Examkin

Development with AWS Services

505 questions

All types505Multiple choice258Multiple select247
Question 1Question →

A developer is configuring a serverless application where an AWS Lambda function processes messages from an Amazon SQS queue. The Lambda function must also query an Amazon RDS PostgreSQL database located in a private subnet of a VPC.

During testing, the developer observes two issues:
1. Messages are occasionally processed multiple times by the Lambda function, even though the executions complete successfully. The Lambda function's timeout is set to 60 seconds, and the SQS queue's visibility timeout is set to 30 seconds.
2. The Lambda function fails to establish a connection to the RDS database, resulting in connection timeout errors.

Which two actions should the developer take to resolve these issues? (Select two.)

Select all that apply

Show answer & explanation

Answer: Increase the visibility timeout of the Amazon SQS queue to at least 360 seconds.; Configure the Lambda function to connect to the VPC using the private subnets, and ensure that the Lambda function's security group allows outbound traffic to the database's security group.

Answer

To resolve the issues, increase the visibility timeout of the Amazon SQS queue to at least 360 seconds, and configure the Lambda function to connect to the VPC using the private subnets while ensuring the security group allows outbound traffic to the database's security group.
To resolve the duplicate processing issue, the visibility timeout of the SQS queue must be increased. AWS recommends setting it to at least 6 times the Lambda function's timeout (which is 60 seconds, so at least 360 seconds) to ensure that the message remains invisible to other consumers while Lambda processes it. To resolve the database connectivity issue, the Lambda function must be configured with VPC access using private subnets, and its security group must allow outbound traffic to the database's security group.

Step-by-Step Solution

1
Address the SQS message visibility timeout mismatch by increasing the visibility timeout of the queue to at least 360 seconds (6 times the Lambda function timeout of 60 seconds) to prevent messages from returning to the queue while Lambda is still processing them.
This resolves the issue of messages being processed multiple times due to the function execution duration exceeding the queue's visibility window.
AWS best practices dictate that the SQS visibility timeout should be configured to at least 6 times the Lambda function timeout to avoid duplicate processing and allow for retries.
2
Address the database connection timeout by configuring the Lambda function to access the VPC.
The Lambda function is associated with the private subnets of the VPC and receives Elastic Network Interfaces (ENIs).
To connect to resources in a private VPC subnet like RDS, the Lambda function must be configured with VPC access pointing to private subnets within that VPC.
3
Configure the security groups to allow communication between the Lambda function and the RDS instance.
The Lambda function's security group is allowed outbound access, and the RDS database's security group is configured to allow inbound traffic from the Lambda function's security group.
Network traffic must be explicitly allowed by security groups at both the source (Lambda) and destination (RDS) to establish a successful database connection.

Key Concept

AWS Lambda integration with Amazon SQS and VPC resources requires proper alignment of SQS visibility timeouts with Lambda timeouts, as well as correct VPC and security group configuration.
Question 2Question →

A developer is building a logistics tracking application that stores package delivery status updates in an Amazon DynamoDB table. The table has a partition key of `PackageID` and a sort key of `StatusTimestamp`. The application needs to retrieve all delivery status updates for a specific `PackageID` that occurred within the last 2424 hours. The results must be returned starting with the most recent update first.

Which two actions should the developer take to meet these requirements with the lowest latency and minimal Read Capacity Unit (RCU) consumption? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Use the `Query` API operation with a key condition expression specifying the `PackageID` and a range comparison on `StatusTimestamp`.; Set the `ScanIndexForward` parameter to `false` in the API request.

Answer

Use the `Query` API operation with a key condition expression on the partition key and sort key, and set the `ScanIndexForward` parameter to `false` in the API request.
To retrieve items sharing the same partition key (`PackageID`) efficiently, the `Query` API operation should be used. The query can filter results by the sort key (`StatusTimestamp`) directly in the key condition expression, which consumes Read Capacity Units (RCUs) only for the items that match the criteria. By default, DynamoDB returns query results in ascending order of the sort key. Setting the `ScanIndexForward` parameter to `false` reverses this order, returning the most recent updates first.

Step-by-Step Solution

1
Determine the appropriate API operation for retrieving data with a known partition key.
Select the `Query` API operation rather than `Scan`.
A `Query` operation directly accesses the partition and filters by sort key efficiently, minimizing RCU consumption, whereas a `Scan` reads the entire table.
2
Configure the sorting order of the returned items.
Set the `ScanIndexForward` parameter to `false`.
DynamoDB sorts query results in ascending order of the sort key by default. Setting `ScanIndexForward` to `false` reverses the order to descending, returning the most recent items first.

Key Concept

Optimizing read operations in Amazon DynamoDB using Query instead of Scan and controlling sort order via ScanIndexForward.
Question 3Question →

A healthcare startup collects continuous heart rate data from thousands of wearable medical patches. The patches stream telemetry data to an Amazon Kinesis Data Stream that has 1212 shards. The stream is experiencing periodic `ProvisionedThroughputExceededException` errors during peak hours, and analysis reveals that a single shard is receiving over 80%80\% of the traffic because the developer chose `device_manufacturer` as the partition key. Which of the following changes to the partition key should the developer implement to resolve the throttling and distribute the load evenly across all shards?

Show answer & explanation

Answer: Change the partition key to a high-entropy value such as a combination of device_id and the telemetry timestamp.

Answer

Change the partition key to a high-entropy value such as a combination of device_id and the telemetry timestamp.
The correct answer resolves partition hotness by switching to a key with high entropy. By combining the unique device identifier with the event timestamp, the developer ensures a uniform distribution of hashed keys across the 1212 shards, mitigating ProvisionedThroughputExceededException errors.

Step-by-Step Solution

1
Analyze the distribution of records across the Kinesis shards.
Identify that the current key (device_manufacturer) has low entropy, resulting in a hot shard receiving 80%80\% of the data stream traffic.
Uneven write distribution is the primary cause of ProvisionedThroughputExceededException errors when overall capacity is sufficient but partition key cardinality is low.
2
Select a partition key strategy with high cardinality.
Choose a key combining device_id and the telemetry timestamp, which provides high entropy.
A high-entropy partition key ensures that the MD5 hashing algorithm evenly hashes payloads across the 1212 available shards, maximizing write throughput.

Key Concept

Selecting high-entropy partition keys to prevent hot shards in Kinesis Data Streams.

Alternative Method

Using an explicit hash key (ExplicitHashKey) in the PutRecord/PutRecords API calls to directly assign records to specific shards.
Estimated Time:1m 30s
Question 4Question →

A developer is building a video streaming application that publishes user engagement events to an Amazon Kinesis Data Stream. An AWS Lambda function processes these events in batches. For specific events, such as 'UpgradeAccount', the Lambda function must publish a message to an Amazon EventBridge custom event bus to trigger downstream provisioning workflows.

During high-load testing, the developer observes two issues:
1. The Lambda function frequently runs out of time while processing batches of events.
2. The Lambda function fails to publish events to the EventBridge custom event bus, receiving an AccessDeniedException.

Which combination of actions should the developer take to resolve these issues? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Decrease the BatchSize parameter of the Lambda event source mapping and ensure the Lambda function's timeout is set appropriately.; Attach an IAM policy to the Lambda function's execution role that grants the events:PutEvents permission for the EventBridge event bus resource.

Answer

Decrease the BatchSize parameter of the Lambda event source mapping and ensure the Lambda function's timeout is set appropriately; and attach an IAM policy to the Lambda function's execution role that grants the events:PutEvents permission for the EventBridge event bus resource.
To resolve the batch timeout, decreasing the BatchSize limits the payload volume per invocation, ensuring the Lambda function can complete execution within its timeout limits. To resolve the AccessDeniedException, the Lambda function's execution role must be granted the events:PutEvents permission, enabling it to write messages to the EventBridge custom event bus.

Step-by-Step Solution

1
Address the Lambda batch execution timeout.
By reducing the BatchSize parameter in the Event Source Mapping, the Lambda function receives fewer records per invocation. This directly reduces the processing time per batch, preventing execution timeouts.
Kinesis streams push batches of records to Lambda, and processing too many large records in a single invocation can exceed the configured Lambda timeout.
2
Resolve the EventBridge AccessDeniedException authorization error.
An IAM policy must be attached to the Lambda execution role granting 'events:PutEvents' for the target EventBridge custom event bus.
AWS services interact using IAM. The Lambda function acts as the caller and requires explicit permissions to call the PutEvents API on the destination EventBridge event bus.

Key Concept

Stream processing tuning with Lambda batch settings and secure event routing to EventBridge via IAM permissions.
Estimated Time:2m 0s
Question 5Question →

A developer is designing a flight booking platform where reservation records are stored in an Amazon DynamoDB table. The table's partition key is `ReservationID`. The application needs to retrieve all reservations for a specific `FlightID` that currently have a `ReservationStatus` of 'Pending'. The solution must be highly efficient, minimize read latency, and avoid unnecessary read capacity consumption. Which two actions should the developer take to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Create a Global Secondary Index (GSI) with FlightID as the partition key and ReservationStatus as the sort key.; Perform a Query operation on the GSI using a key condition expression to specify the FlightID and ReservationStatus.

Answer

To retrieve the pending reservations efficiently, the developer must create a Global Secondary Index (GSI) with FlightID as the partition key and ReservationStatus as the sort key, and then perform a Query operation on this GSI.
To retrieve items efficiently using attributes other than the base table's partition key, a Global Secondary Index (GSI) must be created. Setting FlightID as the partition key and ReservationStatus as the sort key of the GSI allows direct querying. Performing a Query operation on this GSI with a key condition expression retrieves only the matching items, minimizing latency and RCU consumption.

Step-by-Step Solution

1
Analyze the table's primary key and the query requirements.
The table's partition key is ReservationID, but the query requires filtering by FlightID and ReservationStatus, which are non-key attributes in the base table.
DynamoDB does not allow direct Query operations on non-key attributes without an index.
2
Select the appropriate indexing strategy.
Create a Global Secondary Index (GSI) with FlightID as the partition key and ReservationStatus as the sort key.
A GSI allows querying across partition keys different from the base table, enabling direct lookups by FlightID.
3
Execute the retrieval operation.
Perform a Query operation on the GSI with a key condition expression.
Querying is more efficient than scanning because it only consumes capacity units for the matching items.

Key Concept

Using Global Secondary Indexes (GSIs) to perform efficient Query operations instead of Scan operations on non-key attributes in Amazon DynamoDB.
Estimated Time:2m 0s
Question 6Question →

A developer is designing a real-time multiplayer game event processor. The game client sends player match telemetry (including player ID, match ID, action type, and score) to an Amazon Kinesis Data Stream. The developer must ensure that events for the same match are processed in the strict order they occurred by the consumer. In addition, the consumer, an AWS Lambda function running in a virtual private cloud (VPC), must query an external SaaS security endpoint over the internet to check for anomalous player behavior.

Which two actions should the developer take to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Use the match ID as the partition key when publishing events to the Amazon Kinesis Data Stream.; Deploy the Lambda function in the private subnets of the VPC, and route outbound internet traffic through a NAT Gateway located in a public subnet.

Answer

Use the match ID as the partition key when publishing events to the Amazon Kinesis Data Stream, and deploy the Lambda function in the private subnets of the VPC, routing outbound internet traffic through a NAT Gateway located in a public subnet.
To achieve strict event ordering for each match, the events must be sent to the same shard of the Kinesis Data Stream. This is done by selecting a partition key with sufficient cardinality that groups related events, such as the match ID. For the Lambda consumer in a VPC to access an external SaaS endpoint over the internet, it must be placed in private subnets, with its outbound traffic routed to a NAT Gateway in a public subnet. Lambda functions inside a VPC cannot directly use an Internet Gateway or a public IP address.

Step-by-Step Solution

1
Ensure in-order processing of match events by using the match ID as the partition key.
Events with the same match ID are hashed to the same shard of the Kinesis Data Stream, preserving their relative ordering during consumption.
Kinesis guarantees order preservation only within a single shard. Assigning the match ID as the partition key maps all events of that match to the same shard.
2
Configure the Lambda function inside private subnets of the VPC and set up a NAT Gateway in a public subnet.
The Lambda function can communicate with the external SaaS security endpoint over the internet.
Lambda functions deployed in a VPC do not receive public IP addresses. To access the internet, their traffic must be routed from private subnets through a NAT Gateway in a public subnet that has an Internet Gateway route.

Key Concept

Configuring partition keys in Kinesis Data Streams for order preservation and setting up NAT Gateways for Lambda VPC outbound connectivity.
Estimated Time:1m 30s
Question 7Question →

A developer is deploying a Java application to an Amazon ECS cluster running on AWS Fargate. The application uses the AWS SDK for Java to write logs to an Amazon CloudWatch Logs group. The ECS task is configured with an IAM task role that has the necessary permissions to write to CloudWatch. However, the container definition also contains the environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, which contain temporary credentials used during a previous CI/CD test run. When the application runs, it fails to write logs and throws an ExpiredTokenException. Which action should the developer take to resolve this issue?

Show answer & explanation

Answer: Remove the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables from the ECS container definition.

Answer

Remove the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables from the ECS container definition.
The correct answer is to remove the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables from the ECS container definition. In the AWS SDK default credential provider chain, environment variables have higher precedence than ECS container credentials. If these environment variables are set (even with expired credentials), the SDK will attempt to use them, resulting in an ExpiredTokenException. Removing them allows the SDK chain to fall back to the ECS container credentials provider, which retrieves the credentials associated with the ECS task role.

Step-by-Step Solution

1
Analyze the AWS SDK default credential provider chain precedence.
The SDK checks environment variables (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) before it checks the container credentials provider.
Understanding the order of precedence in the SDK is necessary to identify why the expired credentials in the environment variables are being selected over the valid task role.
2
Identify the root cause of the ExpiredTokenException.
The environment variables contain expired temporary credentials, which block the SDK from reaching the container credentials provider.
Since the environment variables are set, the SDK uses them and fails immediately rather than falling back to the task role credentials.
3
Determine the resolution method.
Remove the expired credential environment variables from the container configuration.
By removing these environment variables, the default credential provider chain will successfully fall back to the ECS task role credentials retrieved from the container metadata URI.

Key Concept

AWS SDK Default Credential Provider Chain Precedence
Question 8Question →

A developer is configuring an AWS Lambda function inside a private subnet of a custom VPC to process messages from an Amazon SQS queue. The Lambda function must read database credentials from AWS Secrets Manager and write the processed results to an Amazon DynamoDB table. To satisfy security requirements, the VPC has no internet access, and all traffic must remain within the AWS network.

The developer creates a Gateway VPC endpoint for DynamoDB and an Interface VPC endpoint for Secrets Manager. However, when the Lambda function runs, it fails with connection timeout errors when attempting to access both DynamoDB and Secrets Manager.

Which combination of actions will resolve these connection timeouts? (Select two.)

Select all that apply

Show answer & explanation

Answer: Update the route table associated with the Lambda function's private subnet to include a route that targets the DynamoDB Gateway VPC endpoint for the DynamoDB prefix list.; Modify the security group associated with the Secrets Manager Interface VPC endpoint to allow inbound HTTPS traffic on port 443 from the security group associated with the Lambda function.

Answer

Update the route table associated with the Lambda function's private subnet to include a route that targets the DynamoDB Gateway VPC endpoint for the DynamoDB prefix list, and modify the security group associated with the Secrets Manager Interface VPC endpoint to allow inbound HTTPS traffic on port 443 from the security group associated with the Lambda function.
To resolve connection timeouts inside a private VPC with no internet access, the developer must properly configure the networking and security rules for the VPC endpoints. For the DynamoDB Gateway endpoint, a route must be added to the subnet's route table targeting the DynamoDB prefix list. For the Secrets Manager Interface endpoint, which uses ENIs, the endpoint's security group must be configured to accept inbound HTTPS (port 443) connections from the Lambda function's security group.

Step-by-Step Solution

1
Identify the cause of the DynamoDB timeout.
Determine that DynamoDB is accessed via a Gateway VPC endpoint.
Gateway endpoints require explicit routes in the subnet's route table to direct traffic to the service.
2
Resolve the DynamoDB configuration issue.
Add a route in the private subnet's route table pointing to the DynamoDB prefix list with the Gateway endpoint ID as the target.
This enables the VPC router to forward DynamoDB-bound traffic through the Gateway endpoint.
3
Identify the cause of the Secrets Manager timeout.
Determine that Secrets Manager is accessed via an Interface VPC endpoint.
Interface endpoints use Elastic Network Interfaces (ENIs) with security groups, which require appropriate inbound permissions.
4
Resolve the Secrets Manager configuration issue.
Configure the security group of the Secrets Manager Interface endpoint to allow inbound HTTPS (port 443) traffic from the security group of the Lambda function.
This allows the inbound connection from the Lambda function's ENI to the endpoint's ENI.

Key Concept

AWS Lambda VPC networking using Gateway and Interface VPC endpoints
Estimated Time:3m 0s
Question 9Question →

A developer is migrating a backend AWS Lambda function from a Lambda custom (non-proxy) integration to a Lambda proxy integration on an Amazon API Gateway REST API. Under the custom integration, the Lambda function received a pre-mapped JSON payload containing query parameters and headers, and it returned a simple JSON object:

`{ "status": "success", "data": { "userId": 101 } }`

After configuring the API Gateway to use Lambda Proxy Integration, clients receive a 502 Bad Gateway error on all API requests. Additionally, the Lambda function execution logs show errors indicating that the incoming event format is unexpected.

Which of the following modifications must the developer make to resolve these errors?

Show answer & explanation

Answer: Modify the Lambda function to parse the incoming request body from the event.body property, and update the function's return statement to return a JSON object with statusCode and a stringified JSON body.

Answer

Modify the Lambda function to parse the incoming request body from the event.body property, and update the function's return statement to return a JSON object with statusCode and a stringified JSON body.
The correct option is to modify the Lambda function to parse the incoming request body from the event.body property and return a JSON object with statusCode and a stringified JSON body. This is because Lambda proxy integration passes the entire HTTP request wrapper where the request body is stringified, and requires the response to conform strictly to a response format containing statusCode and body fields.

Step-by-Step Solution

1
Understand the difference between Lambda custom integration and Lambda proxy integration input events.
In custom integrations, API Gateway maps parameters and payload before invoking Lambda. In proxy integrations, API Gateway passes the raw request inside an event object, where the body is a stringified JSON in the event.body property.
This explains why the Lambda function logged unexpected event format errors after the integration type was changed to proxy.
2
Understand the difference in response expectations for Lambda proxy integration.
Lambda proxy integration requires the backend function to return a specific JSON response containing at least statusCode (an integer) and body (a string representing the response payload).
If the backend returns a custom JSON object or a raw string instead of this expected format, API Gateway cannot parse it and yields a 502 Bad Gateway error.
3
Implement code changes in the Lambda function to parse the input and format the output correctly.
The function parses event.body for incoming parameters and returns an object such as { statusCode: 200, body: JSON.stringify({ status: 'success', data: { userId: 101 } }) }.
This matches the input and output requirements for Lambda proxy integration and resolves both the execution logs error and the 502 Bad Gateway response.

Key Concept

The primary difference in payload structure and response contract between API Gateway Lambda Proxy and Lambda Custom (non-proxy) integrations.
Estimated Time:2m 0s
Question 10Question →

A company is developing a desktop-based administration client that must allow authenticated internal users to upload system logs directly to a secure Amazon S3 bucket. The developer wants to manage user registration, sign-in, and password recovery natively within the client, while ensuring that the desktop application receives temporary, limited-privilege AWS credentials to perform the S3 uploads without embedding long-term AWS access keys.

Which architecture should the developer implement to meet these requirements?

Show answer & explanation

Answer: Use an Amazon Cognito User Pool to manage user authentication, and use an Amazon Cognito Identity Pool to exchange the User Pool identity tokens for temporary AWS IAM credentials that authorize writing to the Amazon S3 bucket.

Answer

Use an Amazon Cognito User Pool to manage user authentication, and use an Amazon Cognito Identity Pool to exchange the User Pool identity tokens for temporary AWS IAM credentials that authorize writing to the Amazon S3 bucket.
The correct architecture uses a Cognito User Pool to authenticate the desktop client users (handling registration, login, etc.) and generate JWT identity tokens. The client then passes this token to a Cognito Identity Pool, which validates it and returns temporary, restricted AWS IAM credentials. The desktop client can then use these credentials to upload files directly to S3.

Step-by-Step Solution

1
Configure an Amazon Cognito User Pool.
Creates a user directory that handles user sign-up, sign-in, password reset, and produces JWT tokens (ID, Access, and Refresh tokens) upon successful authentication.
Required to handle native user authentication and directory management.
2
Configure an Amazon Cognito Identity Pool (Federated Identities) and associate it with the User Pool as an identity provider.
Allows the application to exchange the ID token issued by the User Pool for temporary AWS credentials.
Provides the mechanism to federate Cognito User Pool users into AWS IAM roles.
3
Define an IAM Role for authenticated users with a trust policy for Cognito Identity Pools and a permissions policy allowing S3 put-object actions.
Ensures that users mapped by the Identity Pool receive credentials scoped strictly to write to the designated S3 bucket.
Enforces least-privilege access for the S3 bucket operations.

Key Concept

Amazon Cognito User Pools vs Identity Pools
Question 11Question →

A developer is deploying a critical update to a serverless API backend running on AWS Lambda. The application handles high-velocity flash sales where traffic spikes instantly. To eliminate cold start latencies, the developer configures Provisioned Concurrency for the Lambda function. The API backend is integrated with an Amazon API Gateway HTTP API.

During deployment, the developer uploads the new function code, publishes Version 22 of the function, and associates Provisioned Concurrency with Version 22. However, when testing the API Gateway endpoint that routes traffic to the function using the LATEST\text{LATEST} identifier, clients still experience significant cold start latencies, and CloudWatch metrics show that the provisioned concurrency is not being utilized.

What should the developer do to ensure that the API Gateway endpoint utilizes the provisioned concurrency?

Show answer & explanation

Answer: Update the API Gateway integration to target a specific Lambda alias or a published function version that has Provisioned Concurrency configured, rather than targeting the LATEST\text{LATEST} identifier.

Answer

Update the API Gateway integration to target a specific Lambda alias or a published function version that has Provisioned Concurrency configured, rather than targeting the LATEST\text{LATEST} identifier.
Provisioned Concurrency initializes a specified number of execution environments so that they are prepared to respond immediately to your function's invocations. However, AWS Lambda does not allow you to configure Provisioned Concurrency on the LATEST\text{LATEST} version of a function, and any invocations that target the LATEST\text{LATEST} identifier directly or through an alias pointing to LATEST\text{LATEST} will not utilize provisioned concurrency. Therefore, the API Gateway integration must be updated to target a published version or an alias pointing to a published version (such as Version 22) that has Provisioned Concurrency configured.

Step-by-Step Solution

1
Analyze the invocation path of the AWS Lambda function from API Gateway.
Identify that the API Gateway endpoint targets the LATEST\text{LATEST} identifier of the Lambda function.
To determine why the configured Provisioned Concurrency is not being utilized during invocation.
2
Review the AWS Lambda Provisioned Concurrency specifications and restrictions.
Understand that Provisioned Concurrency cannot be associated with or invoked through the LATEST\text{LATEST} identifier; it must be mapped to a specific published version or alias.
To identify the root cause of the cold start latency despite configuration.
3
Modify the routing configuration of the API Gateway and the Lambda function targeting.
Update the API Gateway integration target to point to a Lambda alias (e.g., pointing to Version 22) or directly to Version 22, which has Provisioned Concurrency active.
To route incoming API Gateway traffic to the pre-warmed execution environments.

Key Concept

AWS Lambda Provisioned Concurrency Routing and Versioning Rules
Estimated Time:2m 0s
Question 12Question →

A team of developers is deploying a backend processing application. An AWS Lambda function is configured to run inside a private VPC subnet to securely query an Amazon RDS PostgreSQL database located in another private subnet. The function must also download configuration files from Amazon S3 and make HTTP POST requests to an external, third-party payment processing API on the public internet. Which network configuration should the developer implement to enable these connections while minimizing data transfer costs and maintaining a secure architecture?

Show answer & explanation

Answer: Deploy the Lambda function in the private subnets. Create a Gateway VPC Endpoint for Amazon S3, and configure a NAT Gateway in a public subnet to route outbound traffic to the public internet.

Answer

Deploy the Lambda function in the private subnets, configure a Gateway VPC Endpoint for Amazon S3, and deploy a NAT Gateway in a public subnet to route outbound public internet traffic.
Deploying the Lambda function in private subnets allows it to access the private RDS database securely. Using a Gateway VPC Endpoint for S3 is a cost-effective choice since Gateway Endpoints do not incur hourly or data processing charges, unlike Interface Endpoints. A NAT Gateway deployed in a public subnet is required to route outbound public internet traffic for the Lambda function in the private subnet.

Step-by-Step Solution

1
Analyze the destination targets and security requirements.
The RDS database is private (requires private subnet association), S3 is an AWS service (can use a VPC endpoint), and the payment API is on the public internet (requires a NAT Gateway or NAT instance for private resources).
To determine the networking components needed for the VPC.
2
Determine the most cost-effective and secure way to access Amazon S3.
A Gateway VPC Endpoint is free and routes traffic directly to S3 without going through the NAT Gateway, saving data processing fees.
To minimize data transfer costs as requested.
3
Configure the route table for the private subnets where the Lambda function resides.
Add a route directing 0.0.0.0/00.0.0.0/0 traffic to the NAT Gateway in the public subnet.
To enable outbound internet access to the payment gateway API.

Key Concept

VPC networking for AWS Lambda, including NAT Gateway and VPC Endpoints.
Estimated Time:1m 30s
Question 13Question →

An image processing application uses an Amazon SQS queue to trigger an AWS Lambda function that processes batch metadata and fetches external assets via HTTPS. The Lambda function is placed in a private VPC subnet to securely query an Amazon RDS PostgreSQL DB instance in the same VPC. During testing, the developer observes two issues: the Lambda function fails to connect to the external assets API, and several messages from the SQS queue are being processed multiple times, causing duplicate entries in the database. The Lambda function's timeout is set to 55 minutes. Which two actions should the developer take to resolve these issues? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure a NAT Gateway in a public subnet of the VPC, and add a route in the private subnet's route table pointing 0.0.0.0/00.0.0.0/0 traffic to the NAT Gateway.; Increase the visibility timeout of the Amazon SQS queue to at least 3030 minutes, matching the recommended ratio of 66 times the Lambda function's timeout.

Answer

Configure a NAT Gateway in a public subnet of the VPC with a route for 0.0.0.0/00.0.0.0/0 in the private subnet's route table, and increase the SQS queue's visibility timeout to at least 3030 minutes.
Configuring a NAT Gateway in a public subnet and updating the private subnet's route table ensures that the Lambda function can route outbound HTTPS requests to the internet. Concurrently, increasing the SQS visibility timeout to at least 66 times the Lambda timeout (3030 minutes for a 55-minute Lambda timeout) prevents SQS from releasing messages back to the queue while the Lambda function is still processing them, thereby preventing duplicate processing.

Step-by-Step Solution

1
Analyze the network failure of the Lambda function when accessing the external HTTP API.
Identify that because the Lambda function is placed in a private subnet, it lacks internet access without an outbound gateway.
Lambda functions in private subnets require a NAT Gateway or NAT instance in a public subnet to route outbound internet traffic.
2
Resolve the VPC internet connectivity issue.
Create a NAT Gateway in a public subnet, and configure a route for 0.0.0.0/00.0.0.0/0 pointing to this NAT Gateway in the private subnet's route table.
This establishes internet egress for resources in the private subnet while keeping them protected from inbound public traffic.
3
Analyze the duplicate SQS message processing issue.
Identify that the Lambda function's timeout of 55 minutes is causing messages to exceed the default SQS visibility timeout (which defaults to 3030 seconds) before completion.
When a message processing time exceeds the visibility timeout, the message becomes visible to other consumers, causing duplicates.
4
Adjust the SQS visibility timeout to align with AWS Lambda integration best practices.
Increase the visibility timeout of the SQS queue to 3030 minutes, which is 66 times the Lambda function's timeout.
AWS recommends setting the SQS visibility timeout to at least 66 times the Lambda function's timeout to prevent duplicate deliveries and handle retries.

Key Concept

Configuring private subnet internet access for AWS Lambda and aligning SQS visibility timeouts with Lambda function execution limits.
Estimated Time:2m 0s
Question 14Question →

A developer is creating an AWS Lambda function that fetches metadata from an external third-party API and saves the results to an Amazon DynamoDB table. The external API requires an API key for authentication. The developer needs to optimize the function's performance by minimizing connection latency and ensuring the API key is secured according to AWS best practices.

Which two actions should the developer take to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Initialize the DynamoDB client and the HTTP client outside of the Lambda handler method.; Store the API key in AWS Secrets Manager, retrieve it using the AWS SDK inside the Lambda function, and cache the retrieved key in a global variable outside the handler.

Answer

Initialize the DynamoDB client and the HTTP client outside of the Lambda handler method, and store the API key in AWS Secrets Manager, retrieving and caching it in a global variable outside the handler.
Initializing database clients and HTTP clients outside the handler allows AWS Lambda to reuse these connections across warm invocations, significantly optimizing execution latency. Additionally, retrieving sensitive keys from AWS Secrets Manager programmatically and caching them in global variables ensures credentials are kept secure while preventing API call overhead on subsequent executions.

Step-by-Step Solution

1
Analyze performance optimization for database and external connections in Lambda.
Determine that SDK and HTTP clients should be initialized outside of the handler function.
This allows the function to reuse the execution context, including established TCP connections, across warm invocations, reducing latency.
2
Evaluate secure credential management options for the external API key.
Identify AWS Secrets Manager as the secure repository for the API key instead of hardcoding it in the source code.
Hardcoding credentials exposes secrets in source code repositories and makes key rotation difficult, violating AWS security best practices.
3
Optimize secret retrieval latency within the Lambda execution cycle.
Implement code to retrieve the secret and cache it in a global variable declared outside the handler.
Caching the secret ensures the Lambda function only calls the Secrets Manager service during cold starts, reducing latency and cost for subsequent warm starts.

Key Concept

AWS Lambda execution context reuse and secure credential management using AWS Secrets Manager.
Question 15Question →

A developer is designing a real-time inventory management microservice that uses an Amazon DynamoDB table. The application needs to support the following operations during peak traffic:

* 1010 `TransactWriteItems` operations per second. Each transaction contains two write actions: one writes a new item of 3.5 KB3.5\text{ KB}, and another updates an existing item resulting in a final size of 1.5 KB1.5\text{ KB}.
* 1515 standard `PutItem` operations per second, with an average item size of 4.5 KB4.5\text{ KB}.
* 4040 `TransactGetItems` operations per second. Each transaction reads a single item of 6 KB6\text{ KB}.

To ensure optimal performance, scalability, and security under the AWS shared responsibility model, which capacity provisioning and development strategy should the developer implement?

Show answer & explanation

Answer: Provision 195195 Write Capacity Units (WCUs) and 160160 Read Capacity Units (RCUs). Configure the application to use the default credential provider chain and retrieve items using Query or TransactGetItems operations instead of Scan.

Answer

Provision 195195 Write Capacity Units (WCUs) and 160160 Read Capacity Units (RCUs). Configure the application to use the default credential provider chain and retrieve items using Query or TransactGetItems operations instead of Scan.
The correct strategy provisions 195195 WCUs and 160160 RCUs, uses the default credential provider chain for secure authentication, and retrieves specific items efficiently via Query or TransactGetItems instead of Scan. The Write Capacity Unit (WCU) calculation is as follows: The TransactWriteItems workload consists of 1010 operations/second. Each operation has two write actions: a new item of 3.5 KB3.5\text{ KB} (rounded up to 4 KB4\text{ KB}, costing 4 WCUs×24\text{ WCUs} \times 2 for transactional writes = 8 WCUs8\text{ WCUs}) and an update resulting in a 1.5 KB1.5\text{ KB} item (rounded up to 2 KB2\text{ KB}, costing 2 WCUs×22\text{ WCUs} \times 2 for transactional writes = 4 WCUs4\text{ WCUs}). This totals 12 WCUs12\text{ WCUs} per transaction, or 120 WCUs120\text{ WCUs} for 1010 transactions/second. The standard PutItem workload consists of 1515 operations/second of 4.5 KB4.5\text{ KB} (rounded up to 5 KB5\text{ KB}, costing 5 WCUs5\text{ WCUs}). This consumes 75 WCUs75\text{ WCUs}. Summing these values gives 195 WCUs195\text{ WCUs}. The Read Capacity Unit (RCU) calculation is as follows: The TransactGetItems workload consists of 4040 operations/second. Each transaction reads one 6 KB6\text{ KB} item (rounded up to the nearest 4 KB4\text{ KB} boundary, which is 8 KB8\text{ KB}, consuming 2 RCUs2\text{ RCUs}). Since transactional reads consume double the RCUs of strongly consistent reads, each transaction costs 4 RCUs4\text{ RCUs}, totaling 160 RCUs160\text{ RCUs} for 4040 operations/second.

Step-by-Step Solution

1
Calculate the Write Capacity Units (WCUs) required for the 1010 TransactWriteItems operations per second.
120120 WCUs
Each transaction contains two write actions. Action 1 (3.5 KB3.5\text{ KB}) is rounded up to 4 KB4\text{ KB} and multiplied by 22 for transaction writes, yielding 8 WCUs8\text{ WCUs}. Action 2 (1.5 KB1.5\text{ KB}) is rounded up to 2 KB2\text{ KB} and multiplied by 22, yielding 4 WCUs4\text{ WCUs}. Total per transaction is 12 WCUs12\text{ WCUs}. For 10 operations/sec10\text{ operations/sec}, this consumes 10×12=120 WCUs10 \times 12 = 120\text{ WCUs}.
2
Calculate the WCUs required for the 1515 standard PutItem operations per second.
7575 WCUs
Each standard write of 4.5 KB4.5\text{ KB} is rounded up to 5 KB5\text{ KB} and consumes 5 WCUs5\text{ WCUs}. For 15 operations/sec15\text{ operations/sec}, this consumes 15×5=75 WCUs15 \times 5 = 75\text{ WCUs}.
3
Sum the WCU requirements to find the total provisioned WCU.
195195 WCUs
Combining the transactional writes (120 WCUs120\text{ WCUs}) and standard writes (75 WCUs75\text{ WCUs}) yields a total required write capacity of 195 WCUs195\text{ WCUs}.
4
Calculate the Read Capacity Units (RCUs) required for the 4040 TransactGetItems operations per second.
160160 RCUs
Transactional reads are strongly consistent and consume double the capacity of standard strongly consistent reads. Reading a 6 KB6\text{ KB} item requires rounding up to the nearest 4 KB4\text{ KB} boundary (8 KB8\text{ KB}), consuming 2 RCUs2\text{ RCUs} for a standard strongly consistent read. Doubling this for the transaction results in 4 RCUs4\text{ RCUs} per operation. For 40 operations/sec40\text{ operations/sec}, this consumes 40×4=160 RCUs40 \times 4 = 160\text{ RCUs}.
5
Evaluate the architectural and security configurations.
Use the default credential provider chain and query/retrieve items directly rather than scanning.
Hardcoding credentials violates security best practices, and using Scan operations instead of Query or specific read APIs is highly inefficient and consumes excess RCUs.

Key Concept

DynamoDB capacity calculation for transactional and standard operations combined with security and query optimization
Estimated Time:3m 0s
Question 16Question →

A developer is designing a REST API in Amazon API Gateway to serve as a backend for a mobile application. The API must validate user identity tokens issued by Amazon Cognito User Pools. Once authenticated, the requests must be routed to an AWS Lambda function. To minimize custom code maintenance, execution overhead, and configuration complexity, the developer wants to avoid writing custom request mapping templates or token validation code in API Gateway. Which TWO actions should the developer take to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Configure a Cognito User Pool Authorizer on the API Gateway method.; Use Lambda Proxy Integration for the integration request configuration.

Answer

Configure a Cognito User Pool Authorizer on the API Gateway method and use Lambda Proxy Integration for the integration request configuration.
The correct options are configuring a Cognito User Pool Authorizer and using Lambda Proxy Integration. A Cognito User Pool Authorizer allows API Gateway to automatically validate identity tokens issued by Amazon Cognito without writing custom validation code. Lambda Proxy Integration passes the raw client request details directly to the backend Lambda function, eliminating the need to write and maintain Velocity Template Language (VTL) mapping templates in API Gateway.

Step-by-Step Solution

1
Select the authentication mechanism that minimizes custom code for Cognito validation.
Identify that the Cognito User Pool Authorizer is built directly into API Gateway and handles JWT token verification natively, whereas a custom Lambda Authorizer requires custom code development and maintenance.
This meets the constraint of avoiding custom token validation code.
2
Select the integration type that avoids custom mapping templates.
Identify that Lambda Proxy Integration automatically passes the entire HTTP request structure directly to Lambda in a standardized format, whereas Lambda Custom Integration requires writing VTL templates to map query parameters, headers, and payloads.
This meets the constraint of avoiding custom request mapping templates.

Key Concept

API Gateway offers native integrations and authentication mechanisms to reduce code overhead, including Cognito User Pool Authorizers and Lambda Proxy Integrations.
Question 17Question →

A developer is building a serverless integration where an AWS Lambda function with a timeout of 1010 seconds processes messages from an Amazon SQS FIFO queue containing inventory updates. The system must guarantee that updates for the same product are processed in the order they are received, and messages should not be processed multiple times due to timeout discrepancies.

Which of the following configurations should the developer implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Set the MessageGroupId of each message to the product ID to ensure sequential processing per product.; Set the SQS queue's visibility timeout to 6060 seconds or more to align with the Lambda function's timeout.

Answer

Setting the MessageGroupId to the product ID and configuring the SQS queue's visibility timeout to 6060 seconds or more.
To guarantee sequential processing of messages for the same product, the messages must belong to the same message group, which is achieved by setting the MessageGroupId parameter to the product ID. Additionally, to prevent duplicate message processing when integrating SQS with AWS Lambda, the queue's visibility timeout must be configured to at least 66 times the Lambda function's timeout. Since the Lambda function has a timeout of 1010 seconds, the visibility timeout must be set to 6060 seconds or more.

Step-by-Step Solution

1
Determine the parameter required for message ordering in Amazon SQS FIFO queues.
Identify that the MessageGroupId parameter must be set to group related messages (e.g., by product ID) for sequential processing.
SQS FIFO queues guarantee in-order delivery within a message group, so setting the MessageGroupId to the product ID ensures updates for that product are processed sequentially.
2
Calculate the recommended SQS visibility timeout based on the Lambda function timeout.
Multiply the 1010-second Lambda timeout by 66, yielding 6060 seconds.
AWS Lambda best practices recommend setting the SQS queue's visibility timeout to at least 66 times the function's timeout to prevent concurrent processing of the same message during retries or delays.

Key Concept

Configuring SQS FIFO queues and visibility timeouts for reliable AWS Lambda integration.
Estimated Time:1m 30s
Question 18Question →

A developer is designing an integration for an IoT system that logs temperature metrics to an Amazon DynamoDB table. The table uses `SensorId` as the partition key and `Timestamp` as the sort key. A Lambda function executes a `Query` operation to retrieve metrics for a specific `SensorId` over a 24-hour period.

The query matches exactly 100 items, and each item has an average size of 5 KB5\text{ KB}. The operation uses a `FilterExpression` to only return the 20 items where the `AlertStatus` attribute is set to `RED`. Additionally, a `ProjectionExpression` is used to limit the returned attributes to `Timestamp` and `Reading`, reducing the payload size of each returned item to 1.5 KB1.5\text{ KB}.

If the query is configured to use strongly consistent reads and the Lambda function must handle 10 queries per second, what is the minimum read capacity units (RCUs) that must be provisioned for the table to prevent throttling?

Show answer & explanation

Answer: 1250 RCU1250\text{ RCU}

Answer

The minimum read capacity units (RCUs) that must be provisioned is 1250 RCU1250\text{ RCU}.
The correct answer is 1250 RCU1250\text{ RCU}. In Amazon DynamoDB, read capacity calculations are based on the amount of data read from the table before any FilterExpression or ProjectionExpression is applied. The query matches 100 items with an average size of 5 KB5\text{ KB}, resulting in a total evaluated data size of 500 KB500\text{ KB}. Since the query uses strongly consistent reads, each RCU provides one read per second for an item up to 4 KB4\text{ KB}. Thus, a single query requires 500 KB/4 KB=125500\text{ KB} / 4\text{ KB} = 125 read operations. To support 10 queries per second, the minimum provisioned capacity required is 125×10=1250 RCU125 \times 10 = 1250\text{ RCU}.

Step-by-Step Solution

1
Determine the total data size evaluated by the Query operation.
The total evaluated size is 100×5 KB=500 KB100 \times 5\text{ KB} = 500\text{ KB}.
DynamoDB calculates read capacity based on the size of all items that match the key condition expression, before any FilterExpression or ProjectionExpression is applied.
2
Calculate the read operations required for a single query.
500 KB/4 KB=125500\text{ KB} / 4\text{ KB} = 125 read operations.
For strongly consistent reads, one read operation is consumed for every 4 KB4\text{ KB} of data read, rounded up.
3
Calculate the total provisioned RCU needed per second.
125 read operations×10 queries/sec=1250 RCU125 \text{ read operations} \times 10 \text{ queries/sec} = 1250\text{ RCU}.
Read Capacity Units are provisioned per second, so the single-query requirement must be multiplied by the query rate.

Key Concept

DynamoDB read capacity unit calculation behaves independently of projection and filter expressions.
Question 19Question →

A developer has deployed an AWS Lambda function inside a private subnet of a VPC to process data and write it to an Amazon RDS database. The function also needs to call a third-party payment processing API over HTTPS and upload a summary report to Amazon S3. During testing, the developer observes that the Lambda function can write to the RDS database, but attempts to connect to the third-party API and Amazon S3 fail with network timeouts. Additionally, the Lambda function's execution duration is high due to establishing new HTTPS connections on every execution.

Which two actions should the developer take to resolve these network timeouts and optimize connection performance?

Select all that apply

Show answer & explanation

Answer: Configure a NAT Gateway in a public subnet, and update the private subnet's route table to route external traffic (0.0.0.0/00.0.0.0/0) through the NAT Gateway.; Initialize the SDK and HTTP clients outside the Lambda handler function so that they can be reused across multiple execution context invocations.

Answer

Configure a NAT Gateway in a public subnet, route outbound traffic to it, and initialize SDK/HTTP clients outside the Lambda handler function.
Configuring a NAT Gateway in a public subnet and routing external traffic from the private subnet through it allows the Lambda function to access external networks like the third-party API and AWS services. Initializing the SDK and HTTP clients outside the handler allows the Lambda function to reuse these clients and connection pools across subsequent invocations within the same execution context, reducing overhead and improving latency.

Step-by-Step Solution

1
Analyze the network failure context
The Lambda function is placed inside a private subnet of a VPC. It can reach the RDS database in the same VPC but cannot resolve public API DNS or reach external services.
Resources in private subnets do not have public IP addresses or routes to the internet, blocking HTTPS calls to external APIs and AWS endpoints.
2
Address the outbound internet connectivity issue
Create a NAT Gateway in a public subnet and add a route (0.0.0.0/00.0.0.0/0) in the private subnet's route table pointing to the NAT Gateway.
This enables secure outbound internet translation for resources within private subnets.
3
Optimize connection overhead
Declare the SDK and HTTP clients outside the handler code block.
Lambda reuses the execution context for subsequent warm starts. Code outside the handler is executed once during initialization (cold start), allowing subsequent invocations to reuse established connection pools.

Key Concept

VPC internet connectivity for Lambda and execution context optimization
Question 20Question →

An organization is designing a microservice that will run on AWS Lambda within a private subnet to process messages. The microservice uses the AWS SDK to retrieve sensitive configuration data. During local testing on developer workstations, the application needs to use credentials from a local AWS CLI profile named `dev-profile`. When running on AWS, the microservice must run securely with minimal privilege and without hardcoded secrets.

Which two configuration steps should the developer perform to satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Set the AWS_PROFILE environment variable to dev-profile on the developers' local workstations.; Assign an IAM execution role with the required permissions to the Lambda function.

Answer

To satisfy the requirements, the developer should set the AWS_PROFILE environment variable to the named developer profile on local workstations, and assign an IAM execution role with the necessary permissions to the AWS Lambda function in the production environment.
The correct actions involve setting the environment variable to specify the local named profile and assigning an IAM execution role to the Lambda function. The default credential provider chain of the AWS SDK handles both scenarios seamlessly: locally it resolves the profile via the environment variable, and in Lambda it retrieves the temporary credentials from the execution role.

Step-by-Step Solution

1
Identify how the AWS SDK locates credentials locally.
Setting the AWS_PROFILE environment variable directs the SDK default credential provider chain to retrieve credentials from the shared credentials file for the specified profile.
This avoids hardcoding credentials or modifying code between environments.
2
Determine how the AWS SDK retrieves credentials in the AWS Lambda environment.
The SDK default credential provider chain automatically queries the Lambda execution environment to obtain temporary credentials from the assigned IAM execution role.
This conforms to the principle of least privilege and uses AWS managed temporary credentials.
3
Evaluate the security and routing requirements of the private subnet.
Deploying a NAT Gateway in a private subnet is incorrect; NAT Gateways must be in a public subnet. Additionally, accessing Secrets Manager from a private VPC can be done via VPC endpoints or a public NAT Gateway.
Correct network topology is required to allow the Lambda function to make outbound connections.

Key Concept

AWS SDK Default Credential Provider Chain
Page 1 / 26Next