

Implement client-side buffering to group events and write them to the queue using the SendMessageBatch API with a maximum batch size of 10 messages.
The correct answer is to implement client-side buffering and use the SendMessageBatch API. This API allows writing up to 10 messages (or up to 256 KB total size) in a single request, directly reducing the API costs (which are charged per request) and minimizing HTTP/HTTPS connection overhead on the producer side.

Step-by-Step Solution

1
Analyze the bottleneck of the producer application.
The application sends individual requests per message, leading to high SQS write request costs and HTTP connection overhead.
Before implementing changes, we must identify that the high latency and cost are due to the frequency of SQS write APIs rather than consumer processing times.
2
Identify the appropriate Amazon SQS producer optimization API.
The SendMessageBatch API accepts up to 10 messages or 256 KB of total payload.
This allows aggregating multiple messages into a single HTTP request to optimize cost and network usage.
3
Differentiate between producer-side and consumer-side configurations.
ReceiveMessageWaitTimeSeconds and VisibilityTimeout are eliminated since they configure consumer read operations.
To ensure the correct choice, the developer must recognize that long polling and visibility timeout have no impact on writing messages.

Key Concept

Amazon SQS Producer Batching and SDK Client Best Practices
Estimated Time:1m 30s
Question 178Question →

A developer is managing a production database infrastructure stack using AWS CloudFormation. The template defines an Amazon RDS DB instance whose master password must be rotated automatically every 15 days. Additionally, a manual modification to the DB instance's security group settings made via the AWS Console has caused a subsequent CloudFormation stack update to fail, leaving the stack stuck in the UPDATE_ROLLBACK_FAILED state.

How should the developer securely reference the rotated password in the template and resolve the stack update failure?

Show answer & explanation

Answer: Store the password in AWS Secrets Manager and reference it using a dynamic reference in the template. To resolve the UPDATE_ROLLBACK_FAILED state, run the ContinueUpdateRollback action, manually correcting the out-of-band security group changes if necessary to match the expected state.

Answer

Store the password in AWS Secrets Manager and reference it using a dynamic reference in the template. To resolve the UPDATE_ROLLBACK_FAILED state, run the ContinueUpdateRollback action, manually correcting the out-of-band security group changes if necessary to match the expected state.
AWS Secrets Manager is the correct service for credentials that require automatic rotation. By referencing the secret via a dynamic reference in the template, CloudFormation retrieves the rotated credential securely. If an update fails and the rollback gets blocked (UPDATE_ROLLBACK_FAILED state), standard update actions are unavailable. The developer must invoke ContinueUpdateRollback to resume the rollback, manually aligning the out-of-band changes with the expected state to allow the rollback to finish.

Step-by-Step Solution

1
Select the correct credential storage service based on requirements
AWS Secrets Manager is chosen for password storage.
The security requirement states that the password must be rotated every 15 days. AWS Secrets Manager offers native, built-in support for rotating credentials, whereas Systems Manager Parameter Store does not support automated rotation without writing custom Lambda rotation logic.
2
Define the CloudFormation referencing method
Reference the secret using a dynamic reference string in the template.
Using a dynamic reference format like '{{resolve:secretsmanager:secret-id:SecretString:password}}' allows CloudFormation to securely pull the latest rotated password version during deployments without exposing the value in plaintext.
3
Identify the stack troubleshooting procedure
Invoke the ContinueUpdateRollback operation.
When a stack update fails and the subsequent rollback also fails, the stack gets locked in UPDATE_ROLLBACK_FAILED. Regular updates are blocked in this state. The developer must call ContinueUpdateRollback, which allows the rollback to proceed (often requiring manual reconciliation of the drifted resource in the console or CLI to match the rollback target configuration first).

Key Concept

Managing Secrets Manager dynamic references with auto-rotation, and troubleshooting CloudFormation rollback failures caused by drift.
Question 179Question →

A developer is designing a vehicle tracking system where telemetry data is written to an Amazon DynamoDB table. Each item contains VehicleID (partition key), Timestamp (sort key), Speed, FuelLevel, and GeoLocation. The application needs to retrieve telemetry records for a specific vehicle within a specific 2424-hour window where the vehicle's speed exceeds 80 km/h80\text{ km/h}, while minimizing read latency and resource consumption. Which two actions should the developer take to achieve this?

Select all that apply

Show answer & explanation

Answer: Perform a Query operation specifying the VehicleID in the KeyConditionExpression and a range condition on Timestamp.; Apply a FilterExpression in the Query operation to filter the retrieved records by the speed attribute before returning them.

Answer

Perform a Query operation specifying the VehicleID in the KeyConditionExpression and a range condition on Timestamp, and apply a FilterExpression in the Query operation to filter the retrieved records by the speed attribute before returning them.
To retrieve records for a specific partition key (VehicleID) and a range of sort keys (Timestamp) efficiently, a Query operation should be used. The KeyConditionExpression specifies the partition key equality and the sort key range. To filter the returned items by a non-key attribute (Speed), a FilterExpression is applied. This filters the data on the server side before returning it to the client, minimizing the payload size.

Step-by-Step Solution

1
Analyze the table schema and the query requirements to determine the optimal access pattern.
Identified VehicleID as the partition key and Timestamp as the sort key. Telemetry needs to be retrieved for a specific vehicle over a specific 2424-hour range.
This matches the structure required for a Query operation where partition key is an exact match and sort key can be a range.
2
Choose between a Query and a Scan operation for item retrieval.
Selected Query because it performs direct lookups using the key attributes, whereas Scan checks every item in the table.
Query consumes fewer Read Capacity Units (RCUs) and provides lower latency compared to Scan.
3
Determine how to handle the non-key attribute filter (Speed > 80 km/h80\text{ km/h}).
Applied a FilterExpression to the Query operation.
Since speed is not a key attribute, a FilterExpression is used to filter out non-matching items on the server side after they are read, minimizing the payload returned to the application.

Key Concept

Using Query operations with KeyConditionExpression and FilterExpression to optimize data retrieval in Amazon DynamoDB
Question 180Question →

A developer is configuring a release pipeline in AWS CodePipeline. The pipeline contains a stage that must invoke an AWS Lambda function to perform deployment validation tests. The developer creates a new IAM role for the pipeline to interact with AWS resources. During the first execution of the pipeline, the run fails at the Lambda stage with an access denied error. The developer verifies that the IAM policy attached to the pipeline's service role explicitly grants the `lambda:InvokeFunction` permission. Which of the following configuration failures is preventing the pipeline from executing the Lambda function?

Show answer & explanation

Answer: The IAM trust policy of the pipeline's service role does not allow the CodePipeline service principal (codepipeline.amazonaws.com) to assume the role.

Answer

The IAM trust policy of the pipeline's service role does not allow the CodePipeline service principal (codepipeline.amazonaws.com) to assume the role.
The correct answer is correct because AWS CodePipeline must assume the pipeline's service role to execute stage actions, such as invoking an AWS Lambda function. If the service role's trust policy does not explicitly permit the CodePipeline service principal (`codepipeline.amazonaws.com`) to perform the `sts:AssumeRole` action, CodePipeline cannot assume the role. As a result, the action will fail with an access denied error, regardless of whether the permission policy attached to the role has the `lambda:InvokeFunction` permission.

Step-by-Step Solution

1
Analyze the error message and current configurations.
The pipeline fails with an access denied error during the Lambda invocation stage, despite the pipeline's IAM role having permissions for `lambda:InvokeFunction`.
This indicates that CodePipeline cannot successfully utilize the role, pointing to an issue with role assumption rather than missing execution permissions.
2
Verify how AWS CodePipeline interacts with IAM roles.
AWS CodePipeline requires a trust relationship (trust policy) to assume the service role associated with the pipeline execution.
An IAM role cannot be assumed by an AWS service unless that service is defined as a trusted entity in the role's trust policy.
3
Identify the missing configuration.
The trust policy of the role must include the `codepipeline.amazonaws.com` service principal to allow the service to perform the `sts:AssumeRole` operation.
Correcting this trust policy resolves the access denied issue and allows CodePipeline to invoke the Lambda function.

Key Concept

AWS CodePipeline requires a properly configured IAM trust policy on its service role to allow the service principal to assume the role and execute stage actions.
Estimated Time:1m 30s
PreviousPage 9 / 78Next