Examkin

Tüm alıştırma soruları

1542 soru

Tüm türler1,542Çoktan seçmeli782Çoklu seçim746Sıralama14
Soru 261Soru →

A developer is implementing a logistics microservice using an AWS Lambda function to process shipment status updates. To ensure idempotency and prevent processing duplicate updates within a short timeframe, the developer initializes a mutable Set outside the handler function to store processed update IDs. During load testing, two issues are observed: concurrent invocations occasionally process duplicate updates, and subsequent sequential invocations reject valid updates. Which explanation accurately describes the root cause of these issues, and what is the recommended solution?

Cevabı ve açıklamayı göster

Cevap: Lambda reuses the execution context for sequential invocations, which preserves the global Set across executions and causes valid sequential updates to be rejected. However, concurrent invocations run in separate execution contexts, meaning they do not share the Set and can process duplicates. The recommended solution is to store the processed update IDs in Amazon DynamoDB and use conditional writes.

Cevap

The correct answer explains that Lambda reuses the execution context for sequential invocations, preserving the global state (the Set) and causing valid sequential updates to be rejected, while concurrent invocations run in separate execution contexts and do not share state, resulting in duplicates. The solution is to store the processed update IDs in Amazon DynamoDB and use conditional writes.
The correct answer identifies that AWS Lambda reuses the execution context (including the global memory state) for subsequent sequential requests, which causes the list of processed updates to persist and reject valid requests. For concurrent requests, separate execution contexts are initialized, which prevents them from sharing the in-memory Set and allows duplicate updates to proceed. Storing these IDs in an external, centralized datastore like Amazon DynamoDB using conditional writes solves both issues by ensuring atomic, shared state checks.

Adım Adım Çözüm

1
Evaluate the AWS Lambda execution model and context reuse behavior.
Variables in the global scope (outside the handler) are preserved across sequential invocations that reuse the same execution context, but are isolated between separate concurrent executions.
Lambda optimizes performance by keeping the container warm for subsequent requests, but it does not share memory across concurrent containers.
2
Correlate the observed testing behaviors with the execution context lifecycle.
Sequential invocations reject valid updates because the Set retains IDs from previous runs. Concurrent invocations process duplicates because they run in isolated environments with empty Sets.
This explains why local in-memory caching is insufficient for global idempotency.
3
Identify the AWS best practice for distributed state and idempotency.
Using a persistent, shared datastore like Amazon DynamoDB with conditional writes allows checking and updating the state of an update ID atomically.
This ensures a single source of truth that is accessible by all concurrent Lambda containers.

Anahtar Kavram

AWS Lambda execution context reuse and stateless design patterns
Soru 262Soru →

A team is creating several independent Python microservices using AWS Lambda. To ensure consistent logging across all services, they want to share a custom utility module and several heavy external dependencies without bundling them directly in each function's deployment zip file. What AWS Lambda feature should they use to manage and share these dependencies?

Cevabı ve açıklamayı göster

Cevap: AWS Lambda layers

Cevap

AWS Lambda layers should be used because they allow sharing custom modules and dependencies across multiple Lambda functions, reducing individual deployment package sizes.
AWS Lambda layers allow you to package libraries, custom runtimes, and other dependencies separately from your function code. By deploying these files to a layer, multiple Lambda functions can reference and use them, which keeps the deployment zip packages small and ensures consistency across microservices.

Adım Adım Çözüm

1
Analyze the requirement to share a custom logging utility and dependencies across multiple Lambda functions without bundling them in each zip file.
Identify the need for a mechanism to externalize common dependencies.
This establishes the core technical requirement for the serverless application architecture.
2
Evaluate AWS Lambda features for dependency management.
Identify AWS Lambda layers as a feature specifically built to package, share, and promote code reuse.
Layers allow you to pull in dependencies at runtime, reducing deployment archive sizes.
3
Verify that alternative configuration options do not address code sharing.
Confirm that environment variables, execution context reuse, and VPC configurations do not distribute dependency packages.
Ensures that options related to configuration, state management, and network placement are correctly excluded.

Anahtar Kavram

AWS Lambda Layers for dependency management and code sharing
Tahmini Süre:45s
Soru 263Soru →

A developer is writing a Java application that will use the AWS SDK for Java to write data to an Amazon DynamoDB table. During local development, the application must run on the developer's workstation and connect to a development DynamoDB table. In production, the application will run on an Amazon EC2 instance and must connect to a production DynamoDB table. The developer wants to use the default credential provider chain so that the application can automatically discover and use the appropriate credentials in each environment without any code changes.

Which two configuration steps should the developer perform to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Attach an IAM role with the required DynamoDB permissions to the EC2 instance as an instance profile.; Create a shared credentials file on the local workstation at ~/.aws/credentials containing the development AWS credentials.

Cevap

Attach an IAM role with the required DynamoDB permissions to the EC2 instance as an instance profile, and create a shared credentials file on the local workstation at ~/.aws/credentials containing the development AWS credentials.
The standard approach for environment-agnostic SDK client initialization is to rely on the default credential provider chain. Locally, the developer configures a shared credentials file at ~/.aws/credentials, which is automatically read by the chain. In the EC2 production environment, the developer attaches an IAM role with the correct permissions to the instance profile, which the chain resolves via the Instance Metadata Service (IMDS). Together, these steps satisfy the credential requirements without hardcoding or code alterations.

Adım Adım Çözüm

1
Configure local credentials by creating the ~/.aws/credentials file containing the development access keys.
The local Java application resolves these credentials via the default credential provider chain during development.
The default credential provider chain checks the shared credentials file when environment variables are not set.
2
Create an IAM role with a policy allowing DynamoDB actions and attach it as an instance profile to the EC2 instance.
The EC2 instance gains authorization to access DynamoDB.
The EC2 Instance Metadata Service (IMDS) hosts the credentials associated with the instance profile.
3
Initialize the DynamoDB client in the application code without specifying credentials in the builder or constructor.
The application code remains environment-agnostic.
The default credential provider chain resolves the ~/.aws/credentials file locally and the instance profile on EC2 automatically.

Anahtar Kavram

The AWS SDK default credential provider chain automatically discovers credentials in a defined order of precedence, enabling environment-agnostic code deployment.
Tahmini Süre:1m 30s
Soru 264Soru →

A developer is writing a backend application to retrieve a specific customer's order history from an Amazon DynamoDB table. The table uses CustomerId as the partition key and OrderId as the sort key. The application needs to fetch all orders for a single customer in the most efficient and cost-effective manner. Which API operation should the developer use to retrieve this data?

Cevabı ve açıklamayı göster

Cevap: Perform a Query operation specifying the CustomerId in the key condition expression.

Cevap

Perform a Query operation specifying the CustomerId in the key condition expression.
Performing a Query operation specifying the CustomerId in the key condition expression is the most efficient and cost-effective approach. DynamoDB Query operations search only the partition matching the partition key, returning all matching items while consuming only the RCUs required for the returned dataset.

Adım Adım Çözüm

1
Identify the table's primary key structure.
The partition key is CustomerId and the sort key is OrderId.
Understanding the key schema helps determine which DynamoDB operations can target specific items directly.
2
Evaluate the retrieval requirement.
We need to fetch all orders for a single CustomerId.
Since the search is filtered by the partition key, we can retrieve all items under that partition without scanning the rest of the table.
3
Select the most efficient DynamoDB API operation.
Choose the Query API, passing the CustomerId in the key condition expression.
A Query operation retrieves items directly from the partition associated with the specified partition key, consuming minimal Read Capacity Units (RCUs) compared to a Scan.

Anahtar Kavram

Using Query instead of Scan to efficiently retrieve items with a shared partition key.
Soru 265Soru →

A developer is migrating a REST API endpoint in Amazon API Gateway that currently uses a Lambda custom integration to a Lambda proxy integration. Which of the following actions must the developer perform to ensure the API and backend Lambda function work correctly with the new integration? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Modify the Lambda function response to return a JSON object containing the keys statusCodestatusCode, headersheaders, and bodybody.; Remove any configured integration responses and method response mappings from the API Gateway resource.

Cevap

Modify the Lambda function response to return a JSON object containing the keys statusCodestatusCode, headersheaders, and bodybody, and remove any configured integration responses and method response mappings from the API Gateway resource.
The correct actions are to modify the Lambda function response format and remove configured integration/method responses. In a Lambda proxy integration, API Gateway bypasses integration and method response configurations, passing the backend response directly to the client. This requires the Lambda function to return a structured JSON response containing the HTTP status code, headers, and stringified body.

Adım Adım Çözüm

1
Identify the response requirements for API Gateway Lambda Proxy integration.
The backend Lambda function must return a JSON payload with statusCodestatusCode, headersheaders, and bodybody fields.
API Gateway expects this specific structure to parse and build the HTTP response in proxy mode.
2
Determine the configuration changes needed in the API Gateway console for proxy integration.
Remove custom integration responses, method responses, and mapping templates.
Proxy integration routes the request and response directly without using API Gateway mapping templates or custom integration response configurations.

Anahtar Kavram

Understanding request and response handling differences between API Gateway Lambda Proxy and Lambda Custom integrations.
Tahmini Süre:2m 0s
Soru 266Soru →

A developer has deployed a containerized Node.js application to Amazon ECS on AWS Fargate. The application uses the AWS SDK for JavaScript (v3) to read from an Amazon DynamoDB table. The ECS task is configured with an IAM Task Role that has the required DynamoDB permissions. However, the application fails to query the table, and the developer receives an authentication error from DynamoDB. During debugging, the developer notices that the container definition still includes the environment variables `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` set to mock values used during local testing.

Which of the following explains why the application is failing to access DynamoDB, and what is the correct resolution?

Cevabı ve açıklamayı göster

Cevap: The AWS SDK default credential provider chain evaluates environment variables before checking for ECS container credentials. The SDK signed requests using the mock environment variables, leading to authentication failures. To resolve this, remove the mock environment variables from the container definition.

Cevap

The AWS SDK default credential provider chain evaluates environment variables before checking for ECS container credentials. The SDK signed requests using the mock environment variables, leading to authentication failures. To resolve this, remove the mock environment variables from the container definition.
The correct answer explains that the AWS SDK's default credential provider chain searches environment variables before any other credential sources. If mock or placeholder credentials exist in the environment, the SDK selects them immediately and attempts to use them to sign requests, resulting in authentication failures. Removing the mock variables allows the default provider chain to evaluate subsequent options and retrieve the ECS Task Role credentials.

Adım Adım Çözüm

1
Analyze the SDK default credential provider chain resolution order.
The chain evaluates environment variables first, then system properties, then local configuration files, then ECS container credentials (if available), and finally EC2 instance metadata.
This establishes which credential source is selected when multiple sources are present in the environment.
2
Identify the cause of the authentication failure based on the presence of mock credentials.
Since `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` are present in the environment variables, the SDK uses them immediately and stops searching the chain. It signs API requests with these invalid mock credentials, leading to authentication errors.
This explains why the assigned ECS Task Role is being bypassed.
3
Determine the corrective action to force the SDK to use the ECS Task Role.
Removing the mock environment variables causes the environment provider to be skipped, allowing the SDK to fall back to the ECS container credentials provider which retrieves the temporary credentials linked to the Task Role.
This ensures the default provider chain operates correctly in the Fargate environment.

Anahtar Kavram

AWS SDK default credential provider chain precedence
Soru 267Soru →

A developer is building a backend service for an IoT-based fleet tracking application. Telemetry data is stored in an Amazon DynamoDB table designed with VehicleId as the partition key and LogTimestamp as the sort key. The developer needs to retrieve all telemetry events recorded for a specific vehicle over a specific 24-hour period. Which two actions should the developer take to retrieve this data with the lowest latency and minimal Read Capacity Unit (RCU) consumption? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Perform a Query operation specifying the VehicleId in the KeyConditionExpression; Use a KeyConditionExpression to restrict the LogTimestamp values using a comparison operator

Cevap

To retrieve the telemetry events efficiently, the developer must perform a Query operation specifying the vehicle identifier in the key condition expression, and restrict the timestamp values within the target 24-hour range in the key condition expression.
Performing a Query operation specifying the partition key in the key condition expression, and using the sort key in the key condition expression to filter by the timestamp range, allows DynamoDB to efficiently locate and return only the requested items from a single partition without reading unrelated data.

Adım Adım Çözüm

1
Identify the primary key structure of the DynamoDB table.
The table uses a composite primary key consisting of a partition key (VehicleId) and a sort key (LogTimestamp).
Understanding the key structure is necessary to choose the correct read API operation.
2
Determine the most efficient API operation for retrieving a range of items sharing a partition key.
A Query operation is selected because it targets a single partition key and allows sorting/filtering on the sort key.
Using Query instead of Scan avoids reading the entire table, minimizing latency and RCU usage.
3
Configure the key condition expression for the Query operation.
The expression specifies the exact VehicleId and applies a range condition on the LogTimestamp.
This retrieves only the items matching both criteria directly from the partition.

Anahtar Kavram

Querying DynamoDB tables with composite primary keys using partition and sort keys
Soru 268Soru →

A developer is writing an AWS Lambda function that must download a static reference file from Amazon S3 and reuse it across multiple invocations. The developer wants to minimize execution time and reduce the number of calls to Amazon S3.

Which two actions should the developer take to accomplish this?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Declare the Amazon S3 client and configuration variables outside of the handler function.; Store the downloaded reference file in the local /tmp directory of the execution environment.

Cevap

To optimize execution time and reuse files across invocations, declare the client and variables outside of the handler function, and store the downloaded file in the local /tmp directory.
Declaring the Amazon S3 client outside of the handler ensures it is initialized once during cold start, and storing the downloaded file in the /tmp directory leverages ephemeral storage that persists across warm starts. Together, these steps significantly reduce execution time and avoid redundant calls to S3.

Adım Adım Çözüm

1
Leverage execution context reuse.
Declaring initialization code and S3 clients outside the handler ensures they are executed once during the initialization phase (cold start), making them available for all warm starts.
This reduces the overhead of re-creating the client on every function execution.
2
Use ephemeral local storage for caching.
Download the static reference file to the /tmp directory, which provides writeable disk space that persists as long as the execution context is kept alive.
This allows subsequent invocations to read the file from local storage instead of making expensive network calls to S3.

Anahtar Kavram

AWS Lambda execution context lifecycle, initialization phase, and local ephemeral storage usage.
Soru 269Soru →

An organization has deployed a retail transaction processing system. The core component is a serverless function that handles purchase validation. This function runs inside private subnets of an Amazon VPC to connect to a secure backend database cluster. To finalize transactions, the function must also perform an outbound HTTPS call to an external payment processor.

During high-traffic periods, two issues are observed:
1. The function fails to connect to the external payment processor, resulting in network connection timeouts.
2. The backend database cluster runs out of available database connections, causing transaction failures.

Which combination of architectural and code modifications should the developer implement to resolve these issues? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy a NAT Gateway in a public subnet, and add a route in the private subnets' route table directing destination 0.0.0.0/00.0.0.0/0 to the NAT Gateway.; Declare and initialize the database connection client outside of the Lambda handler method, enabling reuse across warm execution contexts.

Cevap

Configure a NAT Gateway in a public subnet to route outbound traffic from the private subnets, and declare the database connection client outside the Lambda handler method to reuse connections across execution context instances.
To resolve the network connectivity issues, the Lambda function needs outbound internet access. Since it runs in a private VPC subnet, a NAT Gateway must be deployed in a public subnet, and the private subnet's route table must route all outbound traffic (0.0.0.0/00.0.0.0/0) to the NAT Gateway. To resolve database connection exhaustion, the database connection pool must be declared outside the handler function. This ensures that the connection pool persists across warm starts of the Lambda execution context, reducing the total number of connections opened to the database.

Adım Adım Çözüm

1
Analyze the network timeout issue.
Since the Lambda function is deployed within private subnets of a VPC, it lacks direct access to the public internet. It cannot reach the external payment processor's HTTPS endpoint without a network address translation device.
Identifying that resources in a private VPC subnet require a NAT Gateway or similar NAT device placed in a public subnet with an attached Internet Gateway to initiate outbound connections.
2
Formulate the network resolution.
Provision a NAT Gateway in a public subnet, attach an Internet Gateway to the VPC, and add a route in the private subnets' route table directing 0.0.0.0/00.0.0.0/0 to the NAT Gateway.
This establishes a secure, outbound path to the public internet for the Lambda function.
3
Analyze the database connection exhaustion issue.
If connection establishment is performed inside the handler function, every single invocation creates a new connection, which exhausts the database's connection limits under heavy concurrency.
Understanding Lambda execution context lifecycle and cold/warm starts.
4
Formulate the code optimization resolution.
Move the database connection pool initialization outside the handler function to the initialization phase of the container.
The execution context is reused for subsequent invocations, keeping the database connection alive and shared, preventing the overhead of re-establishing connections on every invocation.

Anahtar Kavram

VPC networking for outbound Lambda traffic and execution context reuse for connection management.
Tahmini Süre:2m 0s
Soru 270Soru →

A developer is configuring a REST API in Amazon API Gateway that integrates with a backend AWS Lambda function. The API currently uses a Lambda proxy integration. The developer wants to modify the structure of the incoming client JSON payload before it is passed to the backend Lambda function. The developer attempts to configure a mapping template in API Gateway but finds that it has no effect on the payload received by the Lambda function. Which of the following actions should the developer take to resolve this issue?

Cevabı ve açıklamayı göster

Cevap: Change the integration type to a Lambda custom integration, and define an integration request mapping template in API Gateway to transform the payload.

Cevap

Change the integration type to a Lambda custom integration, and define an integration request mapping template in API Gateway to transform the payload.
The correct action is to change the integration type to a Lambda custom integration. In Amazon API Gateway, a Lambda proxy integration passes the raw request directly to the backend function without processing mapping templates. To utilize API Gateway's native request transformation capabilities, such as defining Velocity Template Language (VTL) mapping templates in the Integration Request, a Lambda custom integration must be used.

Adım Adım Çözüm

1
Analyze the integration type configuration.
Identify that the API is using a Lambda proxy integration.
Lambda proxy integration bypasses API Gateway request and response mapping templates entirely, forwarding the raw request structure directly to Lambda.
2
Determine the requirement for payload transformation.
Realize that transformation needs to happen at the API Gateway layer before reaching the backend.
To modify the payload structure before it hits the backend Lambda function, mapping templates must be evaluated by API Gateway.
3
Select the correct integration and mapping configuration.
Change the integration to a Lambda custom integration and configure the VTL mapping template.
Only Lambda custom (non-proxy) integrations support using Velocity Template Language (VTL) mapping templates to transform client request payloads.

Anahtar Kavram

API Gateway Lambda Custom vs Proxy Integration request mapping capabilities
Tahmini Süre:1m 30s
Soru 271Soru →

A developer is building a school administration web portal. The portal needs to retrieve a student's list of registered courses from an Amazon DynamoDB table. The table is designed with `StudentId` as the partition key and `CourseId` as the sort key. Which DynamoDB operation is the most efficient and cost-effective way to retrieve all courses for a specific student?

Cevabı ve açıklamayı göster

Cevap: Perform a `Query` operation specifying the `StudentId` in the key condition expression.

Cevap

Perform a `Query` operation specifying the `StudentId` in the key condition expression.
The correct answer is the option proposing a `Query` operation because a `Query` operation allows direct retrieval of items that share the same partition key (`StudentId`). This is highly efficient and consumes Read Capacity Units (RCUs) only for the items returned.

Adım Adım Çözüm

1
Analyze the table schema and the query requirements.
The table schema has a composite primary key consisting of a partition key (`StudentId`) and a sort key (`CourseId`). The requirement is to retrieve all courses for a single student.
Understanding the key structure helps determine which DynamoDB operations are supported and most efficient.
2
Evaluate the difference between Query and Scan operations for partition key lookup.
A `Query` operation directly targets the partition key, retrieving only matching items. A `Scan` operation reads the entire table and then filters the results.
Choosing `Query` over `Scan` minimizes the data read from disk, saving performance overhead and cost.
3
Select the optimal DynamoDB API call.
The `Query` API call with a key condition expression for `StudentId` retrieves all courses for that student in a single, efficient request.
This matches best practices for querying composite primary key tables.

Anahtar Kavram

Query vs Scan operations in Amazon DynamoDB
Tahmini Süre:45s
Soru 272Soru →

A developer is designing a REST API using Amazon API Gateway to ingest tracking events. To minimize latency and operating costs, the API must write incoming payloads directly to an Amazon SQS queue without using an intermediate AWS Lambda function. Which two configuration steps must the developer perform in API Gateway to successfully establish this integration? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the integration type as AWS Service, select Simple Queue Service (SQS) as the AWS Service, and set the integration HTTP method to POST.; Create an IAM role that grants sqs:SendMessage permissions and specify this role's ARN in the Execution Role field of the integration settings.

Cevap

The correct configurations are setting the integration type to AWS Service targeting SQS with the POST method, and creating an IAM execution role with the sqs:SendMessage permission for API Gateway.
To integrate API Gateway directly with SQS, you must use the AWS Service integration type with the POST method. Additionally, API Gateway requires an IAM execution role to authorize the sqs:SendMessage action on the SQS queue.

Adım Adım Çözüm

1
Define the backend integration type.
Choose AWS Service integration, specify SQS, and set the HTTP method to POST to use the SendMessage action.
This establishes a direct API Gateway-to-AWS service communication bypass without using a Lambda function.
2
Configure the IAM permissions.
Provide an IAM Execution Role with sqs:SendMessage permission in the integration setup.
API Gateway needs to assume an IAM role that has authorization to write to the specified SQS queue.

Anahtar Kavram

API Gateway direct integration with AWS Services bypassing Lambda
Soru 273Soru →

A developer is configuring a serverless workflow where an Amazon SQS queue triggers an AWS Lambda function to process inventory updates. The Lambda function has its timeout set to 2 minutes. During testing, the developer notices that some messages are being processed multiple times by different Lambda invocations. Which configuration change will resolve this issue?

Cevabı ve açıklamayı göster

Cevap: Configure the SQS queue's visibility timeout to be at least 12 minutes (six times the Lambda function's timeout).

Cevap

Configure the SQS queue's visibility timeout to be at least 12 minutes (six times the Lambda function's timeout).
The correct option proposes configuring the SQS queue's visibility timeout to be at least 12 minutes (six times the Lambda function's timeout of 2 minutes). AWS best practices dictate that the visibility timeout of the source queue must be set to at least 6 times the timeout of the Lambda function to prevent messages from reappearing in the queue and being processed again while the current Lambda invocation is still running or retrying.

Adım Adım Çözüm

1
Analyze the relationship between the Lambda execution duration and SQS visibility timeout.
The Lambda function is configured to run for up to 2 minutes, but the SQS visibility timeout determines how long a message is hidden from other consumers after being polled.
If the visibility timeout is shorter than the Lambda execution time (or not sufficiently long to account for retries and batches), the message will reappear in the queue and be polled by another execution thread before the first one finishes.
2
Apply the AWS-recommended formula for SQS visibility timeout with Lambda.
The visibility timeout should be at least 6 times the Lambda function's timeout (6×2 minutes=12 minutes6 \times 2 \text{ minutes} = 12 \text{ minutes}).
Setting the visibility timeout to at least six times the function's timeout allows the Lambda service to handle retries, batch processing, and potential throttling events without exposing the messages to other consumers too early.

Anahtar Kavram

SQS visibility timeout integration with AWS Lambda
Soru 274Soru →

A developer is implementing an AWS Lambda function that needs to query an Amazon RDS PostgreSQL database located in a private VPC subnet. The function must also make outbound HTTP POST requests to an external API on the public internet, and trace all downstream database queries using AWS X-Ray.

Which two configurations are required to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the Lambda function to run inside the private subnets of the VPC, and route internet-bound traffic through a NAT Gateway located in a public subnet.; Enable active tracing on the Lambda function configuration, and use the AWS X-Ray SDK to instrument the database client in the function code.

Cevap

The Lambda function must be configured to run in the private subnets of the VPC, routing outbound internet traffic through a NAT Gateway. In addition, the developer must enable active tracing on the Lambda function and use the AWS X-Ray SDK within the code to instrument the database client.
To satisfy both database access in a private subnet and public internet connectivity for external APIs, the Lambda function must be configured inside the private subnets of the VPC, with the private subnets routing outbound traffic to a NAT Gateway in a public subnet. Additionally, active tracing must be enabled on the Lambda function, and the database client within the codebase must be instrumented using the AWS X-Ray SDK to record downstream database queries.

Adım Adım Çözüm

1
Configure the Lambda function VPC settings.
The Lambda function is associated with the private subnets of the VPC where the RDS database is located.
This allows the Lambda function to gain network connectivity to the private database via local VPC routing.
2
Configure outbound routing for the private subnets.
A NAT Gateway is deployed in a public subnet, and the route table for the private subnets is configured to route 0.0.0.0/0 traffic to the NAT Gateway.
Since Lambda ENIs in a VPC do not have public IP addresses, they must route through a NAT Gateway in a public subnet to make outbound calls to the public internet.
3
Configure and instrument AWS X-Ray tracing.
Active tracing is enabled on the Lambda function, and the database client in the function code is wrapped or patched with the AWS X-Ray SDK.
Enabling active tracing captures Lambda execution segments, while SDK client patching propagates the tracing context to capture downstream database queries.

Anahtar Kavram

AWS Lambda VPC networking and downstream AWS X-Ray SDK database instrumentation.
Soru 275Soru →

A developer is migrating a Python application that processes images in Amazon S3 from a local development workstation to an AWS Lambda function. In the local environment, the developer initialized the SDK session using `session = boto3.Session(profile_name='dev-profile')`. After deploying the code to Lambda, the function execution fails with a `ProfileNotFound: The config profile (dev-profile) could not be found` error.

Which of the following is the most secure and recommended configuration to resolve this error?

Cevabı ve açıklamayı göster

Cevap: Initialize the client using `boto3.client('s3')` without specifying a session or profile, allowing the SDK to retrieve credentials from the Lambda execution role via the default credential provider chain.

Cevap

Initialize the client using `boto3.client('s3')` without specifying a session or profile, allowing the SDK to retrieve credentials from the Lambda execution role via the default credential provider chain.
The correct approach is to initialize the client using `boto3.client('s3')` without specifying a session or profile. When no explicit configuration profile is requested, the AWS SDK default credential provider chain resolves credentials from the environment. In AWS Lambda, the service automatically populates the environment variables `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and `AWS_SESSION_TOKEN` with temporary credentials from the execution role, which the SDK automatically reads.

Adım Adım Çözüm

1
Modify the code to remove the explicit `profile_name` argument from the Boto3 session initialization.
The SDK client is initialized using default parameters: `s3 = boto3.client('s3')`.
This allows the AWS SDK default credential provider chain to execute instead of looking for a specific local profile.
2
Deploy the updated application to AWS Lambda.
The Lambda function runtime receives the execution command.
AWS Lambda injects temporary, rotated credentials associated with the function's execution role into the environment variables.
3
Verify that the SDK automatically retrieves the injected credentials.
The application successfully authenticates and accesses the S3 bucket without throwing credential or profile errors.
The SDK default credential provider chain checks environment variables first, resolving the Lambda execution role credentials automatically.

Anahtar Kavram

AWS SDK Default Credential Provider Chain and Lambda Execution Roles
Tahmini Süre:1m 0s
Soru 276Soru →

A developer is building a serverless application using Amazon API Gateway and AWS Lambda. The application needs to access the client's source IP address and the incoming request headers within the Lambda function. The developer wants to achieve this with the least amount of operational effort and without writing manual mapping templates.

Which configuration should the developer choose for the API Gateway integration to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Configure a Lambda proxy integration for the API method.

Cevap

Configure a Lambda proxy integration for the API method.
Configuring a Lambda proxy integration is the most efficient approach because API Gateway automatically passes the entire raw request—including headers, query parameters, and the request context containing the client source IP—to the backend Lambda function as the input event object. This configuration requires no manual integration mapping templates, minimizing development and operational effort.

Adım Adım Çözüm

1
Analyze the requirements for metadata mapping.
The client's source IP address and request headers must be sent to the Lambda function.
This establishes the data contract needed by the Lambda function.
2
Evaluate the integration options to minimize manual mapping effort.
Lambda proxy integration automatically formats the incoming request data as a JSON object containing headers and request context (with source IP), passing it directly to the Lambda function.
This avoids the need to write Velocity Template Language (VTL) mapping templates, satisfying the requirement to minimize operational overhead.

Anahtar Kavram

API Gateway Lambda Proxy Integration
Tahmini Süre:1m 30s
Soru 277Soru →

A developer is implementing a microservice for a digital library system. The system needs to retrieve a specific book's metadata using its ISBN (which is the primary key) and retrieve a list of all reviews for a specific book, sorted by the review date.

Which two DynamoDB operations should the developer use to retrieve this data most efficiently with the lowest Read Capacity Unit (RCU) consumption?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Use the GetItem operation to retrieve the book's metadata by its ISBN.; Use the Query operation to retrieve the reviews for a specific book using its partition key.

Cevap

The developer should use the GetItem operation to retrieve the book's metadata and the Query operation to retrieve the reviews.
To retrieve a single item by its primary key (ISBN), the GetItem operation is the most direct and efficient option. To retrieve multiple related items (reviews for a book) that share a partition key, the Query operation reads only the matching items, optimizing performance and RCU usage.

Adım Adım Çözüm

1
Analyze the requirements for retrieving the book's metadata.
The book metadata is identified by a unique ISBN (primary key). The most efficient operation to read a single item by its primary key is GetItem.
GetItem directly targets the specific partition key value and avoids reading any other items in the table.
2
Analyze the requirements for retrieving the reviews.
Reviews are associated with a specific book. Using the book's partition key, the Query operation can retrieve all matching review items efficiently.
Query reads only the items that match the specified partition key and can sort them by the sort key, minimizing the amount of data read.
3
Evaluate and eliminate inefficient operations.
Scan operations must be avoided as they examine every item in the table. Hardcoding credentials must be avoided for security compliance.
Scan operations waste Read Capacity Units (RCUs) and increase latency, while hardcoded credentials violate IAM security principles.

Anahtar Kavram

Retrieving items from Amazon DynamoDB efficiently using GetItem and Query operations instead of Scan operations.
Soru 278Soru →

A developer is deploying a Node.js application to Amazon ECS on AWS Fargate. The application needs to read messages from an Amazon SQS queue. The developer has created an IAM Task Role with the necessary permissions and associated it with the ECS Task. However, when the application runs in ECS, it throws a credentials error stating that it cannot load credentials. The developer discovers that the application task definition has residual `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` environment variables set to empty values, which were used during local Docker container testing.

Which of the following actions should the developer take to resolve this issue and follow AWS security best practices? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Remove the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables from the ECS task definition.; Verify that the application's SDK client initialization relies on the default credential provider chain.

Cevap

The developer should remove the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables from the task definition, and ensure the SDK client utilizes the default credential provider chain.
Removing the empty environment variables from the task definition allows the SDK default credentials provider chain to proceed past the environment variable stage. Because the application is running in an ECS task, the SDK then queries the container credentials endpoint to assume the IAM Task Role. The client initialization must also rely on the default provider chain, which automatically supports this resolution.

Adım Adım Çözüm

1
Analyze the credentials error and the task configuration.
Identify that the presence of empty AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables interrupts the default credentials provider chain before it checks container credentials.
The SDK's default credentials provider chain evaluates environment variables before container credentials. When key variables are present but empty or invalid, the SDK fails instead of falling back.
2
Remove the invalid environment variables from the ECS task definition.
Allows the default credentials provider chain to bypass the environment variable stage and move to the ECS container credentials stage.
This exposes the container credentials relative URI, which is used by the default credentials provider to assume the IAM Task Role.
3
Ensure the application code initializes clients using the default chain.
The SDK will correctly locate the credentials automatically from the ECS container metadata environment.
Hardcoding credentials or credentials file configurations in containerized applications violates security and configuration best practices.

Anahtar Kavram

Default Credential Provider Chain Precedence
Tahmini Süre:1m 30s
Soru 279Soru →

An application developer is designing a new serverless microservice using Amazon API Gateway. The microservice must ingest JSON payloads from client applications, perform minimal transformations using Velocity Mapping Templates (VTL) directly in API Gateway to format the payloads for a downstream service, and authenticate users using standard JSON Web Tokens (JWT) generated by an Amazon Cognito User Pool. The developer wants to minimize latency, custom code overhead, and management complexity.

Which of the following actions should the developer perform to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure a Lambda custom integration for the integration request and define a Velocity Mapping Template (VTL) to transform the payload.; Configure an Amazon Cognito user pool authorizer on the API Gateway method to validate the client JWTs.

Cevap

Configure a Lambda custom integration for the integration request and define a Velocity Mapping Template (VTL) to transform the payload, and configure an Amazon Cognito user pool authorizer on the API Gateway method to validate the client JWTs.
To transform payloads using Velocity Mapping Templates (VTL) before they reach the backend service, the developer must use a Lambda custom (non-proxy) integration because proxy integrations pass the raw event payload directly without allowing mapping templates. Additionally, to validate JWTs from Cognito with the lowest management overhead and custom code, the developer should configure the native Amazon Cognito user pool authorizer.

Adım Adım Çözüm

1
Determine the required integration type for payload transformation.
Since the scenario requires transforming the request payload directly in API Gateway using Velocity Mapping Templates (VTL) before passing it to the backend, a Lambda custom integration (non-proxy) must be selected.
Velocity Mapping Templates (VTL) are only supported in custom integrations (non-proxy integrations). Lambda proxy integration bypasses mapping templates completely.
2
Select the optimal authentication mechanism for Cognito JWT validation.
To validate standard JSON Web Tokens (JWT) generated by Amazon Cognito with minimal custom code and complexity, choose the native Amazon Cognito user pool authorizer.
Cognito user pool authorizers are built-in features that handle validation automatically, whereas custom Lambda authorizers require writing, deploying, and maintaining custom code.

Anahtar Kavram

API Gateway Integrations and Authorizers
Tahmini Süre:2m 0s
Soru 280Soru →

A developer is building a backend for a recipe sharing application. The application needs to retrieve a single recipe's details from an Amazon DynamoDB table by providing the exact `RecipeId` (which is the table's partition key). Which approach should the developer use to retrieve this item most efficiently with the lowest latency and read capacity unit (RCU) consumption?

Cevabı ve açıklamayı göster

Cevap: Perform a GetItem operation using the specific RecipeId.

Cevap

Perform a GetItem operation using the specific RecipeId.
The correct approach is to perform a GetItem operation using the specific RecipeId. In Amazon DynamoDB, GetItem is the most efficient method for retrieving a single item when the full primary key (the partition key in this case) is known. It directly retrieves the item without scanning other data, minimizing latency and RCU consumption.

Adım Adım Çözüm

1
Identify the primary key structure and request details.
The application needs to retrieve a single item using its partition key (RecipeId).
Understanding the key structure helps choose the most specific and optimized API operation.
2
Compare candidate operations (GetItem, Query, Scan).
GetItem is designed for single-item lookups, Query is for multiple items with the same partition key, and Scan evaluates all items in the table.
Choosing the operation that accesses the fewest items minimizes latency and cost.
3
Select GetItem as the optimal API call.
GetItem retrieves the exact item directly using the primary key, consuming 1 strongly consistent read or 0.5 eventually consistent read capacity units.
This achieves the lowest latency and resource consumption.

Anahtar Kavram

Selecting the most efficient DynamoDB operation for single-item retrieval using a primary key.
ÖncekiSayfa 14 / 78Sonraki
Tüm alıştırma soruları — AWS Certified Developer - Associate | Examkin