Examkin

Tüm alıştırma soruları

1542 soru

Tüm türler1,542Çoktan seçmeli782Çoklu seçim746Sıralama14
Soru 381Soru →

A developer is implementing a real-time tracking pipeline for a logistics platform. A producer application writes delivery location updates to an Amazon Kinesis Data Stream using the delivery region name (e.g., 'us-east-1') as the partition key. A downstream AWS Lambda function is configured to process the stream via an event source mapping and must call an external third-party mapping API to validate coordinates. The Lambda function is deployed within private subnets of a VPC. During peak hours, the developer observes ProvisionedThroughputExceededException errors on the Kinesis stream, despite the total data volume being well below the stream's aggregate limit. Additionally, the Lambda function fails to connect to the external API. Which combination of changes should the developer implement to resolve both the Kinesis throttling and the connection issues?

Cevabı ve açıklamayı göster

Cevap: Update the producer application to use a high-entropy key, such as a unique delivery ID, as the partition key. Configure a NAT Gateway in a public subnet and route internet-bound traffic from the Lambda function's private subnet through it.

Cevap

Update the producer application to use a high-entropy key, such as a unique delivery ID, as the partition key. Configure a NAT Gateway in a public subnet and route internet-bound traffic from the Lambda function's private subnet through it.
The correct answer correctly identifies that a high-entropy key like a unique delivery ID is required to distribute writes evenly across all shards, resolving the ProvisionedThroughputExceededException throttling. It also correctly specifies that a NAT Gateway in a public subnet is required to enable outbound internet connectivity for the VPC-enabled Lambda function so that it can reach the third-party API.

Adım Adım Çözüm

1
Analyze the cause of ProvisionedThroughputExceededException.
The current partition key is the region name, which has very low entropy. During peak hours, a large volume of writes goes to the same region, directing all traffic to a single shard (hot shard) and causing write throttling.
Kinesis routes records to shards based on the hash of the partition key; low entropy partition keys lead to uneven distribution.
2
Select a proper partition key strategy.
Using a unique delivery ID as the partition key provides high entropy, distributing writes evenly across all available shards.
High-entropy keys ensure balanced utilization of stream throughput capacity.
3
Analyze the Lambda function's connectivity issue.
The Lambda function is in private subnets and lacks internet connectivity to call the external third-party API.
VPC-enabled Lambda functions require a NAT Gateway configured in a public subnet with routing rules on the private subnet to connect to the public internet.

Anahtar Kavram

Handling Kinesis Data Stream hot shards using high-entropy partition keys, and configuring outbound internet access for Lambda functions running inside a VPC.
Soru 382Soru →

A developer is configuring an AWS Lambda function to process messages from an Amazon SQS queue using an event source mapping. The Lambda function has an execution role with the following permissions policy attached:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"sqs:ReceiveMessage",
"sqs:DeleteMessage"
],
"Resource": "arn:aws:sqs:us-east-1:123456789012:ProcessQueue"
}
]
}

When the developer attempts to create the event source mapping, the operation fails with an error indicating that the Lambda function does not have sufficient permissions to read from the queue.

Which of the following actions should the developer take to successfully configure the event source mapping?

Cevabı ve açıklamayı göster

Cevap: Add the "sqs:GetQueueAttributes" action to the statement in the Lambda execution role's permissions policy.

Cevap

Add the "sqs:GetQueueAttributes" action to the statement in the Lambda execution role's permissions policy.
The correct answer is correct because AWS Lambda requires the `sqs:GetQueueAttributes` permission in addition to `sqs:ReceiveMessage` and `sqs:DeleteMessage` to set up and manage an SQS event source mapping successfully. This permission allows Lambda to read parameters such as the visibility timeout and approximate message count.

Adım Adım Çözüm

1
Analyze the error and permissions required for SQS event source mapping.
Identify that Lambda requires three permissions to poll SQS: ReceiveMessage, DeleteMessage, and GetQueueAttributes.
The Lambda service needs to query the queue parameters to scale polling and read messages properly.
2
Compare the current policy with the required permissions list.
The current permissions policy allows only sqs:ReceiveMessage and sqs:DeleteMessage, and is missing sqs:GetQueueAttributes.
This comparison identifies the missing permission cause of the configuration failure.
3
Select the resolution to append the missing permission.
Add the 'sqs:GetQueueAttributes' action to the existing IAM policy attached to the Lambda execution role.
This updates the permissions policy to grant all necessary access for the event source mapping.

Anahtar Kavram

Permissions required for SQS event source mappings in Lambda execution roles
Tahmini Süre:1m 30s
Soru 383Soru →

An application deployed on AWS Fargate publishes high-throughput security audit logs to an Amazon Kinesis Data Stream. An AWS Lambda function is configured to process the stream records in real-time. The Lambda function is deployed within private subnets of a VPC in order to access an internal Amazon RDS database. However, the Lambda function must also make outbound HTTPS calls to an external third-party security API to validate metadata.

During a high-traffic event, the developer notices two issues:
1. The Lambda function fails to connect to the external API, resulting in connection timeouts.
2. The Kinesis producer on Fargate receives ProvisionedThroughputExceededException errors on specific shards, even though the total stream ingestion rate is well below the overall provisioned limit.

Which two actions should the developer take to resolve these issues? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure a NAT Gateway in a public subnet of the VPC and update the private subnet's route table to route outbound internet traffic through the NAT Gateway.; Update the Fargate producer application to use a high-cardinality identifier, such as a combination of UserID and a high-resolution timestamp, as the Kinesis partition key.

Cevap

Configure a NAT Gateway in a public subnet of the VPC to route outbound internet traffic from the private subnets, and update the Fargate producer application to use a high-cardinality Kinesis partition key combining UserID and a timestamp.
To resolve the Lambda connectivity issue, the function needs a path to the internet. Because it resides in a private VPC subnet to access RDS, it must route outbound traffic through a NAT Gateway located in a public subnet. To resolve the Kinesis throttling issue, the producer must use a high-cardinality partition key (like a UserID and timestamp combination) to distribute records evenly across all available shards, avoiding hot shards.

Adım Adım Çözüm

1
Analyze the network path for the Lambda function in the private subnet.
Identify that the Lambda function lacks internet access because private subnets cannot route directly to the Internet Gateway without a NAT Gateway.
Since the external API resides on the public internet, a NAT Gateway is required to translate private IP addresses to a public IP.
2
Identify the cause of Kinesis ProvisionedThroughputExceededException under low aggregate load.
Determine that specific shards are hot due to an uneven distribution of records.
Hot shards occur when the partition key has low entropy, mapping too many writes to the same shard.
3
Select the correct partitioning strategy to spread the load.
Implement a high-entropy partition key (UserID + timestamp) so that hash values are distributed evenly across the key space.
This utilizes all provisioned shards in the Kinesis stream, resolving individual shard write throttling.

Anahtar Kavram

VPC internet connectivity for Lambda functions and high-entropy partition key design for Kinesis Data Streams.
Tahmini Süre:2m 30s
Soru 384Soru →

A developer is building a fleet management application that tracks real-time GPS location updates from delivery trucks. To build accurate route histories, the location updates for each individual truck must be processed in the exact order they are sent by the vehicle. However, updates from different trucks can be processed concurrently. The developer plans to use AWS integration services to decouple the data ingestion from the processing backend.

Which configuration will meet these requirements while maximizing scalability and throughput?

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon SNS FIFO topic and subscribe an Amazon SQS FIFO queue to it. Set the Message Group ID to the truck's unique identifier when publishing updates to the SNS FIFO topic.

Cevap

Configure an Amazon SNS FIFO topic and subscribe an Amazon SQS FIFO queue to it. Set the Message Group ID to the truck's unique identifier when publishing updates to the SNS FIFO topic.
Using an Amazon SNS FIFO topic subscribed to an Amazon SQS FIFO queue guarantees ordered message delivery. By setting the Message Group ID to the truck's unique identifier, messages for a specific truck are grouped together and processed sequentially, while messages with different Message Group IDs (other trucks) are processed in parallel. This configuration satisfies the ordering constraint per truck while maintaining high concurrency across the fleet.

Adım Adım Çözüm

1
Select the appropriate messaging queue and topic type that supports ordering.
Amazon SNS FIFO and Amazon SQS FIFO are selected, as standard SQS queues do not guarantee first-in, first-out ordering.
FIFO delivery is a strict requirement for constructing accurate route histories per truck.
2
Determine the logical partition key for ordered processing.
The truck's unique identifier is selected as the Message Group ID.
Using the truck ID as the Message Group ID guarantees that location updates for any single truck are processed in sequence, while allowing concurrent processing of messages belonging to different trucks.
3
Configure the subscriber endpoint integration.
The Amazon SQS FIFO queue is subscribed to the Amazon SNS FIFO topic.
This allows fanout capability if additional downstream consumers need ordered messages, while ensuring that the SQS queue consumes messages in the correct sequence.

Anahtar Kavram

Ordering and parallelism in SQS FIFO and SNS FIFO using Message Group IDs
Tahmini Süre:1m 30s
Soru 385Soru →

A developer is configuring a GET method on a REST API in Amazon API Gateway using a Lambda custom integration (non-proxy integration). When the backend AWS Lambda function encounters an invalid input parameter, it returns an error with the message `InvalidParameter`. The client currently receives an HTTP 200200 OK response containing the error message. The developer wants the API Gateway endpoint to return an HTTP 400400 Bad Request status code when this error occurs.

Which configuration steps should the developer take in API Gateway to map this error?

Cevabı ve açıklamayı göster

Cevap: Define an HTTP 400400 response in the Method Response settings. Under the Integration Response settings, create a response with the Lambda Error Regex set to `.*InvalidParameter.*` and associate it with the HTTP 400400 Method Response.

Cevap

Define an HTTP 400 response in the Method Response settings, and under the Integration Response settings, create a response with the Lambda Error Regex set to match the error string and associate it with the HTTP 400 Method Response.
In a Lambda custom (non-proxy) integration, mapping a backend Lambda error to a specific HTTP status code requires two steps: first, declaring the target HTTP status code (such as 400400) in the Method Response configuration, and second, setting up an Integration Response with a regular expression (Lambda Error Regex) that matches the error message string returned by Lambda (e.g., `.*InvalidParameter.*`) and linking it to the declared Method Response.

Adım Adım Çözüm

1
Add an HTTP 400400 response code to the Method Response settings of the API Gateway method configuration.
This registers the HTTP 400400 status code as a valid output that API Gateway can return to the client.
API Gateway requires all status codes returned by a custom integration to be defined in the Method Response first.
2
Add an Integration Response and configure the Lambda Error Regex to match the pattern `.*InvalidParameter.*`.
This enables API Gateway to parse the `errorMessage` field returned in the Lambda function's error payload and match it using the regular expression.
The Lambda Error Regex matches the error message string returned by AWS Lambda in custom integrations.
3
Set the Method Response Status of the newly created Integration Response to 400400.
Requests triggering the regex match will now return an HTTP 400400 status code to the client instead of the default HTTP 200200.
This maps the matched backend error condition to the registered client-side HTTP status code.

Anahtar Kavram

Lambda custom (non-proxy) integrations require configuring Method Responses and Integration Responses with Lambda Error Regex to map backend errors to client HTTP status codes.
Tahmini Süre:1m 30s
Soru 386Soru →

A developer is configuring a REST API in Amazon API Gateway to integrate with a backend AWS Lambda function. To minimize administrative overhead and avoid writing custom mapping templates, the developer decides to use a Lambda proxy integration. Which TWO requirements must be met to ensure this integration works correctly? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The Lambda function must return a JSON object containing at least statusCode, headers, and a stringified body.; API Gateway automatically passes the entire client request (including headers, query parameters, and body) as a single JSON object to the input event of the Lambda function.

Cevap

The Lambda function must return a JSON object containing at least statusCode, headers, and a stringified body; and API Gateway automatically passes the entire client request (including headers, query parameters, and body) as a single JSON object to the input event of the Lambda function.
In a Lambda proxy integration, API Gateway passes the raw client request directly to the Lambda function as a single JSON event structure, removing the need for request mapping templates. On the response path, API Gateway expects the Lambda function to return a specific JSON format containing the status code, headers, and body. If the function returns a raw string or lacks the expected structure, API Gateway will throw a 502 Bad Gateway error.

Adım Adım Çözüm

1
Analyze the integration type selected by the developer, which is Lambda proxy integration.
Identify that Lambda proxy integration requires strict output formatting from the backend and passes the raw request directly to the backend without API Gateway mapping templates.
This establishes the core constraints of proxy integration vs. custom integration.
2
Evaluate how request data is passed from API Gateway to the backend Lambda function.
Determine that the entire HTTP request payload, including path parameters, query parameters, headers, and body, is mapped to the input event object automatically.
This validates the request-side requirements.
3
Evaluate the response contract required for Lambda proxy integration.
Determine that the Lambda function must return a specific JSON response containing fields such as statusCode, headers, and a stringified body, otherwise API Gateway will return a 502 Bad Gateway error.
This validates the response-side requirements.

Anahtar Kavram

Understanding request and response structure in API Gateway Lambda Proxy integration
Soru 387Soru →

A developer is implementing a serverless video processing pipeline. When a user uploads a new video, an Amazon SNS topic publishes an event that is fanned out to an Amazon SQS queue. An AWS Lambda function is configured to process messages from this SQS queue and perform CPU-intensive transcoding, which takes approximately 6 minutes per video. During initial testing, the developer notices two issues: some videos are processed multiple times, resulting in duplicate files in the target Amazon S3 bucket, and the Lambda function periodically times out before completing the transcoding task. Which two configuration changes should the developer implement to resolve these issues?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Increase the visibility timeout of the SQS queue to 42 minutes, following the AWS best practice of setting it to at least six times the Lambda function's timeout.; Increase the execution timeout of the Lambda function to 7 minutes (420 seconds) to allow the transcoding process to complete.

Cevap

Increase the visibility timeout of the SQS queue to 42 minutes, and increase the execution timeout of the Lambda function to 7 minutes (420 seconds).
To ensure messages are processed successfully exactly once without duplicate processing, the developer must align the Lambda function execution timeout and the SQS visibility timeout. First, the Lambda execution timeout must be increased to at least 7 minutes so that the 6-minute transcoding task can finish without being killed. Second, the SQS visibility timeout must be increased to at least 42 minutes (six times the Lambda function timeout). This prevents SQS from making the message visible to other consumers while the Lambda function is actively processing it, avoiding duplicate deliveries.

Adım Adım Çözüm

1
Analyze the execution duration of the backend processing task.
The transcoding task takes approximately 6 minutes, which exceeds the default Lambda timeout and standard SQS visibility window.
Identifying the processing duration helps establish the minimum required thresholds for Lambda execution limits and queue visibility configurations.
2
Adjust the Lambda function's execution timeout to accommodate the workload.
The execution timeout is configured to 7 minutes (420 seconds).
This prevents the Lambda function from being aborted by AWS while the 6-minute transcoding task is running.
3
Apply AWS best practices to configure the SQS queue's visibility timeout based on the new Lambda timeout.
The SQS queue's visibility timeout is set to 42 minutes (6 times the Lambda timeout).
A visibility timeout of at least six times the function's timeout prevents messages from returning to the queue and being reprocessed by another instance before the active Lambda function has finished processing them.

Anahtar Kavram

Configuring SQS visibility timeout in relation to Lambda function timeouts to prevent duplicate message processing.
Soru 388Soru →

A developer is designing a real-time multiplayer analytics pipeline. A game server fleet publishes telemetry events to a custom Amazon EventBridge event bus. The developer wants to route these events to an Amazon Kinesis Data Stream for session-based aggregation. To prevent write throttling due to uneven distribution of records and ensure EventBridge can successfully publish to the stream, which two configurations must the developer implement?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the EventBridge target for the Kinesis Data Stream to use a PartitionKeyPath that extracts the game session identifier (e.g., $.detail.game_session_id) from the JSON event payload.; Associate an IAM role with the EventBridge rule target that has a trust policy allowing the events.amazonaws.com service principal to assume the role, and a permissions policy allowing the kinesis:PutRecord action.

Cevap

The developer must configure the EventBridge target to use a PartitionKeyPath that extracts the game session identifier from the JSON payload, and associate an IAM role with the target that trusts the EventBridge service principal and has permissions to put records into the Kinesis stream.
To successfully route events from EventBridge to Kinesis, EventBridge needs permission to write to the Kinesis stream. This is accomplished by creating an IAM role that trusts the EventBridge service principal (events.amazonaws.com) and contains permissions to perform the kinesis:PutRecord action on the target stream. Additionally, to avoid hot shards and write throttling (such as a ProvisionedThroughputExceededException), the partition key must have high cardinality. Using a PartitionKeyPath to extract a dynamic field like the session identifier from the event payload ensures records are evenly distributed across the stream's shards.

Adım Adım Çözüm

1
Analyze EventBridge target security requirements for Kinesis Data Streams.
Determine that EventBridge requires an IAM role with a trust policy for events.amazonaws.com and write access (kinesis:PutRecord) to the target stream.
EventBridge is a regional service that must assume a developer-provided role to publish events directly to a Kinesis stream target.
2
Analyze Kinesis partitioning strategy to prevent write throttling.
Determine that a dynamic PartitionKeyPath (like $.detail.game_session_id) must be specified in the EventBridge target configuration.
Using high-entropy fields distributes records evenly across multiple shards, preventing ProvisionedThroughputExceededException.
3
Evaluate network connectivity requirements for downstream consumers.
Ensure the consumer Lambda function has access to Kinesis, which requires internet access via a NAT Gateway or an AWS PrivateLink VPC endpoint if deployed in a private subnet.
Lambda functions inside a VPC require proper route tables and gateways to reach public AWS services.

Anahtar Kavram

Stream Processing and Event Routing with Amazon Kinesis and EventBridge
Tahmini Süre:2m 0s
Soru 389Soru →

A developer is designing a real-time notification service for a collaborative task management application. The application stores notifications in an Amazon DynamoDB table with the following schema:

- Partition key: `RecipientUserID` (String)
- Sort key: `NotificationTimestamp` (String)
- Attributes: `IsRead` (Boolean), `Message` (String)

The service needs to retrieve only the unread notifications for a specific user, sorted from newest to oldest. The developer implements a `Query` operation on the base table using a `KeyConditionExpression` of RecipientUserID=:userId\text{RecipientUserID} = \text{:userId} and a `FilterExpression` of IsRead=:false\text{IsRead} = \text{:false}.

As the number of read notifications per user grows over time, the application experiences latency spikes and frequently receives `ProvisionedThroughputExceededException` errors, even though the volume of unread notifications remains low. Which approach is the most cost-effective and performant way to optimize this read operation?

Cevabı ve açıklamayı göster

Cevap: Modify the application to write a new attribute `UnreadTimestamp` only for unread notifications, removing it when marked as read. Create a Global Secondary Index (GSI) with `RecipientUserID` as the partition key and `UnreadTimestamp` as the sort key to query unread notifications directly.

Cevap

Modify the application to write a new attribute `UnreadTimestamp` only for unread notifications, removing it when marked as read. Create a Global Secondary Index (GSI) with `RecipientUserID` as the partition key and `UnreadTimestamp` as the sort key to query unread notifications directly.
The correct answer utilizes a sparse Global Secondary Index (GSI). By writing the sort key attribute `UnreadTimestamp` only for unread notifications and removing it when they are read, the index only contains unread notifications. Querying this GSI returns only the relevant items, significantly reducing RCU consumption and preventing throughput throttling.

Adım Adım Çözüm

1
Analyze base table query behavior and capacity consumption
DynamoDB consumes Read Capacity Units (RCUs) based on the size of all items returned by the key condition expression (RecipientUserID = :userId), before the filter expression (IsRead = :false) is applied. As read notifications grow, this results in high RCU consumption and eventual throttling.
To identify why the current implementation fails to scale and why increasing RCUs on the base table is not the correct solution.
2
Design a sparse index strategy to filter items at the storage layer
Create a schema modification where an attribute like `UnreadTimestamp` only exists when a notification is unread. When the notification is read, the attribute is deleted.
DynamoDB Global Secondary Indexes (GSIs) are sparse by default: they only contain items that possess both the GSI partition key and sort key. This ensures the index size remains minimal and only contains active unread items.
3
Configure the GSI keys and query the index
Define the GSI with `RecipientUserID` as the partition key and `UnreadTimestamp` as the sort key. Query the GSI using `RecipientUserID = :userId` to fetch only unread notifications sorted chronologically.
To retrieve the required dataset directly without wasting RCUs on read notifications, achieving optimal performance and cost efficiency.

Anahtar Kavram

Sparse Global Secondary Indexes in Amazon DynamoDB
Soru 390Soru →

An application team is designing a real-time fraud detection system for a mobile payments platform. The application publishes transaction details as JSON events to a custom Amazon EventBridge event bus. A developer must create an EventBridge rule that filters transaction events to identify high-value payments exceeding 50005000 USD and routes them directly to an Amazon Kinesis Data Stream. The solution must ensure that transactions from the same user are processed in the order they occurred, without causing hot shards under normal load, and that the rule has the necessary access to publish to the stream. Which TWO configurations must the developer implement to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the EventBridge rule target with the PartitionKeyPath parameter set to $.detail.userId to route events for the same user to the same Kinesis shard.; Create an IAM role with a trust policy that allows the events.amazonaws.com service principal to perform sts:AssumeRole, and a permission policy that grants the role kinesis:PutRecord permissions on the Kinesis stream.

Cevap

The developer must configure the EventBridge target with a PartitionKeyPath pointing to the user ID payload attribute, and assign an IAM role whose trust policy permits the EventBridge service principal to assume it and whose permissions policy allows writing to the Kinesis stream.
The correct options implement the appropriate target parameters and cross-service permissions. Specifying the user ID as the PartitionKeyPath ensures ordered delivery per user while avoiding hot shards. Providing an IAM role with a trust policy allowing the EventBridge service principal to assume it and permission policy allowing kinesis:PutRecord allows EventBridge to successfully write the filtered events to the Kinesis stream.

Adım Adım Çözüm

1
Evaluate partitioning and ordering constraints.
Identify that Kinesis preserves transaction order within a single shard based on the partition key. To prevent hot shards and guarantee per-user ordering, a high-entropy field like the user ID must be chosen.
Choosing a low-entropy field like transaction status causes uneven shard utilization and fails the user-specific ordering requirement.
2
Set the target parameters in the EventBridge rule.
Configure the PartitionKeyPath target property using the JSONPath expression $.detail.userId.
This extracts the user ID from the EventBridge event detail payload and applies it as the partition key for Kinesis.
3
Define cross-service IAM authorization.
Create an IAM role allowing the events.amazonaws.com principal to assume the role, and associate a policy that allows kinesis:PutRecord on the target stream.
EventBridge needs explicit trust configuration to assume the role and permissions to write events to the stream.

Anahtar Kavram

Routing events from Amazon EventBridge to Amazon Kinesis Data Streams requires specifying a target JSONPath-based partition key for ordering and shard distribution, along with establishing an IAM trust relationship and permission boundary for EventBridge.
Soru 391Soru →

A developer is configuring an AWS Lambda function with the execution role `arn:aws:iam::123456789012:role/MyLambdaExecutionRole`. The Lambda function needs to temporarily assume a different IAM role named `arn:aws:iam::123456789012:role/TargetReportingRole` to perform analytical reporting. During execution, the Lambda function code calls the AWS Security Token Service (AWS STS) `AssumeRole` API but fails with an `AccessDenied` error. Which of the following configurations are required to successfully allow this role assumption? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: A permission policy attached to MyLambdaExecutionRole that allows the sts:AssumeRole action on the TargetReportingRole resource; A trust policy on TargetReportingRole that allows the principal MyLambdaExecutionRole to perform the sts:AssumeRole action

Cevap

To allow the Lambda function to assume the target role, you must attach a permission policy to the Lambda execution role allowing the sts:AssumeRole action on the target role's ARN, and configure the target role's trust policy to trust the Lambda execution role.
For an IAM entity to assume an IAM role, two conditions must be met: the caller's identity-based policy must explicitly allow the sts:AssumeRole action on the target role's resource ARN, and the target role's trust policy must list the caller's role ARN as a trusted principal for the sts:AssumeRole action.

Adım Adım Çözüm

1
Authorize the caller (Lambda execution role)
The Lambda execution role is granted identity-based permissions to call the sts:AssumeRole action targeting the TargetReportingRole ARN.
The entity initiating the role assumption must be permitted by its own policies to perform the assumption action.
2
Configure trust on the destination (TargetReportingRole)
The trust policy of TargetReportingRole is modified to list the Lambda execution role ARN as a trusted principal for the sts:AssumeRole action.
An IAM role must explicitly define and trust the identities that are permitted to assume it.

Anahtar Kavram

IAM role assumption requires a two-way configuration: permissions on the caller (identity-based policy) and trust on the receiver (trust policy).
Soru 392Soru →

A developer is optimizing a backend order-management microservice for a high-volume retail application. The application stores order details in an Amazon DynamoDB table. The base table has `CustomerID` as the partition key and `OrderID` as the sort key. The average size of an item in the base table is 10 KB10\text{ KB}.

The developer needs to support a new dashboard feature that frequently retrieves the `OrderID`, `OrderDate`, and `TotalAmount` for all orders that have an `OrderStatus` of `BACKORDERED`. These results must be returned chronologically by `OrderDate`. The dashboard is expected to perform 8080 individual query requests per second, each retrieving a single order's projected fields. The dashboard can tolerate eventually consistent data. The average size of the projected attributes (`OrderID`, `OrderDate`, `TotalAmount`) along with the primary keys is 1.5 KB1.5\text{ KB}.

Which configuration will meet these requirements with the lowest latency and lowest provisioned Read Capacity Units (RCUs)?

Cevabı ve açıklamayı göster

Cevap: Create a Global Secondary Index (GSI) with `OrderStatus` as the partition key and `OrderDate` as the sort key. Configure the GSI projection type to `INCLUDE` and project `TotalAmount`. Provision 40 RCUs40\text{ RCUs} for the GSI.

Cevap

Create a Global Secondary Index (GSI) with OrderStatus as the partition key and OrderDate as the sort key. Configure the GSI projection type to INCLUDE and project TotalAmount. Provision 40 RCUs for the GSI.
The correct answer recommends creating a Global Secondary Index (GSI) with `OrderStatus` as the partition key and `OrderDate` as the sort key, projecting only the required attributes (`TotalAmount`) via `INCLUDE`. Because the dashboard needs to query across all customers for a specific status, a GSI is required. By projecting only the necessary fields, the index item size remains small (1.5 KB1.5\text{ KB}), which rounds up to 4 KB4\text{ KB} for capacity calculations. For eventually consistent reads, each 4 KB4\text{ KB} read request consumes 0.5 RCU0.5\text{ RCU} (1 RCU1\text{ RCU} per 2 reads/sec). Therefore, performing 8080 reads per second requires exactly 40 RCUs40\text{ RCUs}.

Adım Adım Çözüm

1
Determine the correct indexing strategy to query across different partition keys.
A Global Secondary Index (GSI) with `OrderStatus` as the partition key and `OrderDate` as the sort key is selected.
The base table's partition key is `CustomerID`, but the queries do not specify a customer. An LSI cannot cross partitions, so a GSI is required to query by `OrderStatus` and sort by `OrderDate` across the entire table.
2
Determine the optimal projection type for the GSI to minimize item size.
The GSI is configured with projection type `INCLUDE` containing the `TotalAmount` attribute.
Projecting only `TotalAmount` keeps the GSI item size small (1.5 KB1.5\text{ KB}), because the base table keys (`CustomerID`, `OrderID`) and the GSI keys (`OrderStatus`, `OrderDate`) are automatically projected.
3
Calculate the required Read Capacity Units (RCUs) for the projected index.
The RCU calculation results in 40 RCUs40\text{ RCUs} for the GSI.
The projected item size is 1.5 KB1.5\text{ KB}, which rounds up to the next 4 KB4\text{ KB} increment (4 KB4\text{ KB}). For eventually consistent reads, 1 RCU performs 2 reads per second. To support 8080 reads per second: RCUs=80/2=40\text{RCUs} = 80 / 2 = 40.

Anahtar Kavram

DynamoDB index selection and Read Capacity Unit (RCU) optimization based on attribute projection and consistency models.
Tahmini Süre:2m 30s
Soru 393Soru →

A developer is implementing a serverless integration where an Amazon Simple Queue Service (Amazon SQS) queue triggers an AWS Lambda function to process batch data. Each batch of messages takes approximately 4 minutes to process, and the Lambda function's timeout is configured to 5 minutes. During testing, the developer notices that many messages are being received and processed multiple times by separate Lambda execution environments. Which action should the developer take to prevent these duplicate executions?

Cevabı ve açıklamayı göster

Cevap: Increase the Amazon SQS queue's visibility timeout to at least 30 minutes.

Cevap

Increase the Amazon SQS queue's visibility timeout to at least 30 minutes.
To prevent duplicate processing of SQS messages by Lambda, the SQS queue's visibility timeout must be set to at least 6 times the Lambda function's timeout. Since the Lambda function timeout is 5 minutes, the visibility timeout must be configured to at least 30 minutes (6×5=306 \times 5 = 30). This ensures messages remain invisible while the Lambda function processes the batch and handles any potential retries.

Adım Adım Çözüm

1
Identify the cause of duplicate message processing.
The issue occurs because the SQS visibility timeout is too short, allowing other execution environments to pull the message before the active Lambda function completes and deletes it.
Since each batch takes 4 minutes and the Lambda timeout is 5 minutes, SQS must keep the messages hidden long enough to cover execution and retry attempts.
2
Calculate the recommended SQS visibility timeout.
Using the formula Visibility Timeout≥6×Lambda Timeout\text{Visibility Timeout} \ge 6 \times \text{Lambda Timeout}, we calculate 6×5 minutes=30 minutes6 \times 5\text{ minutes} = 30\text{ minutes}.
AWS recommends a visibility timeout of at least 6 times the Lambda function's timeout to prevent duplicate processing during retries.
3
Configure the SQS queue with the calculated value.
Setting the SQS queue's visibility timeout to at least 30 minutes resolves the duplicate processing issue.
This guarantees that messages remain invisible in the queue for the entire duration of the Lambda execution and potential retries.

Anahtar Kavram

Amazon SQS visibility timeout configuration for AWS Lambda integrations
Soru 394Soru →

A developer is configuring an AWS Lambda function that must query an Amazon Aurora PostgreSQL database cluster deployed in private subnets within a VPC. The Lambda function also needs to call an external, third-party payment processing API on the public internet. Which network configurations must the developer implement to enable this connectivity? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Associate the Lambda function with the private subnets where the Amazon Aurora database cluster resides.; Configure a NAT Gateway in a public subnet, and update the route tables of the private subnets to route outbound traffic through the NAT Gateway.

Cevap

Associate the Lambda function with the private subnets where the Amazon Aurora database cluster resides, and configure a NAT Gateway in a public subnet while updating the route tables of the private subnets to route outbound traffic through the NAT Gateway.
To connect the Lambda function to the database, it must be integrated with the VPC and associated with the private subnets where the database resides. To connect to the external payment API from inside the private subnets, a NAT Gateway must be configured in a public subnet, and the private subnet route tables must be updated to route outbound traffic to the NAT Gateway.

Adım Adım Çözüm

1
Analyze the database connectivity requirement.
The Lambda function needs to query an Amazon Aurora database cluster in private subnets. To reach it, the Lambda function must be configured to associate with those private subnets.
This creates Elastic Network Interfaces (ENIs) inside the private subnets, enabling local network communication within the VPC.
2
Analyze the external API connectivity requirement.
The Lambda function in private subnets requires internet access to reach the third-party API. A NAT Gateway must be set up in a public subnet, and the private subnet route tables must direct 0.0.0.0/0 traffic to it.
This allows outbound-only internet traffic to flow from the private subnets to the public internet.

Anahtar Kavram

AWS Lambda VPC networking configuration for internal and external resources
Soru 395Soru →

A developer is designing a decoupled backend for a ridesharing application to handle completed trip events. When a trip ends, the system publishes a trip event that must be processed by two independent microservices:

1. A trip analytics service that calculates aggregate metrics and consumes messages from an Amazon SQS Standard queue.
2. A financial ledger service that updates customer balances in the exact order the trips occurred, utilizing an Amazon SQS FIFO queue.

The developer wants to implement a fanout pattern using Amazon SNS to distribute these events.

Which architectural configuration will successfully support this integration?

Cevabı ve açıklamayı göster

Cevap: Create an Amazon SNS Standard topic to publish events to the SQS Standard queue, and create a separate Amazon SNS FIFO topic to publish events to the SQS FIFO queue.

Cevap

Create one Amazon SNS Standard topic to publish events to the SQS Standard queue, and create a separate Amazon SNS FIFO topic to publish events to the SQS FIFO queue.
The correct configuration uses two separate SNS topics (one Standard and one FIFO) to publish to their respective SQS queues. This is required because Amazon SNS FIFO topics only support subscriptions from SQS FIFO queues, and Standard SQS queues cannot subscribe to SNS FIFO topics. Similarly, SQS FIFO queues cannot subscribe to Standard SNS topics. To support both downstream consumer types, separate paths must be implemented.

Adım Adım Çözüm

1
Analyze SQS queue requirements.
The analytics service uses a standard SQS queue, whereas the ledger service requires a FIFO SQS queue for strict ordering.
Different downstream services have different order and throughput requirements.
2
Evaluate Amazon SNS and SQS integration constraints.
Standard SQS queues cannot subscribe to SNS FIFO topics, and SQS FIFO queues cannot subscribe to standard SNS topics.
AWS enforces protocol homogeneity between standard and FIFO tiers to ensure ordering guarantees are maintained.
3
Formulate the fanout architecture.
Create a standard SNS topic to target the standard SQS queue, and a FIFO SNS topic to target the FIFO SQS queue.
Since a single SNS topic cannot fan out to both queue types due to subscription rules, the publisher must send events to both a standard and a FIFO topic.

Anahtar Kavram

Integration compatibility rules between Amazon SNS topics (Standard/FIFO) and Amazon SQS queues (Standard/FIFO).
Soru 396Soru →

A developer is building a smart home energy monitoring dashboard. The energy usage data is stored in an Amazon DynamoDB table where the partition key is SmartMeterID and the sort key is ReadingTimestamp. The developer needs to retrieve all energy consumption readings for a specific SmartMeterID over the last 7 days to display them on a user dashboard.

Which of the following approaches is the most performant and cost-effective method to retrieve these records?

Cevabı ve açıklamayı göster

Cevap: Execute a Query operation with a KeyConditionExpression that specifies the SmartMeterID and uses a comparison operator on the ReadingTimestamp sort key.

Cevap

Execute a Query operation with a KeyConditionExpression that specifies the SmartMeterID and uses a comparison operator on the ReadingTimestamp sort key.
The Query operation is the most efficient and cost-effective way to retrieve items from a DynamoDB table when the partition key is known. By specifying the partition key (SmartMeterID) and using a comparison operator on the sort key (ReadingTimestamp) in the KeyConditionExpression, DynamoDB only reads the items that match the criteria, minimizing the consumed Read Capacity Units (RCUs).

Adım Adım Çözüm

1
Identify the primary key structure of the Amazon DynamoDB table.
The partition key is SmartMeterID, and the sort key is ReadingTimestamp.
Knowing the primary key structure determines which retrieval operations (GetItem, Query, or Scan) are supported and efficient.
2
Determine the data retrieval requirements.
The query needs to target a specific SmartMeterID and a specific range of ReadingTimestamp values (the last 7 days).
This requirement matches the exact structure of a Query operation, which requires an equality comparison on the partition key and optional range comparisons on the sort key.
3
Select the most efficient operation and define the parameters.
Use the Query API with a KeyConditionExpression that specifies the SmartMeterID and a comparison operator (such as BETWEEN or >) on ReadingTimestamp.
A Query operation only searches and consumes Read Capacity Units (RCUs) for the partition and matching sort key range, unlike a Scan which processes the entire table.

Anahtar Kavram

Efficient data retrieval using the DynamoDB Query API vs Scan API
Soru 397Soru →

A developer is implementing an AWS Lambda function in Node.js to process events. The developer wants to log the count of processed items for each individual invocation. The function code is structured as follows:

javascript
let totalItems = 0;

exports.handler = async (event) => {
totalItems += event.items.length;
console.log(`Processed ${totalItems} items.`);
return { statusCode: 200 };
};

During testing, the developer observes that when the function is invoked repeatedly in short succession, the logged count accumulates across requests rather than reflecting only the items processed in the current invocation.

Which of the following modifications should the developer make to ensure the function correctly logs only the items processed in the current invocation?

Cevabı ve açıklamayı göster

Cevap: Declare the totalItems variable inside the handler function so that it is re-initialized on each invocation.

Cevap

Declare the totalItems variable inside the handler function so that it is re-initialized on each invocation.
Declaring the variable inside the handler function ensures that its scope is limited to a single invocation. AWS Lambda reuses execution contexts to optimize performance on subsequent requests. Variables declared outside the handler (globally) persist across warm start invocations, leading to state leakage and cumulative counts, whereas local variables inside the handler are re-initialized on every execution.

Adım Adım Çözüm

1
Analyze the variable scope and lifecycle of variables declared outside the handler function in AWS Lambda.
Identify that variables declared outside the handler (globally) are preserved in memory across subsequent execution context reuse (warm starts).
AWS Lambda reuses the container/execution context to minimize cold start latency, which keeps global state alive.
2
Determine the correct place to declare variables that must be isolated and reset per execution.
Move the variable declaration inside the handler block.
Local variable declarations inside the handler function run on every invocation, ensuring they start at 0 each time.

Anahtar Kavram

AWS Lambda Execution Context Reuse and Variable Scoping
Tahmini Süre:1m 30s
Soru 398Soru →

A developer is designing the data tier for a mobile multiplayer game. Player match logs are stored in an Amazon DynamoDB table with `PlayerID` as the partition key and `MatchID` as the sort key. The table contains millions of records. The game client needs to perform two operations:

1. Retrieve all matches played by a specific player within the last 77 days.
2. Retrieve all matches across the entire game where a player scored more than 10,00010,000 points.

Which TWO strategies should the developer implement to support these access patterns with the lowest read latency and minimum consumption of Read Capacity Units (RCUs)?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a Global Secondary Index (GSI) with `PlayerID` as the partition key and `MatchTimestamp` as the sort key, and query the GSI to retrieve the player's recent matches.; Implement a sparse Global Secondary Index (GSI) by writing a `HighScoreThreshold` attribute only when a score exceeds 10,00010,000, and query the GSI to retrieve the high-scoring matches.

Cevap

The developer should create a Global Secondary Index (GSI) with PlayerID as the partition key and MatchTimestamp as the sort key to retrieve a player's recent matches. Additionally, they should implement a sparse GSI by writing a HighScoreThreshold attribute only when a score exceeds 10,000, and query this GSI for high-scoring matches.
Querying a Global Secondary Index (GSI) configured with PlayerID as the partition key and MatchTimestamp as the sort key allows the application to perform a highly efficient query to retrieve recent matches for a specific player. Additionally, creating a sparse GSI by conditionally writing a HighScoreThreshold attribute only when a score exceeds 10,000 enables the application to query only the high-scoring matches, bypassing the need to perform a costly scan of the entire table.

Adım Adım Çözüm

1
Analyze the access pattern for retrieving matches for a specific player within a 77-day window.
Identify that the base table only supports querying by PlayerID and MatchID. Filtering by MatchTimestamp on the base table requires a Scan or a Query with a FilterExpression, both of which read extra data and waste RCU.
To retrieve only the relevant matches directly, we must place MatchTimestamp as the sort key in a secondary index.
2
Create a Global Secondary Index (GSI) to resolve the first access pattern.
Define a GSI with PlayerID as the partition key and MatchTimestamp as the sort key. Use a Query operation on this GSI with a KeyConditionExpression to fetch matches within the 77-day range.
This allows DynamoDB to read only the items that match the criteria, minimizing RCU consumption.
3
Analyze the access pattern for retrieving high-scoring matches across all players.
Scanning the base table is highly inefficient because it evaluates every record. We need a way to only index and retrieve records where the score is greater than 10,00010,000.
Using a sparse index will exclude low-scoring matches from the GSI, significantly reducing index size and retrieval costs.
4
Implement a sparse GSI for the second access pattern.
Modify the application logic to write a HighScoreThreshold attribute (e.g., containing the score) to the base table item only if the score exceeds 10,00010,000. Create a GSI with HighScoreThreshold as the partition key.
Items without the HighScoreThreshold attribute will not be indexed in the GSI, making the GSI sparse. Querying this sparse GSI directly targets high-scoring matches without scanning other records.

Anahtar Kavram

Optimizing read operations in DynamoDB using Global Secondary Indexes (GSIs) and sparse indexes instead of performing full table Scan operations.
Tahmini Süre:2m 0s
Soru 399Soru →

A developer is implementing a microservices-based subscription management system. When a customer's subscription changes, a backend service publishes a message. This message must be processed by three downstream components:

* A billing service that requires messages to be processed in the exact order they occurred to prevent payment conflicts, with zero duplicate deliveries.
* An email notification service that receives all subscription change events to send customer alerts.
* A marketing analytics engine that only processes subscription upgrade events.

Which combination of configuration steps will satisfy these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an Amazon SNS FIFO topic to receive the subscription events, and subscribe Amazon SQS FIFO queues for the billing, email, and analytics services to this topic.; Configure an Amazon SNS subscription filter policy on the analytics service's queue subscription to only accept messages where the event type attribute is set to 'upgrade'.

Cevap

Create an Amazon SNS FIFO topic to receive the subscription events, and subscribe Amazon SQS FIFO queues for the billing, email, and analytics services to this topic; and configure an Amazon SNS subscription filter policy on the analytics service's queue subscription to only accept messages where the event type attribute is set to 'upgrade'.
To satisfy the requirements of message ordering and deduplication for the billing service, an Amazon SNS FIFO topic combined with Amazon SQS FIFO queues must be used. SNS FIFO topics only support SQS FIFO queues as subscribers. Therefore, SQS FIFO queues must be configured for all downstream services subscribing to the FIFO topic. To ensure the marketing analytics engine only processes subscription upgrade events, a subscription filter policy should be configured on the analytics service's subscription to inspect message attributes and filter out non-upgrade events.

Adım Adım Çözüm

1
Analyze the message ordering and deduplication requirements for the billing service.
Identify that end-to-end FIFO (First-In-First-Out) ordering and exactly-once processing require Amazon SNS FIFO and Amazon SQS FIFO.
Standard SNS and SQS services do not guarantee strict ordering or duplicate prevention.
2
Determine the subscriber requirements for the SNS FIFO topic.
Recognize that Amazon SNS FIFO topics only support Amazon SQS FIFO queues as subscribers.
All downstream queues (billing, email, and analytics) must be SQS FIFO queues to subscribe to the SNS FIFO topic.
3
Apply event filtering for the marketing analytics engine.
Implement an SNS subscription filter policy on the analytics queue subscription to filter messages based on the event type attribute.
This offloads the filtering logic from the application to SNS, ensuring only upgrade events are delivered to the analytics queue.

Anahtar Kavram

Decoupling microservices using Amazon SNS FIFO topics and Amazon SQS FIFO queues with subscription filter policies.
Soru 400Soru →

A developer is designing an AWS Lambda function that processes payment transactions. The function needs to retrieve a payment gateway API key from AWS Systems Manager Parameter Store and write transaction status records to an Amazon DynamoDB table. The developer wants to optimize the function's startup time and runtime performance to handle sudden traffic spikes.

Which two configuration or coding practices should the developer implement to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Initialize the DynamoDB client outside of the Lambda handler function to enable execution context reuse.; Retrieve the API key from Systems Manager Parameter Store outside of the Lambda handler function during the initialization phase.

Cevap

Initialize the DynamoDB client outside of the Lambda handler function, and retrieve the API key from Systems Manager Parameter Store outside of the Lambda handler function during the initialization phase.
Initializing the DynamoDB client and fetching parameters outside the handler leverages the Lambda execution environment lifecycle. Since the execution context is reused for warm starts, these initialization actions occur only during the cold start phase, saving significant time on subsequent invocations.

Adım Adım Çözüm

1
Analyze execution context reuse benefits in AWS Lambda.
Identify that variables and SDK clients initialized outside the handler function persist across multiple invocations in the same execution environment container.
This reduces the overhead of re-establishing TCP connections and performing initialization logic on every invocation.
2
Evaluate the placement of the Parameter Store lookup.
Placing the Parameter Store lookup outside the handler caches the API key in memory, avoiding redundant network requests during subsequent invocations.
Parameter caching in the global scope optimizes execution time and reduces costs related to API calls.
3
Address security and networking constraints.
Reject hardcoding credentials because of security risks. Reject deploying the Lambda function to a public subnet to access AWS services, because Lambda functions in a VPC require a NAT Gateway or VPC endpoint to route traffic to the internet/AWS endpoints.
Standard VPC routing requires private subnets with a NAT Gateway or VPC endpoints for Lambda functions to access external services safely.

Anahtar Kavram

Execution context reuse for caching SDK clients and configuration parameters.
ÖncekiSayfa 20 / 78Sonraki