Examkin

Tüm alıştırma soruları

746 soru

Tüm türler1,542Çoktan seçmeli782Çoklu seçim746Sıralama14
Soru 1Soru →

A developer is configuring a serverless application where an AWS Lambda function processes messages from an Amazon SQS queue. The Lambda function must also query an Amazon RDS PostgreSQL database located in a private subnet of a VPC.

During testing, the developer observes two issues:
1. Messages are occasionally processed multiple times by the Lambda function, even though the executions complete successfully. The Lambda function's timeout is set to 60 seconds, and the SQS queue's visibility timeout is set to 30 seconds.
2. The Lambda function fails to establish a connection to the RDS database, resulting in connection timeout errors.

Which two actions should the developer take to resolve these issues? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Increase the visibility timeout of the Amazon SQS queue to at least 360 seconds.; Configure the Lambda function to connect to the VPC using the private subnets, and ensure that the Lambda function's security group allows outbound traffic to the database's security group.

Cevap

To resolve the issues, increase the visibility timeout of the Amazon SQS queue to at least 360 seconds, and configure the Lambda function to connect to the VPC using the private subnets while ensuring the security group allows outbound traffic to the database's security group.
To resolve the duplicate processing issue, the visibility timeout of the SQS queue must be increased. AWS recommends setting it to at least 6 times the Lambda function's timeout (which is 60 seconds, so at least 360 seconds) to ensure that the message remains invisible to other consumers while Lambda processes it. To resolve the database connectivity issue, the Lambda function must be configured with VPC access using private subnets, and its security group must allow outbound traffic to the database's security group.

Adım Adım Çözüm

1
Address the SQS message visibility timeout mismatch by increasing the visibility timeout of the queue to at least 360 seconds (6 times the Lambda function timeout of 60 seconds) to prevent messages from returning to the queue while Lambda is still processing them.
This resolves the issue of messages being processed multiple times due to the function execution duration exceeding the queue's visibility window.
AWS best practices dictate that the SQS visibility timeout should be configured to at least 6 times the Lambda function timeout to avoid duplicate processing and allow for retries.
2
Address the database connection timeout by configuring the Lambda function to access the VPC.
The Lambda function is associated with the private subnets of the VPC and receives Elastic Network Interfaces (ENIs).
To connect to resources in a private VPC subnet like RDS, the Lambda function must be configured with VPC access pointing to private subnets within that VPC.
3
Configure the security groups to allow communication between the Lambda function and the RDS instance.
The Lambda function's security group is allowed outbound access, and the RDS database's security group is configured to allow inbound traffic from the Lambda function's security group.
Network traffic must be explicitly allowed by security groups at both the source (Lambda) and destination (RDS) to establish a successful database connection.

Anahtar Kavram

AWS Lambda integration with Amazon SQS and VPC resources requires proper alignment of SQS visibility timeouts with Lambda timeouts, as well as correct VPC and security group configuration.
Soru 2Soru →

A developer is building a logistics tracking application that stores package delivery status updates in an Amazon DynamoDB table. The table has a partition key of `PackageID` and a sort key of `StatusTimestamp`. The application needs to retrieve all delivery status updates for a specific `PackageID` that occurred within the last 2424 hours. The results must be returned starting with the most recent update first.

Which two actions should the developer take to meet these requirements with the lowest latency and minimal Read Capacity Unit (RCU) consumption? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Use the `Query` API operation with a key condition expression specifying the `PackageID` and a range comparison on `StatusTimestamp`.; Set the `ScanIndexForward` parameter to `false` in the API request.

Cevap

Use the `Query` API operation with a key condition expression on the partition key and sort key, and set the `ScanIndexForward` parameter to `false` in the API request.
To retrieve items sharing the same partition key (`PackageID`) efficiently, the `Query` API operation should be used. The query can filter results by the sort key (`StatusTimestamp`) directly in the key condition expression, which consumes Read Capacity Units (RCUs) only for the items that match the criteria. By default, DynamoDB returns query results in ascending order of the sort key. Setting the `ScanIndexForward` parameter to `false` reverses this order, returning the most recent updates first.

Adım Adım Çözüm

1
Determine the appropriate API operation for retrieving data with a known partition key.
Select the `Query` API operation rather than `Scan`.
A `Query` operation directly accesses the partition and filters by sort key efficiently, minimizing RCU consumption, whereas a `Scan` reads the entire table.
2
Configure the sorting order of the returned items.
Set the `ScanIndexForward` parameter to `false`.
DynamoDB sorts query results in ascending order of the sort key by default. Setting `ScanIndexForward` to `false` reverses the order to descending, returning the most recent items first.

Anahtar Kavram

Optimizing read operations in Amazon DynamoDB using Query instead of Scan and controlling sort order via ScanIndexForward.
Soru 3Soru →

A developer is building a video streaming application that publishes user engagement events to an Amazon Kinesis Data Stream. An AWS Lambda function processes these events in batches. For specific events, such as 'UpgradeAccount', the Lambda function must publish a message to an Amazon EventBridge custom event bus to trigger downstream provisioning workflows.

During high-load testing, the developer observes two issues:
1. The Lambda function frequently runs out of time while processing batches of events.
2. The Lambda function fails to publish events to the EventBridge custom event bus, receiving an AccessDeniedException.

Which combination of actions should the developer take to resolve these issues? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Decrease the BatchSize parameter of the Lambda event source mapping and ensure the Lambda function's timeout is set appropriately.; Attach an IAM policy to the Lambda function's execution role that grants the events:PutEvents permission for the EventBridge event bus resource.

Cevap

Decrease the BatchSize parameter of the Lambda event source mapping and ensure the Lambda function's timeout is set appropriately; and attach an IAM policy to the Lambda function's execution role that grants the events:PutEvents permission for the EventBridge event bus resource.
To resolve the batch timeout, decreasing the BatchSize limits the payload volume per invocation, ensuring the Lambda function can complete execution within its timeout limits. To resolve the AccessDeniedException, the Lambda function's execution role must be granted the events:PutEvents permission, enabling it to write messages to the EventBridge custom event bus.

Adım Adım Çözüm

1
Address the Lambda batch execution timeout.
By reducing the BatchSize parameter in the Event Source Mapping, the Lambda function receives fewer records per invocation. This directly reduces the processing time per batch, preventing execution timeouts.
Kinesis streams push batches of records to Lambda, and processing too many large records in a single invocation can exceed the configured Lambda timeout.
2
Resolve the EventBridge AccessDeniedException authorization error.
An IAM policy must be attached to the Lambda execution role granting 'events:PutEvents' for the target EventBridge custom event bus.
AWS services interact using IAM. The Lambda function acts as the caller and requires explicit permissions to call the PutEvents API on the destination EventBridge event bus.

Anahtar Kavram

Stream processing tuning with Lambda batch settings and secure event routing to EventBridge via IAM permissions.
Tahmini Süre:2m 0s
Soru 4Soru →

A developer is designing a flight booking platform where reservation records are stored in an Amazon DynamoDB table. The table's partition key is `ReservationID`. The application needs to retrieve all reservations for a specific `FlightID` that currently have a `ReservationStatus` of 'Pending'. The solution must be highly efficient, minimize read latency, and avoid unnecessary read capacity consumption. Which two actions should the developer take to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a Global Secondary Index (GSI) with FlightID as the partition key and ReservationStatus as the sort key.; Perform a Query operation on the GSI using a key condition expression to specify the FlightID and ReservationStatus.

Cevap

To retrieve the pending reservations efficiently, the developer must create a Global Secondary Index (GSI) with FlightID as the partition key and ReservationStatus as the sort key, and then perform a Query operation on this GSI.
To retrieve items efficiently using attributes other than the base table's partition key, a Global Secondary Index (GSI) must be created. Setting FlightID as the partition key and ReservationStatus as the sort key of the GSI allows direct querying. Performing a Query operation on this GSI with a key condition expression retrieves only the matching items, minimizing latency and RCU consumption.

Adım Adım Çözüm

1
Analyze the table's primary key and the query requirements.
The table's partition key is ReservationID, but the query requires filtering by FlightID and ReservationStatus, which are non-key attributes in the base table.
DynamoDB does not allow direct Query operations on non-key attributes without an index.
2
Select the appropriate indexing strategy.
Create a Global Secondary Index (GSI) with FlightID as the partition key and ReservationStatus as the sort key.
A GSI allows querying across partition keys different from the base table, enabling direct lookups by FlightID.
3
Execute the retrieval operation.
Perform a Query operation on the GSI with a key condition expression.
Querying is more efficient than scanning because it only consumes capacity units for the matching items.

Anahtar Kavram

Using Global Secondary Indexes (GSIs) to perform efficient Query operations instead of Scan operations on non-key attributes in Amazon DynamoDB.
Tahmini Süre:2m 0s
Soru 5Soru →

A developer is designing a real-time multiplayer game event processor. The game client sends player match telemetry (including player ID, match ID, action type, and score) to an Amazon Kinesis Data Stream. The developer must ensure that events for the same match are processed in the strict order they occurred by the consumer. In addition, the consumer, an AWS Lambda function running in a virtual private cloud (VPC), must query an external SaaS security endpoint over the internet to check for anomalous player behavior.

Which two actions should the developer take to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Use the match ID as the partition key when publishing events to the Amazon Kinesis Data Stream.; Deploy the Lambda function in the private subnets of the VPC, and route outbound internet traffic through a NAT Gateway located in a public subnet.

Cevap

Use the match ID as the partition key when publishing events to the Amazon Kinesis Data Stream, and deploy the Lambda function in the private subnets of the VPC, routing outbound internet traffic through a NAT Gateway located in a public subnet.
To achieve strict event ordering for each match, the events must be sent to the same shard of the Kinesis Data Stream. This is done by selecting a partition key with sufficient cardinality that groups related events, such as the match ID. For the Lambda consumer in a VPC to access an external SaaS endpoint over the internet, it must be placed in private subnets, with its outbound traffic routed to a NAT Gateway in a public subnet. Lambda functions inside a VPC cannot directly use an Internet Gateway or a public IP address.

Adım Adım Çözüm

1
Ensure in-order processing of match events by using the match ID as the partition key.
Events with the same match ID are hashed to the same shard of the Kinesis Data Stream, preserving their relative ordering during consumption.
Kinesis guarantees order preservation only within a single shard. Assigning the match ID as the partition key maps all events of that match to the same shard.
2
Configure the Lambda function inside private subnets of the VPC and set up a NAT Gateway in a public subnet.
The Lambda function can communicate with the external SaaS security endpoint over the internet.
Lambda functions deployed in a VPC do not receive public IP addresses. To access the internet, their traffic must be routed from private subnets through a NAT Gateway in a public subnet that has an Internet Gateway route.

Anahtar Kavram

Configuring partition keys in Kinesis Data Streams for order preservation and setting up NAT Gateways for Lambda VPC outbound connectivity.
Tahmini Süre:1m 30s
Soru 6Soru →

A developer is configuring an AWS Lambda function inside a private subnet of a custom VPC to process messages from an Amazon SQS queue. The Lambda function must read database credentials from AWS Secrets Manager and write the processed results to an Amazon DynamoDB table. To satisfy security requirements, the VPC has no internet access, and all traffic must remain within the AWS network.

The developer creates a Gateway VPC endpoint for DynamoDB and an Interface VPC endpoint for Secrets Manager. However, when the Lambda function runs, it fails with connection timeout errors when attempting to access both DynamoDB and Secrets Manager.

Which combination of actions will resolve these connection timeouts? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Update the route table associated with the Lambda function's private subnet to include a route that targets the DynamoDB Gateway VPC endpoint for the DynamoDB prefix list.; Modify the security group associated with the Secrets Manager Interface VPC endpoint to allow inbound HTTPS traffic on port 443 from the security group associated with the Lambda function.

Cevap

Update the route table associated with the Lambda function's private subnet to include a route that targets the DynamoDB Gateway VPC endpoint for the DynamoDB prefix list, and modify the security group associated with the Secrets Manager Interface VPC endpoint to allow inbound HTTPS traffic on port 443 from the security group associated with the Lambda function.
To resolve connection timeouts inside a private VPC with no internet access, the developer must properly configure the networking and security rules for the VPC endpoints. For the DynamoDB Gateway endpoint, a route must be added to the subnet's route table targeting the DynamoDB prefix list. For the Secrets Manager Interface endpoint, which uses ENIs, the endpoint's security group must be configured to accept inbound HTTPS (port 443) connections from the Lambda function's security group.

Adım Adım Çözüm

1
Identify the cause of the DynamoDB timeout.
Determine that DynamoDB is accessed via a Gateway VPC endpoint.
Gateway endpoints require explicit routes in the subnet's route table to direct traffic to the service.
2
Resolve the DynamoDB configuration issue.
Add a route in the private subnet's route table pointing to the DynamoDB prefix list with the Gateway endpoint ID as the target.
This enables the VPC router to forward DynamoDB-bound traffic through the Gateway endpoint.
3
Identify the cause of the Secrets Manager timeout.
Determine that Secrets Manager is accessed via an Interface VPC endpoint.
Interface endpoints use Elastic Network Interfaces (ENIs) with security groups, which require appropriate inbound permissions.
4
Resolve the Secrets Manager configuration issue.
Configure the security group of the Secrets Manager Interface endpoint to allow inbound HTTPS (port 443) traffic from the security group of the Lambda function.
This allows the inbound connection from the Lambda function's ENI to the endpoint's ENI.

Anahtar Kavram

AWS Lambda VPC networking using Gateway and Interface VPC endpoints
Tahmini Süre:3m 0s
Soru 7Soru →

A developer is implementing an AWS Lambda function in Account A (111111111111111111111111) that needs to retrieve database credentials stored as a secure parameter in the Systems Manager Parameter Store in Account B (222222222222222222222222). The parameter is encrypted using an AWS KMS customer managed key (CMK) in Account B. The developer intends to use the AWS Security Token Service (STS) to assume an IAM role named `DbConfigReaderRole` in Account B.

The Lambda function is associated with an execution role named `LambdaExecutionRole` in Account A.

Which of the following configuration steps must be performed to allow the Lambda function to retrieve the configuration parameter? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: In Account B, configure the trust policy for `DbConfigReaderRole` to allow the principal `arn:aws:iam::111111111111:role/LambdaExecutionRole` to perform the `sts:AssumeRole` action.; In Account A, attach a policy to `LambdaExecutionRole` that grants `sts:AssumeRole` permissions on the resource `arn:aws:iam::222222222222:role/DbConfigReaderRole`.

Cevap

The configuration requires adding the calling role as a trusted principal in the trust policy of the target role in Account B, and granting permission to assume the target role in the identity-based policy of the caller's role in Account A.
For cross-account access via STS, two distinct components are required: the target role's trust policy must list the source principal as a trusted entity, and the source identity's permissions policy must permit the call to assume the target role.

Adım Adım Çözüm

1
Identify the cross-account trust requirement.
The target role `DbConfigReaderRole` in Account B (222222222222222222222222) must explicitly trust the Lambda execution role in Account A (111111111111111111111111) via its trust policy.
Without this trust relationship, STS will deny the assume role request from Account A's principal.
2
Identify the delegation permission requirement.
The source execution role `LambdaExecutionRole` in Account A must be granted permission to perform the `sts:AssumeRole` action on the target role's ARN in Account B.
By default, IAM execution roles do not have permission to assume arbitrary external roles; this must be explicitly allowed.
3
Differentiate trust policies from identity-based policies and resource-based policies.
Confirm that trust relationships are defined in trust policies (not identity-based policies) and that Systems Manager Parameter Store does not support resource policies.
This rules out the incorrect options that attempt to configure trust in permissions policies or use non-existent parameter resource policies.

Anahtar Kavram

IAM Policies and Roles
Tahmini Süre:2m 0s
Soru 8Soru →

A developer is building a serverless client-side web application. Users will log in using an Amazon Cognito User Pool. Once authenticated, the application must interact directly with AWS services from the browser to download user-specific documents from an Amazon S3 bucket, restricted to the path `documents/${cognito-identity.amazonaws.com:sub}/*`, and write application usage telemetry directly to an Amazon Kinesis Data Stream. The developer wants to implement this with the least operational overhead and without managing any backend API or compute resources. Which TWO actions should the developer take to configure this solution?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an Amazon Cognito Identity Pool, configure the Cognito User Pool as an identity provider, and associate an authenticated IAM role that permits `s3:GetObject` on the prefix `arn:aws:s3:::my-bucket/documents/${cognito-identity.amazonaws.com:sub}/*` and `kinesis:PutRecord` on the stream.; Configure the client application to exchange the Cognito User Pool ID token for temporary AWS credentials using the Cognito Identity Pool.

Cevap

The developer should create an Amazon Cognito Identity Pool configured with the User Pool as an identity provider, assigning an authenticated IAM role that permits Kinesis and user-restricted S3 access. Additionally, the client application must exchange the Cognito User Pool ID token for temporary AWS credentials using the Identity Pool.
To interact directly with AWS services like Amazon S3 and Amazon Kinesis from a client-side application, temporary AWS credentials are required. By creating a Cognito Identity Pool and configuring the User Pool as an identity provider, you can exchange the User Pool ID token for temporary AWS IAM credentials. The authenticated IAM role associated with the Identity Pool can restrict S3 access to user-specific folders using the `${cognito-identity.amazonaws.com:sub}` policy variable and grant write permissions to the Kinesis stream, ensuring secure and direct access with minimal operational overhead.

Adım Adım Çözüm

1
Configure the user directory and federation.
An Amazon Cognito User Pool is set up for authentication, and an Identity Pool is created with the User Pool configured as an identity provider.
This establishes a trust relationship where successful authentication in the User Pool allows the client to request credentials from the Identity Pool.
2
Define the permissions using an IAM policy on the Identity Pool's authenticated role.
The authenticated IAM role is assigned a policy allowing `s3:GetObject` on `arn:aws:s3:::my-bucket/documents/${cognito-identity.amazonaws.com:sub}/*` and `kinesis:PutRecord` on the stream.
The `${cognito-identity.amazonaws.com:sub}` variable represents the user's Cognito Identity ID, ensuring users can only access their own documents, while Kinesis access allows direct telemetry ingestion.
3
Exchange tokens for credentials in the client application.
The client authenticates with the User Pool, obtains an ID token, and calls the Identity Pool to get temporary AWS credentials.
These credentials are used by the AWS SDK in the browser to sign requests directly to S3 and Kinesis using Signature Version 4.

Anahtar Kavram

Amazon Cognito Identity Pools enable client-side applications to obtain temporary, limited-privilege AWS credentials by federating identity providers like Cognito User Pools.
Soru 9Soru →

A developer is configuring an AWS CodeDeploy deployment group for an in-place deployment of a web application to Amazon EC2 instances. The deployment must automatically revert to the last known successful version if the new deployment fails or if application error rates exceed a specific threshold. Additionally, the developer needs to ensure that any temporary files left by a failed deployment are cleaned up during the rollback process.

Which of the following configurations should the developer implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable automatic rollbacks in the CodeDeploy deployment group settings for deployment failures, and configure a CloudWatch alarm to trigger a rollback when application error rates exceed the threshold.; Implement the cleanup script within the BeforeInstall lifecycle hook of the application's AppSpec file, because CodeDeploy rolls back by executing a new deployment of the last successful revision.

Cevap

Enable automatic rollbacks in the CodeDeploy deployment group settings for deployment failures and CloudWatch alarm states, and implement cleanup logic in the BeforeInstall hook of the AppSpec file because CodeDeploy performs a rollback by initiating a new deployment of the last successful revision.
The correct configurations are to enable automatic rollbacks in the CodeDeploy deployment group for both deployment failures and when a configured CloudWatch alarm (tracking error rates) goes into the ALARM state. Furthermore, because CodeDeploy executes a rollback by initiating a new deployment of the last successful revision, the cleanup logic must be placed in a standard lifecycle hook such as BeforeInstall of that revision to ensure any leftover artifacts from the failed deployment are deleted before files are copied.

Adım Adım Çözüm

1
Configure rollback behaviors on the deployment group
Automatic rollbacks are enabled for deployment failures and CloudWatch alarms monitoring error rate thresholds.
This natively automates the rollback process when a failure is detected or when application metrics degrade.
2
Analyze how CodeDeploy executes rollbacks
CodeDeploy handles rollbacks by running a brand new deployment of the previous successful revision.
Understanding this flow reveals that there is no custom Rollback hook; instead, standard deployment hooks in the target revision will run.
3
Place the cleanup script in the correct lifecycle hook of the AppSpec file
The cleanup script is mapped to the BeforeInstall hook of the AppSpec file.
When the rollback deployment starts, the BeforeInstall hook runs before new files are copied, clearing out remnants of the failed deployment.

Anahtar Kavram

AWS CodeDeploy rollbacks are executed as new deployments of the last known successful revision, which run the standard AppSpec lifecycle hooks of that revision rather than a dedicated rollback hook.
Soru 10Soru →

An application running on AWS Fargate generates monthly audit reports (each approximately 8 MB8\text{ MB} in size) that must be encrypted client-side before they are stored in an external third-party storage system. The developer wants to use AWS Key Management Service (AWS KMS) with a customer managed key to secure these reports.

Which of the following actions must the developer take to implement this client-side encryption workflow? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Call the GenerateDataKey API of AWS KMS using the customer managed key identifier to retrieve a plaintext data key and an encrypted data key.; Encrypt the audit report locally using the plaintext data key, store the encrypted data key alongside the encrypted report, and then delete the plaintext data key from memory.

Cevap

To encrypt a file larger than 4 KB4\text{ KB} client-side, the developer must generate a data key by calling the GenerateDataKey API, use the returned plaintext data key to encrypt the report locally, discard the plaintext key from memory, and store the encrypted data key alongside the encrypted audit report.
To encrypt a large file client-side using AWS KMS, the developer must implement envelope encryption. This involves calling the GenerateDataKey API to obtain both a plaintext data key and an encrypted data key. The plaintext data key is used to encrypt the audit report locally, after which the plaintext key is discarded from memory. The encrypted data key is then stored with the encrypted report so that it can be decrypted later by calling the Decrypt API to recover the plaintext key.

Adım Adım Çözüm

1
Generate a unique data key.
The GenerateDataKey API is called, which returns a plaintext data key and an encrypted data key.
Since the file exceeds the direct encryption limit of AWS KMS, envelope encryption is required. The plaintext key is needed to perform the encryption, and the encrypted key is saved for future decryption.
2
Encrypt the data locally.
The Fargate container encrypts the 8 MB8\text{ MB} report using the plaintext data key.
This performs the actual cryptographic operation locally without sending the large file to AWS KMS.
3
Clean up memory and store metadata.
The plaintext key is cleared from the container's memory, and the encrypted data key is written alongside the encrypted report.
Holding the plaintext key longer than necessary in memory presents a security risk, and the encrypted data key is the only way to recover the plaintext key during decryption.

Anahtar Kavram

AWS KMS client-side envelope encryption workflow for objects exceeding the direct encryption size limits.
Soru 11Soru →

A developer is instrumenting a Go-based microservice running on Amazon ECS with the EC2 launch type to trace incoming HTTP requests, downstream HTTP client calls, and calls to Amazon DynamoDB using AWS X-Ray. The X-Ray daemon is already running on the container host instances. Which of the following actions must the developer take to instrument the application and ensure downstream traces are recorded? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Instrument the AWS SDK clients using the X-Ray SDK for Go and wrap the HTTP client's transport with the X-Ray RoundTripper.; Pass the Go context containing the active segment to downstream AWS SDK operations and HTTP client calls.

Cevap

To instrument the Go application for AWS X-Ray, the developer must instrument the AWS SDK clients and HTTP client transport, and explicitly pass the Go context containing the active segment to all downstream calls.
Instrumenting the SDK clients and HTTP transport with X-Ray SDK helpers enables subsegment generation for outgoing requests. Since Go lacks thread-local storage, context must be explicitly passed to propagate the active trace segment.

Adım Adım Çözüm

1
Wrap the HTTP client transport with the X-Ray RoundTripper and initialize the AWS SDK clients with X-Ray instrumentation helper functions.
The application code is prepared to intercept outgoing AWS SDK and HTTP requests to generate X-Ray subsegments.
This establishes the handlers and interceptors required by the X-Ray SDK to record outgoing service details.
2
Ensure that the Go context.Context object representing the active request segment is passed into all downstream SDK calls and HTTP requests.
The trace ID and segment hierarchy are successfully propagated down the call chain.
Go does not have thread-local storage; therefore, trace context propagation relies entirely on passing context variables down the call stack.

Anahtar Kavram

Go X-Ray SDK Instrumentation and Context Propagation
Soru 12Soru →

A developer is setting up an AWS CodeBuild project to compile a Java application and upload the build artifacts to an Amazon S3 bucket. During the first build execution, CodeBuild fails to upload the artifacts, returning an Access Denied error. Additionally, the developer wants the project to use a custom build specification file named build-config.yml located in the config directory of the repository, rather than using the default root-level buildspec.yml file.

Which configuration steps must the developer perform to resolve the upload failure and use the custom build specification? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Update the buildspec path in the CodeBuild project settings to config/build-config.yml.; Modify the CodeBuild service role permissions policy to allow the s3:PutObject action on the artifacts bucket.

Cevap

The correct steps are to update the buildspec path in the CodeBuild project settings to point to the custom path, and to modify the CodeBuild service role permissions policy to allow writing objects to the S3 bucket.
To use a custom build specification file that is not in the root directory or has a different name, the developer must configure the file path in the project settings. Additionally, since the build environment failed to upload the artifacts to Amazon S3 with an Access Denied error, the CodeBuild service role must be updated with a policy that allows the write action on the target S3 bucket.

Adım Adım Çözüm

1
Determine how CodeBuild locates a non-standard buildspec file name and path.
A custom buildspec path like config/build-config.yml must be configured directly within the CodeBuild project settings.
By default, CodeBuild expects buildspec.yml in the root directory. Any custom path or name must be specified in the project configuration.
2
Analyze the cause of the Access Denied error during artifact upload.
The CodeBuild build container runs under an IAM role (the service role). It requires explicit permissions to write objects to the S3 bucket where artifacts are stored.
Without s3:PutObject permissions attached to the CodeBuild service role, the upload will fail with an authorization error.

Anahtar Kavram

AWS CodeBuild custom buildspecs and permissions
Soru 13Soru →

A company is migrating a containerized web application to run on Amazon ECS using the Amazon EC2 launch type. Multiple instances of the application task must run on each container instance, and the tasks are configured to use the bridge network mode. The application code requires access to a database password stored in AWS Secrets Manager and must perform read operations on an Amazon DynamoDB table. Which two configurations are required to support this deployment?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Set the container port to 80 and the host port to 0 (or leave it blank) in the task definition port mapping.; Configure the task definition's Task Role (taskRoleArn) with the IAM policies required to access the Amazon DynamoDB table and AWS Secrets Manager.

Cevap

Configure dynamic port mapping by setting the host port to 0 or leaving it blank, and assign the required IAM policies to the ECS Task Role (taskRoleArn) with a trust policy for ecs-tasks.amazonaws.com.
To support running multiple instances of the container on a single EC2 host using the bridge network mode, dynamic host port mapping is required. This is achieved by setting the host port to 0 or leaving it blank in the task definition port mapping, which allows the ECS agent to automatically map the container port to a random ephemeral port on the host. Furthermore, the application container requires AWS credentials at runtime to query the DynamoDB table and fetch secrets from Secrets Manager. These application-level permissions must be defined in an IAM role assigned to the taskRoleArn (Task Role) parameter of the task definition.

Adım Adım Çözüm

1
Configure the port mapping in the task definition for bridge network mode with the host port set to 0 or left blank.
Enables dynamic port mapping, letting the ECS agent bind the container's port to a random host port.
Allows multiple task instances to run on the same EC2 instance without port conflicts.
2
Create an IAM role that trusts the ecs-tasks.amazonaws.com service principal and attach permission policies for DynamoDB and Secrets Manager.
Creates a role that ECS tasks can assume to perform API operations on AWS services.
Secures application credentials by avoiding hardcoded values and granting access via temporary credentials.
3
Assign this role to the taskRoleArn parameter in the ECS task definition.
Ensures the containerized application executes with the permissions defined in the IAM role.
Maintains the separation of concerns by assigning application access to the Task Role rather than the Task Execution Role.

Anahtar Kavram

ECS Task Role vs Task Execution Role and Bridge Network Mode Port Mapping
Tahmini Süre:2m 0s
Soru 14Soru →

A developer is setting up an AWS CodeBuild project to build a containerized application. The build process needs to retrieve a database password securely from AWS Secrets Manager. The developer has stored a custom build specification file at the path `build/pipelines/buildspec-dev.yml` in the source repository. During the initial build run, CodeBuild fails immediately because it cannot locate the build specification, and the database credentials are not resolved. Which two actions should the developer take to configure the project correctly? (Choose two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Update the CodeBuild project configuration to set the buildspec file path to build/pipelines/buildspec-dev.yml; In the buildspec-dev.yml file, retrieve the database password by defining it under the secrets-manager key in the env section

Cevap

To configure the project correctly, the developer must update the CodeBuild project settings to set the buildspec path to the custom subdirectory path, and update the buildspec-dev.yml file to declare the secret under the secrets-manager key in the env section.
To resolve the buildspec locator issue, the developer must explicitly configure the custom file path in the CodeBuild project configuration since it is not named buildspec.yml at the root. To retrieve the secret correctly, the developer must define it under the secrets-manager key in the env block, which instructs CodeBuild to retrieve the value from Secrets Manager natively.

Adım Adım Çözüm

1
Configure the CodeBuild project settings to point to the correct buildspec location.
CodeBuild is successfully able to locate and parse the buildspec file from build/pipelines/buildspec-dev.yml instead of failing at the start of the build.
By default, CodeBuild only searches for buildspec.yml at the root directory of the source provider. Any other name or path must be configured in the project settings.
2
Configure the env section of the buildspec-dev.yml file to pull the database password from Secrets Manager.
The database password is dynamically retrieved and exposed as an environment variable in the build environment.
Using the native secrets-manager key in the env block tells CodeBuild to fetch the secret from AWS Secrets Manager using the service role's permissions.

Anahtar Kavram

AWS CodeBuild buildspec configuration and Secrets Manager integration
Soru 15Soru →

A developer is troubleshooting an AWS Lambda function that processes customer orders. The Lambda function is configured to run inside a custom VPC in two private subnets to access an Amazon RDS database securely. During testing, the function times out when attempting to connect to an external payment processor's HTTP endpoint over the internet. Additionally, under load, the Lambda function frequently times out because it establishes a new database connection during each invocation, quickly exhausting database resources.

Which combination of actions will resolve these issues? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configuring a NAT gateway in a public subnet, and updating the route tables of the private subnets to route outbound internet traffic (0.0.0.0/0) through the NAT gateway.; Declaring the database connection client outside of the Lambda handler function to enable execution context reuse across warm starts.

Cevap

The correct options are configuring a NAT gateway in a public subnet and routing the private subnet's traffic through it, and declaring the database connection client outside of the handler function to reuse the execution context.
The correct options resolve both issues. Routing internet-bound traffic from private subnets through a NAT gateway in a public subnet allows the Lambda function to communicate with the external payment API. Declaring the database client outside the handler code ensures that the database connection is reused across invocations, mitigating connection overhead and latency.

Adım Adım Çözüm

1
Address the external payment processor connection timeouts.
Determine that Lambda functions in private subnets require a NAT gateway or VPC endpoint to access the public internet.
Since the external API is on the internet, a NAT gateway must be set up in a public subnet, and the private subnet route tables must be updated to route outbound traffic through it.
2
Address the database resource exhaustion and execution timeouts under load.
Move the database connection initialization code out of the Lambda handler block to global scope.
This allows subsequent warm executions of the function to reuse the existing database connection pool instead of repeatedly opening and closing sockets, resolving execution timeouts and database overload.

Anahtar Kavram

VPC networking configuration for outbound Lambda internet access and database connection optimization using execution context reuse.
Soru 16Soru →

A developer is troubleshooting a web dashboard hosted on `https://monitor.server-analytics.io` that queries a backend using an Amazon API Gateway REST API. The API is configured with a Lambda Proxy integration. When the client makes a request to the API, the browser blocks the response and displays the following error:

`Access to XMLHttpRequest at 'https://api.server-analytics.io/v1/logs' from origin 'https://monitor.server-analytics.io' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.`

Which TWO steps should the developer take to resolve these errors?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the `OPTIONS` method on the API Gateway resource to return the required CORS headers for preflight requests.; Modify the Lambda function's response payload to include the `Access-Control-Allow-Origin` header in the `headers` object.

Cevap

Configure the `OPTIONS` method on the API Gateway resource to return the required CORS headers for preflight requests, and modify the Lambda function's response payload to include the `Access-Control-Allow-Origin` header in the `headers` object.
The correct options are configuring the `OPTIONS` method on the API Gateway resource and modifying the Lambda function's response payload. Under a Lambda Proxy integration, resolving CORS requires a two-fold approach: first, the preflight `OPTIONS` request must be handled by API Gateway (or a mock integration) to return the allowed origin; second, the backend Lambda function must return the `Access-Control-Allow-Origin` header in its execution response.

Adım Adım Çözüm

1
Enable CORS preflight by configuring the `OPTIONS` method on the API resource.
The browser's initial preflight request is successfully answered with `Access-Control-Allow-Origin` and other CORS headers.
Browsers send an HTTP `OPTIONS` preflight request before cross-origin non-simple requests to verify if the server permits the cross-origin call.
2
Add the `Access-Control-Allow-Origin` header to the backend response returned by the Lambda function.
The actual HTTP request succeeds because the response payload contains the required header.
Under Lambda Proxy integration, API Gateway does not automatically inject CORS headers into the backend response. The backend Lambda function must explicitly return these headers in its payload.

Anahtar Kavram

CORS handling in API Gateway Lambda Proxy integrations requires CORS configuration for both the preflight `OPTIONS` method on API Gateway and the actual method response from the backend Lambda function.
Tahmini Süre:1m 30s
Soru 17Soru →

A developer is configuring an AWS Lambda function in Account A (111122223333111122223333) to write data to an Amazon DynamoDB table in Account B (444455556666444455556666) by assuming an IAM role named `CrossAccountDynamoDBRole` in Account B. The Lambda function's execution role in Account A is named `LambdaExecutionRole`.

When the Lambda function invokes the `AssumeRole` API call using the AWS SDK, the execution fails with the following error:
`User: arn:aws:sts::111122223333:assumed-role/LambdaExecutionRole/my-function is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::444455556666:role/CrossAccountDynamoDBRole`

Which TWO configurations must the developer implement to resolve this error?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Add a permission policy to the LambdaExecutionRole in Account A that allows the sts:AssumeRole action on arn:aws:iam::444455556666:role/CrossAccountDynamoDBRole.; Configure the trust policy of CrossAccountDynamoDBRole in Account B to allow the sts:AssumeRole action for the principal arn:aws:iam::111122223333:role/LambdaExecutionRole.

Cevap

To allow the Lambda function to perform cross-account access, the developer must grant the sts:AssumeRole permission to the Lambda execution role in Account A and configure the target role in Account B to trust the Lambda execution role in Account A.
The correct configurations involve setting up both sides of the trust boundary. First, the calling role in Account A must be granted permission to perform the sts:AssumeRole action. Second, the trust policy of the target role in Account B must be updated to trust the calling role in Account A as the principal.

Adım Adım Çözüm

1
Analyze the error message and the configuration requirements.
The error indicates that the Lambda execution role in Account A is not authorized to perform sts:AssumeRole on the cross-account role in Account B.
For cross-account role assumption to succeed, two permissions must match: the caller role must have a permission policy allowing sts:AssumeRole, and the destination role must have a trust policy allowing the caller role to assume it.
2
Configure the calling side (Account A).
Attach an IAM policy to the LambdaExecutionRole allowing the action sts:AssumeRole on the resource arn:aws:iam::444455556666:role/CrossAccountDynamoDBRole.
This grants the source role the necessary authorization to call the STS AssumeRole API.
3
Configure the receiving side (Account B).
Update the trust policy of CrossAccountDynamoDBRole to specify the ARN of the LambdaExecutionRole (arn:aws:iam::111122223333:role/LambdaExecutionRole) as the principal and allow sts:AssumeRole.
This establishes the trust relationship, allowing the principal from Account A to assume the role in Account B.

Anahtar Kavram

Cross-account IAM role assumption requires configuration on both the source account (identity policy permitting sts:AssumeRole) and the destination account (trust policy permitting the source identity).
Soru 18Soru →

A developer is setting up an AWS CodeDeploy deployment group for an in-place deployment of a web application to a fleet of Amazon EC2 instances. The deployment fails during the DownloadBundle phase because the CodeDeploy agent on the EC2 instances cannot access the deployment bundle in the Amazon S3 bucket. Additionally, the developer needs to store database credentials securely and retrieve them during the deployment process rather than packaging them in the deployment bundle.

Which two actions should the developer take to resolve these issues? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Attach an IAM policy to the EC2 instance profile role that allows the s3:GetObject action on the S3 bucket containing the deployment bundle.; Store the database credentials as SecureString parameters in AWS Systems Manager Parameter Store, and write a script in the AppSpec BeforeInstall hook to retrieve them.

Cevap

Attach an IAM policy to the EC2 instance profile role that allows the s3:GetObject action on the S3 bucket containing the deployment bundle, and store the database credentials as SecureString parameters in AWS Systems Manager Parameter Store, retrieving them in the AppSpec BeforeInstall hook.
The correct options involve configuring the EC2 instance profile role with the appropriate S3 read permissions so the CodeDeploy agent can download the bundle, and securely storing credentials in Systems Manager Parameter Store as SecureString parameters, retrieving them during a valid EC2 lifecycle hook like BeforeInstall.

Adım Adım Çözüm

1
Analyze the cause of the CodeDeploy agent S3 access failure.
The agent runs on the EC2 instances and uses the instance profile role to download the deployment bundle. S3 permissions must be granted to the instance profile role, not the CodeDeploy service role.
Permissions must align with the identity executing the action, which is the CodeDeploy agent on EC2.
2
Determine the secure method and correct lifecycle hook for credential retrieval on EC2.
Store credentials as SecureString parameters in AWS Systems Manager Parameter Store and retrieve them using a lifecycle hook valid for EC2, such as BeforeInstall.
This avoids plaintext storage and uses a hook that is compatible with EC2 in-place deployments.

Anahtar Kavram

AWS CodeDeploy permissions and AppSpec configuration on EC2
Soru 19Soru →

An image processing application uses an Amazon SQS queue to trigger an AWS Lambda function that processes batch metadata and fetches external assets via HTTPS. The Lambda function is placed in a private VPC subnet to securely query an Amazon RDS PostgreSQL DB instance in the same VPC. During testing, the developer observes two issues: the Lambda function fails to connect to the external assets API, and several messages from the SQS queue are being processed multiple times, causing duplicate entries in the database. The Lambda function's timeout is set to 55 minutes. Which two actions should the developer take to resolve these issues? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure a NAT Gateway in a public subnet of the VPC, and add a route in the private subnet's route table pointing 0.0.0.0/00.0.0.0/0 traffic to the NAT Gateway.; Increase the visibility timeout of the Amazon SQS queue to at least 3030 minutes, matching the recommended ratio of 66 times the Lambda function's timeout.

Cevap

Configure a NAT Gateway in a public subnet of the VPC with a route for 0.0.0.0/00.0.0.0/0 in the private subnet's route table, and increase the SQS queue's visibility timeout to at least 3030 minutes.
Configuring a NAT Gateway in a public subnet and updating the private subnet's route table ensures that the Lambda function can route outbound HTTPS requests to the internet. Concurrently, increasing the SQS visibility timeout to at least 66 times the Lambda timeout (3030 minutes for a 55-minute Lambda timeout) prevents SQS from releasing messages back to the queue while the Lambda function is still processing them, thereby preventing duplicate processing.

Adım Adım Çözüm

1
Analyze the network failure of the Lambda function when accessing the external HTTP API.
Identify that because the Lambda function is placed in a private subnet, it lacks internet access without an outbound gateway.
Lambda functions in private subnets require a NAT Gateway or NAT instance in a public subnet to route outbound internet traffic.
2
Resolve the VPC internet connectivity issue.
Create a NAT Gateway in a public subnet, and configure a route for 0.0.0.0/00.0.0.0/0 pointing to this NAT Gateway in the private subnet's route table.
This establishes internet egress for resources in the private subnet while keeping them protected from inbound public traffic.
3
Analyze the duplicate SQS message processing issue.
Identify that the Lambda function's timeout of 55 minutes is causing messages to exceed the default SQS visibility timeout (which defaults to 3030 seconds) before completion.
When a message processing time exceeds the visibility timeout, the message becomes visible to other consumers, causing duplicates.
4
Adjust the SQS visibility timeout to align with AWS Lambda integration best practices.
Increase the visibility timeout of the SQS queue to 3030 minutes, which is 66 times the Lambda function's timeout.
AWS recommends setting the SQS visibility timeout to at least 66 times the Lambda function's timeout to prevent duplicate deliveries and handle retries.

Anahtar Kavram

Configuring private subnet internet access for AWS Lambda and aligning SQS visibility timeouts with Lambda function execution limits.
Tahmini Süre:2m 0s
Soru 20Soru →

A developer is creating an AWS Lambda function that fetches metadata from an external third-party API and saves the results to an Amazon DynamoDB table. The external API requires an API key for authentication. The developer needs to optimize the function's performance by minimizing connection latency and ensuring the API key is secured according to AWS best practices.

Which two actions should the developer take to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Initialize the DynamoDB client and the HTTP client outside of the Lambda handler method.; Store the API key in AWS Secrets Manager, retrieve it using the AWS SDK inside the Lambda function, and cache the retrieved key in a global variable outside the handler.

Cevap

Initialize the DynamoDB client and the HTTP client outside of the Lambda handler method, and store the API key in AWS Secrets Manager, retrieving and caching it in a global variable outside the handler.
Initializing database clients and HTTP clients outside the handler allows AWS Lambda to reuse these connections across warm invocations, significantly optimizing execution latency. Additionally, retrieving sensitive keys from AWS Secrets Manager programmatically and caching them in global variables ensures credentials are kept secure while preventing API call overhead on subsequent executions.

Adım Adım Çözüm

1
Analyze performance optimization for database and external connections in Lambda.
Determine that SDK and HTTP clients should be initialized outside of the handler function.
This allows the function to reuse the execution context, including established TCP connections, across warm invocations, reducing latency.
2
Evaluate secure credential management options for the external API key.
Identify AWS Secrets Manager as the secure repository for the API key instead of hardcoding it in the source code.
Hardcoding credentials exposes secrets in source code repositories and makes key rotation difficult, violating AWS security best practices.
3
Optimize secret retrieval latency within the Lambda execution cycle.
Implement code to retrieve the secret and cache it in a global variable declared outside the handler.
Caching the secret ensures the Lambda function only calls the Secrets Manager service during cold starts, reducing latency and cost for subsequent warm starts.

Anahtar Kavram

AWS Lambda execution context reuse and secure credential management using AWS Secrets Manager.
Sayfa 1 / 38Sonraki