All practice questions

746 questions

All types1,542 Multiple choice782 Multiple select746 Ordering14

A developer is configuring a serverless application where an AWS Lambda function processes messages from an Amazon SQS queue. The Lambda function must also query an Amazon RDS PostgreSQL database located in a private subnet of a VPC.

During testing, the developer observes two issues:
1. Messages are occasionally processed multiple times by the Lambda function, even though the executions complete successfully. The Lambda function's timeout is set to 60 seconds, and the SQS queue's visibility timeout is set to 30 seconds.
2. The Lambda function fails to establish a connection to the RDS database, resulting in connection timeout errors.

Which two actions should the developer take to resolve these issues? (Select two.)

Select all that apply

Increase the visibility timeout of the Amazon SQS queue to at least 360 seconds.

Configure the Lambda function to connect to the VPC using the private subnets, and ensure that the Lambda function's security group allows outbound traffic to the database's security group.

Configure the Lambda function to run in the public subnets of the VPC and associate a public IP address with the function's execution role.

Decrease the Lambda function's timeout to 15 seconds so that it completes execution before the SQS visibility timeout expires.

Enable SQS FIFO queue deduplication on the existing standard SQS queue to eliminate duplicate messages.

Show answer & explanation

Answer: Increase the visibility timeout of the Amazon SQS queue to at least 360 seconds.; Configure the Lambda function to connect to the VPC using the private subnets, and ensure that the Lambda function's security group allows outbound traffic to the database's security group.

Answer

To resolve the issues, increase the visibility timeout of the Amazon SQS queue to at least 360 seconds, and configure the Lambda function to connect to the VPC using the private subnets while ensuring the security group allows outbound traffic to the database's security group.

To resolve the duplicate processing issue, the visibility timeout of the SQS queue must be increased. AWS recommends setting it to at least 6 times the Lambda function's timeout (which is 60 seconds, so at least 360 seconds) to ensure that the message remains invisible to other consumers while Lambda processes it. To resolve the database connectivity issue, the Lambda function must be configured with VPC access using private subnets, and its security group must allow outbound traffic to the database's security group.

Step-by-Step Solution

Address the SQS message visibility timeout mismatch by increasing the visibility timeout of the queue to at least 360 seconds (6 times the Lambda function timeout of 60 seconds) to prevent messages from returning to the queue while Lambda is still processing them.

This resolves the issue of messages being processed multiple times due to the function execution duration exceeding the queue's visibility window.

AWS best practices dictate that the SQS visibility timeout should be configured to at least 6 times the Lambda function timeout to avoid duplicate processing and allow for retries.

Address the database connection timeout by configuring the Lambda function to access the VPC.

The Lambda function is associated with the private subnets of the VPC and receives Elastic Network Interfaces (ENIs).

To connect to resources in a private VPC subnet like RDS, the Lambda function must be configured with VPC access pointing to private subnets within that VPC.

Configure the security groups to allow communication between the Lambda function and the RDS instance.

The Lambda function's security group is allowed outbound access, and the RDS database's security group is configured to allow inbound traffic from the Lambda function's security group.

Network traffic must be explicitly allowed by security groups at both the source (Lambda) and destination (RDS) to establish a successful database connection.

Key Concept

AWS Lambda integration with Amazon SQS and VPC resources requires proper alignment of SQS visibility timeouts with Lambda timeouts, as well as correct VPC and security group configuration.

Question 2Question →

A developer is building a logistics tracking application that stores package delivery status updates in an Amazon DynamoDB table. The table has a partition key of `PackageID` and a sort key of `StatusTimestamp`. The application needs to retrieve all delivery status updates for a specific `PackageID` that occurred within the last $24$ hours. The results must be returned starting with the most recent update first.

Which two actions should the developer take to meet these requirements with the lowest latency and minimal Read Capacity Unit (RCU) consumption? (Select TWO.)

Select all that apply

Use the `Query` API operation with a key condition expression specifying the `PackageID` and a range comparison on `StatusTimestamp`.

Set the `ScanIndexForward` parameter to `false` in the API request.

Use the `Scan` API operation with a filter expression specifying the `PackageID` and `StatusTimestamp`.

Hardcode AWS credentials directly in the application's SDK client configuration to minimize authorization latency.

Increase the provisioned read capacity units (RCUs) for the table to prevent throttling when sorting the retrieved dataset.

Show answer & explanation

Answer: Use the `Query` API operation with a key condition expression specifying the `PackageID` and a range comparison on `StatusTimestamp`.; Set the `ScanIndexForward` parameter to `false` in the API request.

Answer

Use the `Query` API operation with a key condition expression on the partition key and sort key, and set the `ScanIndexForward` parameter to `false` in the API request.

To retrieve items sharing the same partition key (`PackageID`) efficiently, the `Query` API operation should be used. The query can filter results by the sort key (`StatusTimestamp`) directly in the key condition expression, which consumes Read Capacity Units (RCUs) only for the items that match the criteria. By default, DynamoDB returns query results in ascending order of the sort key. Setting the `ScanIndexForward` parameter to `false` reverses this order, returning the most recent updates first.

Step-by-Step Solution

Determine the appropriate API operation for retrieving data with a known partition key.

Select the `Query` API operation rather than `Scan`.

A `Query` operation directly accesses the partition and filters by sort key efficiently, minimizing RCU consumption, whereas a `Scan` reads the entire table.

Configure the sorting order of the returned items.

Set the `ScanIndexForward` parameter to `false`.

DynamoDB sorts query results in ascending order of the sort key by default. Setting `ScanIndexForward` to `false` reverses the order to descending, returning the most recent items first.

Key Concept

Optimizing read operations in Amazon DynamoDB using Query instead of Scan and controlling sort order via ScanIndexForward.

Question 3Question →

A developer is building a video streaming application that publishes user engagement events to an Amazon Kinesis Data Stream. An AWS Lambda function processes these events in batches. For specific events, such as 'UpgradeAccount', the Lambda function must publish a message to an Amazon EventBridge custom event bus to trigger downstream provisioning workflows.

During high-load testing, the developer observes two issues:
1. The Lambda function frequently runs out of time while processing batches of events.
2. The Lambda function fails to publish events to the EventBridge custom event bus, receiving an AccessDeniedException.

Which combination of actions should the developer take to resolve these issues? (Select TWO.)

Select all that apply

Decrease the BatchSize parameter of the Lambda event source mapping and ensure the Lambda function's timeout is set appropriately.

Modify the producer to use a static string as the partition key for all Kinesis records to ensure sequential processing and prevent Lambda concurrency issues.

Attach an IAM policy to the Lambda function's execution role that grants the events:PutEvents permission for the EventBridge event bus resource.

Modify the trust policy of the EventBridge custom event bus to allow the lambda.amazonaws.com service principal to assume the EventBridge role.

Configure the Lambda function to run inside a private VPC subnet without a NAT Gateway or an EventBridge VPC endpoint to isolate the traffic and bypass EventBridge resource policies.

Show answer & explanation

Answer: Decrease the BatchSize parameter of the Lambda event source mapping and ensure the Lambda function's timeout is set appropriately.; Attach an IAM policy to the Lambda function's execution role that grants the events:PutEvents permission for the EventBridge event bus resource.

Answer

Decrease the BatchSize parameter of the Lambda event source mapping and ensure the Lambda function's timeout is set appropriately; and attach an IAM policy to the Lambda function's execution role that grants the events:PutEvents permission for the EventBridge event bus resource.

To resolve the batch timeout, decreasing the BatchSize limits the payload volume per invocation, ensuring the Lambda function can complete execution within its timeout limits. To resolve the AccessDeniedException, the Lambda function's execution role must be granted the events:PutEvents permission, enabling it to write messages to the EventBridge custom event bus.

Step-by-Step Solution

Address the Lambda batch execution timeout.

By reducing the BatchSize parameter in the Event Source Mapping, the Lambda function receives fewer records per invocation. This directly reduces the processing time per batch, preventing execution timeouts.

Kinesis streams push batches of records to Lambda, and processing too many large records in a single invocation can exceed the configured Lambda timeout.

Resolve the EventBridge AccessDeniedException authorization error.

An IAM policy must be attached to the Lambda execution role granting 'events:PutEvents' for the target EventBridge custom event bus.

AWS services interact using IAM. The Lambda function acts as the caller and requires explicit permissions to call the PutEvents API on the destination EventBridge event bus.

Key Concept

Stream processing tuning with Lambda batch settings and secure event routing to EventBridge via IAM permissions.

Estimated Time:2m 0s

Question 4Question →

A developer is designing a flight booking platform where reservation records are stored in an Amazon DynamoDB table. The table's partition key is `ReservationID`. The application needs to retrieve all reservations for a specific `FlightID` that currently have a `ReservationStatus` of 'Pending'. The solution must be highly efficient, minimize read latency, and avoid unnecessary read capacity consumption. Which two actions should the developer take to meet these requirements?

Select all that apply

Create a Global Secondary Index (GSI) with FlightID as the partition key and ReservationStatus as the sort key.

Perform a Query operation on the GSI using a key condition expression to specify the FlightID and ReservationStatus.

Perform a Scan operation on the base table using a FilterExpression to filter items where the FlightID and ReservationStatus match.

Increase the base table's provisioned Read Capacity Units (RCUs) to mitigate ProvisionedThroughputExceededException errors when performing the daily full table Scan.

Initialize the AWS SDK client inside the application code by hardcoding the access keys of an IAM user that has read access to the table.

Show answer & explanation

Answer: Create a Global Secondary Index (GSI) with FlightID as the partition key and ReservationStatus as the sort key.; Perform a Query operation on the GSI using a key condition expression to specify the FlightID and ReservationStatus.

Answer

To retrieve the pending reservations efficiently, the developer must create a Global Secondary Index (GSI) with FlightID as the partition key and ReservationStatus as the sort key, and then perform a Query operation on this GSI.

To retrieve items efficiently using attributes other than the base table's partition key, a Global Secondary Index (GSI) must be created. Setting FlightID as the partition key and ReservationStatus as the sort key of the GSI allows direct querying. Performing a Query operation on this GSI with a key condition expression retrieves only the matching items, minimizing latency and RCU consumption.

Step-by-Step Solution

Analyze the table's primary key and the query requirements.

The table's partition key is ReservationID, but the query requires filtering by FlightID and ReservationStatus, which are non-key attributes in the base table.

DynamoDB does not allow direct Query operations on non-key attributes without an index.

Select the appropriate indexing strategy.

Create a Global Secondary Index (GSI) with FlightID as the partition key and ReservationStatus as the sort key.

A GSI allows querying across partition keys different from the base table, enabling direct lookups by FlightID.

Execute the retrieval operation.

Perform a Query operation on the GSI with a key condition expression.

Querying is more efficient than scanning because it only consumes capacity units for the matching items.

Key Concept

Using Global Secondary Indexes (GSIs) to perform efficient Query operations instead of Scan operations on non-key attributes in Amazon DynamoDB.

Estimated Time:2m 0s

Question 5Question →

A developer is designing a real-time multiplayer game event processor. The game client sends player match telemetry (including player ID, match ID, action type, and score) to an Amazon Kinesis Data Stream. The developer must ensure that events for the same match are processed in the strict order they occurred by the consumer. In addition, the consumer, an AWS Lambda function running in a virtual private cloud (VPC), must query an external SaaS security endpoint over the internet to check for anomalous player behavior.

Which two actions should the developer take to meet these requirements?

Select all that apply

Use a static partition key like 'game_event' for all records to guarantee that all match events are sent to the same shard for sequential processing.

Use the match ID as the partition key when publishing events to the Amazon Kinesis Data Stream.

Deploy the Lambda function in the public subnets of the VPC and assign it a public IP address to allow outbound communication to the external SaaS endpoint.

Deploy the Lambda function in the private subnets of the VPC, and route outbound internet traffic through a NAT Gateway located in a public subnet.

Configure the Lambda function's execution timeout to 15 minutes to ensure that execution context and database connection pools are preserved across all processed matches.

Show answer & explanation

Answer: Use the match ID as the partition key when publishing events to the Amazon Kinesis Data Stream.; Deploy the Lambda function in the private subnets of the VPC, and route outbound internet traffic through a NAT Gateway located in a public subnet.

Answer

Use the match ID as the partition key when publishing events to the Amazon Kinesis Data Stream, and deploy the Lambda function in the private subnets of the VPC, routing outbound internet traffic through a NAT Gateway located in a public subnet.

To achieve strict event ordering for each match, the events must be sent to the same shard of the Kinesis Data Stream. This is done by selecting a partition key with sufficient cardinality that groups related events, such as the match ID. For the Lambda consumer in a VPC to access an external SaaS endpoint over the internet, it must be placed in private subnets, with its outbound traffic routed to a NAT Gateway in a public subnet. Lambda functions inside a VPC cannot directly use an Internet Gateway or a public IP address.

Step-by-Step Solution

Ensure in-order processing of match events by using the match ID as the partition key.

Events with the same match ID are hashed to the same shard of the Kinesis Data Stream, preserving their relative ordering during consumption.

Kinesis guarantees order preservation only within a single shard. Assigning the match ID as the partition key maps all events of that match to the same shard.

Configure the Lambda function inside private subnets of the VPC and set up a NAT Gateway in a public subnet.

The Lambda function can communicate with the external SaaS security endpoint over the internet.

Lambda functions deployed in a VPC do not receive public IP addresses. To access the internet, their traffic must be routed from private subnets through a NAT Gateway in a public subnet that has an Internet Gateway route.

Key Concept

Configuring partition keys in Kinesis Data Streams for order preservation and setting up NAT Gateways for Lambda VPC outbound connectivity.

Estimated Time:1m 30s

Question 6Question →

A developer is configuring an AWS Lambda function inside a private subnet of a custom VPC to process messages from an Amazon SQS queue. The Lambda function must read database credentials from AWS Secrets Manager and write the processed results to an Amazon DynamoDB table. To satisfy security requirements, the VPC has no internet access, and all traffic must remain within the AWS network.

The developer creates a Gateway VPC endpoint for DynamoDB and an Interface VPC endpoint for Secrets Manager. However, when the Lambda function runs, it fails with connection timeout errors when attempting to access both DynamoDB and Secrets Manager.

Which combination of actions will resolve these connection timeouts? (Select two.)

Select all that apply

Update the route table associated with the Lambda function's private subnet to include a route that targets the DynamoDB Gateway VPC endpoint for the DynamoDB prefix list.

Modify the security group associated with the Secrets Manager Interface VPC endpoint to allow inbound HTTPS traffic on port 443 from the security group associated with the Lambda function.

Configure the security group associated with the Lambda function to allow inbound HTTPS traffic on port 443 from the Secrets Manager Interface VPC endpoint.

Add a route to the route table of the Lambda function's private subnet that routes all traffic to the Secrets Manager Interface VPC endpoint as the target.

Increase the visibility timeout of the SQS queue to be greater than the Lambda function's timeout, and configure the Lambda function's concurrency limit to match the SQS queue's batch size.

Show answer & explanation

Answer: Update the route table associated with the Lambda function's private subnet to include a route that targets the DynamoDB Gateway VPC endpoint for the DynamoDB prefix list.; Modify the security group associated with the Secrets Manager Interface VPC endpoint to allow inbound HTTPS traffic on port 443 from the security group associated with the Lambda function.

Answer

Update the route table associated with the Lambda function's private subnet to include a route that targets the DynamoDB Gateway VPC endpoint for the DynamoDB prefix list, and modify the security group associated with the Secrets Manager Interface VPC endpoint to allow inbound HTTPS traffic on port 443 from the security group associated with the Lambda function.

To resolve connection timeouts inside a private VPC with no internet access, the developer must properly configure the networking and security rules for the VPC endpoints. For the DynamoDB Gateway endpoint, a route must be added to the subnet's route table targeting the DynamoDB prefix list. For the Secrets Manager Interface endpoint, which uses ENIs, the endpoint's security group must be configured to accept inbound HTTPS (port 443) connections from the Lambda function's security group.

Step-by-Step Solution

Identify the cause of the DynamoDB timeout.

Determine that DynamoDB is accessed via a Gateway VPC endpoint.

Gateway endpoints require explicit routes in the subnet's route table to direct traffic to the service.

Resolve the DynamoDB configuration issue.

Add a route in the private subnet's route table pointing to the DynamoDB prefix list with the Gateway endpoint ID as the target.

This enables the VPC router to forward DynamoDB-bound traffic through the Gateway endpoint.

Identify the cause of the Secrets Manager timeout.

Determine that Secrets Manager is accessed via an Interface VPC endpoint.

Interface endpoints use Elastic Network Interfaces (ENIs) with security groups, which require appropriate inbound permissions.

Resolve the Secrets Manager configuration issue.

Configure the security group of the Secrets Manager Interface endpoint to allow inbound HTTPS (port 443) traffic from the security group of the Lambda function.

This allows the inbound connection from the Lambda function's ENI to the endpoint's ENI.

Key Concept

AWS Lambda VPC networking using Gateway and Interface VPC endpoints

Estimated Time:3m 0s

Question 7Question →

A developer is implementing an AWS Lambda function in Account A ( $111111111111$ ) that needs to retrieve database credentials stored as a secure parameter in the Systems Manager Parameter Store in Account B ( $222222222222$ ). The parameter is encrypted using an AWS KMS customer managed key (CMK) in Account B. The developer intends to use the AWS Security Token Service (STS) to assume an IAM role named `DbConfigReaderRole` in Account B.

The Lambda function is associated with an execution role named `LambdaExecutionRole` in Account A.

Which of the following configuration steps must be performed to allow the Lambda function to retrieve the configuration parameter? (Select TWO.)

Select all that apply

In Account B, configure the trust policy for `DbConfigReaderRole` to allow the principal `arn:aws:iam::111111111111:role/LambdaExecutionRole` to perform the `sts:AssumeRole` action.

In Account A, attach a policy to `LambdaExecutionRole` that grants `sts:AssumeRole` permissions on the resource `arn:aws:iam::222222222222:role/DbConfigReaderRole`.

In Account B, attach an identity-based permission policy to `DbConfigReaderRole` that grants `sts:AssumeRole` permissions to the principal `arn:aws:iam::111111111111:role/LambdaExecutionRole`.

In the Lambda function code, configure the AWS SDK client to initialize credentials by hardcoding the access keys of an IAM user in Account B that has permissions to read the parameter.

In Account B, attach a resource-based policy directly to the Systems Manager Parameter that grants `ssm:GetParameter` permissions to the `LambdaExecutionRole` in Account A.

Show answer & explanation

Answer: In Account B, configure the trust policy for `DbConfigReaderRole` to allow the principal `arn:aws:iam::111111111111:role/LambdaExecutionRole` to perform the `sts:AssumeRole` action.; In Account A, attach a policy to `LambdaExecutionRole` that grants `sts:AssumeRole` permissions on the resource `arn:aws:iam::222222222222:role/DbConfigReaderRole`.

Answer

The configuration requires adding the calling role as a trusted principal in the trust policy of the target role in Account B, and granting permission to assume the target role in the identity-based policy of the caller's role in Account A.

For cross-account access via STS, two distinct components are required: the target role's trust policy must list the source principal as a trusted entity, and the source identity's permissions policy must permit the call to assume the target role.

Step-by-Step Solution

Identify the cross-account trust requirement.

The target role `DbConfigReaderRole` in Account B (

222222222222

) must explicitly trust the Lambda execution role in Account A (

111111111111

) via its trust policy.

Without this trust relationship, STS will deny the assume role request from Account A's principal.

Identify the delegation permission requirement.

The source execution role `LambdaExecutionRole` in Account A must be granted permission to perform the `sts:AssumeRole` action on the target role's ARN in Account B.

By default, IAM execution roles do not have permission to assume arbitrary external roles; this must be explicitly allowed.

Differentiate trust policies from identity-based policies and resource-based policies.

Confirm that trust relationships are defined in trust policies (not identity-based policies) and that Systems Manager Parameter Store does not support resource policies.

This rules out the incorrect options that attempt to configure trust in permissions policies or use non-existent parameter resource policies.

Key Concept

IAM Policies and Roles

Estimated Time:2m 0s

Question 8Question →

A developer is building a serverless client-side web application. Users will log in using an Amazon Cognito User Pool. Once authenticated, the application must interact directly with AWS services from the browser to download user-specific documents from an Amazon S3 bucket, restricted to the path `documents/${cognito-identity.amazonaws.com:sub}/*`, and write application usage telemetry directly to an Amazon Kinesis Data Stream. The developer wants to implement this with the least operational overhead and without managing any backend API or compute resources. Which TWO actions should the developer take to configure this solution?

Select all that apply

Create an Amazon Cognito Identity Pool, configure the Cognito User Pool as an identity provider, and associate an authenticated IAM role that permits `s3:GetObject` on the prefix `arn:aws:s3:::my-bucket/documents/${cognito-identity.amazonaws.com:sub}/*` and `kinesis:PutRecord` on the stream.

Configure the client application to exchange the Cognito User Pool ID token for temporary AWS credentials using the Cognito Identity Pool.

Configure the client application to pass the Cognito User Pool Access token directly in the Authorization header of the requests to the Amazon S3 and Kinesis Data Streams endpoints.

Deploy an Amazon API Gateway REST API with a Cognito User Pool Authorizer, and route the client requests through the API to access S3 and Kinesis.

Generate long-term IAM User access keys with the required S3 and Kinesis permissions, and embed them in the client application code.

Show answer & explanation

Answer: Create an Amazon Cognito Identity Pool, configure the Cognito User Pool as an identity provider, and associate an authenticated IAM role that permits `s3:GetObject` on the prefix `arn:aws:s3:::my-bucket/documents/${cognito-identity.amazonaws.com:sub}/*` and `kinesis:PutRecord` on the stream.; Configure the client application to exchange the Cognito User Pool ID token for temporary AWS credentials using the Cognito Identity Pool.

Answer

The developer should create an Amazon Cognito Identity Pool configured with the User Pool as an identity provider, assigning an authenticated IAM role that permits Kinesis and user-restricted S3 access. Additionally, the client application must exchange the Cognito User Pool ID token for temporary AWS credentials using the Identity Pool.

To interact directly with AWS services like Amazon S3 and Amazon Kinesis from a client-side application, temporary AWS credentials are required. By creating a Cognito Identity Pool and configuring the User Pool as an identity provider, you can exchange the User Pool ID token for temporary AWS IAM credentials. The authenticated IAM role associated with the Identity Pool can restrict S3 access to user-specific folders using the `${cognito-identity.amazonaws.com:sub}` policy variable and grant write permissions to the Kinesis stream, ensuring secure and direct access with minimal operational overhead.

Step-by-Step Solution

Configure the user directory and federation.

An Amazon Cognito User Pool is set up for authentication, and an Identity Pool is created with the User Pool configured as an identity provider.

This establishes a trust relationship where successful authentication in the User Pool allows the client to request credentials from the Identity Pool.

Define the permissions using an IAM policy on the Identity Pool's authenticated role.

The authenticated IAM role is assigned a policy allowing `s3:GetObject` on `arn:aws:s3:::my-bucket/documents/${cognito-identity.amazonaws.com:sub}/*` and `kinesis:PutRecord` on the stream.

The `${cognito-identity.amazonaws.com:sub}` variable represents the user's Cognito Identity ID, ensuring users can only access their own documents, while Kinesis access allows direct telemetry ingestion.

Exchange tokens for credentials in the client application.

The client authenticates with the User Pool, obtains an ID token, and calls the Identity Pool to get temporary AWS credentials.

These credentials are used by the AWS SDK in the browser to sign requests directly to S3 and Kinesis using Signature Version 4.

Key Concept

Amazon Cognito Identity Pools enable client-side applications to obtain temporary, limited-privilege AWS credentials by federating identity providers like Cognito User Pools.

Question 9Question →

A developer is configuring an AWS CodeDeploy deployment group for an in-place deployment of a web application to Amazon EC2 instances. The deployment must automatically revert to the last known successful version if the new deployment fails or if application error rates exceed a specific threshold. Additionally, the developer needs to ensure that any temporary files left by a failed deployment are cleaned up during the rollback process.

Which of the following configurations should the developer implement to meet these requirements? (Select TWO.)

Select all that apply

Enable automatic rollbacks in the CodeDeploy deployment group settings for deployment failures, and configure a CloudWatch alarm to trigger a rollback when application error rates exceed the threshold.

Implement the cleanup script within the BeforeInstall lifecycle hook of the application's AppSpec file, because CodeDeploy rolls back by executing a new deployment of the last successful revision.

Add a Rollback hook to the hooks section of the appspec.yml file to execute a script that automatically deletes temporary files when a rollback is initiated.

Attach a service role to the CodeDeploy agent on the EC2 instances with a trust policy that permits the sns:Publish action for rollback alerts.

Store the cleanup script in AWS Systems Manager Parameter Store as a secure parameter, and reference it under the resources section of the appspec.yml file.

Show answer & explanation

Answer: Enable automatic rollbacks in the CodeDeploy deployment group settings for deployment failures, and configure a CloudWatch alarm to trigger a rollback when application error rates exceed the threshold.; Implement the cleanup script within the BeforeInstall lifecycle hook of the application's AppSpec file, because CodeDeploy rolls back by executing a new deployment of the last successful revision.

Answer

Enable automatic rollbacks in the CodeDeploy deployment group settings for deployment failures and CloudWatch alarm states, and implement cleanup logic in the BeforeInstall hook of the AppSpec file because CodeDeploy performs a rollback by initiating a new deployment of the last successful revision.

The correct configurations are to enable automatic rollbacks in the CodeDeploy deployment group for both deployment failures and when a configured CloudWatch alarm (tracking error rates) goes into the ALARM state. Furthermore, because CodeDeploy executes a rollback by initiating a new deployment of the last successful revision, the cleanup logic must be placed in a standard lifecycle hook such as BeforeInstall of that revision to ensure any leftover artifacts from the failed deployment are deleted before files are copied.

Step-by-Step Solution

Configure rollback behaviors on the deployment group

Automatic rollbacks are enabled for deployment failures and CloudWatch alarms monitoring error rate thresholds.

This natively automates the rollback process when a failure is detected or when application metrics degrade.

Analyze how CodeDeploy executes rollbacks

CodeDeploy handles rollbacks by running a brand new deployment of the previous successful revision.

Understanding this flow reveals that there is no custom Rollback hook; instead, standard deployment hooks in the target revision will run.

Place the cleanup script in the correct lifecycle hook of the AppSpec file

The cleanup script is mapped to the BeforeInstall hook of the AppSpec file.

When the rollback deployment starts, the BeforeInstall hook runs before new files are copied, clearing out remnants of the failed deployment.

Key Concept

AWS CodeDeploy rollbacks are executed as new deployments of the last known successful revision, which run the standard AppSpec lifecycle hooks of that revision rather than a dedicated rollback hook.

Question 10Question →

An application running on AWS Fargate generates monthly audit reports (each approximately $8\text{ MB}$ in size) that must be encrypted client-side before they are stored in an external third-party storage system. The developer wants to use AWS Key Management Service (AWS KMS) with a customer managed key to secure these reports.

Which of the following actions must the developer take to implement this client-side encryption workflow? (Select TWO.)

Select all that apply

Call the GenerateDataKey API of AWS KMS using the customer managed key identifier to retrieve a plaintext data key and an encrypted data key.

Call the Encrypt API of AWS KMS to encrypt the audit report directly.

Call the GenerateDataKeyWithoutPlaintext API of AWS KMS to obtain an encrypted data key, and use it to encrypt the audit report locally.

Encrypt the audit report locally using the plaintext data key, store the encrypted data key alongside the encrypted report, and then delete the plaintext data key from memory.

Store the plaintext data key in AWS Systems Manager Parameter Store as a SecureString to reuse it for subsequent audit reports.

Show answer & explanation

Answer: Call the GenerateDataKey API of AWS KMS using the customer managed key identifier to retrieve a plaintext data key and an encrypted data key.; Encrypt the audit report locally using the plaintext data key, store the encrypted data key alongside the encrypted report, and then delete the plaintext data key from memory.

Answer

To encrypt a file larger than

4\text{ KB}

client-side, the developer must generate a data key by calling the GenerateDataKey API, use the returned plaintext data key to encrypt the report locally, discard the plaintext key from memory, and store the encrypted data key alongside the encrypted audit report.

To encrypt a large file client-side using AWS KMS, the developer must implement envelope encryption. This involves calling the GenerateDataKey API to obtain both a plaintext data key and an encrypted data key. The plaintext data key is used to encrypt the audit report locally, after which the plaintext key is discarded from memory. The encrypted data key is then stored with the encrypted report so that it can be decrypted later by calling the Decrypt API to recover the plaintext key.

Step-by-Step Solution

Generate a unique data key.

The GenerateDataKey API is called, which returns a plaintext data key and an encrypted data key.

Since the file exceeds the direct encryption limit of AWS KMS, envelope encryption is required. The plaintext key is needed to perform the encryption, and the encrypted key is saved for future decryption.

Encrypt the data locally.

The Fargate container encrypts the

8\text{ MB}

report using the plaintext data key.

This performs the actual cryptographic operation locally without sending the large file to AWS KMS.

Clean up memory and store metadata.

The plaintext key is cleared from the container's memory, and the encrypted data key is written alongside the encrypted report.

Holding the plaintext key longer than necessary in memory presents a security risk, and the encrypted data key is the only way to recover the plaintext key during decryption.

Key Concept

AWS KMS client-side envelope encryption workflow for objects exceeding the direct encryption size limits.

Question 11Question →

A developer is instrumenting a Go-based microservice running on Amazon ECS with the EC2 launch type to trace incoming HTTP requests, downstream HTTP client calls, and calls to Amazon DynamoDB using AWS X-Ray. The X-Ray daemon is already running on the container host instances. Which of the following actions must the developer take to instrument the application and ensure downstream traces are recorded? (Select TWO.)

Select all that apply

Instrument the AWS SDK clients using the X-Ray SDK for Go and wrap the HTTP client's transport with the X-Ray RoundTripper.

Pass the Go context containing the active segment to downstream AWS SDK operations and HTTP client calls.

Hardcode temporary AWS IAM credentials within the application's SDK client configuration to authorize calls to the X-Ray daemon.

Configure the AWS SDK clients without passing the Go context object, as the Go X-Ray SDK automatically registers a global listener that intercepts and correlates all downstream calls.

Configure the Amazon SQS queue's visibility timeout to be shorter than the database processing time to force X-Ray to flush trace segments.

Show answer & explanation

Answer: Instrument the AWS SDK clients using the X-Ray SDK for Go and wrap the HTTP client's transport with the X-Ray RoundTripper.; Pass the Go context containing the active segment to downstream AWS SDK operations and HTTP client calls.

Answer

To instrument the Go application for AWS X-Ray, the developer must instrument the AWS SDK clients and HTTP client transport, and explicitly pass the Go context containing the active segment to all downstream calls.

Instrumenting the SDK clients and HTTP transport with X-Ray SDK helpers enables subsegment generation for outgoing requests. Since Go lacks thread-local storage, context must be explicitly passed to propagate the active trace segment.

Step-by-Step Solution

Wrap the HTTP client transport with the X-Ray RoundTripper and initialize the AWS SDK clients with X-Ray instrumentation helper functions.

The application code is prepared to intercept outgoing AWS SDK and HTTP requests to generate X-Ray subsegments.

This establishes the handlers and interceptors required by the X-Ray SDK to record outgoing service details.

Ensure that the Go context.Context object representing the active request segment is passed into all downstream SDK calls and HTTP requests.

The trace ID and segment hierarchy are successfully propagated down the call chain.

Go does not have thread-local storage; therefore, trace context propagation relies entirely on passing context variables down the call stack.

Key Concept

Go X-Ray SDK Instrumentation and Context Propagation

Question 12Question →

A developer is setting up an AWS CodeBuild project to compile a Java application and upload the build artifacts to an Amazon S3 bucket. During the first build execution, CodeBuild fails to upload the artifacts, returning an Access Denied error. Additionally, the developer wants the project to use a custom build specification file named build-config.yml located in the config directory of the repository, rather than using the default root-level buildspec.yml file.

Which configuration steps must the developer perform to resolve the upload failure and use the custom build specification? (Select TWO.)

Select all that apply

Update the buildspec path in the CodeBuild project settings to config/build-config.yml.

Modify the CodeBuild service role permissions policy to allow the s3:PutObject action on the artifacts bucket.

Define the custom build specification contents within a Systems Manager Parameter Store parameter and pass the parameter name in the buildspec.

Create a default buildspec.yml file in the repository root and define a redirect block under the install phase pointing to config/build-config.yml.

Modify the IAM trust policy of the Amazon ECS task execution role to allow the codebuild.amazonaws.com service principal to assume it.

Show answer & explanation

Answer: Update the buildspec path in the CodeBuild project settings to config/build-config.yml.; Modify the CodeBuild service role permissions policy to allow the s3:PutObject action on the artifacts bucket.

Answer

The correct steps are to update the buildspec path in the CodeBuild project settings to point to the custom path, and to modify the CodeBuild service role permissions policy to allow writing objects to the S3 bucket.

To use a custom build specification file that is not in the root directory or has a different name, the developer must configure the file path in the project settings. Additionally, since the build environment failed to upload the artifacts to Amazon S3 with an Access Denied error, the CodeBuild service role must be updated with a policy that allows the write action on the target S3 bucket.

Step-by-Step Solution

Determine how CodeBuild locates a non-standard buildspec file name and path.

A custom buildspec path like config/build-config.yml must be configured directly within the CodeBuild project settings.

By default, CodeBuild expects buildspec.yml in the root directory. Any custom path or name must be specified in the project configuration.

Analyze the cause of the Access Denied error during artifact upload.

The CodeBuild build container runs under an IAM role (the service role). It requires explicit permissions to write objects to the S3 bucket where artifacts are stored.

Without s3:PutObject permissions attached to the CodeBuild service role, the upload will fail with an authorization error.

Key Concept

AWS CodeBuild custom buildspecs and permissions

Question 13Question →

A company is migrating a containerized web application to run on Amazon ECS using the Amazon EC2 launch type. Multiple instances of the application task must run on each container instance, and the tasks are configured to use the bridge network mode. The application code requires access to a database password stored in AWS Secrets Manager and must perform read operations on an Amazon DynamoDB table. Which two configurations are required to support this deployment?

Select all that apply

Set the container port to 80 and the host port to 0 (or leave it blank) in the task definition port mapping.

Configure the task definition's Task Role (taskRoleArn) with the IAM policies required to access the Amazon DynamoDB table and AWS Secrets Manager.

Configure the task definition's Task Execution Role (executionRoleArn) with the IAM policies required to access the Amazon DynamoDB table and AWS Secrets Manager.

Configure the IAM role for application permissions with a trust policy that allows the ec2.amazonaws.com service principal to assume the role.

Store the database password as a plaintext environment variable directly in the container definition of the ECS task definition.

Show answer & explanation

Answer: Set the container port to 80 and the host port to 0 (or leave it blank) in the task definition port mapping.; Configure the task definition's Task Role (taskRoleArn) with the IAM policies required to access the Amazon DynamoDB table and AWS Secrets Manager.

Answer

Configure dynamic port mapping by setting the host port to 0 or leaving it blank, and assign the required IAM policies to the ECS Task Role (taskRoleArn) with a trust policy for ecs-tasks.amazonaws.com.

To support running multiple instances of the container on a single EC2 host using the bridge network mode, dynamic host port mapping is required. This is achieved by setting the host port to 0 or leaving it blank in the task definition port mapping, which allows the ECS agent to automatically map the container port to a random ephemeral port on the host. Furthermore, the application container requires AWS credentials at runtime to query the DynamoDB table and fetch secrets from Secrets Manager. These application-level permissions must be defined in an IAM role assigned to the taskRoleArn (Task Role) parameter of the task definition.

Step-by-Step Solution

Configure the port mapping in the task definition for bridge network mode with the host port set to 0 or left blank.

Enables dynamic port mapping, letting the ECS agent bind the container's port to a random host port.

Allows multiple task instances to run on the same EC2 instance without port conflicts.

Create an IAM role that trusts the ecs-tasks.amazonaws.com service principal and attach permission policies for DynamoDB and Secrets Manager.

Creates a role that ECS tasks can assume to perform API operations on AWS services.

Secures application credentials by avoiding hardcoded values and granting access via temporary credentials.

Assign this role to the taskRoleArn parameter in the ECS task definition.

Ensures the containerized application executes with the permissions defined in the IAM role.

Maintains the separation of concerns by assigning application access to the Task Role rather than the Task Execution Role.

Key Concept

ECS Task Role vs Task Execution Role and Bridge Network Mode Port Mapping

Estimated Time:2m 0s

Question 14Question →

A developer is setting up an AWS CodeBuild project to build a containerized application. The build process needs to retrieve a database password securely from AWS Secrets Manager. The developer has stored a custom build specification file at the path `build/pipelines/buildspec-dev.yml` in the source repository. During the initial build run, CodeBuild fails immediately because it cannot locate the build specification, and the database credentials are not resolved. Which two actions should the developer take to configure the project correctly? (Choose two.)

Select all that apply

Update the CodeBuild project configuration to set the buildspec file path to build/pipelines/buildspec-dev.yml

In the buildspec-dev.yml file, retrieve the database password by defining it under the secrets-manager key in the env section

In the buildspec-dev.yml file, retrieve the database password by defining it under the parameter-store key in the env section

Modify the IAM trust policy of the CodeBuild service role to allow the Systems Manager service (ssm.amazonaws.com) to assume the role

Add a shell command in the install phase of the buildspec file to copy the buildspec-dev.yml file to the root of the source directory

Show answer & explanation

Answer: Update the CodeBuild project configuration to set the buildspec file path to build/pipelines/buildspec-dev.yml; In the buildspec-dev.yml file, retrieve the database password by defining it under the secrets-manager key in the env section

Answer

To configure the project correctly, the developer must update the CodeBuild project settings to set the buildspec path to the custom subdirectory path, and update the buildspec-dev.yml file to declare the secret under the secrets-manager key in the env section.

To resolve the buildspec locator issue, the developer must explicitly configure the custom file path in the CodeBuild project configuration since it is not named buildspec.yml at the root. To retrieve the secret correctly, the developer must define it under the secrets-manager key in the env block, which instructs CodeBuild to retrieve the value from Secrets Manager natively.

Step-by-Step Solution

Configure the CodeBuild project settings to point to the correct buildspec location.

CodeBuild is successfully able to locate and parse the buildspec file from build/pipelines/buildspec-dev.yml instead of failing at the start of the build.

By default, CodeBuild only searches for buildspec.yml at the root directory of the source provider. Any other name or path must be configured in the project settings.

Configure the env section of the buildspec-dev.yml file to pull the database password from Secrets Manager.

The database password is dynamically retrieved and exposed as an environment variable in the build environment.

Using the native secrets-manager key in the env block tells CodeBuild to fetch the secret from AWS Secrets Manager using the service role's permissions.

Key Concept

AWS CodeBuild buildspec configuration and Secrets Manager integration

Question 15Question →

A developer is troubleshooting an AWS Lambda function that processes customer orders. The Lambda function is configured to run inside a custom VPC in two private subnets to access an Amazon RDS database securely. During testing, the function times out when attempting to connect to an external payment processor's HTTP endpoint over the internet. Additionally, under load, the Lambda function frequently times out because it establishes a new database connection during each invocation, quickly exhausting database resources.

Which combination of actions will resolve these issues? (Select TWO.)

Select all that apply

Configuring a NAT gateway in a public subnet, and updating the route tables of the private subnets to route outbound internet traffic (0.0.0.0/0) through the NAT gateway.

Declaring the database connection client outside of the Lambda handler function to enable execution context reuse across warm starts.

Attaching an Internet Gateway directly to the private subnets where the Lambda function is deployed, and assigning public IP addresses to the function configuration.

Moving the Lambda function to a public subnet in the VPC to allow direct route access to the Internet Gateway for external communication.

Re-initializing the database connection client inside the Lambda handler and executing a connection close method at the end of each invocation.

Show answer & explanation

Answer: Configuring a NAT gateway in a public subnet, and updating the route tables of the private subnets to route outbound internet traffic (0.0.0.0/0) through the NAT gateway.; Declaring the database connection client outside of the Lambda handler function to enable execution context reuse across warm starts.

Answer

The correct options are configuring a NAT gateway in a public subnet and routing the private subnet's traffic through it, and declaring the database connection client outside of the handler function to reuse the execution context.

The correct options resolve both issues. Routing internet-bound traffic from private subnets through a NAT gateway in a public subnet allows the Lambda function to communicate with the external payment API. Declaring the database client outside the handler code ensures that the database connection is reused across invocations, mitigating connection overhead and latency.

Step-by-Step Solution

Address the external payment processor connection timeouts.

Determine that Lambda functions in private subnets require a NAT gateway or VPC endpoint to access the public internet.

Since the external API is on the internet, a NAT gateway must be set up in a public subnet, and the private subnet route tables must be updated to route outbound traffic through it.

Address the database resource exhaustion and execution timeouts under load.

Move the database connection initialization code out of the Lambda handler block to global scope.

This allows subsequent warm executions of the function to reuse the existing database connection pool instead of repeatedly opening and closing sockets, resolving execution timeouts and database overload.

Key Concept

VPC networking configuration for outbound Lambda internet access and database connection optimization using execution context reuse.

Question 16Question →

A developer is troubleshooting a web dashboard hosted on `https://monitor.server-analytics.io` that queries a backend using an Amazon API Gateway REST API. The API is configured with a Lambda Proxy integration. When the client makes a request to the API, the browser blocks the response and displays the following error:

`Access to XMLHttpRequest at 'https://api.server-analytics.io/v1/logs' from origin 'https://monitor.server-analytics.io' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.`

Which TWO steps should the developer take to resolve these errors?

Select all that apply

Configure the `OPTIONS` method on the API Gateway resource to return the required CORS headers for preflight requests.

Modify the Lambda function's response payload to include the `Access-Control-Allow-Origin` header in the `headers` object.

Configure a CORS configuration rule on the Amazon S3 bucket hosting the web dashboard.

Change the integration type to Lambda Custom Integration and configure API Gateway integration responses to handle the request headers.

Add an IAM resource policy to the API Gateway API that allows the origin `https://monitor.server-analytics.io`.

Show answer & explanation

Answer: Configure the `OPTIONS` method on the API Gateway resource to return the required CORS headers for preflight requests.; Modify the Lambda function's response payload to include the `Access-Control-Allow-Origin` header in the `headers` object.

Answer

Configure the `OPTIONS` method on the API Gateway resource to return the required CORS headers for preflight requests, and modify the Lambda function's response payload to include the `Access-Control-Allow-Origin` header in the `headers` object.

The correct options are configuring the `OPTIONS` method on the API Gateway resource and modifying the Lambda function's response payload. Under a Lambda Proxy integration, resolving CORS requires a two-fold approach: first, the preflight `OPTIONS` request must be handled by API Gateway (or a mock integration) to return the allowed origin; second, the backend Lambda function must return the `Access-Control-Allow-Origin` header in its execution response.

Step-by-Step Solution

Enable CORS preflight by configuring the `OPTIONS` method on the API resource.

The browser's initial preflight request is successfully answered with `Access-Control-Allow-Origin` and other CORS headers.

Browsers send an HTTP `OPTIONS` preflight request before cross-origin non-simple requests to verify if the server permits the cross-origin call.

Add the `Access-Control-Allow-Origin` header to the backend response returned by the Lambda function.

The actual HTTP request succeeds because the response payload contains the required header.

Under Lambda Proxy integration, API Gateway does not automatically inject CORS headers into the backend response. The backend Lambda function must explicitly return these headers in its payload.

Key Concept

CORS handling in API Gateway Lambda Proxy integrations requires CORS configuration for both the preflight `OPTIONS` method on API Gateway and the actual method response from the backend Lambda function.

Estimated Time:1m 30s

Question 17Question →

A developer is configuring an AWS Lambda function in Account A ( $111122223333$ ) to write data to an Amazon DynamoDB table in Account B ( $444455556666$ ) by assuming an IAM role named `CrossAccountDynamoDBRole` in Account B. The Lambda function's execution role in Account A is named `LambdaExecutionRole`.

When the Lambda function invokes the `AssumeRole` API call using the AWS SDK, the execution fails with the following error:
`User: arn:aws:sts::111122223333:assumed-role/LambdaExecutionRole/my-function is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::444455556666:role/CrossAccountDynamoDBRole`

Which TWO configurations must the developer implement to resolve this error?

Select all that apply

Add a permission policy to the LambdaExecutionRole in Account A that allows the sts:AssumeRole action on arn:aws:iam::444455556666:role/CrossAccountDynamoDBRole.

Configure the trust policy of CrossAccountDynamoDBRole in Account B to allow the sts:AssumeRole action for the principal arn:aws:iam::111122223333:role/LambdaExecutionRole.

Configure the trust policy of CrossAccountDynamoDBRole in Account B to allow the dynamodb:PutItem action for the principal lambda.amazonaws.com.

Add a permission policy to the LambdaExecutionRole in Account A that allows the dynamodb:PutItem action on the DynamoDB table in Account B.

Hardcode the AWS access keys of an IAM user created in Account B directly into the Lambda function's initialization code.

Show answer & explanation

Answer: Add a permission policy to the LambdaExecutionRole in Account A that allows the sts:AssumeRole action on arn:aws:iam::444455556666:role/CrossAccountDynamoDBRole.; Configure the trust policy of CrossAccountDynamoDBRole in Account B to allow the sts:AssumeRole action for the principal arn:aws:iam::111122223333:role/LambdaExecutionRole.

Answer

To allow the Lambda function to perform cross-account access, the developer must grant the sts:AssumeRole permission to the Lambda execution role in Account A and configure the target role in Account B to trust the Lambda execution role in Account A.

The correct configurations involve setting up both sides of the trust boundary. First, the calling role in Account A must be granted permission to perform the sts:AssumeRole action. Second, the trust policy of the target role in Account B must be updated to trust the calling role in Account A as the principal.

Step-by-Step Solution

Analyze the error message and the configuration requirements.

The error indicates that the Lambda execution role in Account A is not authorized to perform sts:AssumeRole on the cross-account role in Account B.

For cross-account role assumption to succeed, two permissions must match: the caller role must have a permission policy allowing sts:AssumeRole, and the destination role must have a trust policy allowing the caller role to assume it.

Configure the calling side (Account A).

Attach an IAM policy to the LambdaExecutionRole allowing the action sts:AssumeRole on the resource arn:aws:iam::444455556666:role/CrossAccountDynamoDBRole.

This grants the source role the necessary authorization to call the STS AssumeRole API.

Configure the receiving side (Account B).

Update the trust policy of CrossAccountDynamoDBRole to specify the ARN of the LambdaExecutionRole (arn:aws:iam::111122223333:role/LambdaExecutionRole) as the principal and allow sts:AssumeRole.

This establishes the trust relationship, allowing the principal from Account A to assume the role in Account B.

Key Concept

Cross-account IAM role assumption requires configuration on both the source account (identity policy permitting sts:AssumeRole) and the destination account (trust policy permitting the source identity).

Question 18Question →

A developer is setting up an AWS CodeDeploy deployment group for an in-place deployment of a web application to a fleet of Amazon EC2 instances. The deployment fails during the DownloadBundle phase because the CodeDeploy agent on the EC2 instances cannot access the deployment bundle in the Amazon S3 bucket. Additionally, the developer needs to store database credentials securely and retrieve them during the deployment process rather than packaging them in the deployment bundle.

Which two actions should the developer take to resolve these issues? (Select TWO.)

Select all that apply

Attach an IAM policy to the EC2 instance profile role that allows the s3:GetObject action on the S3 bucket containing the deployment bundle.

Store the database credentials as SecureString parameters in AWS Systems Manager Parameter Store, and write a script in the AppSpec BeforeInstall hook to retrieve them.

Attach an IAM policy to the CodeDeploy service role that allows the s3:GetObject action on the S3 bucket containing the deployment bundle.

Configure the trust policy of the CodeDeploy service role to allow the ec2.amazonaws.com service to assume the role.

Store the database credentials as plaintext parameters in AWS Systems Manager Parameter Store, and write a script in the AppSpec AfterAllowTraffic hook to retrieve them.

Show answer & explanation

Answer: Attach an IAM policy to the EC2 instance profile role that allows the s3:GetObject action on the S3 bucket containing the deployment bundle.; Store the database credentials as SecureString parameters in AWS Systems Manager Parameter Store, and write a script in the AppSpec BeforeInstall hook to retrieve them.

Answer

Attach an IAM policy to the EC2 instance profile role that allows the s3:GetObject action on the S3 bucket containing the deployment bundle, and store the database credentials as SecureString parameters in AWS Systems Manager Parameter Store, retrieving them in the AppSpec BeforeInstall hook.

The correct options involve configuring the EC2 instance profile role with the appropriate S3 read permissions so the CodeDeploy agent can download the bundle, and securely storing credentials in Systems Manager Parameter Store as SecureString parameters, retrieving them during a valid EC2 lifecycle hook like BeforeInstall.

Step-by-Step Solution

Analyze the cause of the CodeDeploy agent S3 access failure.

The agent runs on the EC2 instances and uses the instance profile role to download the deployment bundle. S3 permissions must be granted to the instance profile role, not the CodeDeploy service role.

Permissions must align with the identity executing the action, which is the CodeDeploy agent on EC2.

Determine the secure method and correct lifecycle hook for credential retrieval on EC2.

Store credentials as SecureString parameters in AWS Systems Manager Parameter Store and retrieve them using a lifecycle hook valid for EC2, such as BeforeInstall.

This avoids plaintext storage and uses a hook that is compatible with EC2 in-place deployments.

Key Concept

AWS CodeDeploy permissions and AppSpec configuration on EC2

Question 19Question →

An image processing application uses an Amazon SQS queue to trigger an AWS Lambda function that processes batch metadata and fetches external assets via HTTPS. The Lambda function is placed in a private VPC subnet to securely query an Amazon RDS PostgreSQL DB instance in the same VPC. During testing, the developer observes two issues: the Lambda function fails to connect to the external assets API, and several messages from the SQS queue are being processed multiple times, causing duplicate entries in the database. The Lambda function's timeout is set to $5$ minutes. Which two actions should the developer take to resolve these issues? (Select two.)

Select all that apply

Configure a NAT Gateway in a public subnet of the VPC, and add a route in the private subnet's route table pointing

0.0.0.0/0

traffic to the NAT Gateway.

Increase the visibility timeout of the Amazon SQS queue to at least

30

minutes, matching the recommended ratio of

6

times the Lambda function's timeout.

Assign a public IPv4 address to the Lambda function configuration and associate an Internet Gateway directly with the private subnet's route table.

Increase the Lambda function's timeout value to

30

minutes to allow the function more time to process the batch before the queue retrieves the message again.

Enable Provisioned Concurrency for the Lambda function and set the execution timeout to match the default SQS visibility timeout of

30

seconds.

Show answer & explanation

Answer: Configure a NAT Gateway in a public subnet of the VPC, and add a route in the private subnet's route table pointing $0.0.0.0/0$ traffic to the NAT Gateway.; Increase the visibility timeout of the Amazon SQS queue to at least $30$ minutes, matching the recommended ratio of $6$ times the Lambda function's timeout.

Answer

Configure a NAT Gateway in a public subnet of the VPC with a route for

0.0.0.0/0

in the private subnet's route table, and increase the SQS queue's visibility timeout to at least

30

minutes.

Configuring a NAT Gateway in a public subnet and updating the private subnet's route table ensures that the Lambda function can route outbound HTTPS requests to the internet. Concurrently, increasing the SQS visibility timeout to at least

6

times the Lambda timeout (

30

minutes for a

5

-minute Lambda timeout) prevents SQS from releasing messages back to the queue while the Lambda function is still processing them, thereby preventing duplicate processing.

Step-by-Step Solution

Analyze the network failure of the Lambda function when accessing the external HTTP API.

Identify that because the Lambda function is placed in a private subnet, it lacks internet access without an outbound gateway.

Lambda functions in private subnets require a NAT Gateway or NAT instance in a public subnet to route outbound internet traffic.

Resolve the VPC internet connectivity issue.

Create a NAT Gateway in a public subnet, and configure a route for

0.0.0.0/0

pointing to this NAT Gateway in the private subnet's route table.

This establishes internet egress for resources in the private subnet while keeping them protected from inbound public traffic.

Analyze the duplicate SQS message processing issue.

Identify that the Lambda function's timeout of

5

minutes is causing messages to exceed the default SQS visibility timeout (which defaults to

30

seconds) before completion.

When a message processing time exceeds the visibility timeout, the message becomes visible to other consumers, causing duplicates.

Adjust the SQS visibility timeout to align with AWS Lambda integration best practices.

Increase the visibility timeout of the SQS queue to

30

minutes, which is

6

times the Lambda function's timeout.

AWS recommends setting the SQS visibility timeout to at least

6

times the Lambda function's timeout to prevent duplicate deliveries and handle retries.

Key Concept

Configuring private subnet internet access for AWS Lambda and aligning SQS visibility timeouts with Lambda function execution limits.

Estimated Time:2m 0s

Question 20Question →

A developer is creating an AWS Lambda function that fetches metadata from an external third-party API and saves the results to an Amazon DynamoDB table. The external API requires an API key for authentication. The developer needs to optimize the function's performance by minimizing connection latency and ensuring the API key is secured according to AWS best practices.

Which two actions should the developer take to meet these requirements? (Select two.)

Select all that apply

Initialize the DynamoDB client and the HTTP client outside of the Lambda handler method.

Store the API key in AWS Secrets Manager, retrieve it using the AWS SDK inside the Lambda function, and cache the retrieved key in a global variable outside the handler.

Hardcode the API key in the Lambda function's source code and initialize the AWS SDK client inside the handler method.

Re-create the DynamoDB client and the HTTP connection inside the handler method for every invocation to ensure clean execution states.

Deploy the Lambda function in a private VPC subnet without configuring a NAT Gateway to isolate the traffic to the external API.

Show answer & explanation

Answer: Initialize the DynamoDB client and the HTTP client outside of the Lambda handler method.; Store the API key in AWS Secrets Manager, retrieve it using the AWS SDK inside the Lambda function, and cache the retrieved key in a global variable outside the handler.

Answer

Initialize the DynamoDB client and the HTTP client outside of the Lambda handler method, and store the API key in AWS Secrets Manager, retrieving and caching it in a global variable outside the handler.

Initializing database clients and HTTP clients outside the handler allows AWS Lambda to reuse these connections across warm invocations, significantly optimizing execution latency. Additionally, retrieving sensitive keys from AWS Secrets Manager programmatically and caching them in global variables ensures credentials are kept secure while preventing API call overhead on subsequent executions.

Step-by-Step Solution

Analyze performance optimization for database and external connections in Lambda.

Determine that SDK and HTTP clients should be initialized outside of the handler function.

This allows the function to reuse the execution context, including established TCP connections, across warm invocations, reducing latency.

Evaluate secure credential management options for the external API key.

Identify AWS Secrets Manager as the secure repository for the API key instead of hardcoding it in the source code.

Hardcoding credentials exposes secrets in source code repositories and makes key rotation difficult, violating AWS security best practices.

Optimize secret retrieval latency within the Lambda execution cycle.

Implement code to retrieve the secret and cache it in a global variable declared outside the handler.

Caching the secret ensures the Lambda function only calls the Secrets Manager service during cold starts, reducing latency and cost for subsequent warm starts.

Key Concept

AWS Lambda execution context reuse and secure credential management using AWS Secrets Manager.

Page 1 / 38Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept