Examkin

Tüm alıştırma soruları

1542 soru

Tüm türler1,542Çoktan seçmeli782Çoklu seçim746Sıralama14
Soru 1121Soru →

A developer has a serverless application where an Amazon API Gateway REST API integrates with an AWS Lambda function. The Lambda function processes incoming HTTP requests, sends messages to an Amazon SQS queue, and writes records to an Amazon DynamoDB table. Active tracing is enabled on both the API Gateway stage and the Lambda function. However, in the AWS X-Ray service map, downstream calls to SQS and DynamoDB are missing, and some messages in the SQS queue are being processed multiple times by downstream consumers. Which of the following actions should the developer take to ensure that downstream DynamoDB and SQS calls are properly traced in AWS X-Ray?

Cevabı ve açıklamayı göster

Cevap: Instrument the AWS SDK client using the AWS X-Ray SDK in the Lambda function code to capture downstream calls.

Cevap

Instrument the AWS SDK client using the AWS X-Ray SDK in the Lambda function code to capture downstream calls.
The correct answer is to instrument the AWS SDK client using the AWS X-Ray SDK in the Lambda function code. Active tracing on AWS Lambda only traces the incoming invocation and function overhead. To trace downstream calls made to services like SQS or DynamoDB, the developer must explicitly wrap or patch the AWS SDK client using the AWS X-Ray SDK.

Adım Adım Çözüm

1
Identify why downstream calls are missing from the AWS X-Ray service map.
Realize that active tracing on AWS Lambda only covers the Lambda service and function execution, but does not auto-instrument SDK clients inside the code.
To capture calls to downstream services like DynamoDB and SQS, the AWS SDK client inside the application code must be wrapped or patched by the AWS X-Ray SDK.
2
Apply X-Ray SDK client instrumentation in the Lambda function.
The AWS SDK client is instrumented (e.g., using AWSXRay.captureAWS in Node.js or patch_all() in Python).
This configuration allows the X-Ray SDK to intercept and trace outbound requests made by the AWS SDK client.
3
Ensure that the Lambda function execution role has appropriate permissions.
The Lambda execution role has the AWSXrayWriteOnlyAccess policy attached.
The function must have IAM permissions to write trace data to AWS X-Ray.

Anahtar Kavram

AWS X-Ray SDK instrumentation of AWS SDK clients is required to trace downstream calls from AWS Lambda.
Tahmini Süre:1m 30s
Soru 1122Soru →

A developer is configuring an AWS CodePipeline where an AWS CodeBuild stage runs automated unit tests. The CodeBuild project has been assigned a custom IAM service role with permission policies that grant access to target Amazon S3 buckets and Amazon CloudWatch Logs. However, when the pipeline runs, the CodeBuild execution fails during the start phase with the error message: `CodeBuild is not authorized to perform: sts:AssumeRole on the specified service role`. What is the correct action to troubleshoot and resolve this failure?

Cevabı ve açıklamayı göster

Cevap: Update the trust policy of the custom IAM service role to allow the codebuild.amazonaws.com service principal to perform the sts:AssumeRole action.

Cevap

Update the trust policy of the custom IAM service role to allow the codebuild.amazonaws.com service principal to perform the sts:AssumeRole action.
The correct action is to update the trust policy of the custom IAM service role to allow the codebuild.amazonaws.com service principal to perform the sts:AssumeRole action. For AWS CodeBuild to execute a build, the CodeBuild service itself must be authorized to assume the role assigned to the project. This authorization is granted through the role's trust policy, not its permission policy.

Adım Adım Çözüm

1
Identify the cause of the failure based on the error message.
The error `CodeBuild is not authorized to perform: sts:AssumeRole` indicates that AWS CodeBuild cannot assume the IAM role assigned to the project.
When CodeBuild starts a build, it must assume the specified service role using the Security Token Service (STS) to gain permissions to access other AWS services.
2
Locate and edit the IAM service role in the AWS Management Console or via CLI.
Access the Trust Relationships tab of the custom IAM role.
The trust policy defines which entities (services, users, or accounts) are allowed to assume the role.
3
Configure the trust policy to allow the CodeBuild service principal.
Add 'codebuild.amazonaws.com' as a trusted service principal with the 'sts:AssumeRole' action.
This establishes the necessary trust relationship, resolving the authorization error and allowing CodeBuild to run the project successfully.

Anahtar Kavram

AWS CodeBuild Service Role Trust Relationships
Soru 1123Soru →

An IoT application managed by AeroFleet Logistics tracks real-time location data for thousands of delivery vehicles. The application writes updates to an Amazon DynamoDB table. The table's partition key is `vehicle_status` (which only contains values such as `ACTIVE`, `INACTIVE`, or `MAINTENANCE`), and the sort key is a timestamp. During peak hours, the application frequently receives `ProvisionedThroughputExceededException` errors during writes. A review of CloudWatch metrics shows that the overall table-level consumed Write Capacity Units (WCUs) are far below the provisioned WCU limit, but writes are heavily skewed to a single partition key value. Which of the following combinations of actions should the developer take to resolve these throttling issues and make the application more resilient to transient write failures? (Select TWO options.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Redesign the partition key schema by appending a calculated or random suffix (e.g., 11 to NN) to the `vehicle_status` partition key to distribute write operations across multiple physical partitions.; Configure the application SDK client to implement exponential backoff with jitter for write requests to handle throttling during write spikes gracefully.

Cevap

Redesign the partition key schema by appending a calculated or random suffix to the partition key, and configure the SDK client to implement exponential backoff with jitter.
The correct response involves redesigning the partition key schema by appending a calculated suffix (write-sharding) and modifying the client SDK retry configurations. Adding a suffix distributes writes across multiple partition keys, mitigating hot partition problems. Implementing exponential backoff with jitter ensures that retry attempts do not overwhelm the partition during traffic surges.

Adım Adım Çözüm

1
Diagnose the root cause using CloudWatch metrics.
Confirmed that partition key cardinality is too low, causing skewed traffic to a single partition, exceeding the limit of 10001000 WCUs per partition.
To verify that the ProvisionedThroughputExceededException is due to hot partitions rather than overall table WCU exhaustion.
2
Introduce write sharding using synthetic suffixes.
Append a randomized or calculated suffix (e.g., 11 to NN) to the `vehicle_status` partition key, shifting the key structure from single values to distributed partitions.
To distribute write throughput evenly across multiple physical partitions and eliminate hot partition bottlenecks.
3
Implement exponential backoff and jitter in the application SDK.
Client retries are spaced out progressively and randomized rather than hitting the database simultaneously.
To gracefully manage temporary spikes in database load and avoid retry storms that worsen throttling.

Anahtar Kavram

Write sharding via synthetic key suffixes to distribute traffic across physical partitions, combined with client-side retry policies (exponential backoff with jitter) to build resilient database integrations.
Tahmini Süre:3m 0s
Soru 1124Soru →

A developer is troubleshooting an AWS Lambda function written in Node.js that processes contact form submissions. The function is configured to process one message at a time. The developer notices that when multiple forms are submitted in quick succession, the logs contain duplicate and combined messages from different users. The developer finds that a global array used to accumulate message parts is declared outside the Lambda handler function. Which of the following explains the cause of this issue and the correct resolution?

Cevabı ve açıklamayı göster

Cevap: The Lambda execution context is reused across sequential invocations, causing the global array to retain data from previous executions. The developer should declare and initialize the array inside the handler function.

Cevap

The Lambda execution context is reused across sequential invocations, causing the global array to retain data from previous executions. The developer should declare and initialize the array inside the handler function.
The execution context is reused for sequential invocations, meaning any global variables defined outside the handler will persist. To prevent data from leaking or duplicating between runs, variables containing request-specific data must be defined inside the handler.

Adım Adım Çözüm

1
Analyze the scope of the stateful variables in the Lambda function.
The array is declared outside the handler function (globally).
Variables declared in the global scope are initialized once during the cold start and persist during execution context reuse.
2
Identify the behavior under sequential invocations.
Consecutive invocations reuse the same container, meaning subsequent executions append data to the existing global array rather than starting with an empty array.
AWS Lambda reuses container environments to optimize execution time (warm starts), preserving the state of the global variables.
3
Determine the resolution to isolate data per invocation.
Move the declaration and initialization of the array inside the handler function.
This guarantees that the array is recreated as an empty array at the beginning of every separate execution, preventing data leaks.

Anahtar Kavram

Lambda execution context reuse and global state retention
Soru 1125Soru →

A developer is implementing a serverless data-processing pipeline. An AWS Lambda function is configured to run inside a VPC, associated with two private subnets. The function reads telemetry metadata from an Amazon ElastiCache for Redis cluster in the same VPC, uses AWS Key Management Service (AWS KMS) to decrypt payload fields, and writes the results to an Amazon DynamoDB table. During testing, the Lambda function consistently times out after its configured limit of 15 seconds. The function's IAM execution role contains permissions for KMS decryption and DynamoDB writing, and the security group associated with the Lambda function allows all outbound traffic. What is the root cause of these execution timeouts?

Cevabı ve açıklamayı göster

Cevap: The private subnets do not have a route to a NAT Gateway, and no VPC Endpoints are configured for AWS KMS and DynamoDB, preventing the function from reaching their public endpoints.

Cevap

The private subnets do not have a route to a NAT Gateway, and no VPC Endpoints are configured for AWS KMS and DynamoDB, preventing the function from reaching their public endpoints.
The correct answer is the option indicating that the private subnets lack a route to a NAT Gateway or the necessary VPC Endpoints. When a Lambda function is configured to run inside a VPC, it loses its default internet access. To connect to public AWS services such as AWS KMS and DynamoDB, the function's subnets must route traffic through a NAT Gateway or utilize VPC Endpoints (Interface Endpoint for KMS, and Gateway Endpoint for DynamoDB) to keep the traffic within the AWS network. Without this routing, calls to KMS and DynamoDB will hang and cause the function to time out.

Adım Adım Çözüm

1
Analyze the network placement of the Lambda function and the target endpoints.
The Lambda function is placed inside private VPC subnets to communicate with ElastiCache for Redis (a VPC resource). It also needs to connect to AWS KMS and DynamoDB, which are public AWS services.
Understanding the destination of outbound network calls helps identify if they require public internet access or VPC endpoint routing.
2
Evaluate the default network behavior of VPC-enabled Lambda functions.
Once a Lambda function is attached to a VPC, all its outbound internet access is disabled by default.
This explains why the function can reach ElastiCache (local to the VPC) but cannot reach public AWS endpoints without additional configuration.
3
Determine the necessary routing configuration to restore access to public endpoints.
To access public endpoints, the VPC must have a NAT Gateway in a public subnet with a route in the private subnet's route table, or VPC Endpoints (Gateway for DynamoDB, Interface for KMS) must be provisioned inside the VPC.
Without a NAT Gateway or VPC Endpoints, the TCP connection attempts to AWS KMS and DynamoDB will hang indefinitely, leading to execution timeouts.

Anahtar Kavram

VPC Networking for AWS Lambda and Access to Public AWS Services
Soru 1126Soru →

A developer is configuring an Amazon ECS task definition to deploy an application on AWS Fargate. The container needs to retrieve a database password from AWS Systems Manager Parameter Store during container startup to set it as an environment variable. Once the container is running, the application code uses the AWS SDK to write application logs to an Amazon DynamoDB table. Which combination of configuration steps and IAM roles should the developer configure?

Cevabı ve açıklamayı göster

Cevap: Configure the ECS Task Execution Role with permissions to retrieve the parameter from Systems Manager Parameter Store, configure the ECS Task Role with permissions to perform DynamoDB operations, and configure the trust policy of both roles to allow the ecs-tasks.amazonaws.com service to assume them.

Cevap

Configure the ECS Task Execution Role with permissions to retrieve the parameter from Systems Manager Parameter Store, configure the ECS Task Role with permissions to perform DynamoDB operations, and configure the trust policy of both roles to allow the ecs-tasks.amazonaws.com service to assume them.
The correct configuration requires assigning permissions to retrieve the Systems Manager Parameter Store parameter to the ECS Task Execution Role, because the ECS agent must fetch this value during the container setup phase. The ECS Task Role must be configured with permissions for the DynamoDB operations because this role is used by the application code running inside the container to call AWS services. Additionally, both roles require a trust relationship with the ecs-tasks.amazonaws.com service principal so that Amazon ECS can assume them.

Adım Adım Çözüm

1
Identify the credentials needed at container start time versus application runtime.
The ECS agent requires permissions during startup to fetch the database password from Parameter Store (requiring the Task Execution Role), while the application code needs permissions to write logs to DynamoDB at runtime (requiring the Task Role).
Delineating between task execution and application runtime roles aligns with the principle of least privilege and container security architecture.
2
Define IAM policies for the Task Execution Role and the Task Role.
Create a policy allowing ssm:GetParameters and ssm:GetParameter for the Task Execution Role, and a policy allowing dynamodb:PutItem or dynamodb:BatchWriteItem for the Task Role.
The Task Execution Role performs operations before the container starts, whereas the Task Role handles application-level API requests.
3
Configure trust policies for both IAM roles.
Set the trust relationship service principal to ecs-tasks.amazonaws.com for both roles.
This allows the ECS service to assume the roles when launching and running the Fargate tasks.

Anahtar Kavram

ECS Task Role vs. ECS Task Execution Role
Tahmini Süre:1m 30s
Soru 1127Soru →

A developer is designing a web application hosted on AWS Lambda that connects to an Amazon RDS PostgreSQL database. The application must store transient user session data that expires after 24 hours, and it must also cache frequent, read-heavy queries from the RDS database to reduce latency and database load.

Which two options should the developer choose to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Store user session data in Amazon DynamoDB with a partition key of UserId and enable Time to Live (TTL) to automatically delete expired sessions.; Implement Amazon ElastiCache for Redis to cache database query results from the Amazon RDS instance using a lazy-loading strategy.

Cevap

Store user session data in Amazon DynamoDB with a partition key of UserId and enable Time to Live (TTL), and implement Amazon ElastiCache for Redis to cache database query results from the Amazon RDS instance using a lazy-loading strategy.
The correct combination is storing session data in Amazon DynamoDB with a partition key of UserId and enabling Time to Live (TTL), and implementing Amazon ElastiCache for Redis to cache database query results using a lazy-loading strategy. Storing session state in Amazon DynamoDB is a standard, highly scalable architecture pattern. Since the sessions expire in 24 hours, DynamoDB TTL automatically deletes expired items at no cost, saving write capacity. For the relational database queries, Amazon ElastiCache for Redis acts as a high-performance caching layer that drastically reduces load on the Amazon RDS instance.

Adım Adım Çözüm

1
Analyze session state requirements.
The session data is transient, needs to expire after 24 hours, and requires fast read/write operations.
Choosing DynamoDB with TTL meets the durability and automatic expiration requirements cost-effectively.
2
Analyze database caching requirements.
Frequent, read-heavy query results from a relational database (RDS PostgreSQL) need to be cached.
An in-memory cache like Amazon ElastiCache for Redis is designed for this use case and supports lazy-loading to dynamically populate the cache on demand.

Anahtar Kavram

Caching database query results with ElastiCache and managing transient session states with DynamoDB TTL.

Alternatif Yöntem

Instead of ElastiCache for Redis, self-hosting Redis on Amazon EC2 could be used, but this adds administrative overhead and does not align with AWS managed database/caching best practices.
Tahmini Süre:2m 0s
Soru 1128Soru →

A developer is designing a serverless data ingestion application on AWS Lambda. The application requires access to a third-party service API key that must be rotated automatically every 30 days, as well as a non-sensitive database port number that does not change. To minimize cost and operational overhead, which two actions should the developer take to store and manage these parameters? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Store the API key in AWS Secrets Manager and configure a Lambda function to handle the rotation.; Store the database port number in AWS Systems Manager Parameter Store as a Standard parameter.

Cevap

Store the API key in AWS Secrets Manager with a Lambda rotation function, and store the database port number in AWS Systems Manager Parameter Store as a Standard parameter.
The correct options are to store the API key in AWS Secrets Manager with a Lambda rotation function, and to store the database port in AWS Systems Manager Parameter Store as a Standard parameter. AWS Secrets Manager is appropriate because it supports automatic rotation out-of-the-box. Systems Manager Parameter Store Standard parameters are the correct choice for non-sensitive data because they do not incur a monthly configuration cost.

Adım Adım Çözüm

1
Analyze the requirements for the API key
The API key is highly sensitive and requires automatic rotation every 30 days.
AWS Secrets Manager is designed for storing secrets and provides native integration with AWS Lambda to rotate secrets automatically.
2
Analyze the requirements for the database port number
The database port is non-sensitive and static.
AWS Systems Manager Parameter Store is ideal for storing non-sensitive configuration parameters. Standard parameters are free of charge, helping minimize costs.
3
Select the optimal combination of services to minimize cost and overhead
Use Secrets Manager for the API key to handle automatic rotation, and Parameter Store for the port number to avoid Secrets Manager costs.
This separation aligns with the AWS well-architected best practices of cost optimization and security.

Anahtar Kavram

Selecting between AWS Secrets Manager and Systems Manager Parameter Store based on cost, sensitivity, and automatic rotation requirements.
Soru 1129Soru →

A developer is managing an AWS CloudFormation stack for a web application. The application requires a database password that must be rotated automatically every 30 days. During a stack update to modify the application configuration, a database connection error causes the update to fail, leaving the stack stuck in the UPDATE_ROLLBACK_FAILED state. Which combination of actions should the developer take to securely retrieve the database password in the template and resolve the failed stack update?

Cevabı ve açıklamayı göster

Cevap: Reference the database password in the template using a dynamic reference to AWS Secrets Manager, resolve the database connection issue, and run the ContinueUpdateRollback command.

Cevap

Reference the database password in the template using a dynamic reference to AWS Secrets Manager, resolve the database connection issue, and run the ContinueUpdateRollback command.
The correct answer combines retrieving rotated secrets using Secrets Manager dynamic references with recovering a stuck stack using the ContinueUpdateRollback command. Secrets Manager supports automatic secret rotation, and dynamic references securely fetch these secrets without exposing them. When a stack is in the UPDATE_ROLLBACK_FAILED state, it cannot be updated directly; the underlying issue must be fixed, and ContinueUpdateRollback must be run to complete the rollback to a stable state.

Adım Adım Çözüm

1
Select the correct secrets retrieval mechanism.
Identify that AWS Secrets Manager supports dynamic references and automatic rotation, unlike Parameter Store which is not designed for native secret rotation.
The requirement specifies that the database password must be rotated automatically every 30 days.
2
Identify the mechanism to resolve the stack rollback failure.
Determine that a stack stuck in UPDATE_ROLLBACK_FAILED cannot be updated directly and requires a ContinueUpdateRollback operation after fixing the underlying resource issue.
CloudFormation blocks new stack updates until the stack returns to a stable state (e.g., UPDATE_ROLLBACK_COMPLETE).

Anahtar Kavram

AWS CloudFormation Stack Rollback Resolution and Secrets Management Integration
Soru 1130Soru →

A developer is attempting to deploy an application update using AWS CloudFormation. The initial creation of the stack failed due to a misconfigured resource, leaving the stack in the ROLLBACK_COMPLETE state. When the developer attempts to run the `aws cloudformation update-stack` command with a corrected template, the command fails with a ValidationError. Which of the following actions must the developer take to successfully deploy the corrected template?

Cevabı ve açıklamayı göster

Cevap: Delete the existing CloudFormation stack and then create a new stack using the corrected template.

Cevap

Delete the existing CloudFormation stack and then create a new stack using the corrected template.
The correct answer is to delete the existing stack and create a new one. When a stack fails its initial creation, it rolls back to the ROLLBACK_COMPLETE state. Stacks in this state cannot be updated or modified via change sets. The only way to redeploy under the same stack name is to delete the failed stack and run a new creation process.

Adım Adım Çözüm

1
Identify the current state of the failed CloudFormation stack.
The stack is found to be in the ROLLBACK_COMPLETE state following a failed initial creation attempt.
Understanding the exact state helps determine whether the stack can accept updates or must be deleted.
2
Delete the existing failed stack using the AWS Management Console or the AWS CLI.
The stack in the ROLLBACK_COMPLETE state is completely removed from the AWS account.
AWS CloudFormation does not allow updates to stacks that failed their initial creation and rolled back.
3
Run the create-stack command using the corrected CloudFormation template.
A new stack is successfully created with the resource configurations applied.
Creating a new stack is the only way to deploy the resource once the blocked stack is removed.

Anahtar Kavram

Handling CloudFormation ROLLBACK_COMPLETE state
Tahmini Süre:1m 30s
Soru 1131Soru →

An enterprise application running on Amazon EC2 instances in Account A must retrieve database archives from an Amazon S3 bucket located in Account B. The bucket, named `corporate-db-archives`, uses a customer managed key (CMK) in AWS KMS for server-side encryption. The EC2 instances are associated with an IAM role in Account A named `ArchiveReaderRole`. A developer has already attached a permissions policy to `ArchiveReaderRole` that permits S3 read operations on the bucket and KMS decrypt operations on the CMK. Which two resource-based policies in Account B must be updated to successfully authorize this cross-account read operation? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The S3 bucket policy of `corporate-db-archives` to grant S3 read permissions to the IAM role `ArchiveReaderRole` in Account A; The KMS key policy of the CMK to grant decrypt permissions to the IAM role `ArchiveReaderRole` in Account A

Cevap

The correct resource-based policies to update are the S3 bucket policy of the S3 bucket and the KMS key policy of the customer managed key in Account B to grant access to the IAM role in Account A.
For cross-account access to encrypted S3 resources, the resource-based policies in the destination account (Account B) must explicitly authorize the external principal from the source account (Account A). Thus, both the S3 bucket policy must allow the read operations and the KMS key policy must allow the decrypt operations for the external IAM role.

Adım Adım Çözüm

1
Analyze cross-account authorization requirements.
Identify that cross-account access requires explicit permission in both the caller's identity policy and the target resource's resource-based policies.
Unlike same-account access where an identity policy or a resource policy is sufficient, cross-account access requires evaluation and approval from both sides.
2
Determine S3 resource-based policy changes.
Update the S3 bucket policy in Account B to allow the role `ArchiveReaderRole` from Account A to execute read actions.
The bucket policy must authorize the external principal since default cross-account access is denied.
3
Determine KMS key policy changes.
Update the KMS key policy in Account B to allow the role `ArchiveReaderRole` from Account A to perform decrypt operations.
Since the bucket uses a customer managed KMS key for encryption, the caller needs explicit permission on the key policy to decrypt the objects during retrieval.

Anahtar Kavram

Cross-account IAM delegation requires explicit resource-based policy alignment (S3 bucket and KMS key policies) to authorize external principals.
Soru 1132Soru →

A developer is designing a web application that will be deployed across multiple Amazon EC2 instances in an Auto Scaling group. The application requires a shared session state store that is highly available, survives instance terminations, and survives scale-out events. The session data must be retrieved with sub-millisecond or single-digit millisecond latency, and expired sessions must be automatically deleted to prevent unlimited storage growth. Which TWO solutions meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Store session data in Amazon DynamoDB and enable Time to Live (TTL) on a designated epoch timestamp attribute.; Store session data in Amazon ElastiCache for Redis with replication enabled and configure key expiration.

Cevap

Storing session data in Amazon DynamoDB with Time to Live (TTL) enabled, and storing session data in Amazon ElastiCache for Redis with replication and key expiration configured.
The correct solutions are storing session data in Amazon DynamoDB with Time to Live (TTL) enabled, and storing session data in Amazon ElastiCache for Redis with replication and key expiration. DynamoDB provides single-digit millisecond latency and scales automatically, while its TTL feature handles deletion of expired sessions without consuming write capacity. ElastiCache for Redis is an in-memory data store that offers sub-millisecond performance, and using a replicated cluster ensures high availability while natively supporting key expiration.

Adım Adım Çözüm

1
Identify the latency and availability requirements of the session store.
The session store must survive instance terminations (shared and external), be highly available, and provide sub-millisecond or single-digit millisecond latency.
This filters out storage systems with high latency (like S3 or Glacier) and non-shared stores (like local EC2 instance memory).
2
Evaluate suitable AWS database and caching services that support automated cleanup.
Amazon DynamoDB supports low-latency document/key-value storage with native Time to Live (TTL) to automatically delete expired items. Amazon ElastiCache for Redis provides in-memory sub-millisecond retrieval and supports native key TTL expiration.
Using native TTL features removes the overhead of manual scans or custom cleanup logic, minimizing resource consumption and costs.

Anahtar Kavram

Session State Management and Caching on AWS
Tahmini Süre:2m 0s
Soru 1133Soru →

A developer attempts to create a new AWS CloudFormation stack. The stack creation fails due to a resource configuration error, and the stack status transitions to ROLLBACK_COMPLETE. After correcting the error in the template, the developer attempts to update the stack with the corrected template, but the operation fails. Which of the following actions must the developer take to successfully deploy the resources?

Cevabı ve açıklamayı göster

Cevap: Delete the failed stack and create a new stack using the corrected template.

Cevap

Delete the failed stack and create a new stack using the corrected template.
When the initial creation of a CloudFormation stack fails, the stack rolls back and enters the ROLLBACK_COMPLETE state. A stack in this state cannot be updated or recovered. The only way to deploy the resources with a corrected template is to delete the failed stack and create a new one.

Adım Adım Çözüm

1
Analyze the CloudFormation stack state.
The stack is in the ROLLBACK_COMPLETE state after failing its initial creation.
Understanding the current state of the stack determines whether an update is possible.
2
Determine if a stack update can be performed in this state.
CloudFormation does not allow updates to stacks that failed initial creation and rolled back.
Stacks in the ROLLBACK_COMPLETE status must be deleted before the resources can be created again.
3
Identify the correct resolution step.
Delete the failed stack and create a new one using the corrected template.
This removes the failed stack and allows a clean creation attempt with the fixed template.

Anahtar Kavram

CloudFormation Rollback States and Stack Lifecycle
Tahmini Süre:45s
Soru 1134Soru →

A developer has deployed a Node.js Express application on AWS Elastic Beanstalk. The application has the AWS X-Ray daemon enabled via a configuration file in the .ebextensions directory. The application handles incoming client requests and uses the AWS SDK for JavaScript (v3) to read and write items in an Amazon DynamoDB table. While the X-Ray service map shows the incoming HTTP requests to the Express application, the downstream calls to DynamoDB are completely missing from the traces. Which action should the developer take to ensure the DynamoDB calls are traced and associated with the incoming requests?

Cevabı ve açıklamayı göster

Cevap: Wrap the DynamoDB client instance using the captureAWSv3Client function from the AWS X-Ray SDK for Node.js.

Cevap

Wrap the DynamoDB client instance using the captureAWSv3Client function from the AWS X-Ray SDK for Node.js.
The correct answer is correct because AWS SDK v3 for JavaScript requires explicit wrapping of service client instances using the captureAWSv3Client function from the AWS X-Ray SDK. Once wrapped, the client automatically records metadata and subsegments for every downstream call, associating them with the active trace context in the environment.

Adım Adım Çözüm

1
Identify the missing tracing data source.
The incoming HTTP requests to Elastic Beanstalk are traced, but downstream calls to DynamoDB are missing.
This indicates that context propagation from the incoming HTTP request wrapper to the downstream client is not occurring because the SDK client itself is not instrumented.
2
Apply the appropriate instrumentation method for AWS SDK for JavaScript (v3).
Import the captureAWSv3Client function from 'aws-xray-sdk-core' and wrap the DynamoDB client during initialization.
In SDK v3, unlike SDK v2 which supported patching the entire AWS module, individual client instances must be wrapped explicitly using captureAWSv3Client.

Anahtar Kavram

AWS X-Ray SDK Client Instrumentation for JavaScript (v3)
Soru 1135Soru →

A developer is troubleshooting a PDF generation Lambda function. The function is configured to run inside private subnets of a VPC. It must retrieve document templates from an external public HTTPS endpoint and then save transaction logs to an Amazon RDS PostgreSQL database instance located in another private subnet of the same VPC. During testing, the developer observes two symptoms: the function consistently times out when attempting to reach the external HTTPS endpoint, and the RDS database runs out of available connection slots during concurrent test runs. Which two actions should the developer take to resolve these issues?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Move the database connection client initialization code outside of the Lambda handler function.; Configure a NAT Gateway in a public subnet of the VPC and route internet-bound traffic from the private subnets through this gateway.

Cevap

Initialize the database connection client outside of the Lambda handler function, and configure a NAT Gateway in a public subnet to route internet-bound traffic from the private subnets.
To resolve the RDS connection exhaustion, the database connection client must be initialized outside of the handler function. This enables the Lambda service to leverage execution context reuse, retaining the database connection pool across warm invocations rather than recreating it on every request. To resolve the internet connectivity issue, the Lambda function residing in the private subnet needs outbound internet access. Since Lambda functions do not receive public IP addresses, they cannot use an Internet Gateway directly; instead, traffic destined for the internet must be routed through a NAT Gateway situated in a public subnet.

Adım Adım Çözüm

1
Diagnose the database connection exhaustion issue.
The database connection client is likely being initialized inside the Lambda handler function, causing a new database connection to open on every single invocation under load.
Identifying that new connections are opened per request guides the developer to optimize code structure using execution context reuse.
2
Diagnose the outbound internet connectivity timeout.
The Lambda function is placed in a private subnet and has no pathway to the public internet because it cannot communicate directly with an Internet Gateway without a public IP.
Understanding VPC routing rules explains why the connection to the external HTTPS endpoint is timing out.
3
Apply the solutions to both network and execution context issues.
Initialize the database client globally (outside the handler) to reuse connections, and route private subnet traffic through a NAT Gateway in a public subnet to enable internet access.
These steps address both the resource depletion and the networking blockages identified.

Anahtar Kavram

Debugging Lambda execution context reuse and VPC networking configurations.
Soru 1136Soru →

A developer is deploying a containerized microservice to Amazon ECS on AWS Fargate. The application code inside the container must read and write data to an Amazon DynamoDB table. During startup, the Amazon ECS container agent must retrieve sensitive API keys from AWS Secrets Manager to inject as environment variables and send container logs to Amazon CloudWatch Logs. Which of the following configurations must the developer perform to meet these requirements securely? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Associate an IAM role containing DynamoDB read and write permissions as the Task Role (taskRoleArn) in the task definition.; Associate an IAM role containing Secrets Manager decryption and CloudWatch Logs creation permissions as the Task Execution Role (executionRoleArn) in the task definition.

Cevap

The developer must associate the IAM role containing DynamoDB permissions as the Task Role (taskRoleArn) and associate the IAM role containing Secrets Manager and CloudWatch permissions as the Task Execution Role (executionRoleArn).
The correct configurations involve assigning the correct responsibilities to the Task Role and the Task Execution Role. The Task Role is used by the containers running inside the task to make AWS API calls, so the permission to read and write to the DynamoDB table must be attached to the Task Role. The Task Execution Role is used by the Amazon ECS container agent to perform actions on behalf of the task before the containers start, such as pulling the container image, writing logs to CloudWatch Logs, and retrieving secrets from Secrets Manager to inject as environment variables.

Adım Adım Çözüm

1
Analyze the requirements for permissions that the containerized application code needs during execution.
The application code needs to read and write to Amazon DynamoDB.
Permissions for AWS API calls made by the application code must be granted via the ECS Task Role.
2
Analyze the requirements for permissions that the ECS agent needs to set up the container.
The ECS agent needs to retrieve secrets from Secrets Manager and write logs to CloudWatch Logs.
Permissions for pulling images, retrieving secrets for container initialization, and writing logs are managed by the ECS Task Execution Role.
3
Identify the correct configurations that map these roles to the task definition.
The DynamoDB role is associated with taskRoleArn, and the role containing Secrets Manager and CloudWatch Logs permissions is associated with executionRoleArn.
This configuration correctly separates runtime application permissions from container initialization permissions.

Anahtar Kavram

Separation of concerns between the ECS Task Role and the ECS Task Execution Role.
Tahmini Süre:2m 0s
Soru 1137Soru →

A developer is deploying a multi-tier application using an AWS CloudFormation template. The template defines an Amazon RDS DBInstance that contains critical production data. To ensure data safety and prevent downtime, the developer must meet two requirements:

1. Prevent the database instance from being deleted when the CloudFormation stack is deleted.
2. Prevent the database instance from being accidentally updated or replaced during stack updates, while still allowing other stack resources to be updated.

Which combination of actions should the developer take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Set the DeletionPolicy attribute of the DBInstance resource to Retain in the CloudFormation template.; Define a Stack Policy containing an explicit Deny statement for Update actions on the DBInstance resource.

Cevap

The developer should set the DeletionPolicy attribute of the DBInstance resource to Retain in the CloudFormation template, and define a Stack Policy containing an explicit Deny statement for Update actions on the DBInstance resource.
To satisfy the requirements, the developer must configure both DeletionPolicy and a Stack Policy. Setting the DeletionPolicy to Retain ensures that the RDS DBInstance is kept when the stack is deleted. Applying a Stack Policy with an explicit Deny for Update actions on the DBInstance resource prevents it from being modified or replaced during stack updates, while still allowing other stack resources to be updated.

Adım Adım Çözüm

1
Identify the mechanism to prevent resource deletion upon stack deletion.
Determine that setting the DeletionPolicy attribute to Retain in the template ensures the DBInstance persists even if the CloudFormation stack is deleted.
By default, deleting a stack deletes all of its resources. The DeletionPolicy attribute allows overriding this behavior for specific resources.
2
Identify the mechanism to prevent resource updates or replacement during stack updates.
Determine that applying a Stack Policy with an explicit Deny statement for Update actions on the DBInstance prevents accidental updates or replacements during stack updates.
Stack policies define update permissions for stack resources. Applying an explicit Deny on the DBInstance prevents modifications to it, while allowing other stack resources to update normally.

Anahtar Kavram

AWS CloudFormation Resource Lifecycle Protection
Tahmini Süre:1m 30s
Soru 1138Soru →

A developer is implementing a microservice in AWS Account A that needs to securely access a database credential managed in a centralized security AWS Account B. The microservice must access the credential directly without assuming an IAM role in Account B. Which approach should the developer use to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Store the credential in AWS Secrets Manager in Account B, attach a resource-based policy to the secret that allows the IAM execution role of the microservice in Account A to retrieve it, and encrypt the secret using an AWS KMS customer managed key that grants decryption permissions to Account A.

Cevap

Store the credential in AWS Secrets Manager in Account B, attach a resource-based policy to the secret that allows the IAM execution role of the microservice in Account A to retrieve it, and encrypt the secret using an AWS KMS customer managed key that grants decryption permissions to Account A.
The correct approach is to store the credential in AWS Secrets Manager in Account B, attach a resource-based policy to the secret to allow Account A's role to retrieve it, and use a customer managed KMS key that grants cross-account decryption permissions. AWS Secrets Manager supports resource-based policies, enabling direct access from another account without assuming a role. Additionally, default AWS managed KMS keys cannot be shared across accounts, necessitating a customer managed key.

Adım Adım Çözüm

1
Determine the correct service that supports cross-account sharing via resource-based policies.
AWS Secrets Manager is chosen because Systems Manager Parameter Store does not support resource-based policies for cross-account access.
The requirement is to access the credential directly without assuming an IAM role, which requires resource-based authorization on the secret itself.
2
Establish encryption requirements for cross-account access using AWS KMS.
An AWS KMS customer managed key must be used instead of the default AWS managed key (aws/secretsmanager).
Default AWS managed KMS keys cannot be shared across accounts. A customer managed key is required so its key policy can be modified to grant decryption access to the IAM role in Account A.
3
Configure the resource-based policy on the secret.
Attach a resource policy to the Secrets Manager secret allowing the principal from Account A to perform the GetSecretValue action.
This allows the microservice's execution role in Account A to retrieve the secret payload directly.

Anahtar Kavram

Cross-account access capabilities and encryption configurations in AWS Secrets Manager versus Systems Manager Parameter Store.
Soru 1139Soru →

A developer is configuring a blue/green deployment for a containerized microservice on Amazon ECS using AWS CodeDeploy. The deployment must execute an AWS Lambda function to perform database migrations before the load balancer begins routing production traffic to the new task set. The database password must be rotated automatically every week. During the configuration phase, the deployment fails because of lifecycle and permission errors. Which of the following configurations will successfully execute the database migration during the deployment?

Cevabı ve açıklamayı göster

Cevap: Specify the database migration Lambda function in the BeforeAllowTraffic hook of the AppSpec file, store the database password in AWS Secrets Manager, and grant the CodeDeploy service role permissions to invoke the Lambda function.

Cevap

Specify the database migration Lambda function in the BeforeAllowTraffic hook of the AppSpec file, store the database password in AWS Secrets Manager, and grant the CodeDeploy service role permissions to invoke the Lambda function.
The configuration using the BeforeAllowTraffic lifecycle hook, AWS Secrets Manager, and proper IAM permission policies is correct because it correctly aligns with ECS-specific deployment hooks, meets the automated rotation requirements, and correctly permissions CodeDeploy to execute the validation Lambda function.

Adım Adım Çözüm

1
Identify the correct CodeDeploy lifecycle hook for ECS deployments.
BeforeAllowTraffic is identified as the valid hook because ECS deployments do not support EC2-specific lifecycle hooks like BeforeInstall.
Choosing the correct hook prevents deployment validation errors in the AppSpec file.
2
Determine the correct service for storing database credentials requiring rotation.
AWS Secrets Manager is chosen because it supports automatic rotation natively, unlike Systems Manager Parameter Store.
Meeting the requirement for weekly automatic rotation of credentials.
3
Configure the necessary IAM permissions for CodeDeploy to invoke the migration Lambda function.
Attach an identity-based policy granting lambda:InvokeFunction to the CodeDeploy service role.
Ensuring CodeDeploy has the operational permission to trigger the validation Lambda hook during deployment.

Anahtar Kavram

AWS CodeDeploy ECS lifecycle hooks, secrets management, and IAM permission vs trust policies.
Soru 1140Soru →

An e-commerce platform uses an Amazon DynamoDB table to store product inventory details. During flash sales, the application experiences a massive surge in read requests, resulting in intermittent ProvisionedThroughputExceededException errors. To reduce read latency to sub-milliseconds, the developer integrates an Amazon DynamoDB Accelerator (DAX) cluster. However, the developer notices that several critical inventory check operations, which must retrieve the most up-to-date quantities using strongly consistent reads, continue to suffer from high latency and still trigger throttling on the underlying DynamoDB table. Additionally, some reporting scripts perform full scans of the inventory and are also experiencing performance issues. Which of the following is the most appropriate explanation and resolution for this behavior?

Cevabı ve açıklamayı göster

Cevap: Strongly consistent reads are not cached by DAX and are passed directly through to the DynamoDB table, consuming provisioned read throughput. To resolve the throttling and latency, modify the inventory checks to use eventually consistent reads so they are served from the DAX item cache, and rewrite the reporting scripts to retrieve items using Query operations instead of Scan operations.

Cevap

Strongly consistent reads are not cached by DAX and are passed directly through to the DynamoDB table, consuming provisioned read throughput. To resolve the throttling and latency, modify the inventory checks to use eventually consistent reads so they are served from the DAX item cache, and rewrite the reporting scripts to retrieve items using Query operations instead of Scan operations.
Strongly consistent reads are not cached by DAX and are passed directly through to the underlying DynamoDB table, which consumes read capacity units (RCUs) and can lead to throttling. Modifying the read operations to use eventual consistency allows DAX to serve these requests from the item cache, significantly reducing latency and protecting the DynamoDB table from throttling. Additionally, rewriting full table scans to use Query operations targets specific partition keys, reducing read capacity usage.

Adım Adım Çözüm

1
Analyze how DAX handles strongly consistent reads vs eventually consistent reads.
DAX does not cache strongly consistent reads; it passes them directly to DynamoDB, consuming Provisioned Throughput.
To determine why the inventory checks bypass the DAX cluster and hit DynamoDB.
2
Identify the caching solution for read operations.
Change the inventory check reads from strongly consistent to eventually consistent.
Eventually consistent reads are cached in the DAX item cache, lowering latency and removing load from DynamoDB.
3
Evaluate the reporting scripts' data retrieval strategy.
Replace Scan operations with targeted Query operations.
Scan operations retrieve all items in a table, whereas Query operations search using partition key attributes, significantly reducing RCU consumption.

Anahtar Kavram

DAX Caching Behavior and Read Consistency
ÖncekiSayfa 57 / 78Sonraki
Tüm alıştırma soruları — AWS Certified Developer - Associate | Examkin