Examkin

Tüm alıştırma soruları

1542 soru

Tüm türler1,542Çoktan seçmeli782Çoklu seçim746Sıralama14
Soru 1481Soru →

A developer is building a serverless application and needs to configure Amazon EventBridge to route custom application events to a target AWS Lambda function. The events must be filtered so that only events with a `detail-type` of `OrderCreated` and a `status` of `completed` are forwarded to the function. Which two configurations are required to accomplish this? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an EventBridge rule with an event pattern that matches the custom event source and the status field under the detail object.; Add the Lambda function as a target to the EventBridge rule and configure a resource-based policy on the function to allow the EventBridge service principal to invoke it.

Cevap

The correct configurations are creating an EventBridge rule with an event pattern matching the custom detail-type and status, and adding the Lambda function as a target while allowing EventBridge to invoke it via a resource-based policy.
To route specific events to a target in EventBridge, a rule must be created with an event pattern that filters incoming JSON events. Additionally, EventBridge needs permissions to invoke the target Lambda function, which is granted using a Lambda resource-based policy.

Adım Adım Çözüm

1
Define an EventBridge rule with a pattern.
An EventBridge rule is created that filters events by matching specific JSON fields.
This ensures only matching events (detail-type: OrderCreated and status: completed) are processed.
2
Add the target and set permissions.
The Lambda function is linked as the rule's target, and permission is granted.
EventBridge must have explicit permission to execute the target Lambda function using a resource-based policy.

Anahtar Kavram

Routing events using EventBridge rules, custom event patterns, and Lambda resource-based invoke permissions.
Soru 1482Soru →

A developer is building a ticket reservation system where booking and payment events must be processed in the exact order they are received per booking, and duplicate events must be ignored. The developer uses an Amazon SNS FIFO topic that fans out to multiple Amazon SQS FIFO queues. Which two parameters or configurations must the developer specify when publishing events to the SNS FIFO topic to ensure message ordering and deduplication? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: A unique MessageGroupId for each booking to group messages and ensure they are processed sequentially.; A MessageDeduplicationId for each event (or enable Content-Based Deduplication on the topic) to prevent duplicate messages from being processed within the deduplication interval.

Cevap

Configure a unique MessageGroupId for each booking and provide a MessageDeduplicationId (or enable Content-Based Deduplication) when publishing events to the SNS FIFO topic.
To achieve ordering and deduplication in an SNS/SQS FIFO setup, the developer must specify the MessageGroupId (to group messages by a unique identifier like booking ID to guarantee ordering) and MessageDeduplicationId (or enable Content-Based Deduplication to prevent duplicates).

Adım Adım Çözüm

1
Identify the ordering requirements.
Since booking and payment events must be processed in the exact order they are received per booking, a grouping identifier is needed. Grouping messages by booking ID using MessageGroupId ensures strict ordering within each booking.
SQS and SNS FIFO require MessageGroupId to determine which group of messages must be processed sequentially.
2
Identify the deduplication requirements.
To ignore duplicate events, a deduplication mechanism is required. Providing a MessageDeduplicationId or enabling Content-Based Deduplication ensures that identical messages published within the 5-minute deduplication window are treated as duplicates and discarded.
MessageDeduplicationId is the parameter used by AWS FIFO features to identify and eliminate duplicate messages.

Anahtar Kavram

Amazon SQS and SNS FIFO queues/topics maintain message ordering using MessageGroupId and guarantee exactly-once processing using MessageDeduplicationId.
Soru 1483Soru →

A developer is writing a producer application that sends temperature telemetry data from thousands of IoT devices to an Amazon Kinesis data stream with multiple shards. The developer wants to ensure that the data is distributed evenly across all available shards to prevent write throttling. Which strategy should the developer use when specifying the partition key for the PutRecord API call?

Cevabı ve açıklamayı göster

Cevap: Use a unique device identifier or a generated UUID as the partition key for each record.

Cevap

Use a unique device identifier or a generated UUID as the partition key for each record.
Using a partition key with high entropy (such as a unique device identifier or a generated UUID) ensures that the MD5 hash of the partition key is distributed evenly across the hash ranges of all shards in the Kinesis stream. This prevents a single shard from receiving a disproportionate volume of data (hot shards) and avoids write throttling.

Adım Adım Çözüm

1
Analyze how Amazon Kinesis uses partition keys to distribute records across shards.
Kinesis applies an MD5 hash function to the partition key of each record to determine which shard the record is assigned to.
Understanding the hashing mechanism helps determine the necessary characteristics of a partition key for even distribution.
2
Compare the entropy of the partition key options.
A unique device identifier or UUID provides high entropy, whereas a static string ('sensor_data') provides zero entropy.
High entropy results in an even distribution of hash values across the entire shard space, preventing hot shards.

Anahtar Kavram

Partition key entropy and shard distribution in Amazon Kinesis
Soru 1484Soru →

A developer is writing a backend AWS Lambda function that must parse a 5 MB5\text{ MB} static lookup table stored in Amazon S3. The lookup table is updated only once a week, but the Lambda function is invoked thousands of times per hour. The developer wants to optimize the function's execution time and minimize Amazon S3 data retrieval costs. Which of the following is the most efficient design pattern for the developer to implement?

Cevabı ve açıklamayı göster

Cevap: Download the lookup table to the `/tmp` space and load it into a global variable outside of the Lambda handler function, reusing the cached data for subsequent warm starts.

Cevap

Download the lookup table to the `/tmp` space and load it into a global variable outside of the Lambda handler function, reusing the cached data for subsequent warm starts.
By downloading the lookup table to the `/tmp` space and parsing it into a global variable outside the handler function, the initialization code executes only during a cold start. Subsequent invocations that reuse the warm execution context skip this download and parse phase entirely, accessing the cached data directly from memory. This provides sub-millisecond access times and minimizes S3 API charges.

Adım Adım Çözüm

1
Identify the data access pattern and constraints.
The lookup table is 5 MB5\text{ MB}, static, updated once a week, and read frequently by thousands of invocations per hour.
To design an optimal caching strategy, we must understand the data size, mutability, and invocation frequency.
2
Evaluate the caching capabilities of the AWS Lambda execution environment.
Lambda execution context reuse allows files in the `/tmp` directory and memory-bound global/static variables to persist across warm invocations.
Reusing the execution context avoids downloading the lookup table on every single function execution.
3
Apply the best practice of initializing SDK clients and reading global state outside the handler function.
Downloading the lookup table during the cold start initialization phase (outside the handler) allows subsequent warm executions to immediately read the parsed data from memory.
This minimizes latency and eliminates redundant Amazon S3 GET requests and data retrieval costs.

Anahtar Kavram

Reusing the Lambda execution context (global variables and `/tmp` space) to cache static or rarely changing data across warm invocations.
Soru 1485Soru →

A developer is configuring a serverless application where an Amazon API Gateway REST API integrates with an AWS Lambda function using Lambda proxy integration. Which of the following requirements must be met to ensure successful request processing and client response delivery? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The Lambda function receives the client's HTTP request details, such as headers, query parameters, and payload, directly as the input event object.; The Lambda function must return a JSON response containing a statusCode integer and, if returning a payload, a body string.

Cevap

To configure a Lambda proxy integration successfully, the Lambda function receives the client's HTTP request details directly as the input event object, and it must return a properly structured JSON object that includes the statusCode and a stringified body.
The correct options state that the Lambda function receives the incoming request details directly in its event object and that it must return a JSON response with a statusCode and a body string. These are the core features of API Gateway's Lambda proxy integration.

Adım Adım Çözüm

1
Analyze integration requirements for Lambda proxy integration.
Identify that API Gateway automatically maps the client request to the Lambda input event, so no request mapping templates are needed.
This is a fundamental behavior of Lambda proxy integration, where the full HTTP request details are passed directly to the backend.
2
Analyze response formatting requirements.
Confirm that the Lambda function must format its response output using a specific JSON structure (statusCode and body).
Because API Gateway does not map responses in proxy mode, the Lambda function itself must dictate the status code and payload directly.
3
Evaluate wrong options against the proxy integration model and authorization practices.
Discard options requiring request templates, custom integration responses, or unnecessary custom Lambda authorizers for Cognito.
Request/response mapping is associated with custom integrations, and standard Cognito JWT validation is natively supported by built-in authorizers.

Anahtar Kavram

API Gateway Lambda Proxy Integration behavior and requirements
Tahmini Süre:2m 0s
Soru 1486Soru →

A team is migrating an on-premises batch utility to run as an AWS Lambda function inside a custom VPC. The function must connect to a database running on an Amazon RDS instance within the private subnets of the VPC. Additionally, the function needs to fetch static configuration files from Amazon S3 and make API calls to an external payment processor over the internet. During initial testing, the Lambda function succeeds in connecting to the database but experiences connection timeouts when trying to access S3 and the external payment processor.

Which of the following actions should the developer take to resolve these connectivity issues? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure a NAT Gateway in a public subnet of the VPC, and update the private subnet's route table to route `0.0.0.0/00.0.0.0/0` traffic to the NAT Gateway.; Create a Gateway VPC Endpoint for Amazon S3, and associate it with the route table of the private subnet where the Lambda function resides.

Cevap

To resolve the connectivity issues, the developer must configure a NAT Gateway in a public subnet to allow internet-bound traffic from the private subnet, and create a Gateway VPC Endpoint for Amazon S3 to enable private direct communication with S3.
To allow the Lambda function in the private subnet to connect to external services over the internet, a NAT Gateway must be deployed in a public subnet and the private subnet's route table updated to route internet-bound traffic (represented by the `0.0.0.0/00.0.0.0/0` route) to the NAT Gateway. Additionally, to access Amazon S3 without routing traffic through the NAT Gateway (which incurs extra cost and processing overhead), a Gateway VPC Endpoint for Amazon S3 should be created and associated with the private subnet's route table. This enables direct, private connectivity to S3.

Adım Adım Çözüm

1
Analyze the VPC deployment model for the Lambda function.
The Lambda function is associated with private subnets in the VPC, which allows it to connect to the Amazon RDS instance in the same VPC but isolates it from external networks, including the internet and default public AWS endpoints.
Understanding why the connection timeouts are occurring is the first step in troubleshooting VPC networking.
2
Establish internet access for the Lambda function to reach the external payment processor.
By placing a NAT Gateway in a public subnet and routing the private subnet's `0.0.0.0/00.0.0.0/0` traffic to the NAT Gateway, the Lambda function can securely send egress traffic to the internet.
Lambda functions inside private subnets cannot communicate with the internet directly and require a NAT device to map private IPs to a public IP.
3
Establish direct private connectivity to Amazon S3.
By creating a Gateway VPC Endpoint for Amazon S3 and linking it to the private subnet's route table, traffic destined for S3 is routed directly to the S3 service within the AWS network.
Using a VPC endpoint avoids sending S3 traffic through the NAT Gateway, which saves costs and prevents potential network bandwidth bottlenecks.

Anahtar Kavram

VPC Networking for AWS Lambda and Private Service Access
Tahmini Süre:2m 0s
Soru 1487Soru →

A developer is building a serverless application that publishes events to an Amazon EventBridge event bus. The developer needs to route all events to an Amazon Kinesis Data Firehose delivery stream for long-term archiving, and route only events with a status of "CANCELLED" to an AWS Lambda function for real-time alerting. Which two configurations should the developer implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an EventBridge rule with an event pattern that filters for a status of "CANCELLED" and associate it with the Lambda function target.; Create an EventBridge rule that matches all events and associate it with the Kinesis Data Firehose delivery stream target.

Cevap

To archive all events and send only cancelled events to Lambda, the developer should create one EventBridge rule that matches all events with Kinesis Data Firehose as the target, and a second EventBridge rule with a JSON pattern filtering for a status of "CANCELLED" with the Lambda function as the target.
The correct options involve creating two separate rules on the EventBridge event bus. The first rule matches all incoming events using a broad event pattern and targets the archiving Kinesis Data Firehose stream. The second rule uses a structured JSON event pattern to filter for events where the status field is "CANCELLED" and targets the alerting Lambda function.

Adım Adım Çözüm

1
Analyze the requirement for archiving all events.
Identified that an EventBridge rule matching all events is needed, routed to Kinesis Data Firehose.
Archiving requires capturing the entire stream of events without filtering.
2
Analyze the requirement for real-time alerting on cancellation events.
Identified that an EventBridge rule with a filter pattern matching status "CANCELLED" is needed, routed to the Lambda function.
Alerting is only required for specific events, necessitating content-based filtering.

Anahtar Kavram

Event routing and filtering in Amazon EventBridge rules using event patterns.
Soru 1488Soru →

A developer is creating an AWS Lambda function that processes files uploaded to an Amazon S3 bucket. The developer creates an IAM role named `S3ProcessRole` with the required S3 permission policies. However, when trying to assign the role to the Lambda function, the developer receives an error indicating that the role cannot be assumed by Lambda. The developer inspects the role's trust policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::987654321098:root"
},
"Action": "sts:AssumeRole"
}
]
}

Which modification to the trust policy is required to resolve this error?

Cevabı ve açıklamayı göster

Cevap: Update the Principal block in the trust policy to specify "Service": "lambda.amazonaws.com".

Cevap

Update the Principal block in the trust policy to specify the Lambda service principal.
The correct answer is to modify the Principal block to allow the AWS Lambda service principal (lambda.amazonaws.com) to assume the role. When Lambda runs a function, it must assume the execution role via the sts:AssumeRole action. For this to succeed, the role's trust policy must explicitly trust the Lambda service principal.

Adım Adım Çözüm

1
Identify the cause of the failure: the trust policy limits assumption of the role to the root of AWS account 987654321098, preventing the AWS Lambda service from assuming it.
Discovered that the Principal specifies the account root rather than the Lambda service principal.
Before a service can assume an IAM role, the trust policy must explicitly permit that specific service principal.
2
Locate the Principal block in the trust policy JSON.
Isolated the 'Principal': { 'AWS': 'arn:aws:iam::987654321098:root' } block.
This is the segment governing who is trusted to assume the role.
3
Change the Principal from the AWS account root to the Lambda service principal, lambda.amazonaws.com, and keep the Action as sts:AssumeRole.
The Lambda service principal is now trusted, allowing the function to execute with the role's permissions.
This establishes the necessary trust relationship for the AWS Lambda service.

Anahtar Kavram

IAM Role Trust Policies vs. Permissions Policies
Tahmini Süre:1m 30s
Soru 1489Soru →

A developer is implementing a backend processing system using an Amazon SQS queue and an AWS Lambda function. The Lambda function processes messages in batches and has its timeout configured to 30 seconds. During peak hours, the developer notices that some messages are being processed multiple times by the Lambda function, despite the function successfully completing without errors. The developer also wants to ensure that messages that fail to process after 3 attempts are moved to a dead-letter queue (DLQ). Which two configurations must the developer implement to resolve the duplicate processing issue and properly configure the DLQ? (Choose two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Increase the visibility timeout of the SQS queue to at least 180 seconds.; Define a redrive policy on the source SQS queue that references the DLQ ARN and sets the maxReceiveCount to 3.

Cevap

Increase the visibility timeout of the SQS queue to at least 180 seconds, and define a redrive policy on the source SQS queue that references the DLQ ARN and sets the maxReceiveCount to 3.
To prevent SQS from returning messages to the queue while a Lambda function is still processing them, the source queue's visibility timeout should be set to at least 6 times the timeout of the Lambda function. Since the Lambda function has a timeout of 30 seconds, the SQS visibility timeout must be configured to at least 180 seconds (6×306 \times 30). Additionally, to configure a dead-letter queue (DLQ) for failed messages, a redrive policy must be defined on the source SQS queue (not the DLQ itself) specifying the target DLQ ARN and a maxReceiveCount of 3.

Adım Adım Çözüm

1
Calculate the recommended SQS visibility timeout based on the Lambda function's timeout.
The visibility timeout should be at least 6 times the Lambda timeout: 6×30=1806 \times 30 = 180 seconds.
This prevents the queue from delivering the message to other consumers while the Lambda function is still processing or retrying.
2
Identify where the redrive policy must be configured for a dead-letter queue (DLQ).
The redrive policy must be configured on the source SQS queue, pointing to the DLQ ARN.
Configuring it on the source queue directs SQS to move messages to the DLQ after the maximum receive count is reached.
3
Set the maxReceiveCount attribute in the redrive policy.
Set maxReceiveCount to 3.
This configuration matches the requirement to send messages to the DLQ after 3 failed processing attempts.

Anahtar Kavram

SQS Visibility Timeout and DLQ Redrive Policy Configuration with Lambda Consumers
Soru 1490Soru →

A developer is building a smart agriculture application. An Amazon SNS topic receives soil moisture alerts, which are subscribed to by an Amazon SQS queue. An AWS Lambda function is configured to process messages from this SQS queue. The Lambda function has a timeout of 30 seconds. The SQS queue has a Default Visibility Timeout of 15 seconds. During testing, the developer notices that some alerts are being processed multiple times, even though the Lambda function executes successfully in 20 seconds. Which action should the developer take to prevent these duplicate invocations?

Cevabı ve açıklamayı göster

Cevap: Increase the visibility timeout of the SQS queue to at least 180 seconds.

Cevap

Increase the visibility timeout of the SQS queue to at least 180 seconds.
The correct action is to increase the SQS queue's visibility timeout to at least 180 seconds. AWS recommends setting the visibility timeout of an SQS queue to at least 6 times the timeout of the subscribing Lambda function (6 * 30 seconds = 180 seconds). This configuration ensures that the message is not visible to other consumers while the function is running or retrying.

Adım Adım Çözüm

1
Analyze the execution time of the Lambda consumer relative to the SQS visibility timeout.
The Lambda function takes 20 seconds to process a message, but the SQS queue's visibility timeout is only 15 seconds.
When a message is pulled from SQS, it becomes invisible for 15 seconds. Since the function takes 20 seconds to complete, the message becomes visible again after 15 seconds, allowing another execution context to retrieve it and cause duplicate processing.
2
Apply AWS best practices for SQS and Lambda integrations.
The visibility timeout of the source SQS queue must be set to at least 6 times the timeout of the Lambda function.
Setting the visibility timeout to at least 6 times the Lambda timeout (6 * 30 seconds = 180 seconds) ensures that if the function is throttled or needs to retry, other consumers do not pull the message concurrently.

Anahtar Kavram

AWS Lambda integration with Amazon SQS requires setting the SQS queue's visibility timeout to at least 6 times the Lambda function's timeout to prevent duplicate message processing during execution and retries.
Soru 1491Soru →

A development team is deploying a monitoring agent to forward application performance logs from multiple web servers to Amazon Kinesis Data Streams. The logs must be partitioned so that all logs from a specific web server are ordered sequentially within a single shard. Additionally, logs containing critical errors must be routed to an Amazon EventBridge event bus to trigger automated recovery tasks.

Which of the following configurations should the developer implement? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Use a unique identifier for each web server, such as the server host name, as the partition key when publishing log records to the Kinesis Data Stream.; Define an EventBridge routing rule containing a JSON event pattern that matches logs where the severity level is equal to critical error.

Cevap

To achieve ordering per server and filter error events, the developer should use a unique identifier like the server host name as the partition key in Kinesis, and define an EventBridge routing rule with a JSON event pattern matching critical error logs.
The correct configurations involve using a unique server host name as the partition key to ensure message ordering per server within a shard, and setting up an EventBridge rule with a JSON event pattern matching critical error severity to filter events.

Adım Adım Çözüm

1
Select a partition key strategy for Amazon Kinesis Data Streams that groups logs by server.
Using the server host name maps logs from the same server to the same shard, guaranteeing sequential order of delivery to the consumer.
Kinesis guarantees order within a shard, and records with the same partition key are routed to the same shard.
2
Determine the EventBridge routing mechanism for filtering logs.
Define an EventBridge rule with a JSON pattern to match only logs where the severity level is equal to critical error.
EventBridge rules evaluate the JSON structure of incoming events to route them to targets based on patterns.

Anahtar Kavram

Partitioning in Kinesis Data Streams for ordering and event filtering in EventBridge.
Soru 1492Soru →

A developer is building a producer application that sends real-time traffic sensor data to an Amazon Kinesis data stream consisting of multiple shards. The developer wants to ensure that the data is distributed evenly across all available shards to prevent write throttling. Which partition key strategy should the developer implement?

Cevabı ve açıklamayı göster

Cevap: Use a high-entropy identifier, such as the unique sensor ID, as the partition key for each record.

Cevap

Use a high-entropy identifier, such as the unique sensor ID, as the partition key for each record.
The correct strategy is to use a high-entropy identifier, such as the unique sensor ID. Amazon Kinesis distributes incoming records to shards by hashing the partition key. A high-entropy partition key ensures that records are evenly distributed across all shards, minimizing the risk of hot shards and ingestion throttling.

Adım Adım Çözüm

1
Determine how Amazon Kinesis routes records to specific shards.
Amazon Kinesis applies an MD5 hash function to the partition key to assign the record to a shard.
This is the fundamental routing mechanism of Kinesis Data Streams.
2
Evaluate the entropy of the partition keys.
Using a high-entropy partition key (like a unique sensor ID) yields a wide spread of hash values, while low-entropy keys (like static values) hash to the same value.
High entropy ensures that records are distributed evenly across the shards rather than overloading a single shard.

Anahtar Kavram

Kinesis Data Streams Shard Distribution and Partition Keys
Soru 1493Soru →

A developer is configuring a system where web application clickstream events are sent to an Amazon Kinesis Data Stream. The developer also needs to route user purchase events to an Amazon EventBridge custom event bus. Which two configurations should the developer implement to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Use a unique session identifier as the partition key when writing records to the Kinesis Data Stream.; Configure an Amazon EventBridge rule with a JSON-based event pattern to filter and route only the purchase events.

Cevap

Use a unique session identifier as the partition key when writing records to the Kinesis Data Stream, and configure an Amazon EventBridge rule with a JSON-based event pattern to filter and route only the purchase events.
The correct options are to use a unique session identifier as the partition key and to configure an EventBridge rule with a JSON event pattern. A high-entropy partition key ensures records are distributed evenly across shards, while EventBridge filters and routes events based on JSON structure matching.

Adım Adım Çözüm

1
Select the Kinesis partition key strategy.
Using a unique session ID distributes traffic evenly across all shards, avoiding throttling.
Kinesis routes records to specific shards based on the hash of the partition key.
2
Determine the routing mechanism for purchase events.
Define an EventBridge rule with a JSON event pattern matching purchase events.
EventBridge evaluates incoming JSON payloads against defined rules to filter and route matching events to targets.

Anahtar Kavram

Partition key selection in Amazon Kinesis Data Streams for data distribution, and event routing via JSON pattern matching in Amazon EventBridge.
Soru 1494Soru →

A developer is running an application on an Amazon EC2 instance in Account 123456789012123456789012. The EC2 instance is associated with an IAM instance profile that uses a role named `EC2InstanceRole`. The application needs to perform temporary tasks by assuming an IAM role named `DataProcessorRole` in the same account.

The developer runs a script on the instance using the AWS SDK to assume `DataProcessorRole`, but the operation fails with an `AccessDenied` error.

The trust policy of `DataProcessorRole` is currently configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which of the following configuration changes must the developer make to resolve this issue? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Update the trust policy of `DataProcessorRole` to specify the ARN of `EC2InstanceRole` as the Principal.; Attach an IAM permissions policy to `EC2InstanceRole` that allows the `sts:AssumeRole` action on `arn:aws:iam::123456789012:role/DataProcessorRole`.

Cevap

To resolve the issue, the developer must modify the trust policy of the target role (DataProcessorRole) to trust the assuming identity (EC2InstanceRole) as a principal, and attach a permissions policy to the assuming identity (EC2InstanceRole) that permits the sts:AssumeRole action on the target role's resource ARN.
For an application running on an EC2 instance to assume another IAM role, the target role's trust policy must explicitly trust the IAM identity of the calling application (the option recommending modifying the trust policy of the target role to reference the EC2 instance role ARN). Furthermore, the caller's identity-based policies must authorize it to make the call (the option recommending attaching a permissions policy allowing the assume role operation to the instance role).

Adım Adım Çözüm

1
Analyze the execution caller and error condition.
The SDK script runs as the EC2InstanceRole principal. The current trust policy of DataProcessorRole only trusts the service principal 'ec2.amazonaws.com'.
When EC2 software assumes a role via SDK, the direct caller is the IAM role associated with the instance, not the EC2 service itself.
2
Correct the trust relationship of the target role.
Update the trust policy of DataProcessorRole so its Principal block contains the ARN of EC2InstanceRole.
This establishes that DataProcessorRole trusts the EC2InstanceRole principal to assume it.
3
Configure permissions for the calling identity.
Attach a permissions policy to EC2InstanceRole allowing the 'sts:AssumeRole' action on 'arn:aws:iam::123456789012:role/DataProcessorRole'.
Even when the target role trusts the caller, the caller must have client-side identity permissions authorizing it to make the AssumeRole API call.

Anahtar Kavram

Delegation via IAM AssumeRole requires permissions on both sides: the trust policy of the target role must trust the caller, and the permission policy of the calling role must allow sts:AssumeRole on the target.
Soru 1495Soru →

A developer is designing a real-time transaction processing pipeline. The architecture uses Amazon Kinesis Data Streams to ingest high-volume transaction records from retail merchants, followed by an AWS Lambda function that processes the stream and publishes suspicious transactions to an Amazon EventBridge custom event bus for fraud detection. The Lambda function is deployed inside a private VPC subnet to securely query a database.

During peak sales events, the developer notices two issues:
1. The producer application receives ProvisionedThroughputExceededException errors on the Kinesis stream, even though the total throughput is well below the stream's aggregate limits. The records are currently partitioned using the MerchantID.
2. The Lambda function frequently runs into execution timeouts when attempting to publish events to the EventBridge bus, failing to forward the fraud alerts.

Which two changes should the developer make to resolve these issues?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Update the producer to use a composite partition key by appending a high-entropy transaction identifier to the MerchantID.; Create an interface VPC endpoint (AWS PrivateLink) for EventBridge in the VPC and ensure the Lambda security group allows outbound traffic to it.

Cevap

Updating the producer to use a composite partition key by appending a high-entropy transaction identifier to the MerchantID, and creating an interface VPC endpoint for EventBridge in the VPC.
Updating the producer to use a composite key by appending a high-entropy transaction identifier to the merchant identifier ensures that write operations are evenly distributed across all available Kinesis shards. This prevents hot shards when a single merchant has a transaction spike. Additionally, creating an interface VPC endpoint for EventBridge allows the Lambda function in the private subnet to securely communicate with the EventBridge service privately over the AWS network, resolving the connection timeout issues.

Adım Adım Çözüm

1
Analyze the Kinesis streaming issue where some shards are throttled while total stream throughput is low.
Identify that using MerchantID as the partition key causes uneven distribution (hot shards) when a merchant has a high volume of transactions.
To resolve hot shards, the partition key must have high entropy, which can be achieved by using a composite key.
2
Analyze the Lambda timeout issue when attempting to write to EventBridge.
Identify that the Lambda function is in a private VPC subnet and lacks a route to public AWS endpoints like EventBridge.
To establish connectivity, the VPC requires either a NAT Gateway in a public subnet or an interface VPC endpoint for EventBridge in the private subnet.
3
Select the options that correctly implement these solutions.
The composite partition key implementation and the interface VPC endpoint configuration satisfy both requirements securely and correctly.
These actions resolve the performance bottleneck on Kinesis and the networking boundary issue for VPC-bound Lambda.

Anahtar Kavram

Stream partition key design and private VPC networking for AWS Lambda integrations.
Tahmini Süre:3m 0s
Soru 1496Soru →

A developer is using an AWS Lambda function to process messages from an Amazon SQS standard queue. The Lambda function processes each message by calling a third-party API, which usually takes 10 seconds10\text{ seconds} but can take up to 50 seconds50\text{ seconds} under high load. The SQS queue's visibility timeout is configured to 30 seconds30\text{ seconds}, and the Lambda function's timeout is set to 60 seconds60\text{ seconds}. The developer notices that when the third-party API is slow, messages are processed multiple times, resulting in duplicate database entries. Which change should the developer make to resolve this duplicate processing issue?

Cevabı ve açıklamayı göster

Cevap: Increase the SQS queue's visibility timeout to 360 seconds360\text{ seconds} or more.

Cevap

Increase the SQS queue's visibility timeout to 360 seconds360\text{ seconds} or more.
The correct answer is to increase the SQS queue's visibility timeout to 360 seconds360\text{ seconds} or more. If the queue's visibility timeout is shorter than the Lambda function's timeout, SQS will make the message visible to other consumers while the active execution is still running. AWS recommends configuring the queue's visibility timeout to at least 6 times the Lambda function's timeout to ensure proper handling and retries.

Adım Adım Çözüm

1
Analyze the relationship between the SQS visibility timeout and the Lambda function timeout.
The current SQS visibility timeout (30 seconds30\text{ seconds}) is less than the Lambda function's timeout (60 seconds60\text{ seconds}) and the maximum API response time (50 seconds50\text{ seconds}).
When the visibility timeout is shorter than the execution time, SQS assumes the consumer failed and makes the message visible to other consumers before the current Lambda function finishes, causing duplicates.
2
Apply the AWS recommended best practice for SQS-Lambda integrations.
Determine that the SQS visibility timeout should be at least 6 times the Lambda function's timeout.
Setting the visibility timeout to at least 6×Lambda timeout6 \times \text{Lambda timeout} (6×60 seconds=360 seconds6 \times 60\text{ seconds} = 360\text{ seconds}) prevents concurrent processing of the same message and allows adequate time for processing and potential retries.

Anahtar Kavram

SQS Visibility Timeout vs. Consumer Processing Time
Soru 1497Soru →

A developer is implementing a retail order processing pipeline. A producer application writes order updates to an Amazon Kinesis data stream using the customer's country code as the partition key. An AWS Lambda function, configured within a private VPC subnet without internet access, processes the stream and must route orders exceeding 10,00010,000 USD to an external system via an Amazon EventBridge custom event bus.

During high-traffic events, the developer observes two issues:
1. The Kinesis stream experiences `ProvisionedThroughputExceededException` errors on a single shard, even though overall stream throughput is well below the stream limits.
2. The Lambda function times out and fails to publish the filtered high-value events to the EventBridge event bus.

Which combination of actions will resolve both issues?

Cevabı ve açıklamayı göster

Cevap: Change the Kinesis producer to use a high-entropy value such as the unique order ID as the partition key, and create an interface VPC endpoint (AWS PrivateLink) for EventBridge in the Lambda function's VPC subnets.

Cevap

Change the Kinesis producer to use a high-entropy value such as the unique order ID as the partition key, and create an interface VPC endpoint (AWS PrivateLink) for EventBridge in the Lambda function's VPC subnets.
The correct answer resolves both the database streaming bottleneck and the VPC connectivity bottleneck. By using a high-entropy key like a unique order ID, records are distributed uniformly across all Kinesis shards, resolving the hot shard throttling. By deploying an interface VPC endpoint (PrivateLink) for EventBridge inside the VPC, the Lambda function can route its API calls locally to the endpoint, enabling event routing without requiring public internet routing.

Adım Adım Çözüm

1
Analyze the Kinesis throttling root cause.
The producer uses the country code as the partition key. Because country codes have low cardinality/entropy, some countries with high order volumes will flood a single shard, causing a 'hot shard' and resulting in ProvisionedThroughputExceededException errors even if the overall stream capacity is sufficient.
Kinesis routes records to shards based on the hash of the partition key; high-entropy keys ensure uniform distribution.
2
Select a proper partition key strategy.
Change the partition key to a high-entropy identifier like a unique order ID to distribute writes evenly across all available shards.
This fixes the uneven write distribution and prevents the ProvisionedThroughputExceededException on individual shards.
3
Identify the Lambda connectivity issue to EventBridge.
The Lambda function is running in a private VPC subnet with no internet access. Since EventBridge endpoints are public by default, the Lambda function cannot resolve or reach the EventBridge service, causing the function to time out.
VPC-enabled Lambda functions without a NAT Gateway or VPC endpoint cannot access public AWS service endpoints.
4
Resolve the VPC network connectivity.
Create an interface VPC endpoint (AWS PrivateLink) for EventBridge (com.amazonaws.region.events) inside the Lambda function's VPC.
This establishes private connectivity, allowing the Lambda function to publish events to EventBridge securely without traversing the public internet.

Anahtar Kavram

Kinesis partition key entropy design and VPC Lambda networking with EventBridge PrivateLink.
Soru 1498Soru →

A developer is configuring an Amazon API Gateway REST API to send incoming event data directly to an Amazon Kinesis data stream using a service proxy integration. To authorize this integration, the developer creates an IAM role named `APIGatewayKinesisRole` with a permissions policy that allows `kinesis:PutRecord` on the target stream. However, when testing the API Gateway integration, the developer receives an error indicating that API Gateway is not authorized to assume the role. The developer inspects the trust policy of `APIGatewayKinesisRole`, which is configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "kinesis.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

How should the developer resolve this authorization error?

Cevabı ve açıklamayı göster

Cevap: Change the Service principal in the trust policy to apigateway.amazonaws.com.

Cevap

Change the Service principal in the trust policy to apigateway.amazonaws.com.
To resolve the authorization issue, the service principal in the trust policy must be changed to apigateway.amazonaws.com. This tells IAM that the API Gateway service is trusted to assume the role. When API Gateway executes the integration, it calls sts:AssumeRole on the specified role to get temporary credentials with the permissions defined in the attached policy (which allows kinesis:PutRecord).

Adım Adım Çözüm

1
Analyze the error message and the configuration.
The error indicates that API Gateway is unable to assume the role. The trust policy defines the principal as kinesis.amazonaws.com.
To find why the assume role action fails, we must verify if the correct entity is allowed to assume the role.
2
Identify the service executing the action.
Amazon API Gateway is the service that needs to assume the role to send data to the Kinesis data stream.
The trust policy principal must designate the service requesting the role assumption.
3
Correct the principal in the trust policy.
Change the principal from kinesis.amazonaws.com to apigateway.amazonaws.com.
This allows the API Gateway service to successfully call sts:AssumeRole and acquire temporary credentials.

Anahtar Kavram

IAM trust policy service principal configuration
Soru 1499Soru →

A developer is configuring a REST API in Amazon API Gateway that integrates with an AWS Lambda function. The Lambda function must access the client's source IP address, a query string parameter named `storeId`, and a custom HTTP header named `X-Client-Device` from incoming requests. The developer wants to implement this with minimal configuration overhead and without writing mapping templates. Which two actions must the developer take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the API Gateway integration type as Lambda Proxy Integration.; Access the client IP, query string parameter, and custom header directly from the event object inside the Lambda function code.

Cevap

The developer should configure the API Gateway integration type as Lambda Proxy Integration and access the client IP, query string parameter, and custom header directly from the event object inside the Lambda function code.
Configuring the API Gateway integration type as Lambda Proxy Integration is correct because it passes all request metadata—including query string parameters, headers, and client connection context—directly to the backend Lambda function. Accessing these parameters from the event object inside the Lambda function handler is correct because the proxy integration formats the request as a structured JSON object, allowing direct extraction of the data within the function code without writing any VTL mapping templates.

Adım Adım Çözüm

1
Analyze API Gateway integration options to meet the minimal configuration and zero-mapping template requirements.
Lambda Proxy integration is selected because it forwards the raw HTTP request directly to the Lambda function without mapping templates.
Lambda Custom integration requires manually defining request mapping templates, which increases configuration overhead.
2
Determine how the backend Lambda function accesses the forwarded parameters under a proxy integration.
The parameters are read from the handler's event parameter: the IP from the requestContext object, the header from the headers object, and the query string from the queryStringParameters object.
Lambda Proxy integration structures the incoming request into a standard JSON event schema containing all request metadata.

Anahtar Kavram

API Gateway Lambda Proxy Integration vs Lambda Custom Integration
Tahmini Süre:1m 30s
Soru 1500Soru →

A developer is configuring an AWS Lambda function to process a real-time data stream from Amazon Kinesis. During testing under high load, the Lambda function frequently times out because it cannot process the large batch of stream records within its configured execution time limit. Which action should the developer take to resolve this processing timeout issue?

Cevabı ve açıklamayı göster

Cevap: Decrease the batch size (BatchSize) in the Lambda event source mapping configuration.

Cevap

Decrease the batch size (BatchSize) in the Lambda event source mapping configuration.
Decreasing the batch size in the event source mapping limits the number of stream records sent to the Lambda function during a single invocation. This directly reduces the computational load and time required to execute the function, preventing it from hitting the execution time limit.

Adım Adım Çözüm

1
Identify the root cause of the Lambda function timeout when processing stream records.
The function is attempting to process too many records at once, exceeding the execution time limit.
Lambda polls Kinesis and retrieves records up to the configured BatchSize.
2
Adjust the BatchSize parameter in the event source mapping.
Fewer records are delivered to the Lambda function per invocation.
This reduces the total processing work per invocation, ensuring the function completes before timing out.

Anahtar Kavram

Configuring Kinesis event source mapping parameters for AWS Lambda to optimize stream processing.
Tahmini Süre:1m 0s
ÖncekiSayfa 75 / 78Sonraki