Examkin

Troubleshooting and Optimization

271 soru

Tüm türler271Çoktan seçmeli138Çoklu seçim133
Soru 21Soru →

An organization has an AWS Lambda function running in Account A (111122223333111122223333). The Lambda function needs to be triggered by an Amazon SQS queue located in Account B (444455556666444455556666). A developer is configuring a cross-account event source mapping in Account A to process messages from the queue. During setup, the event source mapping enters an `ERR` status with a permission-related error.

Which combination of actions will resolve this authorization failure? (Choose two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Update the Lambda function's IAM execution role policy in Account A to grant permission for `sqs:ReceiveMessage`, `sqs:DeleteMessage`, and `sqs:GetQueueAttributes` on the SQS queue's ARN in Account B.; Update the SQS queue policy in Account B to grant `sqs:ReceiveMessage`, `sqs:DeleteMessage`, and `sqs:GetQueueAttributes` permissions to the ARN of the Lambda function's execution role in Account A.

Cevap

Updating the Lambda function's execution role policy in Account A to allow SQS actions on the Account B queue, and updating the SQS queue policy in Account B to allow the Lambda execution role ARN.
To configure a cross-account SQS event source mapping, the Lambda function's execution role in Account A must be granted IAM permissions to receive, delete, and get attributes from the queue in Account B. Additionally, the SQS queue policy in Account B must be updated to trust and grant those same permissions to the Lambda function's execution role ARN in Account A.

Adım Adım Çözüm

1
Identify the Lambda execution role ARN in Account A and the SQS queue ARN in Account B.
Obtained the unique identifiers needed to configure the cross-account permissions.
Both ARNs are needed to configure the resource policies and IAM policies correctly.
2
Modify the Lambda execution role's permissions policy in Account A.
Granted sqs:ReceiveMessage, sqs:DeleteMessage, and sqs:GetQueueAttributes permissions on the Account B SQS queue ARN.
Allows the Lambda service (acting on behalf of the function) to access the SQS queue in the other account.
3
Modify the SQS queue resource policy in Account B.
Added a statement allowing the Lambda execution role ARN from Account A to perform sqs:ReceiveMessage, sqs:DeleteMessage, and sqs:GetQueueAttributes.
Grants cross-account access at the resource level, allowing the external role from Account A to access Account B's SQS queue.

Anahtar Kavram

Cross-account authorization for poll-based event sources (SQS) in AWS Lambda requires both identity-based policies (on the Lambda execution role) and resource-based policies (on the SQS queue) to grant permissions.
Soru 22Soru →

A Go-based web application is running on Amazon EC2 instances inside a private subnet. The application handles incoming user requests and calls a downstream microservice on another EC2 instance via HTTP. The developer has installed the AWS X-Ray daemon on all EC2 instances and wants to implement distributed tracing to monitor end-to-end performance. However, currently, no traces are appearing in the AWS X-Ray console, and the downstream HTTP calls are not being correlated with the upstream web requests.

Which two actions must the developer take to resolve these issues and ensure proper end-to-end tracing?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Attach an IAM role with the AWSXRayDaemonWriteAccess policy to the EC2 instances to allow the X-Ray daemon to upload trace data.; Use the AWS X-Ray SDK to instrument the HTTP client in the Go application to automatically inject the tracing header into outgoing requests.

Cevap

Attach an IAM role with the AWSXRayDaemonWriteAccess policy to the EC2 instances, and use the AWS X-Ray SDK to instrument the HTTP client in the Go application.
The solution requires addressing both daemon communication permissions and service-to-service context propagation. First, the daemon running on the EC2 instance requires IAM permissions to upload trace segments, which is resolved by granting the AWSXRayDaemonWriteAccess policy to the instance's role. Second, trace context must be forwarded to downstream HTTP services, which is accomplished by wrapping the HTTP client with the X-Ray SDK so it injects the X-Amzn-Trace-Id header into outgoing requests.

Adım Adım Çözüm

1
Configure permissions for the daemon.
The X-Ray daemon can authenticate and push data.
By attaching an IAM role with the AWSXRayDaemonWriteAccess policy to the EC2 instances, the daemon on EC2 obtains the permissions required to make PutTraceSegments API calls to AWS X-Ray.
2
Instrument the HTTP client code using the AWS X-Ray SDK.
The HTTP client automatically appends the tracing header to outgoing calls.
To propagate the trace context across HTTP boundaries, the client must generate and inject the X-Amzn-Trace-Id header into downstream requests.

Anahtar Kavram

To enable distributed tracing on EC2, the developer must ensure the X-Ray daemon has the necessary IAM permissions via an instance profile, and that HTTP clients are instrumented using the X-Ray SDK to propagate tracing context down the service call stack.
Tahmini Süre:2m 30s
Soru 23Soru →

An organization uses AWS CodePipeline to automate their application deployment. During a recent deployment, an AWS CloudFormation action updating a nested stack fails, triggering a rollback. The parent stack fails to roll back completely and becomes stuck in the `UPDATE_ROLLBACK_FAILED` state because a Lambda function backing a Custom Resource was manually deleted prior to the deployment. Which action should the developer take to resolve this issue and return the stack to a stable state?

Cevabı ve açıklamayı göster

Cevap: Execute the `continue-update-rollback` command in the AWS CLI, specifying the logical ID of the failed custom resource in the `--resources-to-skip` parameter to transition the stack to `UPDATE_ROLLBACK_COMPLETE`. Afterward, recreate the Lambda function or update the template to point to a valid resource, and redeploy.

Cevap

Execute the `continue-update-rollback` command in the AWS CLI, specifying the logical ID of the failed custom resource in the `--resources-to-skip` parameter to transition the stack to `UPDATE_ROLLBACK_COMPLETE`. Afterward, recreate the Lambda function or update the template to point to a valid resource, and redeploy.
When a Custom Resource's provider (like a Lambda function) is deleted, CloudFormation cannot invoke the cleanup logic during rollback, which leaves the stack in the `UPDATE_ROLLBACK_FAILED` state. The developer must use the `continue-update-rollback` command with the `--resources-to-skip` parameter. This allows CloudFormation to bypass execution of the missing resource's logic and transitions the stack to `UPDATE_ROLLBACK_COMPLETE`. After the stack is in a stable state, proper template fixes can be safely applied.

Adım Adım Çözüm

1
Analyze the state of the CloudFormation stack.
The stack is stuck in `UPDATE_ROLLBACK_FAILED` because a Custom Resource's deletion/cleanup handler failed (due to the missing backing Lambda function).
You cannot perform direct updates or standard rollbacks while a stack is in this non-stable state.
2
Execute the recovery operation using the AWS CLI or Console.
Run `aws cloudformation continue-update-rollback --stack-name <stack-name> --resources-to-skip <failed-custom-resource-logical-id>`.
This instructs CloudFormation to skip the cleanup behavior for the deleted Lambda-backed Custom Resource and force the stack into `UPDATE_ROLLBACK_COMPLETE`.
3
Remediate and redeploy.
Update the template with correct Lambda ARNs or recreate the missing Lambda resource, then run the pipeline deployment again.
Now that the stack is in a stable state (`UPDATE_ROLLBACK_COMPLETE`), new deployment updates can be accepted.

Anahtar Kavram

Recovering CloudFormation stacks from the UPDATE_ROLLBACK_FAILED state.
Tahmini Süre:3m 0s
Soru 24Soru →

A developer is updating an AWS CloudFormation stack that manages a production application. The update fails during the creation of a new database instance due to a parameter conflict. CloudFormation automatically initiates a rollback, but the rollback fails because an Amazon S3 bucket, which was manually modified out-of-band, now has a bucket policy that denies the CloudFormation service role the permissions required to delete it. The stack is now in the `UPDATE_ROLLBACK_FAILED` state. The developer updates the S3 bucket policy to allow the CloudFormation service role to delete the bucket.

Which action must the developer perform next to return the stack to a stable state so that future updates can be applied?

Cevabı ve açıklamayı göster

Cevap: Execute the `aws cloudformation continue-update-rollback` command to resume the rollback and return the stack to a stable state.

Cevap

Execute the `aws cloudformation continue-update-rollback` command to resume the rollback and return the stack to a stable state.
The correct action is to resume the rollback by executing the `continue-update-rollback` command. Since the permissions issue blocking the deletion of the S3 bucket has been resolved, CloudFormation will successfully delete the bucket and return the stack to the `UPDATE_ROLLBACK_COMPLETE` state, which allows subsequent updates.

Adım Adım Çözüm

1
Analyze the stack state.
The stack is in the `UPDATE_ROLLBACK_FAILED` state, which prevents direct stack updates.
You must understand the current lifecycle state of the stack to determine the correct troubleshooting command.
2
Identify the cause of the rollback failure and verify its resolution.
The S3 bucket deletion failure due to bucket policy restrictions has been resolved by modifying the bucket policy.
Resuming the rollback will fail again if the underlying resource blocking the rollback is not fixed first.
3
Trigger the resumption of the rollback process.
Executing the `continue-update-rollback` command resumes the rollback, transitioning the stack to `UPDATE_ROLLBACK_COMPLETE`.
This returns the stack to a stable configuration, enabling future update operations.

Anahtar Kavram

Handling CloudFormation stack update rollback failures using the ContinueUpdateRollback action.
Tahmini Süre:2m 0s
Soru 25Soru →

A serverless microservice uses an AWS Lambda function to retrieve user configuration profiles from an Amazon ElastiCache cluster located in a private VPC subnet, and then sends SMS notifications by calling a third-party gateway's HTTP API over the internet. The Lambda function is configured to run in the same VPC and private subnets as the ElastiCache cluster. During execution, the Lambda function successfully connects to ElastiCache, but the HTTP requests to the third-party gateway consistently fail with connection timeout errors. Which two configuration actions should the developer take to resolve this network connectivity issue? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy a NAT Gateway in a public subnet of the VPC, and configure the route table of the Lambda function's private subnets to route traffic destined for 0.0.0.0/00.0.0.0/0 through the NAT Gateway.; Verify that the security group associated with the Lambda function has outbound rules allowing egress HTTP/HTTPS traffic to the internet.

Cevap

Deploy a NAT Gateway in a public subnet of the VPC, route traffic destined for the internet through it, and ensure the Lambda function's security group allows outbound HTTP/HTTPS traffic.
The correct options involve deploying a NAT Gateway in a public subnet and configuring the private subnet's route table to direct internet-bound traffic (0.0.0.0/00.0.0.0/0) to it, while also verifying that the Lambda function's security group allows outbound egress traffic on web ports. This ensures both routing and firewall policies allow the Lambda function to reach the external HTTP API.

Adım Adım Çözüm

1
Analyze the network paths and resources.
The database connection to ElastiCache works because both resources are inside the private subnets of the VPC. The outbound internet calls fail because there is no route to the internet from the private subnets.
Identifying that the failure is related to outbound internet access helps narrow down the solution to VPC egress configurations.
2
Configure the routing tables for internet access.
Deploy a NAT Gateway in a public subnet, and add a route to 0.0.0.0/00.0.0.0/0 in the private subnet's route table pointing to the NAT Gateway.
This establishes a valid network path for resources in the private subnets to communicate with public internet services.
3
Verify security group rules.
Ensure the security group attached to the Lambda function permits outbound traffic to the internet on ports 80 and 443.
Even with correct route tables, restrictive outbound security group rules can block connection attempts.

Anahtar Kavram

Lambda VPC networking requires a NAT Gateway for outbound internet access from private subnets.
Soru 26Soru →

A developer has configured a CI/CD pipeline using AWS CodePipeline. The pipeline has a deploy stage that uses AWS CloudFormation to update a production stack. During a recent deployment, the stack update failed due to an error in a custom resource, and the subsequent rollback attempt also failed, leaving the stack in the UPDATE_ROLLBACK_FAILED state. The developer has resolved the root cause of the custom resource failure in the CloudFormation template and committed the changes to the source repository. However, the pipeline is now failing at the CloudFormation deploy stage with an error stating that the stack cannot be updated in its current state. Which two actions should the developer take to resolve the deployment failure and successfully apply the changes? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Execute the continue-update-rollback command via the AWS CLI or CloudFormation console to resume the rollback process and bring the stack to the UPDATE_ROLLBACK_COMPLETE state.; After the stack reaches a stable state, trigger the pipeline again to apply the updated template containing the fix.

Cevap

Execute the continue-update-rollback command via the AWS CLI or CloudFormation console to resume the rollback process and bring the stack to the UPDATE_ROLLBACK_COMPLETE state, and after the stack reaches a stable state, trigger the pipeline again to apply the updated template containing the fix.
The correct approach is to first return the CloudFormation stack to a stable state. This is achieved by executing the continue-update-rollback action, which moves the stack to UPDATE_ROLLBACK_COMPLETE. Once the stack is stable, the pipeline can be executed again to safely apply the corrected template configuration from the repository.

Adım Adım Çözüm

1
Diagnose the current state of the AWS CloudFormation stack.
The stack is confirmed to be in the UPDATE_ROLLBACK_FAILED state, meaning that the update failed and the subsequent rollback attempt also failed.
You must identify the stack state to determine the appropriate recovery API call, as CloudFormation prevents updates on stacks that are not in a stable state.
2
Resume the rollback using AWS CloudFormation CLI or Console.
By executing 'aws cloudformation continue-update-rollback', CloudFormation attempts to roll back the remaining resources. If specific resources continue to fail, they can be skipped during this process.
This action moves the stack from the unstable UPDATE_ROLLBACK_FAILED state to the stable UPDATE_ROLLBACK_COMPLETE state.
3
Redeploy the corrected template by triggering the CI/CD pipeline.
The pipeline runs successfully, executing the CloudFormation update stage to apply the bug fix to the resources.
Once the stack is stable in the UPDATE_ROLLBACK_COMPLETE state, it can accept new update commands to apply the corrected template configuration.

Anahtar Kavram

Handling AWS CloudFormation stack update rollback failures by resuming the rollback process to reach a stable state before applying further updates.
Soru 27Soru →

A developer is troubleshooting a multi-account deployment pipeline in AWS CodePipeline. During the execution, the AWS CodeBuild stage fails with an AccessDenied error when attempting to assume a deployment role in a target AWS account. Additionally, a separate AWS CloudFormation deploy stage fails with an error indicating that the target stack is in the ROLLBACK_COMPLETE state from a previous failed creation. Which two actions must the developer take to resolve these failures? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Delete the CloudFormation stack in the ROLLBACK_COMPLETE state before running the deployment pipeline again.; Update the trust policy of the target deployment role to allow the AssumeRole action from the CodeBuild service role principal.

Cevap

Delete the CloudFormation stack in the ROLLBACK_COMPLETE state before running the deployment pipeline again, and update the trust policy of the target deployment role to allow the AssumeRole action from the CodeBuild service role principal.
To resolve the deployment issues, the developer must delete the stack in the ROLLBACK_COMPLETE state because CloudFormation does not support updating a stack that failed during its initial creation. Additionally, to resolve the cross-account AccessDenied error, the developer must update the trust policy of the target role to trust the CodeBuild service role as a principal, permitting the sts:AssumeRole action.

Adım Adım Çözüm

1
Identify the cause of the CloudFormation stage failure.
The target stack is determined to be in the ROLLBACK_COMPLETE state, indicating a failed initial creation.
CloudFormation does not allow updating a stack that failed during its initial creation and rolled back to ROLLBACK_COMPLETE. The stack must be deleted before a new creation attempt can succeed.
2
Address the ROLLBACK_COMPLETE state.
The stack is deleted.
Deleting the stack removes the blocked state, allowing the pipeline to create the stack from scratch on the next execution.
3
Identify the cause of the CodeBuild assume-role failure.
The CodeBuild service role in the source account cannot assume the target deployment role due to missing trust permissions.
Cross-account role assumption requires the target role's trust policy to explicitly grant the assuming principal permission to assume it.
4
Update the trust policy of the target deployment role.
The trust policy is updated to include the CodeBuild service role ARN as a trusted principal with the sts:AssumeRole action.
This establishes the trust relationship, allowing STS to successfully issue temporary credentials to CodeBuild to perform the deployment.

Anahtar Kavram

Cross-account IAM delegation and CloudFormation initial creation rollback handling
Soru 28Soru →

A financial technology application uses an Amazon DynamoDB table to retrieve real-time stock price data. During periods of high market activity, the application experiences increased read latency due to a massive spike in repeat query requests for popular stock symbols, leading to Read Capacity Unit (RCU) throttling on the table. A developer decides to deploy an Amazon DynamoDB Accelerator (DAX) cluster to resolve this issue. Which two of the following benefits does deploying a DAX cluster provide to resolve this throughput and latency bottleneck? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: It provides sub-millisecond response times for cached read requests.; It reduces the read load on the DynamoDB table by serving repeat read requests from the cache.

Cevap

Deploying a DAX cluster provides sub-millisecond response times for cached read requests and reduces the read load on the DynamoDB table by serving repeat read requests from the cache.
Deploying a DAX cluster acts as an in-memory cache that serves repeat read requests with sub-millisecond latency. Since these cached reads are resolved within the DAX cluster, they do not consume the underlying table's provisioned Read Capacity Units (RCUs), resolving the throttling bottleneck.

Adım Adım Çözüm

1
Identify the performance bottleneck in the DynamoDB table.
The bottleneck is caused by a massive spike in repeat query requests, leading to RCU throttling and latency.
Understanding the nature of the bottleneck is necessary to choose the correct optimization approach.
2
Evaluate the capabilities of Amazon DynamoDB Accelerator (DAX) to resolve read latency and capacity bottlenecks.
DAX provides an API-compatible, in-memory caching layer that serves repeat read requests with sub-millisecond latency and offloads read traffic from the database table.
This confirms that DAX directly mitigates both the read latency and RCU throttling issues.

Anahtar Kavram

Using Amazon DynamoDB Accelerator (DAX) to cache read requests, reducing latency and table read throughput load.
Tahmini Süre:1m 0s
Soru 29Soru →

A developer is deploying a Node.js web application to AWS Elastic Beanstalk. The application reads and writes data to an Amazon DynamoDB table using the AWS SDK for JavaScript. The developer wants to use AWS X-Ray to perform distributed tracing of incoming HTTP requests and downstream DynamoDB calls. Currently, the application is running, but no trace data is visible in the AWS X-Ray console.

Which two actions should the developer take to instrument the application and enable distributed tracing? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a configuration file in the `.ebextensions` directory at the root of the application source bundle to set `XRayEnabled` to `true` under the `aws:elasticbeanstalk:xray` namespace.; Use the AWS X-Ray SDK in the application code to wrap the DynamoDB client and capture trace context for downstream calls.

Cevap

Enable X-Ray tracing in the Elastic Beanstalk environment using a configuration file in the `.ebextensions` directory, and instrument the DynamoDB client in the application code using the AWS X-Ray SDK.
To trace incoming requests and downstream database calls on AWS Elastic Beanstalk, you must enable the X-Ray daemon on the hosting instances and instrument the database client. Creating a configuration file in the `.ebextensions` directory at the root of the source bundle with `XRayEnabled: true` ensures that the platform automatically installs, runs, and updates the X-Ray daemon. Additionally, wrapping the DynamoDB client with the AWS X-Ray SDK enables the capture of downstream calls as subsegments under the active trace context.

Adım Adım Çözüm

1
Enable the AWS X-Ray daemon in the Elastic Beanstalk environment.
The X-Ray daemon is installed and started on the Elastic Beanstalk EC2 instances, listening on local UDP port 2000.
Elastic Beanstalk does not run the X-Ray daemon by default. Creating a configuration file in the `.ebextensions` folder with the `XRayEnabled` option set to `true` instructs Elastic Beanstalk to configure and run the daemon process.
2
Instrument the downstream AWS SDK DynamoDB client using the AWS X-Ray SDK in the application code.
The application wraps the DynamoDB client, allowing the X-Ray SDK to record and inject trace propagation headers into outgoing requests.
Simply enabling the daemon only collects EC2 instance metadata and application container level data. To trace specific downstream calls (like DynamoDB queries), the AWS SDK client must be explicitly instrumented by the X-Ray SDK.

Anahtar Kavram

Instrumenting Elastic Beanstalk applications with the AWS X-Ray daemon and capturing downstream AWS SDK client calls.
Tahmini Süre:2m 0s
Soru 30Soru →

A mobile application sends a `POST` request to an Amazon API Gateway REST API. The API is configured with a Lambda proxy integration to retrieve user profiles. The developer recently migrated the integration from a Lambda custom integration to a Lambda proxy integration. Following the migration, client requests fail with a `502 Bad Gateway` status code and a CORS error in the browser console. The Lambda function execution logs show that the function completes successfully and returns the user profile data. Which two actions should the developer take to resolve this issue?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Modify the backend Lambda function to return a JSON object containing `statusCode`, a headers map, and a stringified JSON `body`.; Include the `Access-Control-Allow-Origin` header inside the `headers` object of the Lambda function's return payload.

Cevap

To resolve the 502 Bad Gateway and CORS errors, the developer must format the Lambda function's output as a JSON object containing statusCode, a headers map, and a stringified body, and explicitly include the Access-Control-Allow-Origin header inside the headers map.
Under a Lambda proxy integration, API Gateway expects the backend Lambda function to structure its response as a JSON object with the keys: `statusCode`, `headers`, and `body` (as a string). Returning unformatted output causes API Gateway to fail parsing the integration response, throwing a 502 Bad Gateway error. Because the request never successfully completes with valid response headers, the browser console also reports a CORS error. Furthermore, API Gateway does not inject CORS headers automatically into proxy integration responses, meaning the Lambda function itself must return the `Access-Control-Allow-Origin` header in its response payload.

Adım Adım Çözüm

1
Inspect the Lambda function response format.
The Lambda function returns raw user profile data, which is incompatible with Lambda proxy integration requirements.
Lambda proxy integrations require a structured response containing statusCode, headers, and body.
2
Modify the response structure returned by the Lambda function.
The function returns a JSON object with 'statusCode': 200, a 'headers' map, and 'body': JSON.stringify(profileData).
This matches the expected schema for API Gateway to successfully parse the integration response and avoid the 502 Bad Gateway error.
3
Add the Access-Control-Allow-Origin header to the Lambda response.
The headers map contains 'Access-Control-Allow-Origin': '*'.
Since proxy integrations bypass API Gateway integration response formatting, the backend Lambda must explicitly supply the CORS headers to prevent browser blocks.

Anahtar Kavram

Lambda Proxy Integration Response Format and CORS Requirements
Soru 31Soru →

A developer is configuring an Amazon CloudWatch Logs metric filter to monitor HTTP 500 status codes for a legacy web application. The application logs events to a CloudWatch log group in space-delimited Common Log Format (CLF). The developer observes the following sample log event:

`192.0.2.10 - - [14/Jul/2026:12:00:00 +0000] "POST /submit HTTP/1.1" 500 324`

The developer sets up the metric filter with the following pattern:

`[ip, client, user, timestamp, request, status_code = 500, size]`

However, the metric does not record any data points even when the log group receives events containing HTTP 500 errors. What is the reason for this behavior?

Cevabı ve açıklamayı göster

Cevap: The metric filter parser splits the log line strictly by spaces, ignoring brackets and quotes. This causes the timestamp and HTTP request to be parsed into multiple fields, shifting the status code to the ninth position.

Cevap

The metric filter parser splits the log line strictly by spaces, ignoring brackets and quotes. This causes the timestamp and HTTP request to be parsed into multiple fields, shifting the status code to the ninth position.
The correct answer explains that CloudWatch Logs parses space-delimited log events strictly by spaces, ignoring enclosing brackets (like those on timestamps) or quotes (like those around requests). Consequently, the log line is split into ten fields instead of seven, shifting the status code to the ninth position. To fix the issue, the metric filter pattern must declare fields up to the ninth position, such as: `[ip, client, user, timestamp_date, timestamp_zone, method, path, protocol, status_code = 500, size]`.

Adım Adım Çözüm

1
Analyze the raw log line to identify space boundaries.
The log line has space-delimited tokens: 192.0.2.10 (1), - (2), - (3), [14/Jul/2026:12:00:00 (4), +0000] (5), "POST (6), /submit (7), HTTP/1.1" (8), 500 (9), 324 (10).
CloudWatch Logs space-delimited metric filter parser does not respect quotes or brackets for grouping; it separates tokens strictly by spaces.
2
Determine the position of the target metric field.
The HTTP status code '500' is at the 9th position in the sequence of space-separated values.
Knowing the correct position allows us to align the metric filter fields with the actual log format structure.
3
Evaluate the metric filter pattern defined by the developer.
The pattern specifies only 7 fields, mapping 'status_code' to the 6th field (which parses to '"POST'), causing the comparison 'status_code = 500' to fail.
This shows why the existing metric filter fails to capture any matches.

Anahtar Kavram

CloudWatch Logs space-delimited metric filters parse raw log entries strictly by space boundaries without respecting quotes or brackets for grouping.
Tahmini Süre:1m 30s
Soru 32Soru →

A developer is hosting a client-side web application on `https://console.inventoryhub.net`. The application makes an HTTP `DELETE` request to an Amazon API Gateway REST API that uses a Lambda proxy integration to remove items from a database. When a user attempts to delete an item, the browser blocks the request and displays a CORS preflight error in the console. Additionally, when testing the endpoint directly using a custom HTTP client, the API returns a `502 Bad Gateway` error. Which two actions should the developer take to resolve these issues? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure a MOCK integration for the OPTIONS method on the API Gateway resource to return the CORS headers Access-Control-Allow-Origin and Access-Control-Allow-Methods.; Update the backend Lambda function to return a JSON response containing the statusCode, body, and headers fields, including the Access-Control-Allow-Origin header.

Cevap

Configure a MOCK integration for the OPTIONS method on the API Gateway resource to return the CORS headers, and update the backend Lambda function to return a JSON response containing the statusCode, body, and headers fields including the Access-Control-Allow-Origin header.
The browser blocks the request because the API Gateway does not respond to the preflight OPTIONS request with the required CORS headers, which is fixed by configuring a MOCK integration for OPTIONS. Furthermore, the 502 Bad Gateway error indicates that the Lambda function's response violates the required format for proxy integrations. Correcting the Lambda output to include statusCode, body, and headers (with Access-Control-Allow-Origin) resolves both the 502 error and allows the browser to accept the actual DELETE request response.

Adım Adım Çözüm

1
Enable CORS on the API Gateway resource for the OPTIONS method.
This creates an OPTIONS method with a MOCK integration that returns the Access-Control-Allow-Origin and Access-Control-Allow-Methods headers to satisfy the browser's preflight request.
Browsers send a preflight OPTIONS request before cross-origin non-simple requests (like DELETE). The API must respond to OPTIONS without authentication and with the appropriate CORS headers.
2
Ensure the Lambda function returns a correctly structured JSON object containing statusCode, body, and headers.
This resolves the 502 Bad Gateway error caused by the malformed response format under Lambda proxy integration.
Under Lambda proxy integration, API Gateway expects a specific return JSON structure. If the Lambda returns a raw string or missing fields, API Gateway cannot parse it and returns a 502 Bad Gateway error.
3
Include the Access-Control-Allow-Origin header within the Lambda function's returned headers dictionary.
The browser successfully receives the Access-Control-Allow-Origin header on the actual DELETE response and permits the client-side application to read the response.
For Lambda proxy integrations, CORS headers for the actual request (DELETE) must be returned by the backend Lambda function itself, not just the OPTIONS preflight method.

Anahtar Kavram

CORS preflight requests require a MOCK OPTIONS endpoint returning CORS headers, and Lambda proxy integrations require the backend Lambda function to format its response with statusCode, body, and headers, including Access-Control-Allow-Origin.
Soru 33Soru →

A developer is writing an AWS Lambda function in AWS Account A (111111111111111111111111) that needs to retrieve files from an Amazon S3 bucket located in AWS Account B (222222222222222222222222). The developer has attached an IAM policy to the Lambda function's execution role in Account A that grants `s3:GetObject` permissions on the S3 bucket in Account B. However, when the Lambda function runs, it receives an Access Denied error (HTTP 403403) from Amazon S3. Which of the following actions will resolve this authorization failure?

Cevabı ve açıklamayı göster

Cevap: Add a bucket policy to the S3 bucket in Account B that explicitly grants the Lambda execution role ARN in Account A permission to perform the s3:GetObject action.

Cevap

Add a bucket policy to the S3 bucket in Account B that explicitly grants the Lambda execution role ARN in Account A permission to perform the s3:GetObject action.
For cross-account access to Amazon S3, both the identity-based policy in the source account (Account A) and the resource-based policy (bucket policy) in the destination account (Account B) must explicitly grant permission. Adding a bucket policy in the destination account that allows the source account's Lambda execution role to perform the object retrieval action satisfies the second requirement.

Adım Adım Çözüm

1
Identify the authorization boundary for cross-account S3 access.
Determine that the request crosses AWS accounts, requiring authorization from both the source (Account A) and destination (Account B).
Unlike same-account S3 access, cross-account access requires permissions to be granted explicitly on both the identity-based policy and the resource-based policy.
2
Evaluate the existing configuration.
Confirm that the identity-based policy on the Lambda execution role in Account A already allows s3:GetObject on the target resource.
Since the IAM role is configured correctly, the authorization failure points to a missing resource-based permission on the destination bucket.
3
Configure the destination S3 bucket policy.
Add an S3 bucket policy in Account B designating the Lambda execution role from Account A as the Principal, and allowing the s3:GetObject action.
This establishes the necessary trust relationship at the resource level, enabling the Lambda function to retrieve the objects successfully.

Anahtar Kavram

Cross-Account IAM Delegation and Resource-Based Policies
Soru 34Soru →

A developer has configured an AWS Lambda function in Account A to write data to an Amazon DynamoDB table in Account B. To achieve this, the Lambda function code uses the AWS SDK to call `sts:AssumeRole` on an IAM role in Account B named `DynamoDBWriteRole`. The Lambda function's execution role in Account A has a policy allowing `sts:AssumeRole` on the ARN of `DynamoDBWriteRole`. However, the function execution fails with an `AccessDenied` error during the STS assume role operation. The developer examines the trust policy of `DynamoDBWriteRole` in Account B:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which of the following actions will resolve this authorization failure?

Cevabı ve açıklamayı göster

Cevap: Update the trust policy of DynamoDBWriteRole in Account B to specify the ARN of the Lambda execution role from Account A in the Principal block instead of the Lambda service principal.

Cevap

Updating the trust policy of DynamoDBWriteRole in Account B to specify the ARN of the Lambda execution role from Account A in the Principal block instead of the Lambda service principal.
The correct action is to modify the trust policy of the target role in Account B so that it trusts the ARN of the Lambda execution role in Account A. When a Lambda function runs and utilizes the AWS SDK to call `AssumeRole`, the call is initiated under the identity of the Lambda execution role, not the Lambda service principal. Therefore, the destination role's trust policy must explicitly allow the execution role's ARN (or Account A) as the trusted Principal.

Adım Adım Çözüm

1
Identify the identity making the role assumption request.
The Lambda function's execution role in Account A is the calling identity that invokes `sts:AssumeRole`.
When code running inside a Lambda function uses the AWS SDK to assume a role, the request is authenticated via the function's execution role credentials.
2
Analyze the destination role's trust policy in Account B.
The current trust policy grants permissions only to the AWS service principal `lambda.amazonaws.com`.
The service principal `lambda.amazonaws.com` is used to allow the Lambda service to assume a role to execute a function, not to allow programmatic SDK calls made by an IAM role.
3
Modify the trust policy of the destination role in Account B.
Replace the service principal in the Principal block with the ARN of the Lambda execution role from Account A.
This establishes the necessary cross-account trust relation allowing the specific IAM identity from Account A to call `sts:AssumeRole` on the role in Account B.

Anahtar Kavram

Understanding and resolving IAM trust policy misconfigurations in cross-account delegation.
Tahmini Süre:1m 30s
Soru 35Soru →

A developer is attempting to deploy an AWS Serverless Application Model (SAM) template using the AWS CLI in an AWS Organizations member account. The developer is assuming an IAM role named `DeploymentRole` which has the `AdministratorAccess` managed policy attached. During the deployment, the CloudFormation stack creation fails with the following error:

`API: lambda:CreateFunction User: arn:aws:iam::123456789012:assumed-role/DeploymentRole/AWSCloudFormation is not authorized to perform: lambda:CreateFunction on resource: arn:aws:lambda:us-east-1:123456789012:function:MySampleFunction`

Which of the following actions should the developer take to resolve this authorization failure? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Ensure that the IAM permissions boundary attached to the `DeploymentRole` includes permissions for the `lambda:CreateFunction` action.; Verify that no Service Control Policy (SCP) in AWS Organizations is denying the `lambda:CreateFunction` action on the member account.

Cevap

Ensure that the IAM permissions boundary attached to the DeploymentRole includes permissions for the lambda:CreateFunction action, and verify that no Service Control Policy (SCP) in AWS Organizations is denying the lambda:CreateFunction action on the member account.
The correct options are to ensure that the IAM permissions boundary attached to the DeploymentRole includes permissions for the lambda:CreateFunction action, and to verify that no Service Control Policy (SCP) in AWS Organizations is denying the action on the member account. In AWS IAM policy evaluation, even if an identity-based policy (such as AdministratorAccess) allows an action, it will be denied if it is not allowed by an active permissions boundary or if it is denied by an SCP, as both function as policy filters that set the maximum allowable permissions.

Adım Adım Çözüm

1
Analyze the error message and the current permission configuration.
The deployment role has the AdministratorAccess policy but is still unauthorized to perform the lambda:CreateFunction action.
Since the identity-based policy grants full access, the restriction must originate from a policy type that acts as a guardrail, such as a permissions boundary or a Service Control Policy (SCP).
2
Check the IAM permissions boundary on the DeploymentRole.
Confirm whether a permissions boundary is attached to the role, and verify if it includes permissions for the lambda:CreateFunction action.
Permissions boundaries define the maximum permissions that an IAM entity can have. If the boundary does not allow the action, the action is denied even if AdministratorAccess is attached.
3
Check AWS Organizations Service Control Policies (SCPs) applied to the account.
Verify that no SCP at the Root, OU, or account level denies the lambda:CreateFunction action.
SCPs restrict permissions in member accounts. Any explicit deny in an SCP overrides account-level administrator permissions, causing authorization failures.

Anahtar Kavram

Understanding how policy evaluation logic handles administrator permissions when constrained by IAM permissions boundaries and AWS Organizations SCPs.
Soru 36Soru →

A developer is building a mobile application that authenticates users through an Amazon Cognito User Pool. The application then exchanges the user's JSON Web Token (JWT) for temporary AWS credentials using an Amazon Cognito Identity Pool. These credentials are used to sign requests to an Amazon API Gateway REST API using AWS Signature Version 4 (SigV4). However, the API Gateway method is configured with a Cognito User Pool Authorizer, and all signed requests are failing with a 401 Unauthorized error. How should the developer resolve this authorization failure?

Cevabı ve açıklamayı göster

Cevap: Modify the API Gateway method's authorization type to AWS_IAM to allow authorization of requests signed with temporary IAM credentials.

Cevap

Modify the API Gateway method's authorization type to AWS_IAM to allow authorization of requests signed with temporary IAM credentials.
Changing the API Gateway authorization type to AWS_IAM allows API Gateway to natively validate the Signature Version 4 (SigV4) headers. Since Cognito Identity Pools issue temporary IAM credentials associated with an IAM role (either authenticated or unauthenticated), the API Gateway method must be configured to use AWS_IAM authorization to allow access based on these IAM permissions.

Adım Adım Çözüm

1
Analyze the request signing mechanism used by the client application.
The application uses temporary credentials from a Cognito Identity Pool to sign requests with AWS Signature Version 4 (SigV4).
Understanding how the request is signed helps determine which authorization type API Gateway expects.
2
Identify the authorization type currently configured on the API Gateway method.
The method is configured with a Cognito User Pool Authorizer.
A Cognito User Pool Authorizer expects a raw JWT (ID token or access token) from the User Pool in the headers, not a SigV4 signed request.
3
Update the API Gateway method authorization to match the client's credential type.
Change the authorization type to AWS_IAM.
AWS_IAM authorization allows API Gateway to natively process and authorize SigV4 signed requests using the IAM permissions of the assumed Cognito role.

Anahtar Kavram

Resolving Cognito User Pool vs. Identity Pool API Gateway Authorization failures by switching to AWS_IAM authorization for SigV4 signed requests.
Tahmini Süre:1m 30s
Soru 37Soru →

A client-side web application hosted on `https://portal.member-services.org` makes an HTTP `PUT` request to an Amazon API Gateway REST API. The API is integrated with a backend AWS Lambda function using Lambda Proxy integration. Users report that the updates fail. Inspecting the browser console reveals a CORS error stating that the `Access-Control-Allow-Origin` header is missing, while the API Gateway execution logs show a `502 Bad Gateway` error due to a malformed Lambda response. Which two actions should the developer take to resolve these errors?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the API Gateway resource to support CORS by enabling the OPTIONS method and returning the required CORS headers for preflight requests.; Update the backend Lambda function response payload to return a JSON object containing a statusCode, a body, and a headers map that includes the Access-Control-Allow-Origin header.

Cevap

Configure the API Gateway resource to support CORS by enabling the OPTIONS method, and update the backend Lambda function response payload to return a JSON object containing a statusCode, a body, and a headers map that includes the Access-Control-Allow-Origin header.
The correct options are to configure the OPTIONS preflight method in API Gateway and update the backend Lambda function to return a structured JSON response containing the Access-Control-Allow-Origin header in its headers map. The preflight OPTIONS method handles the browser's initial handshake. Since Lambda Proxy integration is used, API Gateway passes the response directly from the Lambda function, requiring the function itself to return the necessary CORS headers and a valid format (statusCode, headers, and body) to avoid a 502 Bad Gateway error.

Adım Adım Çözüm

1
Configure the preflight CORS OPTIONS method in API Gateway.
Allows browsers to complete the CORS preflight handshake before sending the actual PUT request.
Web browsers send a preflight OPTIONS request before non-simple requests like PUT to verify if the server permits cross-origin requests.
2
Modify the Lambda function response format to match Lambda Proxy requirements.
Ensures API Gateway can parse the Lambda response successfully and does not return a 502 Bad Gateway error.
In Lambda Proxy integrations, the Lambda function must return a JSON response with specific keys (statusCode, headers, and body). Returning a raw string or incorrect format causes a 502 error.
3
Include the Access-Control-Allow-Origin header in the Lambda function's response headers map.
Sends the CORS header back to the browser in the actual PUT response, satisfying the browser's CORS policy check.
With Lambda Proxy integrations, API Gateway passes the headers returned by the Lambda function directly to the client. The backend function is responsible for including the CORS headers in its response.

Anahtar Kavram

CORS troubleshooting and Lambda Proxy response formatting in Amazon API Gateway.
Soru 38Soru →

An online learning platform stores quiz questions and metadata in an Amazon DynamoDB table. During exams, a surge in user traffic causes high read latency and ProvisionedThroughputExceededException errors when the application retrieves quiz details. The developer wants to introduce Amazon DynamoDB Accelerator (DAX) to optimize query performance with minimal latency and minimal application rewrite. The application currently retrieves quiz details using strongly consistent reads and executes frequent Scan operations to populate list views. Which combination of actions should the developer take to resolve the latency and throttling issues? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Modify the application's read requests to use eventually consistent reads so that the DynamoDB Accelerator (DAX) client can serve them from the item cache.; Replace the Scan operations with Query operations to allow DAX to store and serve the retrieved quiz details from the query cache.

Cevap

The correct actions are to modify the read requests to use eventually consistent reads and to replace Scan operations with Query operations.
To resolve the read throttling and latency issues, the developer must configure the read requests to use eventually consistent reads, because DynamoDB Accelerator (DAX) only caches eventually consistent reads; strongly consistent reads are passed directly through to DynamoDB and do not benefit from caching. Additionally, replacing Scan operations with Query operations ensures that the retrieved data is cached in the DAX query cache, which dramatically improves performance compared to executing expensive Scan operations.

Adım Adım Çözüm

1
Analyze the consistency requirements for caching with DAX.
Identify that strongly consistent reads bypass the DAX cache, meaning the application must be modified to use eventually consistent reads to leverage DAX.
DAX only caches eventually consistent reads in its item and query caches.
2
Evaluate the retrieval method used in the application.
Identify that Scan operations are inefficient and do not populate the item cache; they should be replaced with Query operations.
Query operations are more efficient, target specific partition keys, and populate the DAX query cache.

Anahtar Kavram

DAX Caching Behavior and Query Optimization
Tahmini Süre:2m 0s
Soru 39Soru →

A developer is maintaining a digital library catalog system that retrieves book details from an Amazon DynamoDB table using GetItem operations. To reduce read latency and minimize Read Capacity Units (RCUs) consumption during peak hours, the developer deploys an Amazon DynamoDB Accelerator (DAX) cluster. The application code is updated to initialize the DAX SDK client and point to the DAX cluster endpoint. However, monitoring shows that read latency remains unchanged and the DynamoDB table continues to consume RCUs at the same rate. The developer verifies that the read requests are configured as strongly consistent reads.

What should the developer do to resolve this issue and achieve the desired caching benefits?

Cevabı ve açıklamayı göster

Cevap: Modify the application's read request configuration to use eventually consistent reads instead of strongly consistent reads.

Cevap

Modify the application's read request configuration to use eventually consistent reads instead of strongly consistent reads.
Amazon DynamoDB Accelerator (DAX) is designed to cache eventually consistent read requests. When a strongly consistent read is requested, DAX passes the request directly through to DynamoDB without caching the result or serving it from the cache. Therefore, modifying the read operations to be eventually consistent allows DAX to serve the requests from its item cache, reducing latency and avoiding RCU consumption on the underlying table.

Adım Adım Çözüm

1
Analyze how Amazon DynamoDB Accelerator (DAX) processes read consistency settings.
Identify that DAX is designed to cache eventually consistent reads. Strongly consistent reads are not cached and are always passed through directly to the underlying DynamoDB table.
This behavior ensures that applications requesting strong consistency always receive the most up-to-date data directly from the source of truth, but it bypasses the performance and cost benefits of DAX.
2
Identify the read consistency configuration of the application's GetItem requests.
The application currently performs strongly consistent reads, causing DAX to forward all requests directly to DynamoDB.
This explains why the read latency is not decreasing and the table continues to consume RCUs at the original rate.
3
Update the application code configuration to request eventually consistent reads.
Subsequent identical read requests will hit the DAX item cache, resulting in sub-millisecond latency and zero RCU consumption on DynamoDB for cache hits.
Eventually consistent reads allow DAX to serve data from its local cache.

Anahtar Kavram

DAX caching behavior and read consistency requirements
Tahmini Süre:1m 30s
Soru 40Soru →

A client-side SvelteKit dashboard application hosted on `https://admin.service.internal` sends a `DELETE` request to an Amazon API Gateway REST API. The request fails, and the browser console displays a CORS preflight error indicating that the `Access-Control-Allow-Origin` header is missing. The REST API is configured with a Lambda Proxy Integration and a custom Lambda Authorizer on the `DELETE` method. The developer has already used the API Gateway Console to enable CORS on the resource, which created an `OPTIONS` method. Which two actions must the developer take to resolve this issue?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the OPTIONS method on the resource to use NONE for its Authorization type in API Gateway, then redeploy the API.; Update the backend Lambda function mapped to the DELETE method to include the Access-Control-Allow-Origin header in the headers object of the returned JSON payload.

Cevap

To resolve the CORS preflight block, the developer must set the Authorization type of the OPTIONS method to NONE in the API Gateway Console, and modify the backend Lambda function for the DELETE method to return the Access-Control-Allow-Origin header in its response headers.
CORS preflight (OPTIONS) requests are initiated by the browser to determine whether the target server permits the cross-origin request. Because these preflight requests lack credentials, they cannot pass authorizers. Consequently, the OPTIONS method must have its Authorization set to NONE. Furthermore, under a Lambda Proxy Integration, API Gateway relies entirely on the backend payload structure to formulate the HTTP response. The developer must return the Access-Control-Allow-Origin header directly from the backend Lambda function to satisfy browser security validations during the subsequent DELETE request.

Adım Adım Çözüm

1
Disable authorization on the preflight method.
Change the Authorization setting for the preflight OPTIONS method to NONE in the API Gateway Console and redeploy the API. This permits browser preflight checks to pass without requiring authorization tokens.
Browsers perform CORS preflight checks using OPTIONS requests, which do not include authorization credentials.
2
Inject CORS headers into the backend Lambda response.
Modify the Lambda function handling the DELETE method to return 'Access-Control-Allow-Origin': 'https://admin.service.internal' (or '*') in the headers object of the response payload.
When using Lambda Proxy Integration, API Gateway bypasses console integration response headers, meaning the backend code must supply the required CORS headers directly.

Anahtar Kavram

Handling CORS preflight authorization and header injection in API Gateway Lambda Proxy integrations.
Tahmini Süre:3m 0s
ÖncekiSayfa 2 / 14Sonraki
Troubleshooting and Optimization Alıştırma Soruları — AWS Certified Developer - Associate — Sayfa 2 | Examkin