Amazon Practice Questions, Discussions & Exam Topics by our Authors

A company is migrating an on-premises database to Amazon RDS for MySQL. The company has read-heavy workloads. The company wants to refactor the code to achieve optimum read performance for queri...

To meet the company's requirements of optimizing read-heavy workloads for a MySQL database on Amazon RDS with the least current and future effort, let's evaluate each option: A) Use a multi-AZ Amazon RDS deployment. Increase the number of connections that the code makes to the database or increase the connection pool size if a connection pool is in use. - Pros: - Multi-AZ deployments improve availability and automatic failover, providing high availability in case of failure. - Connection pool size adjustments might improve connection handling performance. - Cons: - Multi-AZ deployments are designed for high availability, not read scalability. In a multi-AZ setup, the secondary replica is read-only and not intended for querying. It is primarily used for failover purposes, not for read-heavy workloads. - Increasing the number of connections or connection pool size can help performance for certain types of workloads, but it doesn't address the need for optimized read scalability across the application. It only manages connections and doesn’t scale the database for reads specifically. B) Use a multi-AZ Amazon RDS deployment. Modify the code so that queries access the secondary RDS instance. - Pros: - Multi-AZ deployments can ensure high availability in case of failures. - Cons: - In a Multi-AZ RDS deployment, the secondary instance is read-only for failover purposes, so it cannot be used for direct query access. - This would require significant changes to the architecture and potentially disrupt application logic, making this a less practical solution for optimizing read-heavy workloads. C) Deploy Amazon RDS with one or more read replicas. Modify the application code so that queries use the URL for the read replicas. - Pros: - Read replicas are specifically designed for scaling read workloads. By adding one or more read replicas, you can offload read-heavy queries from the primary instance, improving performance. - Automatic replication from the primary ...

Author: Sam · Last updated Jul 14, 2026

A developer is creating an application that will be deployed on IoT devices. The application will send data to a RESTful API that is deployed as an AWS Lambda function. The application will assign each API request a unique identifier. The volume of API requests from the application can randomly increase at any given time of day. During periods of request throttling, the applicatio...

To meet the given requirements, we need a solution that can handle duplicate requests without inconsistencies or data loss. Let's evaluate each option based on key factors such as handling retries, scalability, and data consistency. Option A: Amazon RDS for MySQL DB Instance - Strengths: Amazon RDS is a managed relational database that provides strong consistency and ACID transactions. - Weaknesses: Using RDS can introduce higher latency, especially in high-volume or unpredictable traffic patterns. In a scenario with potentially many retries and random request spikes, the relational database could become a bottleneck. Additionally, relational databases generally require more overhead for scalability compared to NoSQL options, especially under unpredictable or high-volume traffic. - Conclusion: This option would work but is less efficient for handling high throughput and random spikes in requests. It’s not the ideal choice for IoT environments with high-frequency, potentially duplicate requests. Option B: Amazon DynamoDB Table - Strengths: DynamoDB is a managed NoSQL database designed for high scalability, low-latency responses, and handling unpredictable traffic spikes. It supports eventual consistency, which is acceptable in many use cases where strict consistency is not required. It is well-suited to handle high-throughput IoT workloads. - Weaknesses: The Lambda function must check if an identifier exists before processing the request, and if it's a retry, it must ensure no inconsistency occurs, such as reprocessing the same request. DynamoDB offers features like conditional writes, which can help avoid overwriting data during retries. However, careful implementation is needed to avoid race conditions. - Conclusion: This is an ideal solution for handling large-scale IoT requests with a high volume and varying traffic. It can effectively prevent inconsistencies and data loss due to retries. Option C: Amazon DynamoDB Table with Client Error Response for Duplicates - Strengths: Similar to Option B, this option leverages DynamoDB for handling high through...

Author: David · Last updated Jul 14, 2026

A developer wants to expand an application to run in multiple AWS Regions. The developer wants to copy Amazon Machine Images (AMIs) with the latest changes and create a new application stack in the destination Region. According to company requirements, all AMIs must be encrypted in all Regions. However, not all the AMIs that the comp...

The developer needs to meet the encryption requirement for Amazon Machine Images (AMIs) when expanding the application to a new AWS Region. Let's analyze each option based on key factors such as encryption, regional replication, and applicability. Option A: Create New AMIs, and Specify Encryption Parameters. Copy the Encrypted AMIs to the Destination Region. Delete the Unencrypted AMIs. - Strengths: This option explicitly creates new, encrypted AMIs, ensuring compliance with the encryption requirement. Once the AMIs are encrypted, they can be copied to the destination Region. - Weaknesses: Creating new AMIs may involve downtime or additional complexity since you are essentially generating fresh copies of the instances, potentially losing custom configurations that are tied to the original AMIs. It also involves deleting the unencrypted AMIs, which could be an issue if the unencrypted AMIs are needed for backup or rollback. - Conclusion: This solution is effective in meeting the encryption requirement but introduces additional steps, including creating new AMIs and deleting old ones. It's a good option if there is no need to retain unencrypted versions and the creation of new AMIs is acceptable. Option B: Use AWS Key Management Service (AWS KMS) to Enable Encryption on the Unencrypted AMIs. Copy the Encrypted AMIs to the Destination Region. - Strengths: AWS KMS allows for encrypting the AMIs with a customer-managed key, ensuring compliance with the encryption policy. After encryption, the AMIs can be copied to the destination Region. - Weaknesses: AMIs that are already created cannot be directly encrypted after creation. The AMI's volumes need to be copied and encrypted using KMS, but this can’t be done directly on the existing AMI itself. Instead, a new encrypted copy of the AMI must be created by creating snapshots of the associated EBS volumes and copying those with encryption enabled. - Conclusion: This is a viable solution but requires a process of creating new encrypted copies of the AMI rather than directly enabling encryption on e...

Author: Ava · Last updated Jul 14, 2026

A company hosts a client-side web application for one of its subsidiaries on Amazon S3. The web application can be accessed through Amazon CloudFront from https://www.example.com. After a successful rollout, the company wants to host three more client-side web applications for its remaining subsidiaries on three separate S3 buckets. To achieve this goal, a developer moves all the common JavaScript files and web fonts to a central S3 bucket that serves the web applications. Ho...

In this scenario, the developer wants to allow access to JavaScript files and web fonts stored in a central S3 bucket from different web applications hosted on separate S3 buckets. However, the browser is blocking these resources, likely due to cross-origin restrictions. Let's evaluate the options to resolve this issue: Option A: Create Four Access Points That Allow Access to the Central S3 Bucket. Assign an Access Point to Each Web Application Bucket. - Strengths: S3 Access Points can simplify managing permissions for large-scale applications and workloads. They provide a unique hostname for each access point, which could be useful if you have different use cases. - Weaknesses: Access Points are generally more useful for fine-grained access management across multiple applications, but they don’t directly address the issue of cross-origin resource sharing (CORS). The main issue here seems to be related to CORS policy, not access point configuration. - Conclusion: While useful in some scenarios, this option does not directly resolve the CORS-related issue preventing the browser from loading the JavaScript files and web fonts. Option B: Create a Bucket Policy That Allows Access to the Central S3 Bucket. Attach the Bucket Policy to the Central S3 Bucket. - Strengths: A bucket policy can control access at the bucket level and restrict access based on IP addresses, VPCs, and other conditions. - Weaknesses: Bucket policies govern access permissions, but they do not address cross-origin resource sharing (CORS). Without a proper CORS configuration, the browser will block the resources due to security restrictions, even if access is allowed via the bucket policy. - Conclusion: A bucket policy alone would not solve the problem of blocked resources in the browser, as it does not address CORS. It's an access control measure, but not a solution for cross-origin issues. Option C: Create a Cross-Origin Resource Sharing (CORS) Configuration Th...

Author: Charlotte · Last updated Jul 14, 2026

An application is processing clickstream data using Amazon Kinesis. The clickstream data feed into Kinesis experiences periodic spikes. The PutRecords API call occasionally fails and the logs show that the failed call return...

When using Amazon Kinesis, spikes in data throughput can cause failures in the `PutRecords` API call due to exceeding throughput limits. To mitigate the issue, let's evaluate each technique for handling the exception: Option A: Implement Retries with Exponential Backoff - Strengths: Exponential backoff is a recommended approach for handling transient failures when interacting with AWS services like Kinesis. It retries requests at increasing intervals, allowing the system to recover gracefully from temporary spikes in traffic. This helps avoid overwhelming the system with retries at a constant rate. - Weaknesses: None, as exponential backoff is specifically designed to handle situations where there are intermittent failures due to temporary spikes in traffic. - Conclusion: This is a valid technique and will help mitigate the exception by giving the system time to recover during periods of high load. Option B: Use a PutRecord API Instead of PutRecords - Strengths: `PutRecord` sends a single record at a time, which can reduce the likelihood of exceeding throughput limits for bulk requests. If the failure is due to an overload of requests in a batch, using `PutRecord` might mitigate the issue for smaller, isolated data points. - Weaknesses: The main issue is that switching from `PutRecords` to `PutRecord` may not solve the fundamental issue of throughput limits, especially if the spikes in data are large. `PutRecord` only handles one record at a time, which could result in more frequent API calls that may not scale well during high traffic. - Conclusion: While `PutRecord` could reduce the impact of overload, it may not be the most efficient solution compared to handling bulk requests properly with retries and backoff. It could introduce overhead due to a large number of API calls. Option C: Reduce the Frequency and/or Size of the Requests - Strengths: Reducing the frequency and/or size of the requests directly addresses the core issue of throughput limits by reducing the volume of data being sent during peak spikes. This approach can help prevent exceeding the available limits for `PutRecords`. - Weaknesses: This solution may not be feasible if the application needs to ...

Author: Suresh · Last updated Jul 14, 2026

A company has an application that uses Amazon Cognito user pools as an identity provider. The company must secure access to user records. The company has set up multi-factor authentication (MFA). The company also wants to send a login activity notification by ...

To meet the requirement of sending a login activity notification by email every time a user logs in, we need an operationally efficient solution that triggers an email notification automatically when a login occurs. Let's evaluate each option based on simplicity, effectiveness, and operational efficiency: Option A: Create an AWS Lambda function that uses Amazon Simple Email Service (Amazon SES) to send the email notification. Add an Amazon API Gateway API to invoke the function. Call the API from the client side when login confirmation is received. - Strengths: This option provides a custom solution where the client can directly invoke the API to send a notification. - Weaknesses: This requires the client-side application to make an additional API call after login, adding complexity and extra steps. It also increases the risk of failure if the client-side integration is not done properly. Additionally, it may introduce unnecessary operational overhead for maintaining an extra API Gateway and Lambda integration. - Conclusion: While this approach works, it is not efficient as it requires extra steps from the client and adds complexity to the system. This is not the most operationally efficient option. Option B: Create an AWS Lambda function that uses Amazon Simple Email Service (Amazon SES) to send the email notification. Add an Amazon Cognito post authentication Lambda trigger for the function. - Strengths: Amazon Cognito provides built-in support for Lambda triggers, and the post-authentication trigger is designed to invoke a Lambda function immediately after a successful login. This means the function can be triggered automatically without additional client-side code or API calls. The Lambda function can then use Amazon SES to send the email notification. - Weaknesses: None. This is a built-in integration within the Cognito user pool and requires minimal configuration. - Conclusion: This is the most operationally efficient solution because it leverages built-in Cognito functionality to automatically trigger the email notification after each login without requiring additio...

Author: Sophia · Last updated Jul 14, 2026

A developer has an application that stores data in an Amazon S3 bucket. The application uses an HTTP API to store and retrieve objects. When the PutObject API operation adds objects to the S3 bucket the developer must encrypt these objects at rest by u...

To meet the requirement of encrypting objects at rest using Amazon S3's server-side encryption with Amazon S3 managed keys (SSE-S3), we need to focus on the configuration that directly controls the encryption of objects as they are stored in S3. Here's an analysis of each option: A) Create an AWS Key Management Service (AWS KMS) key. Assign the KMS key to the S3 bucket. - This option would use AWS KMS-managed keys (SSE-KMS) for encryption, but the requirement is specifically to use SSE-S3, which does not involve the use of KMS keys. SSE-S3 uses S3-managed keys (not KMS keys), so this is not the correct option for the specified requirement. B) Set the x-amz-server-side-encryption header when invoking the PutObject API operation. - This option is valid. When using SSE-S3, you can specify the `x-amz-server-side-encryption` header with a value of `AES256` when performing the `PutObject` operation. This tells Amazon S3 to encrypt the objects with S3-managed keys (SSE-S3), which is exactly what the developer requires. C) Provide the encryption key in the HTTP hea...

Author: Jack · Last updated Jul 14, 2026

A developer needs to perform geographic load testing of an API. The developer must deploy resources to multiple AWS Regions to support the load testing of the API. How can...

To meet the requirement of performing geographic load testing without additional application code, the developer needs a solution that allows deploying resources to multiple AWS Regions. Let’s analyze each option: A) Create and deploy an AWS Lambda function in each desired Region. Configure the Lambda function to create a stack from an AWS CloudFormation template in that Region when the function is invoked. - This approach would involve deploying Lambda functions across multiple Regions. While possible, it introduces unnecessary complexity. Each Lambda function would need to be configured to invoke CloudFormation stacks, which requires additional setup, maintenance, and management. This approach is more complex than necessary for geographic load testing, as it introduces more components and manual orchestration than the other options. B) Create an AWS CloudFormation template that defines the load test resources. Use the AWS CLI create-stack-set command to create a stack set in the desired Regions. - This option is the most appropriate. AWS CloudFormation StackSets allow you to deploy resources in multiple Regions simultaneously using a single CloudFormation template. The `create-stack-set` command allows you to easily create stacks in multiple regions, which aligns with the geographic load testing requirements without requiring additional application code. It’s simple, scalable, and managed directly via CloudFormation. C) Create an AWS Systems Manager document that defines the resources. Use the document to create the resources in th...

Author: Matthew · Last updated Jul 14, 2026

A developer is creating an application that includes an Amazon API Gateway REST API in the us-east-2 Region. The developer wants to use Amazon CloudFront and a custom domain name for the API. The developer has acquired an SSL/TLS certificate for the d...

To configure a custom domain for an Amazon API Gateway REST API and use Amazon CloudFront, the developer needs to ensure that the SSL/TLS certificate is properly integrated with both API Gateway and CloudFront. Here’s an analysis of each option: A) Import the SSL/TLS certificate into AWS Certificate Manager (ACM) in the same Region as the API. Create a DNS A record for the custom domain. - This option suggests importing the SSL/TLS certificate into ACM in the same region as the API (us-east-2) and creating a DNS A record. However, API Gateway REST APIs require the SSL/TLS certificate to be imported into AWS Certificate Manager (ACM) in the US-East-1 Region for use with CloudFront, which is automatically set up by API Gateway for custom domains. This approach is incorrect because API Gateway uses CloudFront for the distribution, and the certificate needs to be in the US-East-1 Region, not in the same region as the API (us-east-2). B) Import the SSL/TLS certificate into CloudFront. Create a DNS CNAME record for the custom domain. - This option is incorrect because CloudFront does not directly manage SSL/TLS certificates. While CloudFront does use SSL/TLS certificates, they are typically managed in ACM. You cannot import the certificate directly into CloudFront without first using ACM to issue or import the certificate in the correct region (US-East-1). Additionally, creating a CNAME record is required, but the certificate management aspect is not configured properly here. C) Import the SSL/TLS certificate into AWS Certificat...

Author: Aarav · Last updated Jul 14, 2026

A developer is creating a template that uses AWS CloudFormation to deploy an application. The application is serverless and uses Amazon API Gateway, Amazon DynamoDB, and AWS Lambda. Which AW...

When defining serverless resources in YAML for a CloudFormation template, the best option is to use a framework specifically designed to simplify serverless application development and deployment. Let's analyze each option: A) CloudFormation serverless intrinsic functions - This option refers to using CloudFormation intrinsic functions like `Fn::GetAtt` or `Ref` within a template. While intrinsic functions are a core part of CloudFormation and can be used to manage resources, they are not a dedicated solution for defining serverless resources in a simple, declarative way in YAML. This option is not ideal for simplifying the process of defining serverless applications specifically. B) AWS Elastic Beanstalk - AWS Elastic Beanstalk is an excellent service for deploying and managing applications but is primarily used for traditional applications (e.g., web servers, databases) rather than serverless applications. Elastic Beanstalk is not designed specifically for managing serverless resources like API Gateway, Lambda, and DynamoDB in a CloudFormation template, so it's not the best choice for this use case. C) AWS Serverless Application Model (AWS SAM) - This option is the best choice. AWS Serverless Application Model (AWS SAM) is an extension of AWS CloudFormation that simp...

Author: Rohan · Last updated Jul 14, 2026

A developer wants to insert a record into an Amazon DynamoDB table as soon as a new file is added to an Amazon S3 bucket. ...

To achieve the goal of inserting a record into an Amazon DynamoDB table when a new file is added to an S3 bucket, we need an event-driven mechanism that reacts to the upload action and triggers the insertion. Let's evaluate each option: A) Create an event with Amazon EventBridge that will monitor the S3 bucket and then insert the records into DynamoDB. - EventBridge can monitor events from S3 and trigger actions in response. However, while this approach could work, EventBridge is typically used for a broader range of event-driven scenarios (e.g., inter-service communication or multi-service workflows). It’s more complex for a simple case like inserting a record into DynamoDB when a file is uploaded. Lambda functions are generally more straightforward and cost-effective for such a use case. B) Configure an S3 event to invoke an AWS Lambda function that inserts records into DynamoDB. - This is the best solution. You can configure an S3 event notification to trigger a Lambda function whenever a new file is uploaded to the S3 bucket. The Lambda function can then insert a record into DynamoDB based on the event data (such as file metadata or the file name). This solution is simple, efficient, and fully managed. It integrates well with S3 and DynamoDB, and Lambda automatically scales based on the event volume. C) Create an AWS Lambda function that will poll the S3 bucket and then insert the records into DynamoDB. - While this option involves using La...

Author: Emily · Last updated Jul 14, 2026

A development team maintains a web application by using a single AWS CloudFormation template. The template defines web servers and an Amazon RDS database. The team uses the Cloud Formation template to deploy the Cloud Formation stack to different environments. During a recent application deployment, a developer caused the primary development database to be dropped and recreated. The resu...

Let's break down each option and explain the reasoning: A) Add a CloudFormation Deletion Policy attribute with the Retain value to the database resource. - Reasoning: The `DeletionPolicy` attribute with the `Retain` value ensures that when the CloudFormation stack is deleted or updated, the specified resource (in this case, the database) is not deleted. Instead, the resource is retained, preserving any data or configuration that was set up. This option specifically addresses the issue of accidental deletion and data loss by preventing the RDS instance from being dropped during stack updates or deletions. - Why it's selected: This option directly meets the requirement of preventing accidental database deletion and data loss. It is the most direct and effective solution. B) Update the CloudFormation stack policy to prevent updates to the database. - Reasoning: A stack policy is used to control which resources can be updated within a CloudFormation stack, but it doesn't necessarily prevent resource deletion. While this could prevent updates to the database, it doesn't directly address the issue of accidental deletion. The goal is to ensure that the database isn't deleted, which this policy doesn't fully achieve. - Why it's rejected: It prevents updates, but doesn't fully prevent accidental deletion, which is the main concern in the question. C) Modify the database to use a Multi-AZ deployment. - Reasoning: Multi-AZ deployments are designed to enhance the availability and durability of the database. In th...

Author: Madison · Last updated Jul 14, 2026

A company has an Amazon S3 bucket that contains sensitive data. The data must be encrypted in transit and at rest. The company encrypts the data in the S3 bucket by using an AWS Key Management Service (AWS KMS) key. A developer needs to grant several other AWS accounts the permission to use the S3 GetObject operation to ...

Let's evaluate each option for enforcing encryption in transit for the S3 bucket: A) Define a resource-based policy on the S3 bucket to deny access when a request meets the condition "aws:SecureTransport": "false". - Reasoning: This option allows you to set a condition that denies access to the S3 bucket when the request is not encrypted in transit (i.e., not using HTTPS). The `aws:SecureTransport` condition key specifically checks if the request is sent over a secure (HTTPS) connection. If `false`, the request will be denied. This ensures that only secure requests (those that use HTTPS) are allowed to access the data in the S3 bucket. - Why it's selected: This is the correct approach, as it uses a condition directly on the S3 bucket to ensure that all requests for retrieving the data are made over HTTPS, fulfilling the requirement to enforce encryption in transit. B) Define a resource-based policy on the S3 bucket to allow access when a request meets the condition "aws:SecureTransport": "false". - Reasoning: This option allows access when the request is not secure (`"aws:SecureTransport": "false"`), which is the opposite of what is needed. We want to enforce encryption in transit, so allowing insecure requests would violate that requirement. - Why it's rejected: This option is incorrect because it allows unsecured requests rather than denying them, which contradicts the need to enforce encryption in transit. C) Define a role-based ...

Author: Sophia Clark · Last updated Jul 14, 2026

An application that is hosted on an Amazon EC2 instance needs access to files that are stored in an Amazon S3 bucket. The application lists the objects that are stored in the S3 bucket and displays a table to the user. During testing, a developer discovers ...

Let's evaluate each option to determine the most secure and effective solution for the issue where the application on an EC2 instance cannot list objects in an S3 bucket: A) Update the IAM instance profile that is attached to the EC2 instance to include the S3: permission for the S3 bucket. - Reasoning: The `S3:` permission grants full access to all S3 actions, including `ListBucket`, `GetObject`, `PutObject`, etc. While this would allow the EC2 instance to list the objects, it grants more permissions than necessary. Granting excessive permissions violates the principle of least privilege, which aims to minimize the permissions granted to only those needed for a specific task. - Why it's rejected: This is not the most secure option because it grants overly broad permissions. It is better to grant only the necessary permissions. B) Update the IAM instance profile that is attached to the EC2 instance to include the S3:ListBucket permission for the S3 bucket. - Reasoning: The `S3:ListBucket` permission allows the EC2 instance to list the objects in the S3 bucket. This is the minimum required permission to allow the application to display the objects stored in the bucket. This solution follows the principle of least privilege by granting only the specific permission needed to fulfill the task. - Why it's selected: This is the most secure option, as it grants only t...

Author: Andrew · Last updated Jul 14, 2026

A company is planning to securely manage one-time fixed license keys in AWS. The company's development team needs to access the license keys in automaton scripts that run in Amazon EC2 instances and in AWS C...

Let's evaluate each option based on the scenario of securely managing one-time fixed license keys and meeting the requirements of automation scripts running in EC2 instances and CloudFormation stacks: A) Amazon S3 with encrypted files prefixed with "config" - Reasoning: Storing license keys as files in Amazon S3 and encrypting them is a viable option, but it would require significant manual management (e.g., managing access control to specific files, ensuring encryption, etc.). Also, S3 is more commonly used for storing objects like backups, static assets, and not for secrets or sensitive configuration data. - Why it's rejected: While S3 with encryption could work, it is not the most secure or best practice for managing sensitive data like license keys. It also lacks native integrations with AWS services for secure access and automation, which would make it harder to manage efficiently. B) AWS Secrets Manager secrets with a tag that is named SecretString - Reasoning: AWS Secrets Manager is designed to securely store and manage secrets. However, using a tag to store the `SecretString` is not the recommended approach. Secrets Manager automatically handles secret versions, encryption, and access control, but the use of a tag for storing secret data is not a good practice as it is not intended for storing the actual secret data. Secrets should be stored in the "secret value" field, not tags. - Why it's rejected: This is an unconventional and insecure use of tags. Secrets Manager is suitable for securely managing secrets, but tags should not be used to store the actual secret data. This approach introduces potential security risks. ...

Author: Mia · Last updated Jul 14, 2026

A company has deployed infrastructure on AWS. A development team wants to create an AWS Lambda function that will retrieve data from an Amazon Aurora database. The Amazon Aurora database is in a private subnet in company's VPC. The VPC is named VPC1. The data is relati...

Let's break down the options and analyze them based on the requirements: A) Create the Lambda function. Configure VPC1 access for the function. Attach a security group named SG1 to both the Lambda function and the database. Configure the security group inbound and outbound rules to allow TCP traffic on Port 3306. - Reasoning: This option involves creating the Lambda function inside the VPC (VPC1) and configuring access using security groups. By attaching a security group to both the Lambda function and the Aurora database, you can control traffic between the Lambda function and the Aurora database. Security group rules can be set to allow TCP traffic on port 3306 (the default port for MySQL-compatible Aurora), ensuring secure communication between the Lambda function and the database. This is a secure and simple solution that keeps all components within the same VPC. - Why it's selected: This solution is effective and secure. The Lambda function will securely connect to the Aurora database inside VPC1 using security groups, ensuring traffic is controlled and encrypted within the VPC. B) Create and launch a Lambda function in a new public subnet that is in a new VPC named VPC2. Create a peering connection between VPC1 and VPC2. - Reasoning: This option introduces unnecessary complexity by creating a new VPC (VPC2) and peering it with VPC1. A Lambda function in a public subnet in VPC2 will need to access the Aurora database in VPC1 via the VPC peering connection, which adds network complexity and potential security concerns. It also introduces latency and could complicate security group configurations. This setup is not optimal since you can directly deploy the Lambda function within VPC1. - Why it's rejected: While VPC peering can allow communication between VPCs, this option unnecessarily complicates the setup by adding a second VPC and peering, when a simpler and more secure solution within VPC1 is possible. C) Create the Lambda function. Configure VPC1 access for the function. Assign a security gro...

Author: Isabella · Last updated Jul 14, 2026

A developer is building a web application that uses Amazon API Gateway to expose an AWS Lambda function to process requests from clients. During testing, the developer notices that the API Gateway times out even though the Lambda function finishes under the set time limit. Whic...

To troubleshoot the issue of API Gateway timing out while the Lambda function is completing within the set time limit, we need to look for specific API Gateway metrics that can provide insights into the processing and interaction between API Gateway and Lambda. Let's review the options: A) CacheHitCount This metric tracks the number of times API Gateway served requests from the cache. However, this is not relevant in the context of a timeout issue between API Gateway and Lambda because the problem is not related to caching. The issue is likely due to how API Gateway is interacting with Lambda, not caching. Rejected. B) IntegrationLatency This metric measures the time between when API Gateway relays the request to the backend (in this case, AWS Lambda) and when it receives a response. If API Gateway is experiencing issues connecting to Lambda or waiting for a response, this metric could show a delay in that communication. Since the Lambda function is completing within the set time limit, but API Gateway is timing out, this metric will help identify if the Lambda response is being delayed or if there are other connection issues. Selected. C) CacheMissCount This metric tracks the number of times API Gateway requests data that isn't present in the cache, which is irrelevant when troubleshooting...

Author: William · Last updated Jul 14, 2026

A development team wants to build a continuous integration/continuous delivery (CI/CD) pipeline. The team is using AWS CodePipeline to automate the code build and deployment. The team wants to store the program code to pr...

To store the program code in preparation for a CI/CD pipeline using AWS CodePipeline, the team needs a version control service that integrates well with the pipeline for managing source code. Let's analyze the options: A) AWS CodeDeploy AWS CodeDeploy is a service designed for automating code deployment to various environments, such as EC2 instances, Lambda functions, and on-premises servers. While it is a key part of a CI/CD pipeline for deployment, it is not intended for storing or managing the program code itself. Rejected. B) AWS CodeArtifact AWS CodeArtifact is a managed artifact repository service designed to store and manage dependencies and packages, such as libraries or third-party packages. It is commonly used for managing dependencies during builds rather than storing the program's source code itself. Therefore, this service is not suitable for storing the program code. Rejected. C) AWS CodeCommit AWS CodeCommit is a fully managed source control service that hosts secure Git repositories. It is specifically designed for storin...

Author: Siddharth · Last updated Jul 14, 2026

A developer is designing an AWS Lambda function that creates temporary files that are less than 10 MB during invocation. The temporary files will be accessed and modified multiple times during invocation. The developer has no...

In this scenario, the developer needs to store temporary files that are created during the execution of an AWS Lambda function and are only needed for the duration of the function’s invocation. The developer does not need to save or retrieve the files after the function completes. Let's analyze each option: A) the /tmp directory The /tmp directory in AWS Lambda is a local disk storage available during the execution of the Lambda function. Lambda functions can use this directory to store temporary files up to 10 GB in size. Since the files are temporary and only needed during the function's invocation, this is the ideal place to store them. The /tmp directory is fast, ephemeral, and automatically cleared after the Lambda execution, making it perfect for temporary files that don’t need to persist beyond the function’s lifecycle. Selected. B) Amazon Elastic File System (Amazon EFS) Amazon EFS provides scalable file storage that can be accessed by multiple EC2 instances and Lambda functions, but it is designed for persistent storage, typically for files that need to be shared or accessed after Lambda executions. It introduces complexity and additional cost for use in Lambda functions, especially if the data doesn't need to be persistent. Since the developer only needs temporary file storage during invocation, EFS is overkill and not ideal for this use case. Rejected. ...

Author: Manish · Last updated Jul 14, 2026

A developer is designing a serverless application with two AWS Lambda functions to process photos. One Lambda function stores objects in an Amazon S3 bucket and stores the associated metadata in an Amazon DynamoDB table. The other Lambda function fetches the objects from the S3 bucket by using the metadata from the DynamoDB table. Both Lambda functions use the same Python library to perform complex computations and are approach...

Let's evaluate each of the options based on reducing the size of the Lambda deployment packages with the least operational overhead: A) Package each Python library in its own .zip file archive. Deploy each Lambda function with its own copy of the library. - Reasoning: This option suggests packaging the Python libraries separately and deploying a copy of the library with each Lambda function. However, this would increase the overall size of the deployment packages, as each Lambda function would include a copy of the library. Additionally, maintaining multiple copies of the same library across multiple Lambda functions would introduce unnecessary duplication and make it harder to manage library updates. - Rejected: This option creates more overhead due to duplication of libraries and larger deployment sizes. B) Create a Lambda layer with the required Python library. Use the Lambda layer in both Lambda functions. - Reasoning: A Lambda layer is a distribution mechanism for libraries and dependencies that can be shared across multiple Lambda functions. By creating a Lambda layer, you can package the Python library separately and reference it in both Lambda functions. This solution significantly reduces the size of each Lambda deployment package, as the library is stored in the layer, not directly in the Lambda function. This also ensures that both Lambda functions use the same version of the library and simplifies updates. - Selected: This option reduces the deployment size, provides a centralized way to manage the library, and minimizes operational overhead. C) Combine the two Lambda functions into one Lambda function. Deploy the Lambda function as a single .zip...

Author: FlamePhoenix2025 · Last updated Jul 14, 2026

A developer is writing an AWS Lambda function. The developer wants to log key events that occur while the Lambda function runs. The developer wants to include a unique identifier to associate the events with a specific function invocation. Th...

To meet the requirement of logging key events with a unique identifier for each Lambda invocation, let's carefully evaluate each option: A) Obtain the request identifier from the AWS request ID field in the context object. Configure the application to write logs to standard output. - Reasoning: The AWS request ID is available in the context object during a Lambda invocation, which is a great choice for identifying the specific request. Lambda automatically logs to CloudWatch Logs when the logs are written to standard output (`stdout`). This is the recommended method for logging events in AWS Lambda, as it ensures logs are captured in CloudWatch Logs without additional configuration. - Selected: This option is ideal because it correctly uses the context object for the request ID and writes to standard output, which integrates well with CloudWatch. B) Obtain the request identifier from the AWS request ID field in the event object. Configure the application to write logs to a file. - Reasoning: The event object contains the event data sent to the Lambda function, not the request ID. The request ID is part of the context object, not the event object. Writing logs to a file is not the typical practice in Lambda functions, as AWS Lambda does not have a persistent file system, and managing logs in this way would introduce complexity. Lambda functions are designed to write logs to CloudWatch, not to files. - Rejected: Using the event object for the request ID is incorrect, and writing to a file is unnecessary and problematic in Lambda's stateless environment. C) Obt...

Author: Ravi Patel · Last updated Jul 14, 2026

A developer is working on a serverless application that needs to process any changes to an Amazon DynamoDB table with an AWS Lambda function. How should the develope...

To process changes to a DynamoDB table with an AWS Lambda function, let's review each option and determine the best configuration for this scenario. Option A: Create an Amazon Kinesis data stream, and attach it to the DynamoDB table. Create a trigger to connect the data stream to the Lambda function. - Why it's rejected: DynamoDB itself does not directly support integrating with Kinesis streams to process changes. While both Kinesis and DynamoDB are powerful services, this approach requires additional setup and complexity for streaming changes from DynamoDB to Kinesis, which is not necessary in this use case. - When to use: This method can be useful in scenarios where the application has more complex real-time data streaming needs, but it's over-engineered for simply processing DynamoDB changes. Option B: Create an Amazon EventBridge rule to invoke the Lambda function on a regular schedule. Connect to the DynamoDB table from the Lambda function to detect changes. - Why it's rejected: EventBridge can trigger scheduled events, but it doesn't natively handle changes or real-time updates from DynamoDB. This option involves polling the DynamoDB table regularly, which is inefficient and does not provide an immediate response to changes in the table. - When to use: EventBridge would be more suited for scheduled tasks or for triggering Lambda functions on specific events that happen on a regular basis, rather than processing real-time changes to the DynamoDB table. Option C: Enable DynamoDB Streams on the table. Create a trigger to connect the Dy...

Author: James · Last updated Jul 14, 2026

An application uses an Amazon EC2 Auto Scaling group. A developer notices that EC2 instances are taking a long time to become available during scale-out events. The UserData script is taking a long time to run. The developer must implement a solution to decrease the time that elapses before an EC2 instance becomes available. The solution must make the most recent version of the application available at all times and must apply all available security update...

To address the issue of EC2 instances taking too long to become available during scale-out events, the solution should focus on reducing startup times while ensuring that the most recent application version and necessary security patches are applied. Let’s evaluate each option: Option A: Use EC2 Image Builder to create an Amazon Machine Image (AMI). Install all the patches and agents that are needed to manage and run the application. Update the Auto Scaling group launch configuration to use the AMI. - Why it's rejected: This option involves using EC2 Image Builder to create an AMI with the patches and agents already installed. While it reduces the time required for instance startup, it doesn't address the requirement of always having the most recent version of the application available. The AMI would need to be rebuilt and validated whenever an application update is required, which increases the effort involved in managing updates. - When to use: This approach is helpful if you need to manage base images with specific configurations but does not fulfill the "most recent version of the application" requirement. Option B: Use EC2 Image Builder to create an Amazon Machine Image (AMI). Install the latest version of the application and all the patches and agents that are needed to manage and run the application. Update the Auto Scaling group launch configuration to use the AMI. - Why it's selected: This option creates an AMI using EC2 Image Builder, installing the latest version of the application along with necessary patches and agents. The AMI is validated, and when new EC2 instances are launched, they will be up to date with both the application and security patches. By using EC2 Image Builder, this solution minimizes the number of images created while ensuring that the most recent version of the application is always available. Updating the Auto Scaling group launch configuration to use the new AMI ensures that scale-out events use the latest image. - When to use: This option is ideal when you need to create a consistent and updated image that incorporates the latest application version and patches. It balances image management with application version control. Option C: Set up AWS Co...

Author: StarryEagle42 · Last updated Jul 14, 2026

A developer is creating an AWS Lambda function that needs credentials to connect to an Amazon RDS for MySQL database. An Amazon S3 bucket currently stores the credentials. The developer needs to improve the existing solution by implementing credential rotation and secure storage. The developer also needs to provide integration...

To select the most appropriate solution for securely storing and rotating credentials with minimal management overhead, let's analyze each option: Option A: Store the credentials in AWS Systems Manager Parameter Store. Select the database that the parameter will access. Use the default AWS Key Management Service (AWS KMS) key to encrypt the parameter. Enable automatic rotation for the parameter. Use the parameter from Parameter Store on the Lambda function to connect to the database. - Why it's rejected: While AWS Systems Manager Parameter Store offers encrypted storage for parameters, it does not natively support automatic credential rotation for Amazon RDS credentials in the same way that AWS Secrets Manager does. This would require additional custom development to manage rotation and synchronization with the RDS instance. - When to use: Systems Manager Parameter Store can be useful for storing non-credential parameters or for simple secrets, but it’s not the best choice for a fully managed, integrated credential rotation solution. Option B: Encrypt the credentials with the default AWS Key Management Service (AWS KMS) key. Store the credentials as environment variables for the Lambda function. Create a second Lambda function to generate new credentials and to rotate the credentials by updating the environment variables of the first Lambda function. Invoke the second Lambda function by using an Amazon EventBridge rule that runs on a schedule. Update the database to use the new credentials. On the first Lambda function, retrieve the credentials from the environment variables. Decrypt the credentials by using AWS KMS, Connect to the database. - Why it's rejected: Storing credentials as Lambda environment variables and rotating them manually adds significant management overhead. It requires creating additional Lambda functions, updating environment variables, and synchronizing the database credentials. This solution also lacks a native mechanism for automatically rotating RDS credentials, making it more error-prone and harder to maintain. - When to use: This approach could be used in environments where extreme customization is required, but it’s inefficient and complex for managing database credentials compared to other options. Option C: Store the credentials in AWS Secrets Manager. Set the secret type to Credentials for Amazon RDS database...

Author: Abigail · Last updated Jul 14, 2026

A developer has written the following IAM policy to provide access to an Amazon S3 bucket: Which access does the policy all...

Author: Oscar · Last updated Jul 14, 2026

A developer is creating a mobile app that calls a backend service by using an Amazon API Gateway REST API. For integration testing during the development phase, the developer wants to simulate different backend responses without invoking...

Let’s review each option and evaluate them based on the requirement of simulating different backend responses with the least operational overhead. Option A: Create an AWS Lambda function. Use API Gateway proxy integration to return constant HTTP responses. - Why it's rejected: Using an AWS Lambda function for simulating different backend responses involves more setup and maintenance than necessary. While Lambda can indeed simulate different responses, this option introduces more operational overhead by requiring Lambda code, configuration, and integration management. Also, it may not be as flexible or efficient as using built-in API Gateway features to mock responses. - When to use: This would be appropriate if you need more complex logic or dynamic backend responses, but it doesn't meet the "least operational overhead" requirement for simple testing. Option B: Create an Amazon EC2 instance that serves the backend REST API by using an AWS CloudFormation template. - Why it's rejected: This option involves creating and managing an EC2 instance, which introduces significant operational overhead for a simple task like simulating backend responses. You would need to manage the EC2 instance, handle scaling, maintenance, and security, making this approach far more complicated than necessary for integration testing. - When to use: This could be used in a more complex production environment where the backend service is not yet ready, but it involves unnecessary management overhead for a simple mock integration during development. Option C: Customize the API Gateway stage to select a response type based on the request. - Why it's rejected: This opt...

Author: William · Last updated Jul 14, 2026

A developer has a legacy application that is hosted on-premises. Other applications hosted on AWS depend on the on-premises application for proper functioning. In case of any application errors, the developer wants to be able to use Amazon Cloud...

To monitor and troubleshoot all applications from one place using Amazon CloudWatch, the developer needs a solution that allows seamless integration between the on-premises server and AWS CloudWatch. Let's evaluate the options: Option A: Install an AWS SDK on the on-premises server to automatically send logs to CloudWatch. - Pros: The AWS SDK can be used to programmatically send logs from the on-premises server to CloudWatch. - Cons: This approach requires custom development, including setting up the SDK, handling authentication, and error handling. It’s less efficient compared to other methods designed specifically for log management. - Reason for Rejection: The developer would need to write and maintain custom code, which could add unnecessary complexity for simply sending logs to CloudWatch. Additionally, the SDK is not primarily intended for logging; it’s more suited for interacting with AWS services. Option B: Download the CloudWatch agent to the on-premises server. Configure the agent to use IAM user credentials with permissions for CloudWatch. - Pros: The CloudWatch agent is designed for this exact scenario. It can be easily installed on the on-premises server to collect logs and metrics. The agent can securely send logs to CloudWatch and is fully supported by AWS. - Cons: The setup involves configuring IAM user credentials, but this is a straightforward task with AWS’s managed IAM features. - Reason for Selection: This option is the most direct and efficient for sending logs from on-premises to CloudWatch. The CloudWatch agent is designed specifically to collect and forward logs and metrics from on-prem...

Author: Sofia · Last updated Jul 14, 2026

An Amazon Kinesis Data Firehose delivery stream is receiving customer data that contains personally identifiable information. A developer needs to remove pattern-based customer identifiers from the data and store the m...

To meet the requirement of removing pattern-based customer identifiers from the data and storing it in an Amazon S3 bucket, the solution needs to be efficient, cost-effective, and manageable. Let's analyze each option: Option A: Implement Kinesis Data Firehose data transformation as an AWS Lambda function. Configure the function to remove the customer identifiers. Set an Amazon S3 bucket as the destination of the delivery stream. - Pros: - Purpose-built solution: Kinesis Data Firehose integrates well with AWS Lambda, allowing you to process and transform the data before it is delivered to the destination. - Efficient: AWS Lambda is highly scalable and managed, which makes it a good fit for real-time data processing. - No additional infrastructure: Lambda functions are serverless and require no maintenance of additional resources. - Direct delivery: Data can be directly stored in Amazon S3, which is exactly what is required here. - Cons: There are some limits on the size of data that can be processed by Lambda functions (6 MB synchronous, 256 KB asynchronous), but these limits are typically sufficient for many use cases. - Reason for Selection: This is the most appropriate solution as it directly integrates with Kinesis Data Firehose, performs the required transformation (removal of identifiers), and delivers the data to Amazon S3 with minimal additional setup. Option B: Launch an Amazon EC2 instance. Set the EC2 instance as the destination of the delivery stream. Run an application on the EC2 instance to remove the customer identifiers. Store the transformed data in an Amazon S3 bucket. - Pros: EC2 instances can process the data and perform the necessary transformations. - Cons: - Complexity: You need to manage the EC2 instance, which involves more operational overhead, such as instance maintenance, scaling, and monitoring. - Cost: EC2 instances are typically more expensive compared to serverless solutions like Lambda, especially if the processing is continuous. - Scalability: Scaling the EC2 instance to handle large amounts of data may require additional configuration and may not be as efficient as Lambda. - Reason for Rejection: This option introduces unnecessary complexity and operational overhead. It's not as efficient or cost-effective compared to Lambd...

Author: Charlotte · Last updated Jul 14, 2026

A developer is using an AWS Lambda function to generate avatars for profile pictures that are uploaded to an Amazon S3 bucket. The Lambda function is automatically invoked for profile pictures that are saved under the /original/ S3 prefix. The developer notices that some pictures cause the Lambda function to time out. The developer wants to implement a fallback ...

To implement a fallback mechanism for the Lambda function that generates avatars, the solution should allow for minimal development effort while providing an effective way to handle failures (such as Lambda timeouts). Let's evaluate each option: Option A: Set the image resize Lambda function as a destination of the avatar generator Lambda function for the events that fail processing. - Pros: - Simple integration: Lambda destinations can automatically trigger another Lambda function upon failure, providing an easy way to implement a fallback. - Cons: - Limited configuration: While Lambda destinations are an efficient mechanism for failure handling, they don't allow for complex error handling or retries. It is a straightforward solution but may not be as flexible as other methods. - Failure scope: Only specific errors are captured and forwarded to the fallback function, and there may be limitations on retry logic and processing control. - Reason for Rejection: This option is simple but may not offer the best flexibility if you need more complex error handling or additional processing capabilities. However, for simple error forwarding, this could be an option. Option B: Create an Amazon Simple Queue Service (Amazon SQS) queue. Set the SQS queue as a destination with an on failure condition for the avatar generator Lambda function. Configure the image resize Lambda function to poll from the SQS queue. - Pros: - Asynchronous processing: SQS allows for decoupling and asynchronous retry mechanisms. - Scalability: If the failure rate increases, SQS can handle backpressure by queuing failed events. - Cons: - Increased complexity: Implementing SQS requires managing the queue, ensuring proper Lambda polling, and handling retries manually. - Latency: This introduces additional steps—messages are first placed in SQS, and the resize function then polls and processes the data. This adds more time to the workflow, which could be undesirable. - Reason for Rejection: While SQS can handle retry logic and failures efficiently, the added complexity and latency make it a less optimal choice compared to other options. Option C: Create an AWS Step Functions state machine that invokes the avatar generator Lambda function and uses the image resize Lambda function as a fallback. Create an Amazon EventBridge rule that ma...

Author: Ethan · Last updated Jul 14, 2026

A developer needs to migrate an online retail application to AWS to handle an anticipated increase in traffic. The application currently runs on two servers: one server for the web application and another server for the database. The web server renders webpages and manages session state in memory. The database server hosts a MySQL database that contains order details. When traffic to the application is heavy, the memory usage for the web server approaches 100% and the application slows down considerably. The developer has found that most of the memory increase and performance decrease is related to the load of managing additiona...

To address the performance issues caused by heavy traffic and high memory usage on the web server, the developer needs to optimize the handling of user sessions and manage database traffic more efficiently. Let's evaluate each option based on the requirements. Option A: Use an EC2 instance to host the MySQL database. Store the session data and the application data in the MySQL database. - Pros: - Simple setup for managing both application and session data in a single database. - Cons: - Performance issue: Storing session data in the same database as the application data increases load on the database server. Since session data is often read and written frequently, storing it in MySQL could increase the load on the database, leading to performance degradation. - Scalability: EC2 instances for databases may not scale as efficiently as managed database services like Amazon RDS, especially under high traffic loads. - Reason for Rejection: Storing session data in the MySQL database would add unnecessary load to the database, which is likely already a performance bottleneck. This option does not address the core issue of high memory usage and slowdowns on the web server. Option B: Use Amazon ElastiCache for Memcached to store and manage the session data. Use an Amazon RDS for MySQL DB instance to store the application data. - Pros: - Session management: ElastiCache for Memcached is a fast, in-memory caching service that is well-suited for managing session data. It offloads session management from the web server and reduces memory usage. - Scalability: Amazon RDS for MySQL is a fully managed service that automatically handles scaling and performance optimizations for the MySQL database, improving reliability and performance. - Improved performance: By using ElastiCache to handle session data, the web server can focus on rendering pages, and session data can be stored in a high-performance, low-latency cache. - Cons: - Complexity: Introducing both ElastiCache and RDS introduces some complexity in the architecture but provides significant benefits in performance and scalability. - Reason for Selection: This solution effectively addresses the core issue of managing session data separately from the application data. Using ElastiCache for session data allows the web servers to scale more efficiently, while RDS handles the application database, providing both performance improvements and scalability. ...

Author: Ella · Last updated Jul 14, 2026

An application uses Lambda functions to extract metadata from files uploaded to an S3 bucket; the metadata is stored in Amazon DynamoDB. The application starts behaving unexpectedly, and the developer wants to examine the logs of the Lambda...

In this scenario, the developer is looking for logs related to the behavior of Lambda functions. Let's analyze each option to determine where the Lambda logs can be found: Option A: Amazon S3 - Pros: S3 is the storage location for the uploaded files, but it does not handle Lambda function logs or errors directly. - Cons: S3 does not store logs generated by Lambda functions. It only stores files that are uploaded by the application. - Reason for Rejection: The logs related to Lambda function execution errors will not be found in S3. S3 is just the source of the files being processed, not where Lambda function logs are stored. Option B: AWS CloudTrail - Pros: CloudTrail logs API calls and events related to AWS services, including Lambda invocations. - Cons: While CloudTrail can provide logs of Lambda invocations (e.g., when the function was triggered), it does not capture detailed logs of Lambda function execution or errors (such as specific code errors or log outputs). - Reason for Rejection: CloudTrail is useful for tracking AWS service API calls but not for capturing detailed logs of the Lambda function's internal operations or errors. Option C: Amazon CloudWatch - Pros: AWS Lambda automatically integr...

Author: FlamePhoenix2025 · Last updated Jul 14, 2026

A company is using an AWS Lambda function to process records from an Amazon Kinesis data stream. The company recently observed slow processing of the records. A developer notices that the iterator age metric for the function is increasing and that the Lambda run duration...

To increase the processing speed of an AWS Lambda function that is processing records from an Amazon Kinesis data stream, we should focus on improving the throughput of the Lambda function and its ability to process records faster. Let's go through each option and explain the reasoning behind selecting or rejecting each one. A) Increase the number of shards of the Kinesis data stream. - Reasoning: Kinesis data streams are divided into shards, and each shard can support a limited number of records per second. If the iterator age is increasing, it suggests that the Lambda function cannot process the records fast enough. By increasing the number of shards, more records can be processed concurrently, which would help the Lambda function process records faster and reduce the iterator age. - Selected: This is a good option because it increases the concurrency of the stream processing, allowing the Lambda function to consume and process more records in parallel. B) Decrease the timeout of the Lambda function. - Reasoning: Decreasing the timeout is not a viable solution to improving performance. In fact, reducing the timeout could cause the Lambda function to terminate prematurely, which would lead to more unprocessed records and a higher iterator age. The problem here is not the timeout but rather the function’s ability to process records quickly. - Rejected: This option would likely exacerbate the issue, so it is not a good choice. C) Increase the memory that is allocated to the Lambda function. - Reasoning: Increasing the memory allocated to a Lambda function can improve its processing speed. Lambda functions have a CPU allocation ...

Author: Aarav · Last updated Jul 14, 2026

A company needs to harden its container images before the images are in a running state. The company's application uses Amazon Elastic Container Registry (Amazon ECR) as an image registry. Amazon Elastic Kubernetes Service (Amazon EKS) for compute, and an AWS CodePipeline pipeline that orchestrates a continuous integration and continuous delivery (CI/CD) workflow. Dynamic application security testing occurs in the final stage of the pipeline after a new image is deployed to a development namespace in the EKS ...

To analyze the container image earlier in the CI/CD pipeline, the solution needs to balance security analysis with operational efficiency while integrating seamlessly with the existing pipeline. Let's evaluate the options: A) Build the container image and run the docker scan command locally. Mitigate any findings before pushing changes to the source code repository. Write a pre-commit hook that enforces the use of this workflow before commit. - Reasoning: This solution enforces scanning before pushing the image by running a scan locally with a pre-commit hook. While this approach works, it is less efficient in a CI/CD pipeline because it places the burden of security scanning on the developer's local environment. This adds friction and potential inconsistencies in scanning between different environments, as developers might not run the scan in the same way or miss certain vulnerabilities. - Rejected: This option lacks operational efficiency because it requires manual scanning on developer machines and does not scale well for a collaborative, automated CI/CD pipeline. B) Create a new CodePipeline stage that occurs after the container image is built. Configure ECR basic image scanning to scan on image push. Use an AWS Lambda function as the action provider. Configure the Lambda function to check the scan results and to fail the pipeline if there are findings. - Reasoning: This solution creates a new stage after the image is built, which runs the ECR basic image scan and then processes the results. Using an AWS Lambda function to fail the pipeline if security findings are present is an efficient, automated solution. It integrates tightly with the CI/CD workflow, ensuring that the image is analyzed early in the pipeline without requiring manual intervention or external tools. - Selected: This option provides operational efficiency because it automates the scanning and decision-making process within the CI/CD pipeline without relying on manual steps or local configurations. ...

Author: Zain · Last updated Jul 14, 2026

A developer is testing a new file storage application that uses an Amazon CloudFront distribution to serve content from an Amazon S3 bucket. The distribution accesses the S3 bucket by using an origin access identity (OAI). The S3 bucket's permissions explicitly deny access to all other users. The application prompts users to authenticate on a login page and then uses signed cookies to allow users to access their personal storage directories. The developer has configured the distribution to use its default cache behavior with restricted viewer access and has set the origin to point to the S3 bucket. However, when the developer tries...

The objective is to allow unauthenticated access to the login page while ensuring that private content remains secure. Let's evaluate each option: A) Add a second cache behavior to the distribution with the same origin as the default cache behavior. Set the path pattern for the second cache behavior to the path of the login page, and make viewer access unrestricted. Keep the default cache behavior's settings unchanged. - Reasoning: By adding a second cache behavior with unrestricted access for the login page, we allow unauthenticated users to access the login page directly. The default cache behavior still has restricted access for the rest of the content. This solution ensures that only the login page is publicly accessible, and the rest of the content remains protected. - Selected: This option is a good fit because it provides the right level of access control: the login page is publicly accessible, and the rest of the application remains secure. This solution efficiently separates public and private content with minimal configuration. B) Add a second cache behavior to the distribution with the same origin as the default cache behavior. Set the path pattern for the second cache behavior to , and make viewer access restricted. Change the default cache behavior's path pattern to the path of the login page, and make viewer access unrestricted. - Reasoning: This approach changes the behavior in a way that would restrict access to all paths except the login page. However, it would likely break access to other static content that the users might need during authentication or in the app, as it makes all paths except the login page restricted. - Rejected: This approach is not optimal because it restricts access to all other content, which could interfere with users accessing other necessary resources (e.g., images, CSS, JS) after logging in. C) Add a second origin as a failover origin to...

Author: Zain · Last updated Jul 14, 2026

A developer is using AWS Amplify Hosting to build and deploy an application. The developer is receiving an increased number of bug reports from users. The developer wants to add end-to-end testing to the application to eliminate as many bugs as possible...

To eliminate bugs and ensure quality before deployment, the developer needs to integrate end-to-end (E2E) testing into the AWS Amplify deployment process. Let's evaluate each option in detail: A) Run the amplify add test command in the Amplify CLI. - Reasoning: The `amplify add test` command is used for adding a test category to an Amplify project. However, it is not directly designed for adding end-to-end testing. This command helps integrate testing tools like AWS Device Farm or other automated testing services, but it’s not specifically tied to building a test phase for end-to-end tests as needed here. - Rejected: While it is useful for adding test integrations, it does not directly address the requirement for end-to-end testing within the deployment pipeline. B) Create unit tests in the application. Deploy the unit tests by using the amplify push command in the Amplify CLI. - Reasoning: Unit tests are important for verifying the individual components of an application, but end-to-end testing focuses on the entire flow of the application, simulating real-world user interaction across multiple services. Unit tests are not designed for E2E testing, which involves testing the application as a whole. - Rejected: While unit tests are essential, they do not meet the specific requirement of end-to-end testing. C) Add...

Author: Sofia · Last updated Jul 14, 2026

An ecommerce company is using an AWS Lambda function behind Amazon API Gateway as its application tier. To process orders during checkout, the application calls a POST API from the frontend. The POST API invokes the Lambda function asynchronously. In rare situations, the application has not...

To solve the problem of missed order processing in the Lambda function behind the Amazon API Gateway, the root cause needs to be determined. Since the Lambda logs do not show any errors or failures, the issue likely lies in how events are being handled or processed asynchronously. Let's evaluate each option: A) Inspect the frontend logs for API failures. Call the POST API manually by using the requests from the log file. - Reasoning: This option involves inspecting frontend logs for failures and manually calling the API with requests from the logs. While this may help identify issues on the frontend or if the API call was never made, it does not address the root cause of missed order processing. Since the Lambda logs show no errors or failures, the issue could be in how the events are managed asynchronously, rather than with the frontend API calls themselves. - Rejected: This approach is not likely to solve the problem, as it does not target the asynchronous nature of the Lambda invocation or ensure that the Lambda function is processing the events correctly. B) Create and inspect the Lambda dead-letter queue. Troubleshoot the failed functions. Reprocess the events. - Reasoning: A dead-letter queue (DLQ) is used to capture failed events from an asynchronous Lambda invocation. If the Lambda function fails to process an event, the event is placed in the DLQ. By configuring a DLQ for the Lambda function, the developer can capture events that couldn't be processed, review them for any issues, and attempt to reprocess them. Since the application occasionally misses orders but Lambda logs show no failures, it is possible that the events are being discarded silently or not processed due to internal Lambda service issues or throttling. - Selected: This is the most effective solution. By enabling a DLQ, the developer can...

Author: Aarav · Last updated Jul 14, 2026

A company is building a web application on AWS. When a customer sends a request, the application will generate reports and then make the reports available to the customer within one hour. Reports should be accessible to the customer for 8 hours. Some reports are larger than 1 MB. Each report is unique to the customer. The appli...

Analysis of the Options A) DynamoDB with TTL: - Pros: - DynamoDB supports Time-to-Live (TTL), which can automatically delete items after a specified period (in this case, 2 days), which meets the requirement of deleting old reports. - Low operational overhead, as DynamoDB manages the TTL and automatic deletion of expired items. - Can scale automatically to handle varying loads. - Cons: - DynamoDB is designed for low-latency read and write operations but is not optimal for storing large objects (over 1 MB). Storing larger reports in DynamoDB could result in higher costs and potential performance degradation. - DynamoDB is not ideal for file storage and serving large reports to customers. It's better suited for structured data like JSON items, not binary large objects (BLOBs). B) S3 with SNS Notifications: - Pros: - S3 is designed to store large objects efficiently, making it an ideal choice for reports larger than 1 MB. - SNS can be used for real-time notifications, but this does not directly impact the report retrieval process. - Cons: - While the reports can be stored in S3, this option does not address how the customer will access the reports (using URLs, presigned URLs, etc.), making the delivery mechanism a bit unclear. - Adding SNS notifications and subscriptions for every customer introduces unnecessary complexity and operational overhead for providing access to reports. The requirement is for easy access to the reports, and SNS notifications for access aren't required. C) S3 with Presigned URL and Lifecycle Configuration: - Pros: - S3 is ideal for storing large files and is highly scalable. It supports server-side encryption for security. - A presigned URL provides secure, time-limited access to the reports, ensuring they are available to the customer for exactly 8 hours. - S3 Lifecycle configuration can automatically delete old reports after 2 days, aligning with the requirement to remove expired reports. - The solution requires minimal operational manage...

Author: CrystalWolfX · Last updated Jul 14, 2026

A company has deployed an application on AWS Elastic Beanstalk. The company has configured the Auto Scaling group that is associated with the Elastic Beanstalk environment to have five Amazon EC2 instances. If the capacity is fewer than four EC2 instances during the deployment, application performance de...

Analysis of the Options: A) Change the Auto Scaling group to six desired instances: - Pros: - Increasing the number of EC2 instances ensures that the application will always have more resources during the deployment, reducing the chance of performance degradation. - Cons: - This option is not cost-effective, as it increases the number of EC2 instances beyond what is necessary. The company will be paying for one additional EC2 instance that may not be required after deployment, leading to unnecessary costs. - It does not address the root cause of the issue during deployment, which is the deployment strategy and how EC2 instances are managed during the update. B) Change the deployment policy to traffic splitting. Specify an evaluation time of 1 hour: - Pros: - Traffic splitting would allow gradual updates by routing a portion of the traffic to the new version and the rest to the old version. - By specifying an evaluation time of 1 hour, the application can be monitored for performance after splitting traffic, allowing for controlled updates and reducing downtime. - Cons: - While traffic splitting can be effective for controlled rollouts, it may not fully resolve the issue of degraded performance due to fewer EC2 instances. It doesn’t directly address the issue of having insufficient instances during deployment, which is likely the cause of performance degradation. - Traffic splitting introduces complexity with routing traffic and monitoring, making it less straightforward and more resource-intensive. C) Change the deployment policy to rolling with additional batch. Specify a batch size of 1: - Pros: - The rolling deployment policy ensures that not all instances are updated simultaneously, reducing the risk of performance degradation. - By specifying a batch size of 1, the application can update one instance at a time, ensuring that at least four instances will remain running at all times, which addresses the issue of performance degradation during the deployment. - Cons: - Increased deployment time is a consideration here,...

Author: Daniel · Last updated Jul 14, 2026

A developer is incorporating AWS X-Ray into an application that handles personal identifiable information (PII). The application is hosted on Amazon EC2 instances. The application trace messages include encrypted PII and go to Amazon CloudWatch. The develop...

Analysis of the Options: A) Manually instrument the X-Ray SDK in the application code: - Pros: - Manually instrumenting the X-Ray SDK would allow the developer to have complete control over which data is traced and how it is handled, including the ability to exclude PII from being sent to X-Ray or CloudWatch. - The developer can ensure that sensitive data is not accidentally traced by excluding specific fields or encrypting them before sending them out. - Cons: - This approach requires extensive manual coding to filter out PII from the trace data. It is error-prone and increases the complexity of the application code. - Even if the PII is encrypted, there's a risk of misconfiguration or accidental inclusion of sensitive data if not thoroughly tested. - Less efficient compared to automated solutions and introduces additional development overhead. B) Use the X-Ray auto-instrumentation agent: - Pros: - The auto-instrumentation agent simplifies the process of integrating X-Ray by automatically tracing requests and responses without requiring extensive changes to the application code. - It can help capture data from libraries and frameworks automatically, reducing the need for manual instrumentation. - Cons: - Does not provide fine-grained control over sensitive data like PII. By default, the agent would send all trace data, including PII, to X-Ray unless specifically configured. - The auto-instrumentation agent is not designed to handle PII-specific masking or filtering, and it would require additional manual steps to prevent sensitive data from being sent to X-Ray. - Not ideal for cases where sensitive data needs strict handling during tracing. C) Use Amazon Macie to detect and hide PII. Call the X-Ray API from AWS Lambda: - Pros: - Amazon Macie can automatically detect and classify PII in data, and it can help ensure that sensitive information is not included in logs or traces. - By invoking the X-Ray API from an AWS Lambda function, you could potentially filter or redact PII from the trace data before sending it to X-Ray. - Cons: - This solution introduces unnecessary complexity by adding multiple services like Macie and Lambda, which may not be required just to prevent PII from going outside EC2 instances. - Macie is primarily designed for data classification and sensitive data discovery rather than for filtering specific trace d...

Author: Liam · Last updated Jul 14, 2026

A developer is migrating some features from a legacy monolithic application to use AWS Lambda functions instead. The application currently stores data in an Amazon Aurora DB cluster that runs in private subnets in a VPC. The AWS account has one VPC deployed. The Lambda functions and the DB cluster are deployed in the same AWS Region in the same AWS account. The developer...

Analysis of the Options: A) Configure the DB cluster's public access setting to Yes: - Pros: - This would allow the DB cluster to be accessible over the internet. - Cons: - This option exposes the DB cluster to the public internet, which contradicts the requirement of accessing the DB securely without crossing the public internet. - This would be a security risk, as opening a database to the internet increases its vulnerability to attacks, even if proper authentication mechanisms are used. B) Configure an Amazon RDS database proxy for the Lambda functions: - Pros: - The RDS database proxy can help improve the connection management between Lambda functions and the Aurora DB cluster. It provides connection pooling, reducing the overhead of managing many individual database connections. - However, the database proxy itself is not a security solution for private access; it simply acts as a middle layer for connection management. - Cons: - While the database proxy optimizes connection pooling, it does not inherently solve the issue of ensuring that Lambda functions access the DB securely within the private network. If the Lambda functions are not deployed in the same VPC or subnet as the DB, additional setup is still needed. - Does not fully address the requirement of secure, private access without the use of public internet. C) Configure a NAT gateway and a security group for the Lambda functions: - Pros: - A NAT gateway is used to allow resources in private subnets to access the internet while keeping them private, but this does not directly help with the Lambda functions accessing the DB cluster securely within the VPC. - The security group could be configured to allow traffic from Lambda to the DB cluster, ensuring proper access controls. - Cons: - This approach introduces unnecessary complexity if the goal is simply to allow Lambda functions to securely access the DB within the same VPC. A NAT gateway is not required because Lambda functions do not need internet access to communicate with the DB. - Lambda functions do not req...

Author: Kai99 · Last updated Jul 14, 2026

A developer is building a new application on AWS. The application uses an AWS Lambda function that retrieves information from an Amazon DynamoDB table. The developer hard coded the DynamoDB table name into the Lambda function code. The table name might change over time. The developer does...

Analysis of the Options: A) Create a Lambda environment variable to store the table name. Use the standard method for the programming language to retrieve the variable: - Pros: - Using Lambda environment variables is a straightforward and best practice for storing configuration values like table names. - The environment variable can be easily modified through the AWS Lambda console or AWS CLI, without needing to change the function code. - No need for any additional libraries or complex solutions, and the value is securely stored within Lambda configuration. - This solution is flexible and can be updated without redeploying or modifying the Lambda code. - Cons: - None. This is the most efficient and recommended solution for dynamic configuration values that might change over time. B) Store the table name in a file. Store the file in the /tmp folder. Use the SDK for the programming language to retrieve the table name: - Pros: - Storing the table name in a file might work, and the `/tmp` folder is ephemeral storage available to the Lambda function. - Cons: - The /tmp folder is ephemeral and gets cleared between Lambda invocations, so this solution would not persist the table name between invocations. - This adds unnecessary complexity by requiring file I/O operations to retrieve the table name, and it’s not as efficient as using environment variables. - Not a scalable solution for dynamic configuration changes. C) Create a file to store the table name. Zip the file and upload the file to the Lambda layer. Use the SDK for the programming language to retrieve the table name: - Pros: - Lambda layers allow you to include shared code or configuration. - Cons: - This introduces unnecessary complexity, as Lambda layers are generally used for sharing libraries a...

Author: Sophia Clark · Last updated Jul 14, 2026

A company has a critical application on AWS. The application exposes an HTTP API by using Amazon API Gateway. The API is integrated with an AWS Lambda function. The application stores data in an Amazon RDS for MySQL DB instance with 2 virtual CPUs (vCPUs) and 64 GB of RAM. Customers have reported that some of the API calls return HTTP 500 Internal Server Error responses. Amazon CloudWatch Logs shows errors for =E2=80=9Ctoo many connections.=E2=80=9D The errors occur during peak...

The issue described in the question is that the API calls are returning HTTP 500 errors due to "too many connections" to the Amazon RDS for MySQL database. This issue seems to occur during peak usage times when there are unpredictable spikes in traffic, and the database is reaching its connection limit. We will evaluate each option based on the requirements: Option A: Decrease the number of vCPUs for the DB instance. Increase the max_connections setting. - Explanation: Decreasing the number of vCPUs would reduce the capacity of the database and may worsen the issue, not improve it. The critical issue here is related to the number of concurrent connections, and lowering the resources would make the database even less resilient. Increasing the `max_connections` setting can be helpful to allow more concurrent connections but does not address the underlying cause (the unpredictable spikes in usage), and it could lead to resource exhaustion. This is not a sustainable solution. - Reason for rejection: Decreasing vCPUs would likely reduce performance, and simply increasing the `max_connections` without addressing the underlying issue can lead to resource exhaustion. Option B: Use Amazon RDS Proxy to create a proxy that connects to the DB instance. Update the Lambda function to connect to the proxy. - Explanation: RDS Proxy is designed to manage database connections efficiently, especially for applications that experience spikes in traffic. It pools and reuses database connections, reducing the number of concurrent connections directly hitting the RDS instance. This helps mitigate the issue of "too many connections" by reducing the load on the database, which is crucial during peak usage times. It also improves application resiliency by handling connection spikes and automatically scaling. - Reason for selection: This is the most suitable solution as it addresses the problem of too many simultaneous connections and enhances the resilience of the application. It works well in unpredictable traffic scenarios and can prevent database resource exhaustion. Option C: Add a CloudWatch alarm that changes the DB instance class...

Author: Arjun · Last updated Jul 14, 2026

A company has installed smart meters in all its customer locations. The smart meters measure power usage at 1-minute intervals and send the usage readings to a remote endpoint for collection. The company needs to create an endpoint that will receive the smart meter readings and store the readings in a database. The company wants to store the location ID and timestamp information. The company wants to give its customers low-latency access to their current usage and historical usage ...

Solution Requirements: - Data Storage: The readings are time-series data with a location ID and timestamp, meaning the database needs to handle high-volume, frequently-updated records. - Low-Latency Access: Customers should have fast access to current and historical usage. - Scalability: The solution must scale effectively without downtime to handle significant growth in data volume. - Cost-Effectiveness: The solution must be cost-effective given the potential increase in data volume. Let’s evaluate each option: Option A: Store the smart meter readings in an Amazon RDS database. Create an index on the location ID and timestamp columns. Use the columns to filter on the customers' data. - Explanation: Amazon RDS provides a relational database service where you can store structured data like the smart meter readings. Indexing the `location ID` and `timestamp` columns would allow for efficient querying. However, relational databases like RDS may not scale well for high-frequency writes and reads as required for time-series data. The solution might face performance degradation under heavy load, especially with frequent, large-scale inserts (smart meter data arriving every minute). Additionally, scaling relational databases typically involves vertical scaling (increasing instance size) or read replicas, which may still lead to performance bottlenecks during peak times. - Reason for rejection: While it’s a viable option for handling structured data, RDS doesn’t offer the best performance and scalability for this kind of high-frequency, large-scale time-series data. Managing and querying large amounts of real-time data can also lead to performance degradation. Option B: Store the smart meter readings in an Amazon DynamoDB table. Create a composite key by using the location ID and timestamp columns. Use the columns to filter on the customers' data. - Explanation: DynamoDB is a fully managed NoSQL database optimized for high throughput and low-latency access. Using a composite key with `location ID` and `timestamp` will allow for efficient querying of customer data by location and time. DynamoDB can automatically scale horizontally with virtually no downtime, which is ideal for handling increasing demand and large datasets. It is also cost-effective, as you pay only for what you use (write and read throughput), making it a good choice for high-volume workloads like this. - Reason for selection: DynamoDB provides the scalability, low-latency access, and cost-effectiveness required to sto...

Author: Abigail · Last updated Jul 14, 2026

A company is building a serverless application that uses AWS Lambda functions. The company needs to create a set of test events to test Lambda functions in a development environment. The test events will be created once and then will be used by all the developers in an IAM developer group. The t...

Requirements: - Single Set of Test Events: The test events should be created once and shared across developers. - Editable by Developers: Any developer in the IAM group should be able to edit the test events. - Serverless Environment: The solution should be consistent with serverless principles. Let’s evaluate the options: Option A: Create and store the test events in Amazon S3 as JSON objects. Allow S3 bucket access to all IAM users. - Explanation: Amazon S3 can store JSON objects, and it supports fine-grained access control via IAM policies. Storing the test events as JSON objects in an S3 bucket allows all IAM users in the developer group to read and edit the events if they have appropriate permissions. This is scalable, simple to implement, and supports access control. Developers can also use the AWS S3 console or SDKs to edit the test events. - Reason for selection: This option allows developers to easily access and edit test events in a shared location. It is highly flexible, cost-effective, and integrates well with the serverless model. Option B: Create the test events. Configure the event sharing settings to make the test events shareable. - Explanation: While this option might sound useful, AWS Lambda does not have a built-in event sharing feature. Lambda functions themselves don't natively provide a mechanism to "share" test events in the way this option suggests. The event-sharing functionality is not directly related to Lambda's test event management. - Reason for rejection: AWS Lambda doesn’t provide built-in event sharing settings, and this option would not work for storing and managing test events in a way that is accessible by multiple users for editing. ...

Author: John · Last updated Jul 14, 2026

A developer is configuring an application's deployment environment in AWS CodePipeline. The application code is stored in a GitHub repository. The developer wants to ensure that the repository package's unit tests run in the new deployment environment. The developer has already set the pipeline's source provider to GitHub and has specified the repository and bra...

To meet the requirement of running unit tests in the new deployment environment with the least overhead, let's evaluate the options: Key Requirements: - Unit tests need to be run on the repository package. - Source is from GitHub (already configured). - Least overhead: We want a solution that integrates well with AWS CodePipeline and avoids unnecessary complexity. Option A: Create an AWS CodeCommit project. Add the repository package's build and test commands to the project's buildspec. - Explanation: AWS CodeCommit is a source control service, but in this case, the source code is already stored in GitHub. Using CodeCommit here introduces unnecessary overhead, as it would require migrating the code from GitHub to CodeCommit. Additionally, integrating with CodeCommit does not streamline the pipeline configuration as effectively as other services that directly integrate with CodePipeline and GitHub. - Reason for rejection: CodeCommit adds unnecessary complexity and overhead, as the source is already in GitHub. There's no need to move the code to CodeCommit just for running tests. Option B: Create an AWS CodeBuild project. Add the repository package's build and test commands to the project's buildspec. - Explanation: AWS CodeBuild is a fully managed build service that can run unit tests, and it integrates easily with AWS CodePipeline. After specifying the build and test commands in a `buildspec.yml` file, CodeBuild can automatically run the tests as part of the pipeline. CodeBuild fits seamlessly into this environment with minimal configuration, allowing the developer to focus on the testing without needing to worry about the underlying infrastructure. - Reason for selection: This is the optimal choice. AWS CodeBuild integrates well with CodePipeline, is easy to configure, and provides the necessary functionality to run unit tests. It’s straightforward and does not introduce any unnecessary complexity. Option C: Create an AWS CodeDeploy project. Add the repository package's build and test commands to the project's buildspec. - Explanation: AWS CodeDeploy is primarily used for automating the deployment of applications to compute servi...

Author: Charlotte · Last updated Jul 14, 2026

An engineer created an A/B test of a new feature on an Amazon CloudWatch Evidently project. The engineer configured two variations of the feature (Variation A and Variation B) for the test. The engineer wants to work exclusively with Variation A. The engineer needs to make updates so that Variation A i...

To meet the requirement of exclusively working with Variation A in an A/B test on Amazon CloudWatch Evidently, the engineer needs to ensure that only Variation A is returned when the application’s endpoint is hit. Let's evaluate each option based on this requirement: Option A: Add an override to the feature. Set the identifier of the override to the engineer's user ID. Set the variation to Variation A. - Explanation: Overrides in CloudWatch Evidently allow for specific users or groups to see a particular variation, overriding the default experiment configuration. By setting the identifier to the engineer’s user ID and specifying Variation A, the engineer can ensure that only they see Variation A, but others might still see different variations based on the experiment’s configuration. This doesn't achieve the desired outcome of making Variation A the exclusive variation for everyone. - Reason for rejection: This approach only targets the engineer's user ID and does not guarantee that everyone will see Variation A. It is not suitable for ensuring that Variation A is the only variation shown to all users. Option B: Add an override to the feature. Set the identifier of the override to Variation A. Set the variation to 100%. - Explanation: This option creates an override where Variation A is set to 100%, meaning 100% of the traffic will see Variation A. This ensures that Variation A becomes the only variation served, effectively removing any impact from Variation B. This is exactly what the engineer needs to achieve: making Variation A the only active variation. - Reason for selection: This option directly meets the requirement of ensuring that Variation A is the only variation seen when ...

Author: Max · Last updated Jul 14, 2026

A developer is working on an existing application that uses Amazon DynamoDB as its data store. The DynamoDB table has the following attributes: partNumber (partition key), vendor (sort key), description, productFamily, and productType. When the developer analyzes the usage patterns, the developer notices that there are application modules that frequently look for a list of products based on the productFamily and...

Let's break down each option and analyze its suitability based on the requirements and key factors: A) Create a global secondary index (GSI) with productFamily as the partition key and productType as the sort key. - GSI: A GSI allows for querying based on different partition and sort key combinations, separate from the primary key (partNumber and vendor). - Analysis: This is a good option because it allows querying based on the `productFamily` and `productType` attributes directly, which are the attributes frequently used in queries. The GSI can have different partition and sort key combinations, optimizing the query performance for this specific use case. The GSI is also flexible and can be created without affecting the original table structure. B) Create a local secondary index (LSI) with productFamily as the partition key and productType as the sort key. - LSI: A Local Secondary Index (LSI) allows for different sort keys for the same partition key. - Analysis: This option is not appropriate because LSIs are based on the same partition key as the main table. However, in this scenario, `productFamily` and `productType` are not part of the primary key (the partition key is `partNumber`). Therefore, using an LSI with `productFamily` as the partition key would not work, as LSIs cannot change the partition key. The LSI is limited to the partition key used in the main table, so this does not fit the requirement. C) Recreate the table. Add partNumber as the partition key and vendor as the sort key. During table creation, add a local secondary index (LSI) with productFamily as the partition key and productType as ...

Author: Andrew · Last updated Jul 14, 2026

A developer creates a VPC named VPC-A that has public and private subnets. The developer also creates an Amazon RDS database inside the private subnet of VPC-A. To perform some queries, the developer creates an AWS Lambda function in the default VPC. The Lambda function has code to access the RDS database. When the Lambda ...

Let's analyze the different options based on the scenario: A) Modify the RDS security group. Add a rule to allow traffic from all the ports from the VPC CIDR block. - Analysis: While modifying the RDS security group to allow traffic from the entire VPC CIDR block might seem like a solution, it's not an ideal security practice. Allowing traffic from all ports from the entire VPC can open up unnecessary access and may result in security risks. It’s better to restrict access to specific IP addresses or subnets and more granular rules. - Rejection Reason: This option is too broad and not secure. It's important to control access more tightly to avoid unintended vulnerabilities. B) Redeploy the Lambda function in the same subnet as the RDS instance. Ensure that the RDS security group allows traffic from the Lambda function. - Analysis: Redeploying the Lambda function in the same subnet as the RDS instance might not solve the issue directly because the problem could be related to network connectivity (e.g., the Lambda function is in the default VPC, while the RDS instance is in VPC-A). A Lambda function can be configured to access resources across VPCs through VPC peering, transit gateways, or private endpoints. - Rejection Reason: This approach may not be necessary or feasible if Lambda cannot be placed in VPC-A without significant changes, or if cross-VPC connectivity isn’t established. C) Create a security group for the Lambda function. Add a new rule in the RDS security group to allow traffic from the new Lambda security group. - Analysis: This is a good option. AWS allows Lambda functions to be associated with ...

Author: Liam · Last updated Jul 14, 2026

A company runs an application on AWS. The company deployed the application on Amazon EC2 instances. The application stores data on Amazon Aurora. The application recently logged multiple application-specific custom DECRYP_ERROR errors to Amazon CloudWatch logs. The company did not detect the issue until the automated tests that run every 30 minutes failed. A developer must implement a solution that will monitor for the custom e...

Let's analyze each option to determine the best solution: A) Configure the application to create a custom metric and to push the metric to CloudWatch. Create an AWS CloudTrail alarm. Configure the CloudTrail alarm to use an Amazon Simple Notification Service (Amazon SNS) topic to send notifications. - Analysis: While this option creates a custom metric for monitoring DECRYP_ERROR errors, using CloudTrail alarms is not suitable. CloudTrail is primarily used for tracking API activity and actions across AWS services, rather than monitoring application logs or specific custom errors. This would introduce unnecessary complexity as the errors logged are specific to the application and not related to API calls. - Rejection Reason: CloudTrail is not designed for application-level error monitoring, and this solution would add complexity with no clear advantage. B) Create an AWS Lambda function to run every 5 minutes to scan the CloudWatch logs for the keyword DECRYP_ERROR. Configure the Lambda function to use Amazon Simple Notification Service (Amazon SNS) to send a notification. - Analysis: This option introduces operational overhead because it requires configuring a Lambda function that runs periodically, scanning logs every 5 minutes. This can add unnecessary complexity and delays in detection, as the function only runs at specific intervals. A better solution would alert in real time when the error occurs, not after a delay. - Rejection Reason: While it could work, the periodic scan approach results in delayed notifications and additional management overhead (Lambda, monitoring, scheduling, etc.). C) Use Amazon CloudWatch Logs to create a metric filter that has a filter pattern for DECRYP_ERROR. Create a CloudWatch alarm on this metric for a threshold >=3. Configure the alarm to send Amazon Simple Notification Service (Amazon SNS) notifications. - Analysis: This option directly uses CloudWatch Logs to create a metric filter for the specific DECRYP_ERROR pattern in the logs. Cl...

Author: Vikram · Last updated Jul 14, 2026

A developer created an AWS Lambda function that accesses resources in a VPC. The Lambda function polls an Amazon Simple Queue Service (Amazon SQS) queue for new messages through a VPC endpoint. Then the function calculates a rolling average of the numeric values that are contained in the messages. After initial tests of the Lambda function, the developer found that the va...

Let's analyze each option to determine the most suitable solution: A) Set the function's reserved concurrency to 1. Calculate the rolling average in the function. Store the calculated rolling average in Amazon ElastiCache. - Analysis: Setting reserved concurrency to 1 ensures that only one instance of the Lambda function can run at a time, which could prevent race conditions and concurrency issues. However, this alone doesn't address how to calculate and store the rolling average across multiple invocations of the function, especially since Lambda functions are stateless by default. Amazon ElastiCache can be used to store the rolling average, but it's not clear how the function would consistently access and update this value for each new message. - Rejection Reason: While reserved concurrency can help with limiting function execution to one at a time, this solution lacks the necessary mechanism to persist and update the rolling average accurately. B) Modify the function to store the values in Amazon ElastiCache. When the function initializes, use the previous values from the cache to calculate the rolling average. - Analysis: This is a good option. Amazon ElastiCache is an in-memory store, making it ideal for fast access and updating the rolling average over time. When the function initializes, it can retrieve the previous rolling average (and other relevant values) from the cache, update the average with the new message, and then store the updated value back in the cache. This approach ensures that the rolling average is calculated consistently, even if the Lambda function is invoked multiple times. - Selected Reason: This is the most effective approach. By storing the values in ElastiCache, the function can consistently access and update the rolling average across invocations, ensuring accuracy. C) Set the function's provisioned concurrency to 1. Calculate th...

Author: Evelyn · Last updated Jul 14, 2026