Amazon Practice Questions, Discussions & Exam Topics by our Authors
An AI practitioner needs to improve the accuracy of a natural language generation model. The model uses rapidly changing inventory da...
The key requirement here is:
Improve accuracy of a natural language generation (NLG) model
The model depends on rapidly changing inventory data
This implies frequent updates to factual, external data, not model behavior itself
---
✅ Correct Answer: C) Retrieval Augmented Generation (RAG)
Why RAG is the best choice
Retrieval-Augmented Generation (RAG) is specifically designed to improve LLM/NLG accuracy by:
Fetching real-time or frequently updated external data at query time
Grounding responses in current, authoritative sources (e.g., inventory databases, knowledge bases)
Avoiding the need to retrain the model whenever data changes
Key fit for this scenario:
Inventory data changes rapidly → retraining would be inefficient
RAG allows the model to query the latest inventory at runtime
Ensures responses remain accurate and up to date
When to use RAG:
Dynamic product catalogs (e-commerce inventory)
Real-time pricing systems
Frequently updated enterprise knowledge bases
Chatbots needing live data access
---
❌ Why other options are incorrect
A) Transfer Learning
Used to adapt a pre-trained model to a new domain or task
Requires training/fine-tuning
Not s...
Author: Maya · Last updated Jul 19, 2026
SNAPSHOT
-
A company is using Amazon Bedrock AgentCore to build, deploy, and implement agents at scale. The company needs to identify which resources to use.
Select the correct AgentCore resource fr...
Author: Krishna · Last updated Jul 19, 2026
A company is using Retrieval Augmented Generation (RAG) with Amazon Bedrock and Stable Diffusion to generate product images based on text descriptions. The results are often random and lack specific details. The company wants...
The key issue is that the generated images are not closely following the text prompts, resulting in outputs that feel random and lack specificity. In diffusion models like Stable Diffusion (including via Amazon Bedrock’s Stability AI models), this is primarily controlled by how strongly the model adheres to the prompt versus its learned distribution.
Correct Answer: C) Increase the classifier-free guidance (CFG) scale
Why C is correct
Classifier-Free Guidance (CFG) is the most direct mechanism for controlling prompt adherence in Stable Diffusion.
Higher CFG scale = stronger adherence to the prompt
It reduces randomness and encourages the model to strictly follow text instructions
This improves specificity, detail alignment, and constraint satisfaction
In AWS Bedrock Stability AI models, CFG is commonly tuned to balance creativity vs precision
📌 In this scenario, the company wants more specific, less random outputs, which is exactly what increasing CFG achieves.
---
Why the other options are incorrect
A) Increase the number of generation steps ❌
Steps control image refinement quality, not prompt alignment
More steps:
Improve sharpnes...
Author: CrimsonViperX · Last updated Jul 19, 2026
A company is building a large language model (LLM)-based AI assistant to support service agents by automatically managing customer inquiries. The company wants to reduce the effort that customer service agents require during support calls.
The company needs to select a metric to...
The requirement is to choose a metric that best evaluates whether an LLM-based assistant is reducing the effort required by customer service agents during support calls.
Key interpretation of the objective
“Reducing agent effort during support calls” most directly relates to:
How long agents spend per interaction
How much time/interaction complexity is reduced during a call
Real-time efficiency gains during ongoing conversations
---
Option analysis
A) Website engagement rate ❌
This measures how users interact with a website (clicks, time on site, page views).
It is unrelated to call center performance or agent workload, so it does not reflect support call efficiency.
---
B) Average call duration ✅ (Correct)
This directly measures the time spent per customer support call.
Why it fits:
If the AI assistant is effective, it should help agents resolve issues faster
Reduced effort typically manifests as shorter handling time
It is a standard operational metric for contact centers (often called AHT – Average Handle Time)
When to use:
Evaluating tools that assist agents in real-time (LLM copilots, chat summarization, suggested replies)
Measuring effi...
Author: Noah · Last updated Jul 19, 2026
A company wants to use its documents as a knowledge base for a large language model (LLM) in a Retrieval Augmented Generation (RAG) ...
For a Retrieval Augmented Generation (RAG) solution, the goal is to make unstructured documents searchable in a way that allows semantic similarity matching between a user query and relevant content.
Correct approach: B) Create embeddings from document chunks
In RAG systems, documents are first split into smaller chunks and then converted into vector embeddings using an embedding model (e.g., Amazon Bedrock embeddings or similar). These embeddings capture the semantic meaning of the text, not just keywords.
At query time, the user’s question is also converted into an embedding, and a vector database (such as Amazon OpenSearch Service with vector search, Amazon Aurora PostgreSQL with pgvector, or Amazon Kendra) finds the most similar document chunks. These chunks are then passed to the LLM as context for generation.
This is the core mechanism that enables semantic retrieval in RAG, making it the correct answer.
---
Why the other options are incorrect:
A) Encrypt each document with encryption keys
This is for security and data protection, not retrieval.
Encryption ensures confidentiality (e.g., using AWS KMS), but encrypted data cannot be semantically searched unless decrypted first.
Use case: ...
Author: Aditya · Last updated Jul 19, 2026
A company deploys a foundation model (FM). The company notices that the FM is producing answers to user-submitted questions about politics. The company wants to ensure that the model does not send ans...
The requirement is to prevent a foundation model (FM) from generating or returning responses to political questions. This is a classic content filtering / policy enforcement at inference time problem.
✅ Correct Answer: A) Amazon Bedrock Guardrails
Why A is correct (key reasoning factors)
Purpose-built for safety controls at runtime in Amazon Bedrock.
Allows you to block or filter specific topics (e.g., politics, violence, hate speech, etc.).
Supports:
Topic filtering (e.g., “politics” can be explicitly denied)
Input and output filtering
Custom blocked phrases and categories
Works before and after model response generation, ensuring unsafe or disallowed content never reaches the user.
This directly matches the requirement: “ensure the model does not send answers to political questions.”
👉 Best scenario:
Use when you need content moderation, safety policies, and topic restrictions for FM applications.
---
❌ Why other options are wrong
B) Amazon Bedrock Agents
Used for building AI agents that orchestrate tasks across tools and APIs.
Focus: workflow automation, tool use, m...
Author: Isabella · Last updated Jul 19, 2026
A company plans to build an AI model for the company's global customer base. The company wants to train the model on a dataset that reflects...
The requirement is to train an AI model on a dataset that reflects user diversity across a global customer base. In ML terms, this is primarily about ensuring the training data is representative and not biased toward dominant groups or regions.
Correct Option: A) Balance class representation in the dataset
A balanced dataset ensures that different user groups (classes) are proportionally represented. This helps the model learn patterns from all segments of the global user base, preventing bias toward overrepresented groups. For AWS exam scenarios, this aligns with building fair, generalizable models using Amazon SageMaker training data best practices, where data balancing is a key preprocessing step.
---
Why other options are incorrect
B) Use a regional dataset with complete data
This is incorrect because a single regional dataset, even if complete, does not represent a global user base. It introduces geographic bias, making the model perform poorly for users outside that region.
This approach is only suitable when building region-specific mo...
Author: Vikram · Last updated Jul 19, 2026
A company wants to deploy a secure AI system with controlled access. The system must allow only authorized personnel to access model train...
To meet the requirement of allowing only authorized personnel to access model training data, the key need is fine-grained access control and identity-based authorization, not compute, storage, or encryption alone.
Correct Answer: C) AWS Identity and Access Management (IAM)
---
Why IAM is correct
Amazon Web Services IAM is the core AWS service used to manage authentication (who can access) and authorization (what they can access).
Key reasons:
Defines users, groups, and roles
Allows policy-based access control to specific AWS resources (like S3 buckets containing training data)
Enforces least privilege access, ensuring only approved personnel can access sensitive datasets
Can be integrated with services used in AI/ML workflows (e.g., S3, SageMaker)
👉 In this scenario, IAM directly controls who can access training data, which is exactly the requirement.
---
Why other options are incorrect
A) AWS Key Management System (KMS)
Purpose: Encryption key management, not user access control
It protects data at rest and in transit, but does NOT decide who can access datasets
Scenari...
Author: GlowingTiger · Last updated Jul 19, 2026
Which term is the speed at which a pre-trained foundation model (FM) processes requests and delivers...
The correct concept here is how quickly a pre-trained foundation model responds to an input and produces an output, which is specifically measured as inference latency.
Option analysis
A) Model size
This refers to the number of parameters in a foundation model (e.g., 7B, 70B parameters).
It affects compute cost, memory usage, and indirectly influences speed.
Larger models generally respond slower, but model size is not a direct measure of processing speed.
Use case: choosing between smaller/faster vs larger/more capable models (trade-off between accuracy and performance).
B) Inference latency ✅
This is the time taken by a trained model to process an input request and generate a response.
It directly measures responsiveness and speed.
Key metric in production systems, especially for real-time applications (chatbots, recommendation systems, fraud detection).
Lower latency = faster user experience.
Use case: optimizing system performance, selecting models for real-time ...
Author: Kunal · Last updated Jul 19, 2026
A company stores its AI datasets in Amazon S3 buckets. The company wants to share the S3 buckets with its business partners. The company needs to avoid accidentally sharing sensitive data.
...
The correct answer is B) Amazon Macie.
Why Amazon Macie is correct
Amazon Macie is a fully managed data security and data privacy service that uses machine learning to automatically discover, classify, and protect sensitive data in Amazon S3.
In this scenario:
The company stores datasets in Amazon S3
They plan to share data with external business partners
They must avoid accidentally exposing sensitive information
Macie directly addresses this by:
Scanning S3 buckets continuously or on demand
Identifying sensitive data such as PII (personally identifiable information), financial data, credentials, etc.
Providing alerts and dashboards to prevent accidental data exposure before sharing
This makes it the best fit for data discovery and classification in S3 before sharing externally.
---
Why the other options are incorrect
A) Amazon Kendra
Kendra is an intelligent search service
It ...
Author: Isabella1 · Last updated Jul 19, 2026
A company is using AI to build a toy recommendation website that suggests toys based on a customer's interests and age. The company notices that the AI tends to suggest stereotypically gendered t...
The correct choice is D) Amazon SageMaker Clarify.
Why Amazon SageMaker Clarify is the correct answer
The scenario describes a machine learning model recommending toys but showing biased, stereotypically gendered outputs. This is a classic case of model bias in ML predictions, and AWS provides a dedicated tool for exactly this problem:
Amazon SageMaker Clarify is designed to:
Detect bias in datasets and ML model predictions
Measure pre-training and post-training bias
Provide feature importance and explainability (SHAP values)
Help identify whether certain attributes (like gender, age, etc.) are unfairly influencing outcomes
In this case, the company needs to investigate fairness and bias in recommendations, which is precisely SageMaker Clarify’s purpose.
---
Why the other options are incorrect
A) Amazon Rekognition
Amazon Rekognition is used for:
Image and video analysis (face detection, object detection, moderation)
Why it is wrong:
It does not analyze ML recommendation bias
It is unrelated to recommendation systems or fairness auditing
It cannot evaluate gender bias in toy recommendations
Use case: detecting objects/people in images, facial analysis, content modera...
Author: NightmareDragon2025 · Last updated Jul 19, 2026
Which option is a disadvantage of using generative AI models in production systems?
The question asks for a disadvantage of using generative AI models in production systems in an AWS context.
Option A: Possible high accuracy and reliability
This is generally a benefit, not a disadvantage.
Generative AI models can sometimes produce highly useful and accurate outputs when trained well and given good prompts or grounding data (e.g., via retrieval-augmented generation in systems like Amazon Bedrock).
However, it is not guaranteed, so it is not considered a disadvantage.
When this applies:
Customer support summarization
Content generation where quality is acceptable but not mission-critical
---
Option B: Deterministic and consistent behavior
This is also not a disadvantage of generative AI—it is actually something generative models typically lack. They are probabilistic, not deterministic.
So the statement itself is incorrect in describing generative AI. Deterministic behavior is more typical of rule-based systems or traditional software.
When deterministic behavior is desired:
Financial transaction systems
Compliance-heavy workflows
Audit-critical processing
---
Option C: Negligible computational resource requirements
This is incorrect. Generative AI models typically require sign...
Author: John · Last updated Jul 19, 2026
SNAPSHOT
-
A company wants to customize a foundation model (FM). The company wants to understand the customization methods and data types that are available.
Select the correct customization method ...
Author: Max · Last updated Jul 19, 2026
Which AWS service helps select foundation models (FMs) for generative AI use cases?
The question asks which AWS service helps select and use foundation models (FMs) for generative AI use cases.
Correct Answer: B) Amazon Bedrock
Why Amazon Bedrock is correct
Amazon Bedrock is a fully managed service that provides access to multiple foundation models (FMs) from different providers (such as Anthropic, Meta, Amazon Titan, etc.).
Key reasons it fits the question:
It is designed specifically for generative AI use cases
It allows users to choose and compare foundation models
It provides a unified API to test, evaluate, and deploy FMs
It removes the need to manage underlying infrastructure
It is the primary AWS service for FM selection and orchestration
So, when an exam question mentions selecting foundation models, Bedrock is the direct match.
---
Why the other options are incorrect
A) Amazon Personalize
Used for recommendation systems (e.g., product recommendations, personalization engines)
Works with user behavior data,...
Author: Mia · Last updated Jul 19, 2026
A company wants to increase employee productivity by using a generative AI solution to write code to test software applications.
Which solution ...
The requirement is: increase productivity by using generative AI to write code for testing software applications with the least operational effort.
Correct choice: C) Amazon Q Developer
---
Why C is correct (key reasoning factors)
Amazon Q Developer is specifically designed to:
Generate application code, unit tests, and test automation scripts
Work directly inside IDEs (like VS Code, JetBrains)
Provide inline suggestions, code explanations, and test generation
Require minimal setup and no infrastructure management
Why it meets “LEAST operational effort”
No need to provision ML infrastructure
No need to design prompts or orchestration layers
No need to manage models or deployment pipelines
Ready-to-use developer tool
When to use it
Writing application code
Generating unit/integration tests
Refactoring and debugging code
Automating repetitive development tasks
---
Why the other options are incorrect
A) Amazon Q Business
Designed for business users, not software development
Focuses on:
Document Q&A
Enterprise knowledge search
Summ...
Author: Sara · Last updated Jul 19, 2026
A company that uses multiple ML models wants to identify changes in original model quality so that the company can resolve any issues....
Correct Answer: D) Amazon SageMaker Model Monitor
A company wants to identify changes in original model quality over time across multiple ML models. This is a classic model drift / data drift / prediction quality monitoring problem in production ML systems.
---
✅ Why D) Amazon SageMaker Model Monitor is correct
Amazon SageMaker Model Monitor is specifically designed to:
Continuously monitor deployed ML models
Detect data drift (input feature distribution changes)
Detect concept drift / model quality degradation
Compare live predictions vs baseline training data
Track model performance metrics over time
Key factors that make it the right choice:
Focuses on production monitoring
Works with deployed models
Detects changes in model behavior and data quality
Supports automated alerts and reports
Designed for multiple models in production environments
Typical use case:
A fraud detection model starts misclassifying transactions due to changing user behavior
Model Monitor detects drift and alerts engineers before business impact grows
---
❌ Why the other options are incorrect
A) Amazon SageMaker JumpStart
Provides preb...
Author: Maya · Last updated Jul 19, 2026
SNAPSHOT
-
A company is using a generative AI model to develop a digital assistant. The model's responses occasionally include undesirable and potentially harmful content.
Select the correct Amazon Bedrock filter policy f...
Author: Harper · Last updated Jul 19, 2026
A company has two teams: Team A and Team B. Team A has VPCs that run in Account A. The team uses a transit gateway (TGW-A) to route traffic between workloads that run in the different VPCs. Similarly, Team 'B' has VPCs that run in Account B. Team 'B' uses a different transit gateway (TGW-B) to route traffic between workloads that run in the different VPCs.
The company's network team manages the routing for Team A and Team 'B'. The netwo...
To determine the best solution with the least operational overhead, we need to evaluate the options based on key AWS networking factors:
---
Key Factors for Evaluation:
1. Operational overhead – simplicity and ease of migration.
2. Reuse of existing infrastructure – reusing TGW-A is preferred over creating a new TGW.
3. Resource sharing – AWS RAM (Resource Access Manager) can share TGWs across accounts.
4. Routing configuration complexity – fewer changes to routing tables reduce effort and risk.
5. Future scalability – using centralized routing may help but adds complexity.
---
Option Analysis:
A) Use TGW-A, share with Account B, attach VPCs, update routes, retire TGW-B. ✅
Pros:
Leverages existing TGW-A.
No need to build a new TGW.
Minimal changes: only add VPC attachments and update routes.
Simplifies overall architecture into a single TGW.
Least operational overhead.
Cons:
Routing changes must still be tested carefully.
Best used when: One TGW is already working well, and you want a fast, low-complexity consolidation.
B) Use TGW-A and "replicate" TGW-B config to TGW-A before deleting TGW-B. ❌
Pros:
Keeps TGW-B temporarily until TGW-A is ready.
Cons:
"Replicating configuration" is not automatic in AWS – it’s a manual and error-prone process.
...
Author: Carlos Garcia · Last updated Jul 24, 2026
A company has an AWS environment that includes multiple VPCs that are connected by a transit gateway. The company wants to use a certificate-based AWS Site-to-Site VPN connection to establish connectivity between an on-premises environment and the AWS environment. The company does not have a static public IP address for the on-premises environment.
Wh...
To establish a certificate-based Site-to-Site VPN between an on-premises environment with no static public IP and an AWS Transit Gateway, we must carefully evaluate the requirements and constraints of AWS VPN capabilities.
---
🔍 Key Factors to Consider:
1. Certificate-Based Authentication:
AWS Site-to-Site VPN supports mutual authentication using X.509 certificates (instead of PSK).
For certificate-based VPN, the certificate must come from a trusted CA and be associated with a VPN endpoint, not directly to the customer gateway.
2. Dynamic IP Address (No Static IP):
Site-to-Site VPN traditionally requires a static public IP on the customer side to configure the Customer Gateway (CGW).
However, AWS supports dynamic CGW IP when you do not specify an IP and instead associate it with a certificate.
3. Transit Gateway Integration:
Transit Gateways support Site-to-Site VPN attachments just like Virtual Private Gateways.
---
✅ Option Analysis:
---
A) Create a public certificate in AWS Certificate Manager (ACM).
❌ Incorrect.
Reason: AWS Site-to-Site VPN does not support ACM certificates for VPN endpoints. It uses certificates from AWS Private Certificate Authority (Private CA), not public ACM.
When used: ACM public certificates are used for services like CloudFront, API Gateway, ALB, not for VPN authentication.
---
B) Create a private certificate in AWS Certificate Manager (ACM).
✅ Correct.
Reason: AWS Site-...
Author: Alexander · Last updated Jul 24, 2026
A company operates in multiple AWS Regions. The company has deployed transit gateways in each Region. The company uses AWS Organizations to operate multiple AWS accounts in one organization.
The company needs to capture all VPC flow log data when a new VPC is created. The company needs to sen...
To determine the best solution with the least administrative effort, let’s analyze each option using key factors like automation, scalability, central management, compliance enforcement, and required operational overhead.
---
Option A: Update IAM permissions for each user to include a condition that ensures users can create VPCs only when VPC Flow Logs is enabled and configured correctly.
✅ Pros:
Provides proactive control by preventing non-compliant VPC creation.
Enforces compliance at the time of resource creation.
❌ Cons:
High administrative overhead: Requires managing complex IAM policies across multiple accounts and users.
Doesn’t automatically apply flow logs; just prevents creation unless conditions are met.
Limited flexibility if VPC creation is triggered by automated systems or third-party tools.
Use case:
Suitable when the organization wants tight control over user actions via IAM and has a small number of users or accounts.
---
Option B: Create a custom AWS Config rule with automatic remediation that verifies VPC Flow Logs is enabled and configured correctly. Apply the AWS Config rule to the organization.
✅ Pros:
Centralized management via AWS Config conformance packs.
Automated remediation ensures non-compliant VPCs are corrected without manual intervention.
Scales across multiple accounts and regions using AWS Organizations.
Ensures continuous compliance, even if VPCs are created outside approved workflows (e.g., via automation).
❌ Cons:
Slight upfront effort to define the custom AWS Config rule and remediation logic.
AWS Config has a cost associated with rule evaluations and recording configuration changes.
Use case:
Ideal for enterprise-scale, multi-account environments needing ongoing compliance checks with low manual effort.
---
...
Author: Maya · Last updated Jul 24, 2026
A company wants to analyze TCP internet traffic. The traffic originates from Amazon EC2 instances in the company's VPC. The EC2 instances initiate connections through a NAT gateway.
The company wants to capture data about the traffic including source and destination IP addresses ports, and the first 8 bytes of the TCP segments...
To determine the correct solution, let's evaluate each option based on the key requirements:
Requirements Recap:
Analyze TCP internet traffic.
Traffic originates from EC2 instances in a VPC.
Initiates connections through a NAT Gateway.
Must capture source/destination IPs, ports, and first 8 bytes of TCP segments.
Must collect, store, and analyze the data.
---
Option A:
> Configure the EC2 instances to be VPC traffic mirror sources. Deploy software on the traffic mirror target to forward the data to Amazon CloudWatch Logs. Analyze the data by using CloudWatch Logs Insights.
✅ Traffic Mirroring captures full packets, including first 8 bytes of TCP segment—meets this requirement.
❌ CloudWatch Logs is not ideal for storing raw mirrored packet data; it's better suited for log entries, not binary traffic captures.
❌ Forwarding full packet data to CloudWatch Logs is expensive, not scalable, and not recommended for packet-level analysis.
✅ Correct data capture, but storage/analysis layer is inefficient for packet data.
Use case: Good for near-real-time troubleshooting at small scale if integration with CloudWatch is essential.
---
Option B:
> Configure the NAT gateway to be a VPC traffic mirror source. Deploy software on the traffic mirror target to forward the data to an Amazon S3 bucket. Analyze the data by using Amazon Athena.
✅ Traffic Mirroring from the NAT Gateway works: NAT Gateway handles outbound traffic, which meets the use case.
✅ Captures packet-level data including source/destination IPs, ports, and first 8 bytes.
✅ Storing in S3 is scalable and cost-effective.
✅ Athena supports querying structured data formats derived from mirrored traffic (e.g....
Author: Oliver · Last updated Jul 24, 2026
A media company is planning to host an event that the company will live stream to users. The company wants to use Amazon CloudFront.
A network engineer creates a primary origin and a secondary origin for CloudFront. The engineer needs to ensure that the primary origin can fail over to the secondary ...
To determine the best solution with the least operational overhead to fail over between origins in Amazon CloudFront, we must consider how CloudFront origin failover works natively, and compare that to the complexity and reliability of the other options.
---
✅ Option C: Set the CloudFront origin connection timeout value to 5 seconds. Set the origin connection attempts value to 2.
Explanation:
CloudFront has native support for origin failover when two origins are configured in an origin group.
When the primary origin fails, CloudFront automatically retries the secondary origin based on connection timeout and attempt values.
In this option:
Setting the origin connection timeout to 5 seconds and
Setting origin connection attempts to 2 means that failover can happen in about 10 seconds.
This solution uses built-in CloudFront features, which provides reliable failover with minimal operational overhead (no code or infrastructure to maintain).
This approach also meets the requirement of failing over within 15 seconds.
---
❌ Option A: Lambda\@Edge for health checks every 10 seconds
Why it's rejected:
Lambda\@Edge is not designed for continuous health monitoring.
It introduces significant operational overhead: managing health checks, rerouting logic, monitoring Lambda execution.
There's also inherent latency and complexity in doing this manually via Lambda\@Edge.
This approach reinvents functionality that CloudFront already supports natively.
Use case where it might apply:
Custom failover logic based on application-level health (not network-based), or content inspection.
-...
Author: Zara1234 · Last updated Jul 24, 2026
AnyCompany deploys and manages networking resources in its AWS network account, named Account-A. AnyCompany acquires Example Corp, which has an application that runs behind an Application Load Balancer (ALB) in Example Corp's AWS account, named Account-B.
Example Corp needs to use AWS Global Accelerator to create an accelerator to publish the applicati...
To solve this scenario, let's break down the key requirements and constraints:
---
✅ Key Requirements:
Global Accelerator must be used to expose the application to users.
The application runs behind an ALB in Account-B (Example Corp).
The accelerator must be managed by AnyCompany's networking team in Account-A.
The solution should incur the least management overhead.
---
🔍 Option Analysis:
---
Option A:
> Create an accelerator in Account-B. Use a cross-account role from Account-A to grant the networking team access to manage the accelerator.
✅ Cross-account IAM role allows Account-A users to manage resources in Account-B.
❌ The accelerator exists in Account-B, not Account-A, so the ownership remains in the application account.
❌ This creates cross-account role complexity and more overhead for permissions, audits, and role switching.
❌ Does not align with requirement that Account-A manages the accelerator directly.
Use case: Useful if Account-B owns and manages the accelerator but wants to delegate some permissions to Account-A.
---
Option B:
> Deploy a Network Load Balancer (NLB) in Account-A to route traffic to the ALB in Account-B. Create an accelerator, and set the NLB as the endpoint in Account-A.
✅ This gives Account-A full control over the accelerator and its endpoints.
❌ Adds significant complexity: requires transit routing or VPC peering, setting up NLB → ALB forwarding, managing target groups, and ensuring cross-VPC connectivity.
❌ Not the "least management overhead" – introduces extra infrastructure and operational burden.
✅ Technically viable for scenarios where central traffic management is needed.
Use case: When you need all traffic to flow through a centralized NLB in a n...
Author: Ahmed · Last updated Jul 24, 2026
A company has two AWS Direct Connect connections between Direct Connect locations and the company's on-premises environment in the US. The company uses the connections to communicate with AWS workloads that run in the us-east-1 Region. The company has a transit gateway that connects several VPCs. The Direct Connect connections terminate at a Direct Connect gateway and the transit VIFs to the transit gateway.
The company recently acquired a smaller company that is based in Europe. The newly acquired company has only on-premises workloads. The newly acquired company does not expect to run workloads on AWS for the next 3 years. However, the newly acquired company requires connectivity to the parent company's AWS res...
To determine the best solution with the LEAST operational overhead for providing connectivity between the newly acquired company in Europe and:
1. AWS workloads in us-east-1, and
2. The parent company’s on-premises environment in the US,
while considering that the acquired company:
Has on-premises workloads only (no AWS VPCs),
Needs connectivity to both AWS and US on-prem, and
Requires low operational overhead,
let’s evaluate each option.
---
✅ Option A: Associate new transit VIFs to the existing Direct Connect gateway. Configure the new transit VIFs to use Direct Connect SiteLink.
Key features:
Transit VIFs terminate at Direct Connect gateway, not specific to any AWS Region.
SiteLink allows inter-region or inter-location communication without going through AWS VPCs or the public internet.
How it helps:
Europe site’s transit VIFs can connect directly to US Direct Connect location through SiteLink.
Allows connectivity to parent company’s US on-premises through existing Direct Connect and transit gateway connections.
No need to deploy new AWS infrastructure (like VPCs or transit gateways) in Europe.
Simplifies routing — all VIFs connect to a single DX gateway.
Operational overhead: Very low — no new AWS VPCs or TGWs to manage in Europe.
---
❌ Option B: Associate new transit VIFs to a new Direct Connect gateway and to a new transit gateway in eu-west-1. Use transit gateway peering.
Key features:
Creates new AWS infrastructure (new DX gateway, new TGW).
Requires TGW peering across regions (Europe ↔ US).
Why it’s not ideal:
Requires creating and managing a new transit gateway and DX gateway in Europe.
Adds complexity: inter-region peering, propagation policies, routing.
New VPCs mi...
Author: StarlightBear · Last updated Jul 24, 2026
A company is establishing hybrid cloud connectivity from an on-premises environment to AWS in the us-east-1 Region. The company is using a 10 Gbps AWS Direct Connect dedicated connection. The company has two accounts in AWS. Account A has transit gateways in four AWS Regions. Account 'B' has transit gateways in three Regions. The company does not plan to expand.
To...
To determine the most cost-effective solution for hybrid cloud connectivity between on-premises and AWS, while maintaining separate infrastructure per account (to meet security requirements), we need to evaluate each option based on:
---
Key Factors for Evaluation
1. Security Isolation – Separate cloud infrastructure per account.
2. Cost – Minimize Direct Connect (DX) infrastructure and port charges.
3. Scalability/Future-proofing – Although no expansion is planned, future flexibility is still a consideration.
4. AWS Best Practices – Using Direct Connect Gateway with Transit Gateway and AWS RAM.
5. Direct Connect Gateway Association Limits – Each DX Gateway can support up to 3 Transit Gateway attachments.
---
Option Analysis
---
Option A
> One DX Gateway shared via AWS RAM. Two transit VIFs (one per account). Each account attaches its regional Transit Gateways to the shared DX Gateway.
✅ Security: Separate transit VIFs for each account ensure traffic separation.
✅ Cost: Only one 10 Gbps DX connection and one DX Gateway.
✅ Scalable within current footprint (7 TGW attachments total: within 3 TGWs per VIF limit).
✅ Meets AWS best practices for multi-account connectivity.
✅ Efficient use of RAM for resource sharing.
⚠️ Slightly more complex to manage in terms of RAM and attachment mappings.
→ Best overall balance of cost, security, and simplicity (given no expansion planned).
---
Option B
> Two DX Gateways (one per account), both sharing same DX physical link. One transit VIF per DX Gateway.
✅ ...
Author: Daniel · Last updated Jul 24, 2026
A company runs an application across multiple AWS Regions and multiple Availability Zones. The company needs to expand to a new AWS Region. Low latency is critical to the functionality of the application.
A network engineer needs to gather metrics for the latency between the existing. Regions and the new...
To determine the best solution for measuring inter-Region latency with historical metrics for at least the past 30 days, we need to evaluate each option based on key factors like latency visibility, historical data availability, metric granularity, and multi-Region performance monitoring.
---
A) Configure an AWS Network Access Analyzer Network Access Scope, and use the analysis to review the latency.
Why Rejected:
Network Access Analyzer is used to identify unintended network paths or validate network access according to policy, not for performance or latency metrics.
It doesn't provide latency measurements or historical performance data.
Use Case: Security auditing, network access visibility — not performance monitoring.
---
B) Set up AWS Network Manager Infrastructure Performance. Publish network performance metrics to Amazon CloudWatch.
Why Selected:
AWS Network Manager Infrastructure Performance is designed to monitor network latency and performance between AWS Regions and between AWS and on-premises.
It supports active monitoring using probes between AWS Global Network Regions.
Metrics are published to CloudWatch, allowing retention, visualization, and analysis for up to 15 months.
Enables historical analysis, satisfying the requirement for a...
Author: Alexander · Last updated Jul 24, 2026
A company is implementing an application on Amazon EC2 instances. The application needs to process incoming transactions. When the application detects a transaction that is not valid, the application must send a chat message to the company's support team. To send the message, the application needs to retrieve the access token to authenticate by using the chat API.
A developer needs to implement a solution to store the access token. The access t...
When choosing the solution to store the access token, key factors to consider include:
1. Encryption at rest and in transit: The solution should encrypt the token both at rest and during transit to meet the security requirements.
2. Accessibility from multiple AWS accounts: The token must be accessible by resources across AWS accounts, so cross-account access is required.
3. Minimal management overhead: Ideally, the solution should minimize complexity and manual intervention.
Option A: AWS Systems Manager Parameter Store SecureString
- Advantages:
- Encryption: Supports encryption with AWS KMS managed keys.
- Cross-account access: Resource-based policies allow you to grant access to other AWS accounts.
- Minimal setup: No need for managing a separate service like DynamoDB or S3. Only the EC2 instance needs access permissions to Parameter Store.
- Low management overhead: Once set up, it requires minimal management, especially for transient secrets like an access token.
- Disadvantages:
- Scalability: While good for small numbers of secrets, if the application scales to require complex secret management, you may need to migrate to a more specialized solution.
Option B: DynamoDB with AWS KMS
- Advantages:
- Encryption: Supports encryption at rest via AWS KMS.
- Scalability: DynamoDB is designed for high throughput and scale.
- Disadvantages:
- Complexity: Requires managing a DynamoDB table for a single access token. This introduces unnecessary complexity for what is essentially a single secret.
- Overhead: Both managing DynamoDB permissions and dealing with KMS decryption adds extra layers of management and overhead compared to simpler solutions.
Option C: AWS Secrets Manager
- Advantages:
- Encryption: Provides en...
Author: Ella · Last updated Jul 14, 2026
A company is running Amazon EC2 instances in multiple AWS accounts. A developer needs to implement an application that collects all the lifecycle events of the EC2 instances. The application needs to store the lifecycle events in a single Amazon Simple Queue Service (Amaz...
Let's evaluate each option based on the requirements:
Requirements:
1. Collect lifecycle events of EC2 instances from multiple accounts: The solution must be able to gather lifecycle events from EC2 instances in various AWS accounts.
2. Store lifecycle events in a single SQS queue in the main account: The events need to be centralized and placed in an SQS queue for further processing.
3. Minimize management overhead: The solution should not require excessive manual intervention or complex setup.
Option A: Use Amazon EventBridge in the main account with an SQS target
- EventBridge setup: Amazon EC2 lifecycle events are automatically sent to EventBridge in the respective accounts. In the main account, EventBridge can be configured to accept these events.
- Centralized SQS target: The rule in EventBridge of the main account can have the SQS queue as the target.
- Cross-account access: No additional steps needed for permissions since EventBridge is designed for cross-account event routing.
- Management overhead: The setup is centralized in the main account, and it requires minimal ongoing maintenance after configuration.
Why this is a good option: This solution allows you to easily collect EC2 lifecycle events from multiple accounts and forward them to a centralized SQS queue with minimal configuration. EventBridge also has native cross-account capabilities, which reduces complexity.
Option B: Use SQS resource policies and EventBridge rules in each account
- SQS access configuration: You would need to set up SQS resource policies to allow write access from each AWS account. This can be cumbersome as you need to maintain access control for each account.
- EventBridge in each account: You also need to configure EventBridge rules in each account to forward lifecycle events to the main account's SQS queue.
- Management overhead: This solution involves more configuration at the individual account level, and the access control with SQS can be more error-prone, especially as the number of accounts grows.
Why this is not ideal: The added complexity of configuring individual EventBridge rules and managing SQS resource policies increases the management overhead, which is less efficient compared to a simpler centralized approach.
Option C: Use AWS Lambda to scan EC2 instances and detect lifecycle changes
- Lambd...
Author: Andrew · Last updated Jul 14, 2026
An application is using Amazon Cognito user pools and identity pools for secure access. A developer wants to integrate the user-specific file upload and download features in the application with Amazon S3. The developer must ensure that the files are saved and retrieved in a secure manner and that users can access only...
Requirements:
- Secure file upload and download: The solution must ensure files are uploaded and downloaded securely.
- User-specific access: Users should only have access to their own files, not the files of other users.
- File size range: The file sizes range from 3 KB to 300 MB, meaning the solution needs to handle both small and large files efficiently.
- Integration with Amazon Cognito: The solution must integrate with Cognito user pools and identity pools for secure access.
Option A: Use S3 Event Notifications to validate the file upload and download requests and update the user interface (UI)
- Event Notifications: S3 Event Notifications can notify the application when files are uploaded or downloaded.
- Validation in UI: However, relying on S3 event notifications for validation of access rights isn't ideal for ensuring secure file access since event notifications are typically used for processing asynchronous events rather than validating access control.
- Lack of direct access control: It doesn't provide a mechanism to enforce security directly in the file access process.
Why this is not ideal: While event notifications can be useful for processing events asynchronously, they don't directly address the security requirements of restricting file access or validating the user’s permissions during the file upload or download process. It adds complexity without a proper access control mechanism.
Option B: Save the details of the uploaded files in a separate Amazon DynamoDB table. Filter the list of files in the user interface (UI) by comparing the current user ID with the user ID associated with the file in the table
- DynamoDB for file metadata: This option involves saving metadata about the uploaded files in DynamoDB and comparing user IDs in the UI.
- Access control: While storing metadata in DynamoDB can help manage file information, it doesn't directly prevent unauthorized file access. Files themselves are still stored in S3, and this solution doesn't integrate access control mechanisms for the actual file retrieval process.
- Complexity: Managing metadata in DynamoDB adds another layer of complexity that doesn't provide direct file security.
Why this is not ideal: While DynamoDB can store metadata about the files, this doesn't effectively enforce security on the files themselves or ensure that the user cannot access files belonging to other users. It adds unnecessary complexity without addressing the core security concerns around file storage and retrieval.
Option C: Use Amazon API Gateway and an AWS Lambda function to upload and download files. Validate each request in the La...
Author: FlamePhoenix2025 · Last updated Jul 14, 2026
A company is building a scalable data management solution by using AWS services to improve the speed and agility of development. The solution will ingest large volumes of data from various sources and will process this data through multiple business rules and transformations.
The solution requires business rules to run in sequence and to handle reprocessing of data if errors occur when the business rules run. The company needs the solution...
Key Requirements:
1. Scalable: The solution must handle large volumes of data.
2. Business rules running in sequence: Business rules should execute in a specific order.
3. Reprocessing capability: The solution should handle reprocessing of data if errors occur.
4. Least maintenance: The solution should be low-maintenance and minimize manual interventions.
Option A: AWS Batch
- What it is: AWS Batch is a fully managed service for running batch computing workloads at any scale.
- Pros: It can scale to process large volumes of data in parallel, and it is optimized for batch processing jobs.
- Cons: AWS Batch does not provide a built-in mechanism to define complex workflows or ensure the sequential execution of tasks. Handling error recovery and reprocessing would need to be implemented manually, which increases complexity and maintenance overhead. It's not primarily focused on orchestrating workflows or data transformations in a sequence.
Why this is not ideal: While AWS Batch can handle large-scale data processing, it is more suited for batch jobs rather than orchestrating complex workflows with sequential dependencies. It would require additional services or custom logic for error handling and reprocessing, leading to higher maintenance.
Option B: AWS Step Functions
- What it is: AWS Step Functions is a serverless orchestration service that allows you to coordinate multiple AWS services into workflows, including the sequential execution of business rules.
- Pros:
- Step Functions provides a visual workflow interface to define and manage the execution of tasks in sequence.
- It natively supports error handling, retries, and manual interventions for reprocessing tasks.
- It integrates well with other AWS services like AWS Lambda, Amazon SNS, and Amazon SQS, making it highly extensible.
- Step Functions automatically scales as needed, handling workflows with varying complexity.
- It is a fully managed service, reducing operational overhead and maintenance.
Why this is the best option: Step Functions is designed specifically for orchestrating workflows with dependencies, making it an ideal choice for managing the sequential execution of business rules. It simplifies error handling and provides built-in capabilities for reprocessing data, ensuring that the solution is both scalable and requires minimal maintenance.
Option ...
Author: Amira99 · Last updated Jul 14, 2026
A developer has created an AWS Lambda function that is written in Python. The Lambda function reads data from objects in Amazon S3 and writes data to an Amazon DynamoDB table. The function is successfully invoked from an S3 event notification when an object is created. Howe...
Key Requirements:
- The Lambda function is successfully invoked by an S3 event.
- The Lambda function reads data from Amazon S3.
- The function attempts to write data to Amazon DynamoDB, but it fails during this step.
Option A: The Lambda function's concurrency limit has been exceeded
- Concurrency limit: This issue arises when the function is invoked more times than the maximum allowed concurrency for that Lambda function, which could cause throttling.
- Reason for rejection: If the concurrency limit were exceeded, the function would either fail immediately or invoke with throttling errors, but it would not affect a specific part of the Lambda's execution (such as just the write to DynamoDB). The function would not complete the entire process if concurrency were the issue.
Why this is not the cause: If the function were hitting the concurrency limit, the issue would likely affect all parts of the Lambda function and not just the specific DynamoDB write operation. The problem here seems isolated to the DynamoDB interaction.
Option B: DynamoDB table requires a global secondary index (GSI) to support writes
- Global secondary index (GSI): GSIs are used to allow queries on different attributes of the table. However, writing to DynamoDB does not require a GSI unless you are querying the table in a way that requires it.
- Reason for rejection: GSIs are necessary for querying data in specific patterns, but not for general write operations. If the Lambda function is simply writing to the table (inserting data), it does not require a GSI.
Why this is not the cause: Writing data to a DynamoDB table does not require a GSI unless you are specifically querying by attributes not part of the primary key. A write operation itself will succeed without a GSI, so this is unlikely to be the issue.
Option C: The Lambda function does not have IAM permissions to write to DynamoDB
- IAM permissions: Lambda functions interact with AWS services (like DynamoDB) via IAM roles. If the IAM role associated with the Lambda function does...
Author: Elizabeth · Last updated Jul 14, 2026
A developer is creating an AWS CloudFormation template to deploy Amazon EC2 instances across multiple AWS accounts. The developer must choose the EC2 instances from a list of approved instance types.
How can th...
Let's analyze each option and evaluate which one best meets the requirements:
A) Create a separate CloudFormation template for each EC2 instance type in the list.
- This option would lead to a complex setup, where the developer would have to maintain multiple CloudFormation templates for different EC2 instance types. Managing many templates would be cumbersome and error-prone. Additionally, it doesn't allow for easy customization or flexibility, as each template would only support a specific instance type.
- Rejection reason: It is not efficient to create separate templates for each EC2 instance type.
B) In the Resources section of the CloudFormation template, create resources for each EC2 instance type in the list.
- In this case, creating resources for each EC2 instance type in the template would result in a very large and complex template with multiple EC2 resources. This could also lead to unwanted EC2 instances being created if the template is accidentally used in environments that don’t need all of them. Furthermore, it doesn't provide a way to restrict the EC2 instance type selection dynamically.
- Rejection reason: This would unnecessarily complicate the template and increase the chances of deploying unwanted resources.
C) In the CloudFormation template, create a separ...
Author: Zara · Last updated Jul 14, 2026
A developer has an application that makes batch requests directly to Amazon DynamoDB by using the BatchGetItem low-level API operation. The responses frequently return values in the UnprocessedKeys element.
Which actions should the developer take to incre...
Let's evaluate each option and determine the most suitable actions to take when dealing with unprocessed keys in DynamoDB's BatchGetItem operation:
A) Retry the batch operation immediately.
- Retrying the operation immediately without any delay or backoff may lead to further throttling, as the system may still be under high load. This can worsen the problem instead of resolving it. It is important to handle unprocessed keys gracefully to avoid overloading the service.
- Rejection reason: Immediate retries without backoff can lead to inefficient resource use and potential throttling.
B) Retry the batch operation with exponential backoff and randomized delay.
- This is the best option. Exponential backoff and randomized delay help to avoid overwhelming the DynamoDB service and reduce the risk of encountering repeated throttling. This strategy is a standard best practice for handling request retries in AWS services. By applying this method, the application becomes more resilient, as it avoids overloading DynamoDB with frequent retries and improves the chances of successful processing after each delay.
- Selected reason: This approach reduces load on DynamoDB, adheres to best practices for retries, and improves the chances of processing unprocessed keys successfully.
C) Update the application to use an AWS software development kit (AWS SDK) to make the requests.
- While using the AWS SDK simplifies the interaction with AWS services, it doesn't specifically address how to handle unprocessed keys in the BatchGetItem operation. The SDK may handle retries and errors in some cases, but it do...
Author: Chloe · Last updated Jul 14, 2026
A company is running a custom application on a set of on-premises Linux servers that are accessed using Amazon API Gateway. AWS X-Ray tracing has been enabled on the API test stage.
How can a developer ...
Let's evaluate each option based on its feasibility and ease of implementation:
A) Install and run the X-Ray SDK on the on-premises servers to capture and relay the data to the X-Ray service.
- The X-Ray SDK allows applications to capture trace data and send it to X-Ray. However, setting up the SDK would require significant configuration for each server to instrument the application code. While this option provides flexibility, it can be more complex to configure compared to other solutions. It also requires changes to the application code, which might not be ideal for the least amount of configuration.
- Rejection reason: Although feasible, it requires significant effort to modify and instrument the application code.
B) Install and run the X-Ray daemon on the on-premises servers to capture and relay the data to the X-Ray service.
- The X-Ray daemon is the simplest option for enabling X-Ray tracing on on-premises servers. It captures trace data from the application and relays it to the X-Ray service. The daemon runs as a background process and doesn't require any changes to the application code. This option requires minimal configuration, as the daemon handles the communication with AWS X-Ray, making it a low-effort solution.
- Selected reason: This option allows the developer to enable tracing with the least configuration and without modifying the application code. It is the simplest and most efficient solution.
C) Capture incoming requests o...
Author: VenomousSerpent42 · Last updated Jul 14, 2026
A company wants to share information with a third party. The third party has an HTTP API endpoint that the company can use to share the information. The company has the required API key to access the HTTP API.
The company needs a way to manage the API key by using code. The integration of the API...
Let's evaluate each option and select the most secure and efficient solution:
A) Store the API credentials in AWS Secrets Manager. Retrieve the API credentials at runtime by using the AWS SDK. Use the credentials to make the API call.
- Advantages:
- Security: AWS Secrets Manager is designed specifically for storing and managing sensitive information such as API keys, passwords, and access keys.
- Access Control: Secrets Manager integrates seamlessly with IAM policies, allowing fine-grained access control to the credentials.
- Automatic Rotation: Secrets Manager supports automatic rotation of credentials, reducing the risk of using stale or compromised API keys.
- Minimal Performance Impact: Secrets Manager caches secrets to reduce the performance overhead, ensuring that the API key is retrieved quickly with minimal delay at runtime.
- Conclusion: This solution is the most secure as it uses a dedicated service for managing sensitive credentials with built-in encryption, access control, and rotation.
B) Store the API credentials in a local code variable. Push the code to a secure Git repository. Use the local code variable at runtime to make the API call.
- Disadvantages:
- Security Risks: Storing sensitive credentials directly in code (even in a Git repository) is risky. Even though the repository is secure, the credentials can be exposed if anyone gains unauthorized access to the repository or if the code is pushed to a less secure location by mistake.
- Lack of Management Features: This approach lacks features like automatic rotation, audit logs, or access control that are essential for securely managing API keys.
- Rejection Reason: This method exposes sensitive information in the codebase, making it highly insecure.
C) Store the API credentials as an object in a private Amazon S3 bucket. Restrict access to the S3 object by using IAM policies. Retrieve the API credentials at runtime by using the AWS SDK. Use the credentials to make the API call.
- Advantages:
- Security: S3 provides encryption (both at rest and in transit) and access contr...
Author: Sofia · Last updated Jul 14, 2026
A developer is deploying a new application to Amazon Elastic Container Service (Amazon ECS). The developer needs to securely store and retrieve different types of variables. These variables include authentication information for a remote API, the URL for the API, and credentials. The authentication information and API URL must be available to all current and future deployed versio...
To solve this problem, the goal is to securely store and retrieve various types of variables (authentication information, API URL, and credentials) with minimal changes to the application, while also ensuring the values are available across development, testing, and production environments.
Let's go through each option and evaluate it:
A) Update the application to retrieve the variables from AWS Systems Manager Parameter Store. Use unique paths in Parameter Store for each variable in each environment. Store the credentials in AWS Secrets Manager in each environment.
- Pros: AWS Systems Manager Parameter Store and AWS Secrets Manager are secure and highly scalable solutions for managing configuration values and sensitive information, respectively. They integrate easily with AWS ECS, allowing applications to retrieve configuration data securely without hardcoding values. With Parameter Store and Secrets Manager, you can maintain unique paths and versions for different environments (e.g., dev, test, prod).
- Cons: The developer would need to update the application code to use the AWS SDK to retrieve values from these services. However, this is minimal effort compared to other alternatives. Parameter Store supports both plain text and encrypted values, and Secrets Manager provides automatic rotation of credentials.
B) Update the application to retrieve the variables from AWS Key Management Service (AWS KMS). Store the API URL and credentials as unique keys for each environment.
- Pros: KMS can encrypt and decrypt data, but it's not designed to directly manage variables such as API URLs or authentication credentials.
- Cons: KMS is primarily for managing encryption keys, not for storing application configuration values. While you can use KMS for encryption, it doesn't provide easy access management for variables like API URLs and credentials. This would also require more custom development effort to retrieve the variables and decrypt them at runtime.
C) Update the application to retrieve the variables from an encrypte...
Author: Emma · Last updated Jul 14, 2026
A company is migrating legacy internal applications to AWS. Leadership wants to rewrite the internal employee directory to use native AWS services. A developer needs to create a solution for storing employee contact details and high-resolution photos for use with the new application.
Which ...
Let's evaluate each of the options based on key factors such as scalability, performance, cost, ease of use, and suitability for storing employee contact information and high-resolution photos.
Option A: Encode each employee's contact information and photos using Base64. Store the information in an Amazon DynamoDB table using a sort key.
- Pros: DynamoDB is a fast, scalable NoSQL database, and it would be able to handle contact information retrieval.
- Cons: Base64 encoding increases the size of both the contact information and photos by approximately 33%. This is inefficient, especially for high-resolution images, and increases both storage costs and processing overhead. Storing large photos in DynamoDB would not be ideal, as DynamoDB is better suited for small, fast key-value data rather than large binary objects.
- Scenario where applicable: This solution might be applicable for small, lightweight applications where data size is not a concern, but for high-resolution photos, this is a poor choice.
Option B: Store each employee's contact information in an Amazon DynamoDB table along with the object keys for the photos stored in Amazon S3.
- Pros: DynamoDB is well-suited for fast lookups of employee contact details and metadata. Amazon S3 is optimized for storing large binary objects, such as high-resolution photos, with low cost and high availability. By storing the contact information in DynamoDB and using S3 for the photos, the solution is highly scalable and cost-effective. S3's integration with AWS APIs makes it easy to access individual photos using object keys stored in DynamoDB.
- Cons: There is a slight complexity in managing two services (DynamoDB for contact data and S3 for photos), but this is manageable.
- Scenario where applicable: This is a great choice for applications where both structured data (contact information) and unstructured data (photos) need to be stored and retrieved efficiently.
Option C: Use Amazon Cognito user pools to im...
Author: Ethan · Last updated Jul 14, 2026
A developer is creating an application that will give users the ability to store photos from their cellphones in the cloud. The application needs to support tens of thousands of users. The application uses an Amazon API Gateway REST API that is integrated with AWS Lambda functions to process the photos. The application stores details about the photos in Amazon DynamoDB.
Users need to create an account to access the application. In the application, users must...
Let's evaluate the options based on operational overhead, scalability, security, and simplicity:
Option A:
Use Amazon Cognito user pools to manage user accounts. Create an Amazon Cognito user pool authorizer in API Gateway to control access to the API. Use the Lambda function to store the photos and details in the DynamoDB table. Retrieve previously uploaded photos directly from the DynamoDB table.
- Pros: Amazon Cognito simplifies user authentication and user management. Using API Gateway with Cognito as the authorizer is a common setup for controlling access. DynamoDB is a good choice for storing structured data like photo metadata.
- Cons: Directly storing photos in DynamoDB is inefficient because DynamoDB is not optimized for large binary objects like photos. Storing photos in DynamoDB could lead to higher costs and operational overhead due to size limitations and performance constraints.
- Scenario where applicable: Suitable for applications where all data is small and manageable in DynamoDB, but not ideal for photo storage in this scenario.
Option B:
Use Amazon Cognito user pools to manage user accounts. Create an Amazon Cognito user pool authorizer in API Gateway to control access to the API. Use the Lambda function to store the photos in Amazon S3. Store the object's S3 key as part of the photo details in the DynamoDB table. Retrieve previously uploaded photos by querying DynamoDB for the S3 key.
- Pros: This approach uses Cognito for easy user authentication and S3 for photo storage, which is highly scalable and cost-effective for large binary data like photos. S3 is designed for this use case, providing low-latency access to photos. Storing the S3 key in DynamoDB keeps the metadata lightweight and enables fast queries.
- Cons: The only potential downside is the added complexity of managing S3 keys, but it is a minimal complexity compared to the benefits.
- Scenario where applicable: This is an ideal solution for applications that need to store and retrieve large binary files (photos) with minimal overhead.
Option C:
Create an IAM user for each user of the application during the sign-up process. Use IAM authentication to access the API Gateway API. Use th...
Author: FlamePhoenix2025 · Last updated Jul 14, 2026
A company receives food orders from multiple partners. The company has a microservices application that uses Amazon API Gateway APIs with AWS Lambda integration. Each partner sends orders by calling a customized API that is exposed through API Gateway. The API call invokes a shared Lambda function to process the orders.
Partners need to be notified after the Lambda function processes the orders. Each partner must receive updates for onl...
Let's evaluate each option based on scalability, maintainability, and ease of adding new partners:
Option A: Create a different Amazon Simple Notification Service (Amazon SNS) topic for each partner. Configure the Lambda function to publish messages for each partner to the partner's SNS topic.
- Pros: This solution allows for separate topics for each partner, ensuring messages are delivered to the correct partner.
- Cons: As the number of partners grows, the complexity of managing a large number of SNS topics increases. Each time a new partner is added, a new SNS topic needs to be created, and the Lambda function needs to be updated to publish to this new topic. This approach can become difficult to manage as the number of partners grows.
- Scenario where applicable: This could be suitable for small numbers of partners, but it’s not scalable for a large or growing number of partners, as the number of topics to manage increases over time.
Option B: Create a different Lambda function for each partner. Configure the Lambda function to notify each partner's service endpoint directly.
- Pros: This solution allows for direct and customized notifications for each partner.
- Cons: Creating a separate Lambda function for each partner introduces significant operational overhead. The system will become difficult to maintain as the number of partners grows, and adding new partners would require creating new Lambda functions and updating the existing infrastructure. This does not meet the requirement of being easily scalable or requiring few code changes when adding new partners.
- Scenario where applicable: This could work in very small-scale environments with a limited number of partners, but it is not scalable or maintainable in the long term.
Option C: Create an Amazon SNS topic. Configure the Lambda function to publish messages with specific attributes to the SNS topic. Subscribe each partner to the SNS topic. Apply the approp...
Author: Siddharth · Last updated Jul 14, 2026
A financial company must store original customer records for 10 years for legal reasons. A complete record contains personally identifiable information (PII). According to local regulations, PII is available to only certain people in the company and must not be shared with third parties. The company needs to make the records available to third-party organizations for statistical analysis without sharing the PII.
A developer wants to store the original immutable record in Amazon S3. Depending on who accesses the S3 document, the document should be returned as is or with all the PII re...
Let's evaluate the options based on the requirements of storing customer records with personally identifiable information (PII) in Amazon S3, making the records available to third-party organizations without sharing PII, and ensuring compliance with legal regulations:
Option A: Set up an S3 event notification that invokes the removePii function when an S3 GET request is made. Call Amazon S3 by using a GET request to access the object without PII.
- Pros: The event notification on GET requests could trigger the removal of PII when a specific person or system accesses the file, and the document could be returned without PII. However, this approach would not work well for directly modifying the document on-the-fly as a GET request is intended for data retrieval, not data modification.
- Cons: S3 event notifications trigger on PUT, POST, COPY, or DELETE operations, not on GET requests. This means you cannot invoke a Lambda function based on a GET request directly. Additionally, a GET request fetches data, so removing PII on the fly during the GET request is not feasible.
- Scenario where applicable: This is not a suitable solution, as GET events cannot directly trigger a Lambda function.
Option B: Set up an S3 event notification that invokes the removePii function when an S3 PUT request is made. Call Amazon S3 by using a PUT request to access the object without PII.
- Pros: A PUT request triggers when an object is uploaded or overwritten in S3, which might be useful if you want to update the stored document after removing the PII.
- Cons: The event notification on a PUT request would invoke the Lambda function when the document is uploaded or updated. However, it does not solve the problem of making the original document available in its unaltered form for authorized users and with PII removed for third-party access. It also does not allow real-time access to the document without modifying it each time.
- Scenario where applicable: This is not the most efficient approach, as it involves modifying the object, but the company needs to keep the original immutable record intact.
...
Author: MoonlitPantherX · Last updated Jul 14, 2026
A developer is deploying an AWS Lambda function The developer wants the ability to return to older versions of the function quickly and seamlessly.
How can ...
Let's evaluate each option based on the developer's goal of quickly and seamlessly returning to older versions of the Lambda function with the least operational overhead:
Option A: Use AWS OpsWorks to perform blue/green deployments.
- Pros: AWS OpsWorks is a configuration management service that supports deployment automation, including blue/green deployments. It allows for easy rollbacks and versioning of deployments.
- Cons: AWS OpsWorks is a more complex service compared to the other options and generally requires more configuration and management effort. For Lambda functions, this might be an over-engineered solution, adding unnecessary complexity and operational overhead when simpler approaches are available.
- Scenario where applicable: This option is better suited for more complex deployment scenarios involving multiple components or services, not just for Lambda function versioning.
Option B: Use a function alias with different versions.
- Pros: This is the best option for Lambda versioning with minimal operational overhead. Lambda allows you to create multiple versions of a function. By using function aliases, you can easily manage which version of the Lambda function is live. You can point an alias to the desired version and quickly switch between versions with a few API calls or configuration changes. This is simple, native to Lambda, and does not require additional services or heavy management.
- Cons: There are no significant downsides. This approach is highly efficient for managing different versions of a Lambda function.
- Scenario where applicable: This is the optimal solution for managing versions of a Lambda function and performing rollbacks with minimal operational overhead.
Option C: Maintain deployment packages for older versions in Amazon S3.
- Pr...
Author: Matthew · Last updated Jul 14, 2026
A developer has written an AWS Lambda function. The function is CPU-bound. The developer wants to ensure that the function returns responses quic...
To improve the performance of a CPU-bound AWS Lambda function, the key focus should be on enhancing its ability to process CPU-intensive tasks faster. Here’s the evaluation of the options:
A) Increase the function's CPU core count
AWS Lambda does not allow the explicit control of CPU cores. Instead, Lambda allocates CPU resources proportional to the amount of memory allocated to the function. Since Lambda does not give direct control over the CPU cores, this option isn’t feasible.
B) Increase the function's memory
Increasing the memory allocation for the Lambda function will automatically increase the CPU resources available to the function. This is particularly important for CPU-bound tasks, as more memory translates to more CPU power, leading to faster execution times for CPU-heavy operations. By allocating more memory, the function will get access to more processing power, which can directly reduce the execution time.
C) Increase the function's reserved concurrency
Reserved concurrency controls the number of concurrent executions of your Lambda function. While it can help with scaling and handling more req...
Author: Lucas Carter · Last updated Jul 14, 2026
For a deployment using AWS Code Deploy, what is the run order of the hooks for in-place deployments?
For an in-place deployment using AWS CodeDeploy, the run order of the hooks is essential for ensuring that the application is updated smoothly and without downtime. Let's break down the possible options:
A) BeforeInstall -> ApplicationStop -> ApplicationStart -> AfterInstall
- BeforeInstall is typically used to prepare the environment before installation, such as backing up files or checking configurations.
- ApplicationStop is used to stop the current version of the application.
- ApplicationStart would typically be used after the installation to start the application again.
- AfterInstall is used after the installation is complete, usually for tasks like configuring or finalizing the deployment.
This order does not match the typical in-place deployment sequence, as ApplicationStart should ideally happen after installation (not before the AfterInstall step). This order is incorrect.
B) ApplicationStop -> BeforeInstall -> AfterInstall -> ApplicationStart
- ApplicationStop stops the current application version.
- BeforeInstall prepares the environment for the new version (e.g., backing up files).
- AfterInstall is used to finalize the deployment, such as configuring new application files.
- ApplicationStart starts the application after the new version is deployed.
This order is the correct run order for an in-place deployment in AWS CodeDeploy. Stopping the application first, preparing the environment, then installing, configuring, and finally starting the application is the typical sequence.
C) BeforeInstall -> ApplicationStop -> Valid...
Author: Sofia2021 · Last updated Jul 14, 2026
A company is building a serverless application on AWS. The application uses an AWS Lambda function to process customer orders 24 hours a day, 7 days a week. The Lambda function calls an external vendor's HTTP API to process payments.
During load tests, a developer discovers that the external vendor payment processing API occasionally times out and returns errors. The company expects that some payment processing API calls will return errors.
The company wants the support team to receive notifications in near real time only when the payment processing external API err...
Let’s analyze the options and determine the best solution for the given scenario:
A) Write the results of payment processing API calls to Amazon CloudWatch. Use Amazon CloudWatch Logs Insights to query the CloudWatch logs. Schedule the Lambda function to check the CloudWatch logs and notify the existing SNS topic.
- CloudWatch Logs Insights can be useful for querying logs, but scheduling a Lambda function to process logs regularly is not the most efficient approach. This method introduces complexity and potential delays in data processing since the Lambda function would need to periodically check logs. It also doesn’t provide real-time monitoring or alerting.
- Not ideal, because it adds complexity and latency with scheduled checks rather than providing near real-time notifications.
B) Publish custom metrics to CloudWatch that record the failures of the external payment processing API calls. Configure a CloudWatch alarm to notify the existing SNS topic when the error rate exceeds the specified rate.
- Publishing custom metrics to CloudWatch is a great approach for tracking API failures, as CloudWatch provides native support for metrics and alarms. By publishing metrics such as the failure count of the payment API calls and setting an alarm based on the error rate (e.g., exceeding 5% failures within an hour), you can achieve near real-time monitoring.
- CloudWatch alarms can then trigger notifications directly to the SNS topic when the error rate threshold is exceeded, making this solution very efficient for monitoring and alerting in real time.
- Ideal solution, as it’s simple, leverages AWS-native services for real-time monitoring and alerts, and meets the requirement to notify the support team only when the error rate exceeds 5%.
C) Publish the results of the external payment processing API calls to a new Amazon SNS topic. Subscribe the...
Author: Grace · Last updated Jul 14, 2026
A company is offering APIs as a service over the internet to provide unauthenticated read access to statistical information that is updated daily. The company uses Amazon API Gateway and AWS Lambda to develop the APIs. The service has become popular, and the...
Let's break down the options and analyze the best choice for improving the responsiveness of the APIs:
A) Enable API caching in API Gateway
- API caching helps improve the responsiveness of APIs by reducing the number of calls to backend services (like AWS Lambda). When a client makes a request, the response can be cached for a specified time, and subsequent requests for the same data are served directly from the cache instead of invoking the Lambda function again. This reduces the latency and can significantly improve API performance, especially for frequently accessed or static data like the statistical information that is updated daily.
- Ideal solution, as caching reduces repeated calls to Lambda, making the API more responsive and scalable.
B) Configure API Gateway to use an interface VPC endpoint
- Interface VPC endpoints allow communication between API Gateway and services in a VPC, providing a private and secure connection. However, in this case, the company is offering unauthenticated read-only APIs over the internet. Since the data is publicly available and not requiring internal VPC communication, setting up an interface VPC endpoint is unnecessary and will not enhance API responsiveness. This is more useful for services that require private, secure communication within a VPC.
- Not ideal, as it is primarily used for private communication, and it won’t significantly improve the responsiveness for public APIs.
C) Enable cross-origin resource sharing (CORS...
Author: Ryan · Last updated Jul 14, 2026
A developer wants to store information about movies. Each movie has a title, release year, and genre. The movie information also can include additional properties about the cast and production crew. This additional information is inconsistent across movies. For example, one movie might have an assistant director, and another movie might have an animal trainer.
The developer needs to implement a solution to support the following use cases:
For a given title and release year, get all details about the movie that has that t...
To address the given use cases for storing movie information, we need to ensure that the data store can support efficient querying for movie details based on various attributes (title, release year, genre), while also handling the flexibility of inconsistent additional properties (such as the cast and crew). Let's evaluate each option:
Option A: Create an Amazon DynamoDB table. Configure the table with a primary key that consists of the title as the partition key and the release year as the sort key. Create a global secondary index that uses the genre as the partition key and the title as the sort key.
- Pros:
- This configuration would efficiently support queries based on a specific title and release year (through the primary key), which satisfies one of the use cases.
- The global secondary index (GSI) on genre allows you to query all movies by genre, fulfilling the requirement to get all movies within a specific genre.
- DynamoDB's flexible schema is well-suited to store inconsistent data, such as varying cast or crew information, because the attributes can be dynamically added to each record.
- Cons:
- For querying by title alone, you would need to scan the table (since the GSI uses the title as the sort key), which can be inefficient for large datasets.
- However, this is a minor issue given the use case, since querying by title alone is likely less frequent than querying by both title and release year or by genre.
Option B: Create an Amazon DynamoDB table. Configure the table with a primary key that consists of the genre as the partition key and the release year as the sort key. Create a global secondary index that uses the title as the partition key.
- Pros:
- This configuration supports querying by genre and release year efficiently, and the GSI on title could help retrieve movies by title.
- Cons:
- The primary key based on genre and release year does not efficiently support querying for all movies by title (if you want to get all movies with the same title across different years, this would require scanning, which is inefficient).
- This approach does not meet the requirement to query by title and release year, as it limits efficient access to queries ba...
Author: Amelia · Last updated Jul 14, 2026
A developer maintains an Amazon API Gateway REST API. Customers use the API through a frontend UI and Amazon Cognito authentication.
The developer has a new version of the API that contains new endpoints and backward-incompatible interface changes. The developer needs to provide beta access to other de...
In this scenario, the goal is to provide beta access to a new version of an API while minimizing operational overhead and ensuring that existing customers are not affected.
Let's review each option:
A) Define a development stage on the API Gateway API. Instruct the other developers to point the endpoints to the development stage.
- Reasoning: A development stage in Amazon API Gateway allows you to define separate deployment environments for testing, staging, and production. This enables the developer to deploy the new version of the API to a non-production stage while keeping the production version intact.
- Key Factors: The key advantage of this option is that it provides isolated environments for testing without changing the API that customers interact with. Developers can test the new API version independently by pointing to the development stage, ensuring there is no disruption for customers.
- Why Rejected: This option meets the requirements, so it is not rejected. It provides the least overhead and does not require creating a new API or complex changes in the application code.
B) Define a new API Gateway API that points to the new API application code. Instruct the other developers to point the endpoints to the new API.
- Reasoning: This option would involve creating an entirely new API Gateway instance for the new API version. Developers would need to point their endpoints to this new API.
- Key Factors: While this is a valid solution, it introduces higher operational overhead because you are managing two separate APIs. It requires additional resources, API configurations, and potentially a new setup for authorization and monitoring. It can also create confusion with managing multiple APIs.
- Why Rejected: This solution introduces unnecessary complexity by requiring a new API Gateway setup, leading to more operational overhead. It is more resource-intensive compared to defining a simple development stag...
Author: Ava · Last updated Jul 14, 2026
A developer is creating an application that will store personal health information (PHI). The PHI needs to be encrypted at all times. An encrypted Amazon RDS for MySQL DB instance is storing the data. The developer wants to increase the performance of the application by caching frequent...
To meet the given requirements, let’s analyze each option based on performance, encryption, caching capabilities, and the ability to sort or rank datasets:
A) Create an Amazon ElastiCache for Redis instance. Enable encryption of data in transit and at rest. Store frequently accessed data in the cache.
- Pros:
- Redis supports rich data structures like sorted sets, which makes it ideal for ranking or sorting datasets.
- Encryption of data in transit and at rest can be enabled to meet security requirements.
- Excellent caching capabilities for frequently accessed data, improving performance significantly.
- Cons:
- Redis requires proper management of memory to avoid data loss.
- It is a key-value store, so data management (e.g., sorting) requires thoughtful design but works very well for specific use cases like ranking.
B) Create an Amazon ElastiCache for Memcached instance. Enable encryption of data in transit and at rest. Store frequently accessed data in the cache.
- Pros:
- Memcached is a great caching solution for fast access to frequently requested data.
- Supports encryption in transit and at rest.
- Cons:
- Memcached does not have built-in support for sorting or ranking datasets. It’s primarily a simple key-value store, so additional application-level logic would be required for sorting or ranking.
- Lacks rich data structures that are available in Redis (e.g., sorted sets).
C) Create an Amazon RDS for MySQL read replica. Connect to the read replica by using SSL. Configure the read replica to store frequently acc...
Author: Julian · Last updated Jul 14, 2026
A company has a multi-node Windows legacy application that runs on premises. The application uses a network shared folder as a centralized configuration repository to store configuration files in .xml format. The company is migrating the application to Amazon EC2 instances. As part of the migration to AWS, a developer mus...
To determine the most cost-effective solution for ensuring high availability of the shared configuration repository during the migration to Amazon EC2 instances, let's evaluate each option:
Option A: Mount an Amazon Elastic Block Store (Amazon EBS) volume onto one of the EC2 instances. Deploy a file system on the EBS volume. Use the host operating system to share a folder. Update the application code to read and write configuration files from the shared folder.
- Analysis:
- EBS volumes are designed for use with a single EC2 instance at a time, so this setup would not provide high availability across multiple EC2 instances.
- The EBS volume would need to be mounted individually on each EC2 instance, but sharing it in a high-availability manner between multiple instances would require complex configurations (e.g., using a clustered file system), which would increase management complexity.
- This solution can be cost-effective but does not meet the high availability requirement.
Option B: Deploy a micro EC2 instance with an instance store volume. Use the host operating system to share a folder. Update the application code to read and write configuration files from the shared folder.
- Analysis:
- Instance store volumes are ephemeral (data is lost when the instance is stopped or terminated), so they are not suitable for storing critical configuration files like the ones required here.
- Additionally, relying on a single EC2 instance for shared file storage introduces a risk of downtime, so this solution does not provide high availability.
- This is not a cost-effective solution because of the lack of durability and high availability.
Option C: Create an Amazon S3 bucket to...
Author: ThunderBear · Last updated Jul 14, 2026
A company wants to deploy and maintain static websites on AWS. Each website's source code is hosted in one of several version control systems, including AWS CodeCommit, Bitbucket, and GitHub.
The company wants to implement phased releases by using development, staging, user acceptance testing, and production environments in the AWS Cloud. Deployments to each environment must be started by code merges on the relevant Git branch. The company wants to...
To determine the best solution for deploying and maintaining static websites on AWS with the least operational overhead, let's evaluate each option based on key requirements: ease of deployment, serverless architecture, HTTPS, automation, and minimizing operational overhead.
Option A: Host each website by using AWS Amplify with a serverless backend. Connect the repository branches that correspond to each of the desired environments. Start deployments by merging code changes to a desired branch.
- Analysis:
- Serverless architecture: AWS Amplify is a fully managed service, offering serverless hosting for static websites with built-in integration to various version control systems, including CodeCommit, GitHub, and Bitbucket.
- HTTPS support: Amplify automatically provides HTTPS for websites.
- Phased releases: You can set up separate environments (development, staging, production) corresponding to different Git branches. Each time code is merged into the desired branch, Amplify triggers the deployment automatically.
- Minimal operational overhead: AWS Amplify handles the underlying infrastructure, including scaling, SSL certificates, and deployment triggers. This option is designed to reduce operational tasks.
- This solution is ideal because it aligns with all the requirements, offering serverless hosting, automated deployments, HTTPS, and environment-based deployments.
Option B: Host each website in AWS Elastic Beanstalk with multiple environments. Use the EB CLI to link each repository branch. Integrate AWS CodePipeline to automate deployments from version control code merges.
- Analysis:
- Serverless: Elastic Beanstalk is not fully serverless. While it abstracts infrastructure management, it still requires managing EC2 instances.
- HTTPS: Beanstalk can provide HTTPS via an Application Load Balancer, but this requires additional setup.
- Operational overhead: Elastic Beanstalk requires more management than AWS Amplify, particularly with configuring and maintaining environments and integrating with CodePipeline.
- Suitability: Elastic Beanstalk is better for applications that need server-side processing, but for static websites, it's more complex than necessary, adding unnecessary operational overhead.
Option C:...
