Amazon Practice Questions, Discussions & Exam Topics by our Authors

An application that is deployed to Amazon EC2 is using Amazon DynamoDB. The application calls the DynamoDB REST API. Periodically, the application receives a ProvisionedThroughputExceededException error when the application writes t...

To mitigate the `ProvisionedThroughputExceededException` error in the most cost-effective way, the solution must address the core issue—exceeding the provisioned throughput limits of the DynamoDB table—without unnecessarily increasing costs. Let's evaluate each option: Option A: Modify the application code to perform exponential backoff when the error is received. - Explanation: Exponential backoff is a strategy where, upon receiving a rate-limiting error, the application waits for progressively longer intervals before retrying the operation. This helps reduce the likelihood of overwhelming the DynamoDB table with retries. - Reason for selection: This is a highly cost-effective approach. It doesn’t require any infrastructure changes or significant operational overhead. It simply adjusts the application’s behavior to retry operations in a more efficient manner, which is ideal when encountering throughput throttling. Option B: Modify the application to use the AWS SDKs for DynamoDB. - Explanation: The AWS SDKs for DynamoDB include built-in features like automatic retries with exponential backoff, which can help prevent throttling errors by intelligently retrying requests. - Reason for selection: If the application is not already using the AWS SDK, this is a great option because it simplifies retry logic and takes advantage of built-in best practices for handling throughput errors. This approach reduces development effort and makes the application more resilient to transient failures. It is also cost-effective because the SDK provides automated features that reduce the need for custom code. Option C: Increase the read and write throughput of the DynamoDB table. - Explanation: Increasing the read and write throughput would increase the capacity of the DynamoDB table to handle more requests. - Reason for rejection: Although this solution may reduce the number of `ProvisionedThroughputExceededException` errors, it incurs additional ongoing costs. Increasing provisioned throughput is typically more expensive than handling errors via backoff or optimizing the application’s request patterns. It is not as cost-effective as other solutions, especially if the ...

Author: Sofia · Last updated Jul 14, 2026

When a developer tries to run an AWS CodeBuild project, it raises an error because the length of all environment variables exceeds the limit for the co...

When a developer faces the issue of environment variables exceeding the character length limit in AWS CodeBuild, there are several options for resolving this issue. Let’s analyze each option in terms of their suitability: A) Add the `export LC_ALL="en_US.utf8"` command to the pre_build section to ensure POSIX localization. - Reasoning: This command is related to setting the locale for the build environment and does not address the problem of environment variable length exceeding the limit. It is used for ensuring the right locale in the environment, but does not help with handling large amounts of environment data. - Rejection Reason: This option does not address the specific problem of exceeding environment variable length limits, so it is irrelevant in this case. B) Use Amazon Cognito to store key-value pairs for large numbers of environment variables. - Reasoning: Amazon Cognito is primarily a user authentication and identity management service. It is not designed for storing environment variables or configuration data at build time. Using it for this purpose would be non-optimal and overly complicated. - Rejection Reason: This option does not fit the purpose of storing environment variables and would introduce unnecessary complexity without solving the core issue. C) Update the settings for the build project to use an Amazon S3 bucket for large numbers of environment variables. - Reasoning: While Amazon S3 can be used to store large files, environment variables are typically ...

Author: Charlotte · Last updated Jul 14, 2026

A company is expanding the compatibility of its photo-sharing mobile app to hundreds of additional devices with unique screen dimensions and resolutions. Photos are stored in Amazon S3 in their original format and resolution. The company uses an Amazon CloudFront distribution to serve the photos. The app includes the dimension and resolution of the display as GET parameters with every request. A developer needs to implement ...

The developer is looking for a cost-effective solution to optimize photo delivery for mobile devices with different screen dimensions and resolutions. Let’s evaluate each option based on cost-effectiveness, scalability, and ease of implementation: A) Use S3 Batch Operations to invoke an AWS Lambda function to create new variants of the photos with the required dimensions and resolutions. Create a dynamic CloudFront origin that automatically maps the request of each device to the corresponding photo variant. - Reasoning: This option involves creating multiple pre-optimized variants of the photos and serving them from CloudFront based on the device's requested resolution. This approach will incur storage costs for each variant of the photos created in S3, as well as ongoing maintenance for each possible variant. Additionally, managing a large number of photo variants can become complex and expensive as the number of devices grows. - Rejection Reason: This approach will not be cost-effective because it requires storing and managing numerous variants of the photos for each possible screen resolution and dimension, leading to higher storage costs. B) Use S3 Batch Operations to invoke an AWS Lambda function to create new variants of the photos with the required dimensions and resolutions. Create a Lambda@Edge function to route requests to the corresponding photo variant by using request headers. - Reasoning: This approach involves creating multiple variants of photos for each device and using Lambda@Edge to route requests to the appropriate variant. Although Lambda@Edge can process requests closer to the user, creating multiple variants for each screen dimension will result in high storage costs and additional complexity to manage the variants. - Rejection Reason: This option is similar to option A but adds Lambda@Edge for routing. While Lambda@Edge helps with low-latency request processing, it still requires creating and storing multiple photo variants, which can become expensive and complex to mai...

Author: Chloe · Last updated Jul 14, 2026

A company is building an application for stock trading. The application needs sub-millisecond latency for processing trade requests. The company uses Amazon DynamoDB to store all the trading data that is used to process each trading request. A development team performs load testing on the application and finds that the data retrieval time is higher than expe...

The development team needs to reduce data retrieval time for their stock trading application while maintaining sub-millisecond latency. Let's evaluate each option to see which one fits best in terms of performance and ease of implementation: A) Add local secondary indexes (LSIs) for the trading data. - Reasoning: Local secondary indexes (LSIs) in DynamoDB allow for alternative query patterns with the same partition key. While LSIs can help optimize queries when you need to access data in different ways (e.g., using different sort keys), they do not necessarily reduce retrieval time to sub-millisecond latency. Additionally, LSIs require careful consideration regarding the design of partition keys and the size of the dataset. This approach may improve performance for specific types of queries but does not directly address latency issues if the current data retrieval time is still high. - Rejection Reason: This option focuses on different query access patterns and may not directly address the need for sub-millisecond latency in general data retrieval. B) Store the trading data in Amazon S3, and use S3 Transfer Acceleration. - Reasoning: Storing trading data in Amazon S3 is generally suited for storing large, unstructured data or archival purposes. However, S3 Transfer Acceleration is typically used for large files over long distances and is not designed to handle high-performance transactional data retrieval with sub-millisecond latency requirements. S3 also introduces higher latency compared to DynamoDB, as it is not optimized for fast, low-latency querying of small amounts of data. - Rejection Reason: S3 is not designed for low-latency, high-throughput, transactional data retrieval. It is not the best fit for an application that requires sub-millisecond latency for pro...

Author: Noah · Last updated Jul 14, 2026

A developer is working on a Python application that runs on Amazon EC2 instances. The developer wants to enable tracing of application requests to debug performance issues in the code. Which ...

To enable tracing of application requests and debug performance issues in a Python application running on Amazon EC2, the developer needs to implement solutions that specifically facilitate tracing and performance monitoring. Let’s evaluate the options provided to identify the best choices. A) Install the Amazon CloudWatch agent on the EC2 instances. - Reasoning: The Amazon CloudWatch agent allows you to collect and send logs and metrics from the EC2 instance to CloudWatch, but it is primarily for general logging and monitoring purposes. While CloudWatch can help with performance monitoring, it does not specifically enable tracing of application requests or provide detailed tracing of performance issues in the code. - Rejection Reason: While CloudWatch is useful for monitoring metrics and logs, it does not provide the detailed tracing functionality needed for debugging application requests and performance issues, so it is not sufficient for the use case of tracing specific application requests. B) Install the AWS X-Ray daemon on the EC2 instances. - Reasoning: AWS X-Ray is a service that provides tracing capabilities to analyze and debug the performance of applications, especially for tracking requests through various components of the application. The X-Ray daemon is required to collect trace data and send it to the X-Ray service. This allows the developer to trace requests and identify performance bottlenecks in the application. - Selected Option: Installing the AWS X-Ray daemon is essential for enabling tracing in the application, as it collects and forwards trace data to X-Ray. This is a critical step for achieving the goal of tracing application requests. C) Configure the application to write JSON-formatted logs to /var/log/cloudwatch. - Reasoning: This option would allow the application to log information to CloudWatch, but it does not specifically help with tracing requests or performance issues. CloudWatch logs are useful for tracking general lo...

Author: Harper · Last updated Jul 14, 2026

A company has an application that runs as a series of AWS Lambda functions. Each Lambda function receives data from an Amazon Simple Notification Service (Amazon SNS) topic and writes the data to an Amazon Aurora DB instance. To comply with an information security policy, the company must ensure that the Lambda f...

The company needs to ensure that its AWS Lambda functions use a single securely encrypted database connection string to access an Amazon Aurora DB instance while complying with an information security policy. Let’s evaluate each option to determine which one best satisfies these security and compliance requirements. A) Use IAM database authentication for Aurora to enable secure database connections for all the Lambda functions. - Reasoning: IAM database authentication allows Lambda functions to authenticate to Amazon Aurora using AWS Identity and Access Management (IAM) roles, instead of using traditional database credentials. This method provides a secure, centralized way to authenticate without needing to store or manage database passwords. Using IAM roles to authenticate is highly secure and eliminates the need to handle sensitive credentials directly. - Selected Option: This solution is optimal because it eliminates the need to store credentials in code or other systems, ensuring both security and compliance. IAM database authentication integrates securely with Aurora and Lambda without requiring the management of explicit credentials. B) Store the credentials and read the credentials from an encrypted Amazon RDS DB instance. - Reasoning: While storing the database credentials in an encrypted Amazon RDS DB instance could secure the credentials, it is not the best solution for Lambda functions. The process of retrieving credentials from an RDS DB instance would involve querying the database, which could introduce overhead and delays. Moreover, RDS DB instances are primarily used for data storage, not for securely managing credentials for Lambda functions. - Rejection Reason: This approach would add unnecessary complexity and is not the most efficient or secure method to store credentials for Lambda functions. Managing credentials through a dedicated system like Systems Manager Parameter Store or IAM is more suitable. C) Store the credentials in AWS Systems Manager Parameter Store as a secure string parameter. - Reasoning: Storing cr...

Author: CrimsonViperX · Last updated Jul 14, 2026

A developer is troubleshooting an Amazon API Gateway API. Clients are receiving HTTP 400 response errors when the clients try to access an endpoint of the...

Let's break down each option and its applicability to the given scenario: A) Create an Amazon Kinesis Data Firehose delivery stream to receive API call logs from API Gateway. Configure Amazon CloudWatch Logs as the delivery streams destination. - Reasoning: This option involves sending API Gateway logs to a Kinesis Data Firehose, which then delivers them to CloudWatch Logs. While this could be helpful for streaming logs in real time, it is not the most suitable option for troubleshooting HTTP 400 errors. Kinesis is typically used for large-scale, real-time streaming data, and setting this up adds complexity and may not directly help pinpoint the cause of the errors (such as client request issues). - Rejected because: The complexity added by Kinesis and the indirect method for troubleshooting HTTP errors doesn't provide immediate, actionable insights for the 400 error in API Gateway. B) Turn on AWS CloudTrail Insights and create a trail. Specify the Amazon Resource Name (ARN) of the trail for the stage of the API. - Reasoning: AWS CloudTrail Insights provides information about unusual API activities, but it is typically used to detect anomalies or unusual behavior patterns (e.g., spikes in traffic, unusual error rates). CloudTrail logs API calls, but does not provide detailed request-level logs such as input validation errors or specific 400 response codes. - Rejected because: CloudTrail Insights is more suited for identifying anomalies in API usage and is not specifically useful for identifying the detailed cause of an HTTP 400 response, which is likely related to request issues rather than operational anomalies. C) Turn on AWS X-Ray for the API stage. Create an Amazon CloudWatch ...

Author: MoonlitPantherX · Last updated Jul 14, 2026

A company developed an API application on AWS by using Amazon CloudFront, Amazon API Gateway, and AWS Lambda. The API has a minimum of four requests every second. A developer notices that many API users run the same query by using the POST method. The develope...

Let's analyze each of the options based on the requirement to cache the POST request and optimize API resources: A) Configure the CloudFront cache. Update the application to return cached content based upon the default request headers. - Reasoning: CloudFront can cache GET requests by default, but POST requests are typically not cached because they usually involve data mutations (e.g., creating or modifying resources). Caching POST requests would require modifying how the application handles them to return cached content. Caching POST requests by default is not generally supported as it conflicts with how POST requests are typically used (e.g., submitting forms, transactions). - Rejected because: CloudFront’s caching mechanism is not designed to cache POST requests by default, and using the default headers would not be sufficient for caching these types of requests effectively. POST requests should be treated with caution due to the potential for repeated state changes. B) Override the cache method in the selected stage of API Gateway. Select the POST method. - Reasoning: API Gateway does allow caching, but it only supports caching for GET, HEAD, and OPTIONS methods. POST requests typically involve sending data to the server and should not be cached in the same way as GET requests. While API Gateway caching is useful for improving performance, it will not cache POST requests unless the data and headers are specifically configured, and even then, it may not align with the developer’s goal of caching POST queries. - Rejected because: API Gateway's caching capabilities do not support caching for POST methods, and this would lead to a mis...

Author: MysticJaguar44 · Last updated Jul 14, 2026

A company is building a microservices application that consists of many AWS Lambda functions. The development team wants to use AWS Serverless Application Model (AWS SAM) templates to automatically test the Lambda functions. The development team plans to test a small percentage of traffic that is directed to new updates before the team commits to a...

Let's analyze each of the options based on the requirement to automatically test Lambda functions, test a small percentage of traffic directed to new updates, and ensure operational efficiency for the microservices application: A) Use AWS SAM CLI commands in AWS CodeDeploy to invoke the Lambda functions to test the deployment. - Reasoning: While AWS SAM CLI is useful for testing Lambda functions locally, invoking the Lambda functions through CodeDeploy to test the deployment is not the most efficient solution for automatic testing at scale. This would require significant configuration to integrate SAM CLI, AWS CodeDeploy, and the testing process. - Rejected because: This option is operationally complex and does not inherently support gradual deployment or automatic traffic testing in a scalable and efficient way. B) Declare the EventInvokeConfig on the Lambda functions in the AWS SAM templates with OnSuccess and OnFailure configurations. - Reasoning: EventInvokeConfig is useful for managing retry behavior and dead-letter queue (DLQ) configurations in Lambda. However, it is not specifically related to testing Lambda functions or controlling traffic distribution during deployment. This option focuses on invocation behavior, but it doesn't help with testing a small percentage of traffic or gradual deployments. - Rejected because: This option does not address the need for gradual deployment or traffic shifting, and thus, does not directly meet the requirements. C) Enable gradual deployments through AWS SAM templates. - Reasoning: AWS SAM provides integrated support for gradual deployments, which allows the team to deploy new versions of Lambda functions to a small percentage of traffic before fully committing to the deployment. This is highly operationally efficient, as it reduces risk by allowing a small sampl...

Author: Ethan Smith · Last updated Jul 14, 2026

A company is using AWS CloudFormation to deploy a two-tier application. The application will use Amazon RDS as its backend database. The company wants a solution that will randomly generate the database password during deployment. The solution also must automatically rotate the database password w...

Let's break down each of the options in terms of the requirement for randomly generating the database password during deployment and automatically rotating the password without requiring changes to the application: A) Use an AWS Lambda function as a CloudFormation custom resource to generate and rotate the password. - Reasoning: Using a Lambda function as a CloudFormation custom resource to generate and rotate passwords can be a flexible approach. However, this requires significant manual setup and ongoing maintenance. You would need to code the Lambda function to handle both the generation and rotation of the password. While this can work, it is less operationally efficient because of the complexity involved in writing and managing the Lambda function, especially in terms of error handling and integration with the RDS instance for rotation. - Rejected because: Although it can work, it introduces additional operational overhead with custom Lambda functions that need to be maintained. B) Use an AWS Systems Manager Parameter Store resource with the SecureString data type to generate and rotate the password. - Reasoning: AWS Systems Manager Parameter Store with the `SecureString` type can be used to securely store the password. However, it lacks automatic password rotation functionality built-in. You would need to implement your own solution for rotating the password, which could require additional resources (like Lambda) and complexity. - Rejected because: It does not offer native password rotation functionality, and managing the rotation yourself adds o...

Author: Emma · Last updated Jul 14, 2026

A developer has been asked to create an AWS Lambda function that is invoked any time updates are made to items in an Amazon DynamoDB table. The function has been created, and appropriate permissions have been added to the Lambda execution role. Amazon DynamoDB streams have been enabled for the table...

Let's go through each option to determine which one will enable the DynamoDB table updates to invoke the Lambda function: A) Change the StreamViewType parameter value to NEW_AND_OLD_IMAGES for the DynamoDB table. - Reasoning: The `StreamViewType` parameter controls what data is included in the DynamoDB stream (such as new images, old images, or both). However, this does not directly address the issue of Lambda function invocation. The problem is not related to the content of the stream, but rather whether the Lambda function is properly configured to receive events from the DynamoDB stream. - Rejected because: Changing the stream view type does not affect whether the Lambda function is invoked when updates are made to the DynamoDB table. B) Configure event source mapping for the Lambda function. - Reasoning: Event source mapping is the configuration that links DynamoDB Streams to Lambda. It ensures that the Lambda function is triggered when an update occurs in the DynamoDB table. This step is required to establish the connection between the DynamoDB stream and the Lambda function. If the Lambda function isn't being invoked, it's likely that the event source mapping has not been properly set up. - Selected because: Event source mapping is necessary t...

Author: IronLion88 · Last updated Jul 14, 2026

A developer needs to deploy an application running on AWS Fargate using Amazon ECS. The application has environment variables that must be passed to a container for the application to ...

In AWS Fargate using Amazon ECS, environment variables are used to provide configuration details to containers when they are deployed. Let's evaluate each option: A) Define an array that includes the environment variables under the environment parameter within the service definition. - Rejection Reason: While the service definition defines the behavior and scaling of the service, it is not directly responsible for defining container-level configurations like environment variables. The environment variables must be provided within the task definition, which is used by the service. Hence, this option is not the right place to define environment variables. B) Define an array that includes the environment variables under the environment parameter within the task definition. - Selection Reason: This is the correct option. The task definition in ECS is the place to define container configurations, including environment variables. The environment variables will be passed to the containers in this way and are set up when the container is launched. This ensures the container receives the required configurations upon deployment. ECS service uses...

Author: Noah · Last updated Jul 14, 2026

A development team maintains a web application by using a single AWS RDS, template. The template defines web servers and an Amazon RDS database. The team uses the CloudFormation template to deploy the CloudFormation stack to different environments. During a recent application deployment, a developer caused the primary development database to be dropped and recreated. The result o...

To prevent accidental database deletion in the future and ensure data safety, the team can implement the following solutions: A) Add a CloudFormation DeletionPolicy attribute with the Retain value to the database resource. - Selection Reason: The DeletionPolicy attribute in CloudFormation can be set to Retain. This ensures that when the stack is deleted, the database resource is retained instead of being deleted. By doing this, even if the stack or the resource is deleted, the database will persist, helping prevent data loss. This option directly addresses the goal of preventing accidental database deletion and retaining the data. B) Update the CloudFormation stack policy to prevent updates to the database. - Rejection Reason: A CloudFormation stack policy restricts actions like updates and deletions to certain resources, but it does not guarantee that the database will be retained during stack deletion. While stack policies can prevent resource modification, it doesn't ensure the database is preserved during deletion of the stack, which is the main concern here. C) Modify the database to use a Multi-AZ deployment. - Rejection Reason: A Multi-AZ deployment increases availability and durability by replicating the database across multiple availability zones, but it does not directly address the risk of accidental deletion. Th...

Author: Ava · Last updated Jul 14, 2026

A developer is storing sensitive data generated by an application in Amazon S3. The developer wants to encrypt the data at rest. A company policy requires an audit trail of when the AWS Key Management Service (...

The requirement is to store sensitive data in Amazon S3 and encrypt it at rest, with an audit trail of AWS KMS key usage. Let's evaluate each encryption option: A) Server-side encryption with Amazon S3 managed keys (SSE-S3) - Rejection Reason: SSE-S3 uses Amazon S3's built-in encryption with S3-managed keys. While it encrypts data at rest, it does not provide any audit trail for when and by whom the encryption keys were used. SSE-S3 does not use AWS KMS and does not satisfy the requirement for tracking key usage. It’s a simpler, less customizable option for encryption. B) Server-side encryption with AWS KMS managed keys (SSE-KMS) - Selection Reason: SSE-KMS provides server-side encryption where S3 uses AWS KMS-managed keys to encrypt data. The key benefit here is that AWS KMS integrates with AWS CloudTrail, allowing an audit trail of when and by whom the key was used. This is exactly what the company policy requires—tracking key usage. Additionally, SSE-KMS offers more control over encryption, such as key rotation and permissions, making it the most suitable choice for both security and compliance with audit requirements. C) Server-side encryp...

Author: Victoria · Last updated Jul 14, 2026

A company has an ecommerce application. To track product reviews, the company=E2=80=99s development team uses an Amazon DynamoDB table. Every record includes the following: =E2=80=A2 A Review ID, a 16-digit universally unique identifier (UUID) =E2=80=A2 A Product ID and User ID, 16-digit UUIDs that reference other tables =E2=80=A2 A Product Rating on a scale of 1-5 =E2=80=A2 An optional comment from the user The table partition key is...

To determine the fastest response for the query of retrieving the 10 reviews with the highest rating for a given product, we need to optimize for both the partitioning of data and the sorting order, particularly the Product Rating. Let's break down the options: A) A global secondary index (GSI) with Product ID as the partition key and Product Rating as the sort key - Selection Reason: A GSI with Product ID as the partition key and Product Rating as the sort key would be the ideal choice for this query. The reason is that the query is looking for reviews of a specific product (using the Product ID as the partition key), and it needs to retrieve the reviews with the highest ratings (which will be efficiently sorted using the Product Rating as the sort key). This GSI allows us to perform the query efficiently by first partitioning by product and then sorting reviews by rating, which directly satisfies the requirement to find the highest-rated reviews. Additionally, the ability to retrieve the top reviews with a simple Query operation is a key factor in ensuring fast response times. B) A global secondary index (GSI) with Product ID as the partition key and Review ID as the sort key - Rejection Reason: While this GSI uses the Product ID as the partition key, it sorts by Review ID, which is not relevant to the query. The query requires sorting by Product Rating to get the highest-rated reviews, not by Review ID. Therefore, this option would not improve performance for the specific query on product ratings. C) A local secondary index (LSI) with Product...

Author: Aria · Last updated Jul 14, 2026

A company needs to distribute firmware updates to its customers around the world. Which service will allow easy and secure co...

Let's evaluate each option in terms of security, cost-effectiveness, and ease of use for distributing firmware updates: A) Use Amazon CloudFront with signed URLs for Amazon S3 - Selection Reason: This option is ideal for controlling access securely and cost-effectively. CloudFront is a content delivery network (CDN) that caches and distributes content globally. By using signed URLs for Amazon S3, you can restrict access to the firmware downloads, ensuring that only authorized users can download the files. This approach allows fine-grained control over access, such as expiration times for URLs and restricting access based on certain conditions (e.g., IP address). It also minimizes costs because CloudFront is cost-effective for global content distribution, and S3 is optimized for storing and serving files. This combination of CloudFront and signed URLs is commonly used for secure, low-cost content delivery with fine-grained access control. B) Create a dedicated Amazon CloudFront Distribution for each customer - Rejection Reason: Creating a separate CloudFront distribution for each customer would be unnecessarily complex and expensive. It would require managing multiple distributions, each potentially with its own configuration, leading to higher overhead and cost. This approach doesn’t scale well and is much less efficient than using signed URLs to manage access for all customers through a single CloudFront distribution. C) Use Amazon CloudFront with AWS Lambda@Edge - Rejection R...

Author: Arjun · Last updated Jul 14, 2026

A developer is testing an application that invokes an AWS Lambda function asynchronously. During the testing phase, the Lambda function fails to process af...

To troubleshoot the failure of an AWS Lambda function that is invoked asynchronously and fails to process after two retries, we need to focus on gathering the right data to investigate the failure and possibly capture unprocessed events for further analysis. Let’s evaluate the options: A) Configure AWS CloudTrail logging to investigate the invocation failures. - Reasoning: AWS CloudTrail logs provide information about API calls made to AWS services, including Lambda invocations. While CloudTrail can help you see that a Lambda function was invoked and whether there were any issues at the API level, it does not capture detailed execution errors or event data from Lambda directly. It would not help to investigate why the Lambda function failed after retries. - Rejected: CloudTrail is not ideal for troubleshooting function-specific failures or to inspect the actual error responses from Lambda itself. B) Configure Dead Letter Queues by sending events to Amazon SQS for investigation. - Reasoning: A Dead Letter Queue (DLQ) is an ideal solution in this scenario. When a Lambda function fails to process an event after the maximum number of retries (which is 2 for asynchronous invocations), the event can be sent to a DLQ like Amazon SQS or Amazon SNS. This allows the developer to inspect the failed event, look at logs, and understand why the failure occurred. It's a common practice for handling unprocessed events in asynchr...

Author: Liam · Last updated Jul 14, 2026

A company is migrating its PostgreSQL database into the AWS Cloud. The company wants to use a database that will secure and regularly rotate database credentials. The company wants a solution that does not...

Let's evaluate each option based on the company’s needs, which are to secure and regularly rotate database credentials without additional programming overhead: A) Use Amazon Aurora PostgreSQL for the database. Store the database credentials in AWS Systems Manager Parameter Store. Turn on rotation. - Reasoning: Aurora PostgreSQL is a fully managed relational database service that supports PostgreSQL, so it's an appropriate choice for migrating a PostgreSQL database. AWS Systems Manager Parameter Store can be used to store credentials securely, but it does not natively support automatic credential rotation. To achieve automatic rotation with Parameter Store, additional programming is required to trigger the rotation process, making this less desirable as it involves more overhead. - Rejected: While Aurora PostgreSQL is a suitable database choice, Parameter Store does not provide built-in automatic credential rotation for database credentials without additional programming. B) Use Amazon Aurora PostgreSQL for the database. Store the database credentials in AWS Secrets Manager. Turn on rotation. - Reasoning: Aurora PostgreSQL is a good fit for PostgreSQL databases. AWS Secrets Manager allows for secure storage of database credentials and supports automatic credential rotation for many database types, including Amazon Aurora PostgreSQL. This meets the company’s requirement of securing credentials and rotating them regularly without needing additional programming effort. Secrets Manager provides a simple and native solution for credential rotati...

Author: Vikram · Last updated Jul 14, 2026

A developer is creating a mobile application that will not require users to log in. What is the MOST efficien...

Let's evaluate the options in the context of a mobile application that does not require users to log in but still needs access to AWS resources. A) Use an identity provider to securely authenticate with the application. - Reasoning: This option involves using an identity provider (IdP) to authenticate users. While this is an excellent option for applications that require user login and secure access, the scenario specifically states that no login is required. Therefore, the authentication process via an identity provider is unnecessary, as it would introduce complexity and overhead for users who don't need to log in. - Rejected: Not suitable because login/authentication is not required in this case. B) Create an AWS Lambda function to create an IAM user when a user accesses the application. - Reasoning: Creating IAM users dynamically using Lambda is not efficient for this use case. It introduces significant complexity and overhead because it involves creating and managing IAM users for each access, which is not scalable and not ideal for mobile applications. Additionally, IAM users are intended for system-level access, and creating users for individual, unauthenticated mobile users would complicate the system unnecessarily. - Rejected: This option adds unnecessary complexity and is not scalable for this use case. C) Create credentials using AWS KMS and apply these credentials to users when using the application....

Author: Sara · Last updated Jul 14, 2026

A company has developed a new serverless application using AWS Lambda functions that will be deployed using the AWS Serverless Application Model (AWS SAM) CLI. Whic...

Let's evaluate the options in the context of deploying a serverless application using AWS Lambda and AWS Serverless Application Model (AWS SAM): A) Compress the application to a .zip file and upload it into AWS Lambda. - Reasoning: While packaging a Lambda function into a .zip file is one way to deploy code to AWS Lambda, the AWS SAM CLI provides a more streamlined process for serverless applications. Using SAM, developers can define the application structure in a template (in YAML format) and deploy it using SAM commands. Compressing the application manually into a .zip file is not necessary when using AWS SAM, as SAM automates the packaging and deployment steps. - Rejected: This is not the most efficient method when using AWS SAM, as SAM handles the packaging and deployment automatically. B) Test the new AWS Lambda function by first tracing it in AWS X-Ray. - Reasoning: AWS X-Ray is useful for tracing and debugging Lambda functions, but it is typically done after deployment to monitor and debug Lambda invocations. Testing and tracing a Lambda function in X-Ray would not be a prerequisite before deploying the application with AWS SAM. - Rejected: This is a post-deployment step for debugging and monitoring, not a pre-deployment step. C) Bundle the serverless application using a SAM package. - Reasoning: The SAM package comma...

Author: Arjun · Last updated Jul 14, 2026

A company wants to automate part of its deployment process. A developer needs to automate the process of checking for and deleting unused resources that supported previously deployed stacks but that are no longer used. The company has a central application that uses the AWS Cloud Development Kit (AWS CDK) to manage all deployment stacks. The stacks are spread out across multiple accounts. The developer=E2=80=...

Let’s evaluate the options based on the company’s requirements to automate the checking and deletion of unused resources in multiple accounts with minimal configuration: A) In the central AWS CDK application, write a handler function in the code that uses AWS SDK calls to check for and delete unused resources. Create an AWS CloudFormation template from a JSON file. Use the template to attach the function code to an AWS Lambda function and to invoke the Lambda function when the deployment stack runs. - Reasoning: While AWS Lambda can be used to automate the process, creating a CloudFormation template manually from a JSON file is not efficient when using AWS CDK. The AWS CDK itself abstracts much of this complexity and manages resources as code. Additionally, using a CloudFormation template in this manner doesn’t integrate seamlessly with the AWS CDK deployment process, leading to unnecessary complexity and configuration. - Rejected: This option introduces additional complexity and doesn’t align well with AWS CDK's capabilities. B) In the central AWS CDK application, write a handler function in the code that uses AWS SDK calls to check for and delete unused resources. Create an AWS CDK custom resource. Use the custom resource to attach the function code to an AWS Lambda function and to invoke the Lambda function when the deployment stack runs. - Reasoning: This option makes good use of AWS CDK and is the most seamless approach for integrating custom logic into the deployment process. AWS CDK custom resources allow developers to extend CloudFormation's capabilities by running custom code (in this case, the Lambda function to check and delete unused resources). This solution is well integrated with AWS CDK, requires minimal configuration, and leverages the full power of CDK’s resource management. - Selected Option: This is the optimal choice because it integrates directly with the CDK deployment process, is easy to configure, and follows best practices for extending CDK func...

Author: BlazingPhoenix22 · Last updated Jul 14, 2026

A company built a new application in the AWS Cloud. The company automated the bootstrapping of new resources with an Auto Scaling group by using AWS CloudFormation templates. The bootstrap scripts contain sensitive data. The company needs a solution that is integrated with CloudFormation...

To solve the problem, let's analyze each option, considering the need to securely manage sensitive data in CloudFormation templates and the most secure method of doing so. Option A: Put the sensitive data into a CloudFormation parameter. Encrypt the CloudFormation templates by using an AWS Key Management Service (AWS KMS) key. - Pros: CloudFormation parameters are a standard way to pass values to CloudFormation stacks. Encrypting the template with AWS KMS would add an encryption layer to the template, ensuring that it is protected. - Cons: Storing sensitive data directly as parameters in CloudFormation could expose them if not handled carefully. While the template could be encrypted, there is no guarantee that the parameters themselves are encrypted at rest unless specified. This could still expose sensitive data in the template if someone has access to it. Reason for rejection: While encryption can protect the template, it doesn't securely protect the sensitive data itself in a way that best suits automation or compliance best practices. Option B: Put the sensitive data into an Amazon S3 bucket. Update the CloudFormation templates to download the object from Amazon S3 during bootstrap. - Pros: S3 allows for secure storage of sensitive data, and access to S3 can be tightly controlled with IAM policies. - Cons: Storing sensitive data in S3 requires careful management of access policies and encryption settings. Also, using S3 to store and retrieve sensitive data requires ensuring that the instance during bootstrapping has the right permissions to download the object securely. Reason for rejection: While S3 is a good option for storing data, this method introduces complexities regarding IAM access and encryption. It’s less integrated with CloudFormation compared to other options. Option C: Put the sensitive data into AWS Systems Manager Parameter Store as a secure string parameter. Update the CloudFormation ...

Author: Ishaan · Last updated Jul 14, 2026

A company needs to set up secure database credentials for all its AWS Cloud resources. The company=E2=80=99s resources include Amazon RDS DB instances, Amazon DocumentDB clusters, and Amazon Aurora DB instances. The company=E2=80=99s security policy mandates that database credenti...

Let's evaluate each option based on the need to securely store, rotate, and manage database credentials for Amazon RDS, Amazon DocumentDB, and Amazon Aurora instances, ensuring that credentials are encrypted at rest and rotated regularly. Option A: Set up IAM database authentication for token-based access. Generate user tokens to provide centralized access to RDS DB instances, Amazon DocumentDB clusters, and Aurora DB instances. - Pros: IAM database authentication is a secure way to authenticate users to RDS, Aurora, and DocumentDB without relying on static credentials. Tokens are temporary and automatically expire, reducing the risk of credential exposure. - Cons: While IAM-based token authentication reduces the need for stored credentials, it doesn't address the security policy’s requirement for encrypted credentials at rest. It also doesn't handle credential rotation directly for the databases in a manner that aligns with all the services mentioned. Reason for rejection: Although token-based authentication is secure, it does not fulfill the encryption at rest and rotation requirements for database credentials in this case. It's also not as universally applicable as other solutions, especially when it comes to existing systems. Option B: Create parameters for the database credentials in AWS Systems Manager Parameter Store. Set the Type parameter to SecureString. Set up automatic rotation on the parameters. - Pros: AWS Systems Manager Parameter Store can store sensitive information in a secure, encrypted manner using the "SecureString" type, which ensures credentials are encrypted at rest. Automatic rotation can be set up for credentials, providing a secure and automated process. - Cons: While Parameter Store is a secure storage option for sensitive data, it doesn't have native integration with RDS, DocumentDB, and Aurora to handle credential rotation in a fully automated manner. This would require custom automation to rotate the credentials across all services, which adds complexity. Reason for rejection: While it is a secure option for storing and rotating credentials, Parameter Store is not as tightly integrated with AWS managed databases as other solutions like Secrets Manager, which can handle rotation more seamlessly across all the services mentioned. Option C: Store the database access credentials as an encrypted Amazon S3 objec...

Author: William · Last updated Jul 14, 2026

A developer has created an AWS Lambda function that makes queries to an Amazon Aurora MySQL DB instance. When the developer performs a test, the DB instance shows an error for too many connection...

Let's analyze the options to determine which one would address the issue of "too many connections" with the least operational effort, while meeting the requirements. Option A: Create a read replica for the DB instance. Query the replica DB instance instead of the primary DB instance. - Pros: A read replica could offload read queries, reducing the number of connections to the primary DB instance. This is especially helpful if the Lambda function performs read-heavy operations. - Cons: This option would only work for read queries, not write operations. If the Lambda function performs write operations, it would still need to connect to the primary instance, which wouldn't fully resolve the issue of too many connections. Additionally, setting up and maintaining read replicas involves some operational overhead, including replication management and ensuring that read and write traffic is appropriately routed. Reason for rejection: While useful for read-heavy workloads, this solution doesn't address the underlying connection issues for both read and write operations and adds operational complexity with replica management. Option B: Migrate the data to an Amazon DynamoDB database. - Pros: DynamoDB is a fully managed NoSQL database that scales automatically and handles high connection volumes without the traditional limitations of relational databases like MySQL. - Cons: This solution would require significant changes to the application, as DynamoDB is a NoSQL database, which differs from MySQL in its data model and querying structure. Migrating to DynamoDB involves reworking the schema and queries, which may require substantial effort and disrupt the current application. Reason for rejection: While DynamoDB scales automatically, migrating to a completely different database type would require significant rework of the application and introduce unnecessary complexity for this scenario. Option C: Configure the Amazon Aurora MySQL DB instance for Multi-AZ deployme...

Author: Mia · Last updated Jul 14, 2026

A developer is creating a new REST API by using Amazon API Gateway and AWS Lambda. The development team tests the API and validates responses for the known use cases before deploying the API to the production environment. The developer wants to make the REST API available for testing by using API Gate...

To meet the developer’s requirement of testing the REST API locally with Amazon API Gateway and AWS Lambda using the AWS SAM CLI, let's evaluate the subcommands: Option A: `sam local invoke` - Pros: This command is used to invoke a Lambda function locally by passing an event (e.g., JSON payload) as input. It simulates the execution of a Lambda function in the local environment. - Cons: While this is useful for testing Lambda functions, it does not simulate the API Gateway. It only runs the Lambda function locally and doesn't expose an API endpoint for testing. This is not ideal for testing a REST API that is being exposed via API Gateway. Reason for rejection: This command is focused on directly invoking the Lambda function, not simulating the entire REST API with API Gateway. Option B: `sam local generate-event` - Pros: This command generates sample events for different AWS services (such as Lambda, S3, etc.) that can be used to invoke the Lambda functions. - Cons: This command does not launch a local API Gateway. It is useful for generating event payloads but doesn't create a local REST API for testing. Reason for rejection: While useful for generating events to test the Lambda function, it does not provide the necessary functionality for testing the API Gateway locally. Option C: `sam local start-lambda` - Pros: This command starts a local Lambda runtime and listens for invocations from other tools (such as API Gateway) locally. It s...

Author: Victoria · Last updated Jul 14, 2026

A company has a serverless application on AWS that uses a fleet of AWS Lambda functions that have aliases. The company regularly publishes new Lambda function by using an in-house deployment solution. The company wants to improve the release process and to use traffic shifting. A newly published function ve...

To meet the requirement of gradually shifting traffic to a newly published Lambda function version, let's analyze each option and see which one best fits the scenario. Option A: Configure routing on the alias of the new function by using a weighted alias. - Pros: Weighted aliases in AWS Lambda allow you to control the distribution of traffic between different versions of a Lambda function. This means you can initially route only a fixed percentage of the traffic to the new version, which aligns with the company's need to gradually expose the new version to production users. - Cons: The main downside is the potential for manual management of traffic weights, especially as new versions are deployed. However, this can be managed effectively by automation as part of the deployment pipeline. Reason for selection: This solution allows for precise control over the percentage of traffic directed to the new Lambda function version. It supports gradual rollout and traffic shifting, which meets the company's requirement of releasing the new version to a small percentage of users initially. Option B: Configure a canary deployment type for Lambda. - Pros: Canary deployments are designed for gradually rolling out a new version of a Lambda function, starting with a small percentage of traffic. The canary deployment automatically shifts traffic from the old version to the new one over time. - Cons: Canary deployments are typically managed through AWS Lambda's deployment settings (not through aliases), and it is part of AWS deployment strategies. However, this option specifically describes how AWS Lambda can manage traffic shifting automatically, which simplifies the process significantly. It automates the rollout over a defined interval, making it a robust solution for gradual releases. Reason for selection: This is an excellent solution because it allows for automated traffic shifting, which meets the requirement for controlling the release of new versions. It reduces the need for manual configuration and is built into the Lambda deployment mo...

Author: James · Last updated Jul 14, 2026

A company has an application that stores data in Amazon RDS instances. The application periodically experiences surges of high traffic that cause performance problems. During periods of peak traffic, a developer notices a reduction in query speed in all database queries. The team=E2=80=99s technical lead determines that a multi-threaded and scalable caching solution shou...

Let's break down each option to determine the best fit for the requirements: A) Use Amazon ElastiCache for Memcached to offload read requests from the main database. - Why it's a good option: Memcached is a high-performance, in-memory key-value store designed for caching data. It is scalable and can handle a large number of read requests with low latency. It's particularly useful for offloading read-heavy traffic from databases. - Why it's rejected: Memcached is less feature-rich compared to Redis, as it doesn't support data persistence, advanced data structures, or complex cache invalidation strategies. However, if you need a simpler solution for basic caching, Memcached could work, but it may lack some advanced features that Redis provides. B) Replicate the data to Amazon DynamoDB and set up a DynamoDB Accelerator (DAX) cluster. - Why it's a good option: DynamoDB is a fully managed NoSQL database with high scalability, and DAX is a managed in-memory caching service for DynamoDB, offering microsecond read latency. This solution would offload traffic to DynamoDB, and DAX would help speed up reads. - Why it's rejected: While DynamoDB with DAX is excellent for specific use cases where data fits well in a NoSQL structure, it would require significant changes to the application's data model and architecture, particularly if the app is built on relational databases like RDS. This makes it a complex solution for this situation. C) Configure the Amazon RDS instances to use Multi-AZ deployment with one standby instance. Offload read requests from the main database to the standby instance. - Why it's a good option: Multi-AZ deployments provide high availability and failover support by having a standby instance that mirrors the primary instance. Read traffic can be offloaded to the standby instance to reduce load on the primary database. - Why it's rejected: While Multi-AZ provides read replicas for load balancing, it does not offer the same performance improvements for read-heavy applications as caching systems like Memcached or Redis. Addi...

Author: Jack · Last updated Jul 14, 2026

A developer must provide an API key to an AWS Lambda function to authenticate with a third-party system. The Lambda function will run on a schedule. The developer needs to ensure that the A...

Let’s evaluate each option and determine the most appropriate solution for securely storing the API key in AWS Lambda: A) Store the API key as a Lambda environment variable by using an AWS Key Management Service (AWS KMS) customer managed key. - Why it's a good option: Environment variables are commonly used for storing configuration information in Lambda functions, and encrypting them using AWS KMS ensures that the API key remains encrypted at rest. AWS KMS allows for the creation of a customer-managed key, which ensures that only authorized users and services can access or decrypt the environment variables. - Why it's selected: This option meets the requirement of encrypting the API key at rest, provides the ability to securely manage encryption keys, and does not expose the key in plaintext. The API key remains securely stored, and only the Lambda function can access it when it runs, providing a secure solution for authentication with the third-party system. B) Configure the application to prompt the user to provide the password to the Lambda function on the first run. - Why it's rejected: This approach introduces unnecessary complexity and potential security issues. Asking for the password during the first run would be cumbersome for automated processes, such as scheduled Lambda invocations. Additionally, it does not address how to securely store the API key for subsequent Lambda invocations or ensure that the API key remains encrypted at rest. C) Store the API key as a value in the application code. - Why it's rejected: Storing the API key directly in the application code is highly insecure. The key would be visible in the source code, which could be exposed to u...

Author: Nathan · Last updated Jul 14, 2026

An IT department uses Amazon S3 to store sensitive images. After more than 1 year, the company moves the images into archival storage. The company rarely accesses the images, but the company wants a storage solution that maximizes resiliency. The IT department needs access to the images th...

Let's analyze each option to determine the most cost-effective solution based on the given requirements: archival storage, rare access, resiliency, and retrieval time within 24 hours. A) Use S3 Standard-Infrequent Access (S3 Standard-IA) to store the images. Use S3 Glacier Deep Archive with standard retrieval to store and retrieve archived images. - Why it's a good option: - S3 Standard-IA is designed for infrequent access with lower storage costs compared to S3 Standard, making it suitable for storing images that are accessed rarely. - S3 Glacier Deep Archive is the lowest-cost storage class for long-term archival, designed for data that is accessed very infrequently. It offers standard retrieval in about 12 hours, which fits the requirement of having access within 24 hours. - Combining S3 Standard-IA and Glacier Deep Archive strikes a balance between cost and retrieval time, providing both cost-effectiveness and reasonable access times. - Why it's selected: This solution maximizes resiliency (S3 Standard-IA and Glacier Deep Archive are both highly durable and reliable) while keeping costs low and ensuring access to the archived images within the required time frame. B) Use S3 Standard-Infrequent Access (S3 Standard-IA) to store the images. Use S3 Glacier Deep Archive with bulk retrieval to store and retrieve archived images. - Why it's rejected: - Bulk retrieval from S3 Glacier Deep Archive takes 12+ hours, and is designed for larger retrievals where speed is less important. This would exceed the 24-hour retrieval requirement for urgent access to archived images, making this solution unsuitable. - Bulk retrieval is also cheaper than standard retrieval but isn't ideal for the given access timeline. C) Use S3 Intelligent-Tiering to store the images. Use S3 Glacier Deep Archive with standard retrieval to store and retrieve archived images. - Why it's rejected: - S3 Intelligent-Tiering automatically moves objects between two access tiers (frequent and infrequent) based on access patterns. While it can be useful for data with unpredictable access, it is more expensive than S3 Standard-IA. - Since the images are rarely accessed, Intelligen...

Author: FrostFalcon88 · Last updated Jul 14, 2026

A developer is building a serverless application by using the AWS Serverless Application Model (AWS SAM). The developer is currently testing the application in a development environment. When the application is nearly finished, the developer will need to set up additional testing and staging environments for a quality assurance team. The developer wants to us...

Let's evaluate each option based on the developer's need to deploy to multiple environments with minimal development effort using AWS SAM. A) Add a configuration file in TOML format to group configuration entries to every environment. Add a table for each testing and staging environment. Deploy updates to the environments by using the `sam deploy` command and the `--config-env` flag that corresponds to each environment. - Why it's rejected: AWS SAM does not natively support TOML configuration files. While it's possible to create a custom solution using TOML or another configuration file format, this approach adds unnecessary complexity and would require additional development effort to handle the environment-specific configuration manually. This option is not as straightforward as the others, and there is no built-in support in AWS SAM for TOML files. B) Create additional AWS SAM templates for each testing and staging environment. Write a custom shell script that uses the `sam deploy` command and the `--template-file` flag to deploy updates to the environments. - Why it's rejected: While this solution could work, it introduces significant complexity by requiring multiple AWS SAM templates for each environment and the need for custom scripting. Maintaining multiple templates can quickly become cumbersome as the application grows and requires additional resources to ensure updates are applied to each environment properly. The additional overhead of managing separate templates and scripts makes this option more labor-intensive than necessary. C) Create one AWS SAM configuration file that has default parameters. Perform updates to the testing and staging environments by using the `--parameter-overrides` flag in the AWS SAM CLI and the parameters that the updates will override. - Why it's a good option: - AWS SAM allows for the use of parameter overrides to customize resource configurations for different environments without needing to modify the SAM template itself. By defining default parameters in the configuration file and overriding them when deploying to specific environments, the developer can deploy to multiple environments with minimal changes. - This option is effective because it keeps the same template while allowing the customization of parameters, making it simpler to manage different environments with fewer files and minimal development effort. - Why it's selected: This solution lev...

Author: Zara1234 · Last updated Jul 14, 2026

A developer is working on an application that processes operating data from IoT devices. Each IoT device uploads a data file once every hour to an Amazon S3 bucket. The developer wants to immediately process each data file when the data file is uploaded to Amazon S3. The developer will use an AWS Lambda function to process the data files from Amazon S3. The Lambda function is configured with the S3 bucket information whe...

Let's break down each option to identify which one would best meet the developer's requirements for processing files uploaded to Amazon S3 using AWS Lambda: A) Add an asynchronous invocation to the Lambda function. Select the S3 bucket as the source. - Why it's rejected: While asynchronous invocations are a valid feature in AWS Lambda, they are typically used for functions that do not require immediate processing and can tolerate a delay in execution. Asynchronous invocation means that the Lambda function would be queued and processed after the event triggers, with some delay. This would not ensure that the Lambda function processes the file immediately when it's uploaded to S3, which contradicts the developer's requirement for immediate processing. B) Add an Amazon EventBridge event to the Lambda function. Select the S3 bucket as the source. - Why it's rejected: While EventBridge can be used to capture S3 events (like object creation), it is more complex than necessary for this specific use case. EventBridge requires additional configuration and is typically used for more advanced event-driven architectures where multiple services might need to respond to an event. While this could work, it adds unnecessary complexity compared to a direct integration between S3 and Lambda. C) Add a trigger to the Lambda function. Select the S3 bucket as the source. - Why it's selected: - Lambda triggers from S3 are the most straightforward and efficient way to automatically invoke a Lambda function when a file is uploaded to an S3 bucket. - By setting S3 as the event source, you can configure the Lambda function to be triggered immediately after an object is created in the S3 bucket (e.g....

Author: Noah · Last updated Jul 14, 2026

A developer is setting up infrastructure by using AWS CloudFormation. If an error occurs when the resources described in the Cloud Formation template are provisioned, successfully provisioned resources must be preserved. The developer must provisio...

To meet the requirement of preserving successfully provisioned resources even if an error occurs during the stack creation or update process in AWS CloudFormation, the key is to prevent the stack from rolling back. Let's review each option: A) Add an --enable-termination-protection command line option to the create-stack command and the update-stack command. - Explanation: This option enables termination protection for a stack, which prevents the stack from being deleted through the AWS Management Console, AWS CLI, or API. However, this does not prevent rollback during stack creation or update. Termination protection only ensures that the stack cannot be deleted after it has been created; it does not help with preserving resources during a failure or rollback. - Rejection Reason: This option is not suitable for preventing rollback in case of errors during resource provisioning. B) Add a --disable-rollback command line option to the create-stack command and the update-stack command. - Explanation: This option is used to prevent AWS CloudFormation from rolling back the stack if an error occurs during stack creation or update. By using `--disable-rollback`, if any resource creation fails, CloudFormation will stop executing further changes but will retain the successfully provisioned resources. This is the desired behavior because it ensures that resources that wer...

Author: Emily · Last updated Jul 14, 2026

A developer is building a serverless application that connects to an Amazon Aurora PostgreSQL database. The serverless application consists of hundreds of AWS Lambda functions. During every Lambda function scale out, a new database connection is made that increases database resource consumption. The developer needs to decrease the number of c...

To address the problem of excessive database connections during Lambda function scaling, let's evaluate each option carefully. A) Configure provisioned concurrency for each Lambda function by setting the ProvisionedConcurrentExecutions parameter to 10. - Explanation: Provisioned concurrency pre-warms a set number of Lambda instances to ensure they are ready to handle requests immediately. While this reduces cold start latency, it does not directly manage the number of database connections. Each Lambda instance still opens a new database connection, which does not solve the problem of excessive database connections. - Rejection Reason: This option does not reduce the number of database connections made by scaling Lambda functions, which is the core issue. B) Enable cluster cache management for Aurora PostgreSQL. Change the connection string of each Lambda function to point to cluster cache management. - Explanation: Cluster cache management for Aurora PostgreSQL is a feature designed to reduce the load on the primary database by caching query results. However, this is mainly designed to optimize query performance and reduce database load, but it does not address the issue of managing database connections. It doesn’t pool or reduce the number of connections established by Lambda functions. - Rejection Reason: This option does not specifically manage the connection count or pooling for Lambda functions, so it does not meet the requirements. C) Use Amazon RDS Proxy to create a connection pool to manage the database connections. Change the connec...

Author: ShadowWolf101 · Last updated Jul 14, 2026

A developer is preparing to begin development of a new version of an application. The previous version of the application is deployed in a production environment. The developer needs to deploy fixes and updates to the current version during the development of the new version of the application...

Let's evaluate each option based on the requirements: the developer needs to deploy fixes and updates to the current version of the application while also developing a new version. The code for the new version is stored in AWS CodeCommit. A) From the main branch, create a feature branch for production bug fixes. Create a second feature branch from the main branch for development of the new version. - Explanation: This option is a standard Git workflow where the main branch holds the production-ready code, and separate feature branches are created for bug fixes and new development. This ensures that the current production version can receive updates and fixes while the new version is being developed in parallel. Both feature branches can be merged back into the main branch after development and testing. - Reason for Selection: This is the most appropriate solution because it allows parallel development of the current version and the new version without affecting each other. It also ensures that bug fixes can be deployed without interfering with the ongoing development of the new version. B) Create a Git tag of the code that is currently deployed in production. Create a Git tag for the development of the new version. Push the two tags to the CodeCommit repository. - Explanation: Git tags are useful for marking specific points in history (like releases). However, using tags alone does not facilitate ongoing development or updates to the production code. Tags don't allow for active development or fixes, and they don’t provide a mechanism for applying bug fixes during the development of the new version. - Rejection Reason: While tags are useful for marking the current state of th...

Author: MoonlitPantherX · Last updated Jul 14, 2026

A developer is creating an AWS CloudFormation stack. The stack contains IAM resources with custom names. When the developer tries to deploy the stack, they receive an Insufficie...

The issue the developer is facing arises from an InsufficientCapabilities error when deploying IAM resources with custom names in AWS CloudFormation. Let's evaluate each option to identify how to resolve this issue: A) Specify the CAPABILITY_AUTO_EXPAND capability in the CloudFormation stack. - Explanation: The `CAPABILITY_AUTO_EXPAND` capability is used for expanding macros in AWS CloudFormation, such as AWS CloudFormation macros or custom resources. This capability is unrelated to IAM resources, custom names, or permissions required for IAM resource management. - Rejection Reason: This option is irrelevant because `CAPABILITY_AUTO_EXPAND` does not resolve issues with IAM permissions or custom IAM resource names. B) Use an administrator's role to deploy IAM resources with CloudFormation. - Explanation: While using an administrator's role may grant the necessary permissions to deploy IAM resources, it does not address the underlying issue of the error, which specifically relates to the need for a specific capability to allow the creation of IAM resources with custom names in CloudFormation. Using an administrator’s role alone may not resolve the InsufficientCapabilities error, as CloudFormation still needs to be explicitly told that it is allowed to create certain IAM resources. - Rejection Reason: This option...

Author: Sophia Clark · Last updated Jul 14, 2026

A company uses Amazon API Gateway to expose a set of APIs to customers. The APIs have caching enabled in API Gateway. Customers need a way to invalidate the cache for each API when they test the API. ...

To allow customers to invalidate the cache for the API exposed by Amazon API Gateway, the solution needs to focus on providing customers a way to trigger cache invalidation. Let's evaluate the provided options: A) Ask the customers to use AWS credentials to call the InvalidateCache API operation. - Explanation: This option suggests that customers can use AWS credentials to directly invoke the `InvalidateCache` API operation. While this is technically feasible (the `InvalidateCache` operation is part of the API Gateway management APIs), it is not an efficient or practical approach for API consumers. This would require customers to have AWS credentials and permissions to invoke AWS API Gateway administrative operations, which is generally not recommended for production environments. - Rejection Reason: Requiring customers to directly use AWS credentials to invalidate the cache is not ideal because it involves giving customers access to backend management operations, which introduces security and permission complexity. B) Attach an InvalidateCache policy to the IAM execution role that the customers use to invoke the API. Ask the customers to send a request that contains the Cache-Control:max-age=3D0 HTTP header when they make an API call. - Explanation: The `Cache-Control:max-age=0` header can be used to prevent caching for a particular request, but it doesn’t invalidate the cache for all customers or allow for a global invalidation. This approach will only affect cache behavior for individual API requests but does not provide a method to clear or invalidate the cache for all users. - Rejection Reason: This is not an effective method to invalidate the cache as it doesn't allow for a global or API-wide cache invalida...

Author: Stella · Last updated Jul 14, 2026

A developer is creating an AWS Lambda function that will generate and export a file. The function requires 100 MB of temporary storage for temporary files while running. These files will not be needed after the ...

Option A: Store the files in Amazon Elastic Block Store (Amazon EBS) and delete the files at the end of the Lambda function. - Reason for rejection: Amazon EBS is primarily used for persistent storage attached to EC2 instances. AWS Lambda doesn't have direct access to EBS volumes by default. It also adds complexity, as EBS requires provisioning and management, such as attaching it to an EC2 instance. Lambda functions don't inherently support EBS, which would involve additional configuration. This makes it less efficient than other options. - Best scenario: Would be useful for EC2 instances requiring persistent storage, but not for Lambda functions. Option B: Copy the files to Amazon Elastic File System (Amazon EFS) and delete the files at the end of the Lambda function. - Reason for rejection: Amazon EFS is a scalable file storage system suitable for persistent storage across multiple instances, but it is generally overkill for temporary storage in Lambda functions. Using EFS introduces additional costs, configuration complexity, and may increase latency due to network access. Lambda functions can use EFS, but it's unnecessary unless the function requires persistent, shared file systems. - Best scenario: Suitable for multi-instance applications requiring shared file storage, not ideal for Lambda's temporary file needs. Option C: Store the files in the /tmp directory and delete the files at the end of the Lambda function. - Reason for selection: AWS Lambda provides a `/tmp` directory for tempor...

Author: Henry · Last updated Jul 14, 2026

A company uses Amazon DynamoDB as a data store for its order management system. The company frontend application stores orders in a DynamoDB table. The DynamoDB table is configured to send change events to a DynamoDB stream. The company uses an AWS Lambda function to log and process the incoming orders based on data from the DynamoDB stream. An operational review reveals that the order quantity of incoming orders is someti...

To select the most appropriate option, let's analyze each solution in the context of the developer's requirement to create a dashboard that shows how many unique customers are affected by orders with quantity equal to 0. Option A: - Grant Lambda’s execution role permissions to upload logs to CloudWatch Logs. This suggests using CloudWatch Logs Insights to query logs, focusing on orders with a quantity of 0. The results would then be visualized on a CloudWatch dashboard. - Advantages: - CloudWatch Logs Insights allows querying logs for specific patterns, including order quantities. - A CloudWatch dashboard can display the query results. - Disadvantages: - Lambda logs could become large and complex, especially if the function processes numerous orders. This might make it harder to query and maintain, especially if the number of logs grows significantly. Option B: - Use Amazon Athena to query CloudTrail logs. Athena is often used to query logs stored in Amazon S3, specifically CloudTrail logs in this case, which track API calls. - Advantages: - Athena is useful for querying large volumes of log data efficiently. - Disadvantages: - CloudTrail logs are primarily for auditing AWS API calls and might not be structured for the specific use case of tracking orders with quantity equal to 0. Therefore, relying on CloudTrail logs would likely not give you the required level of detail about DynamoDB table changes (like order quantity) that are happening in the Lambda function. Option C: - Configure the Lambda function to send events to EventBridge. EventBridge would trigger based on the quantity of orders, and CloudWatch would be used as a target for visualization. - ...

Author: CrimsonViperX · Last updated Jul 14, 2026

A developer needs to troubleshoot an AWS Lambda function in a development environment. The Lambda function is configured in VPC mode and needs to connect to an existing Amazon RDS for SQL Server DB instance. The DB instance is deployed in a private subnet and accepts connections by using port 1433. When the developer tests the function, the function...

Option A: Check that the function's security group has outbound access on port 1433 to the DB instance's security group. Check that the DB instance's security group has inbound access on port 1433 from the function's security group. - Reason for selection: In a VPC setup, both the Lambda function and the RDS instance are controlled by security groups. For the Lambda function to access the RDS instance, the function's security group must have the proper outbound rules to allow traffic to the DB instance on port 1433. Similarly, the RDS instance's security group needs to allow inbound traffic from the Lambda function on port 1433. This is a crucial configuration because if the security groups are not set up to allow the appropriate traffic, the Lambda function will be unable to connect to the DB. - Best scenario: Always necessary when dealing with VPCs, security groups, and instances that need to communicate over specific ports (like SQL Server). Option B: Check that the function's security group has inbound access on port 1433 from the DB instance's security group. Check that the DB instance's security group has outbound access on port 1433 to the function's security group. - Reason for rejection: The inbound access for the Lambda function is not the issue; the function requires outbound access to connect to the database. The function's security group must allow outbound traffic to the DB instance's security group, not the other way around. Similarly, RDS instances do not initiate outbound connections to Lambda functions. Therefore, this option would not address the problem. - Best scenario: Incorrect for troubleshooting connection issues where Lambda is trying to access an RDS instance. Option C: Check that the VPC is set up for a NAT gateway. Check that the DB instance has the public access option turned on. - Reason for rejection: The NAT gateway is typically used when instances in a private subnet need to access the internet. In this case, the Lambda function is already within the VPC, and the RDS instance doesn't need to be publicly accessible to allow Lambda to connect to it. This option...

Author: Ryan · Last updated Jul 14, 2026

A developer needs to launch a new Amazon EC2 instance by using the AWS CLI. Which AWS CLI command shou...

Option A: aws ec2 bundle-instance - Reason for rejection: The `aws ec2 bundle-instance` command was used in earlier versions of EC2 to bundle an instance for AMI creation or migration to S3. However, it is no longer used in the latest AWS EC2 management processes. This command does not launch a new EC2 instance, so it’s irrelevant for this scenario. - Best scenario: Used to bundle EC2 instances for migration or backup in older workflows, but not applicable now for launching new instances. Option B: aws ec2 start-instances - Reason for rejection: The `aws ec2 start-instances` command is used to start an existing, stopped EC2 instance, not to launch a new one. To launch a new instance, the developer would need a different command. - Best scenario: Used when restarting a previously stopped instance, not for launching new EC2 instances. Option C: aws ec2 confirm-product-instance - Reason for rejection: The `aw...

Author: Leah Davis · Last updated Jul 14, 2026

A developer needs to manage AWS infrastructure as code and must be able to deploy multiple identical copies of the infrastructure, stage changes, and revert t...

Option A: Use cost allocation reports and AWS OpsWorks to deploy and manage the infrastructure. - Reason for rejection: AWS OpsWorks is a configuration management service that helps manage infrastructure but is not focused on infrastructure as code (IaC) or version-controlled deployments. Cost allocation reports are useful for tracking costs but do not help in the actual management or deployment of infrastructure. This option does not provide the flexibility or version control needed to manage infrastructure as code, stage changes, and revert to previous versions. - Best scenario: OpsWorks is suitable for application lifecycle management but not the best fit for infrastructure as code. Option B: Use Amazon CloudWatch metrics and alerts along with resource tagging to deploy and manage the infrastructure. - Reason for rejection: CloudWatch metrics and alerts are used to monitor AWS resources, and resource tagging helps organize resources for management. However, these are not used to manage infrastructure as code. There is no direct way to define infrastructure as code, deploy multiple copies, or revert to previous versions using just CloudWatch and tagging. This approach is primarily focused on monitoring and not on provisioning or version control. - Best scenario: Useful for monitoring and alerting, but not for managing infrastructure deployment or versioning. Option C: Use AWS Elastic Beanstalk and AWS CodeCommit to deploy and manage the infrastructure. - Reason for rejection: Elastic Beanstalk is an application deployment service, primarily for deploying appli...

Author: Maya · Last updated Jul 14, 2026

A developer is working on an AWS Lambda function that accesses Amazon DynamoDB. The Lambda function must retrieve an item and update some of its attributes, or create the item if it does not exist. The Lambda function has access to the primary key. ...

Let's analyze the IAM permissions that the developer would need to enable the Lambda function to retrieve an item, update its attributes, or create it if it doesn't exist. Breakdown of the operations: 1. Retrieve an item: The Lambda function will need permissions to retrieve an item from DynamoDB. This requires the `dynamodb:GetItem` permission. 2. Update some attributes: If the item exists, the Lambda function will need to modify it. The correct operation for this in DynamoDB is `dynamodb:UpdateItem`, which updates specific attributes of an existing item. 3. Create an item if it doesn't exist: If the item doesn't exist, the function will need to create it, which requires the `dynamodb:PutItem` permission. Now let's evaluate each option: - A) `dynamodb:DeleteItem`, `dynamodb:GetItem`, `dynamodb:PutItem`: - `dynamodb:DeleteItem` is unnecessary because the task does not involve deleting an item. - `dynamodb:GetItem` is required to retrieve an item, so it's valid. - `dynamodb:PutItem` is needed to create an item if it doesn't exist, so it's valid. - However, `DeleteItem` is an extraneous permission here. - B) `dynamodb:UpdateItem`, `dynamodb:GetItem`, `dynamodb:DescribeTable`: - `dynamodb:UpdateItem` is valid to update item attributes. - `dynamodb:GetItem` is valid...

Author: Benjamin · Last updated Jul 14, 2026

A developer has built a market application that stores pricing data in Amazon DynamoDB with Amazon ElastiCache in front. The prices of items in the market change frequently. Sellers have begun complaining that, after they update the price of ...

Let's break down each option and reason through the issue: Issue at Hand: The application stores pricing data in Amazon DynamoDB and uses Amazon ElastiCache in front of it to cache the data. Sellers are reporting that after they update the price of an item, the new price doesn't reflect on the product listing. This suggests that the application is likely fetching the cached data instead of the updated price from DynamoDB. Option Analysis: - A) The cache is not being invalidated when the price of the item is changed: - Explanation: ElastiCache is used to cache frequently accessed data, but if the cache is not invalidated or updated when the price of an item is changed in DynamoDB, users may continue to see the old price from the cache. - Why it's valid: If the cache isn't invalidated or updated properly after a price change, the application will continue serving stale data from the cache. This is a common caching problem. - Conclusion: This is a strong candidate for the issue because the complaint is that the price isn't changing on the product listing, implying the application is retrieving stale data from the cache. - B) The price of the item is being retrieved using a write-through ElastiCache cluster: - Explanation: With a write-through cache strategy, whenever data is written to the underlying database (DynamoDB), it should also be written to the cache simultaneously. This ensures that the cache reflects the same data as the database. - Why it's not likely: If the cache is properly set up as write-through, the price would be updated in both DynamoDB and ElastiCache simultaneously, so this wouldn't explain the issue of stale data in the prod...

Author: Zara1234 · Last updated Jul 14, 2026

A company requires that all applications running on Amazon EC2 use IAM roles to gain access to AWS services. A developer is modifying an application that currently relies on IAM user access keys stored in environment variables to access Amazon DynamoDB tables using boto, the AWS SDK for Python. The developer associated a role with the same permissions as the IAM user to the EC2 instance, then deleted the IAM user. When the application was restarted, the AWS AccessDeniedException messa...

Let's evaluate each option to identify the most likely cause of the AccessDeniedException messages after the application was restarted: A) IAM policies might take a few minutes to propagate to resources. - Explanation: IAM policies generally propagate quickly, but in some cases, there could be a brief delay in the application of new policies or role assignments. - Reasoning: The application was restarted after the IAM user was deleted and the role was assigned to the EC2 instance. However, it’s unlikely that IAM policy propagation would take long enough to cause persistent access issues. If the role was correctly associated with the EC2 instance, the access should be granted almost immediately. - Conclusion: While this could be a factor, it's unlikely to be the primary cause in this case, especially since the AWS CLI worked fine on the server. B) Disabled environment variable credentials are still being used by the application. - Explanation: The application was originally using IAM user access keys stored in environment variables. After the IAM user was deleted and replaced by an EC2 instance role, it's possible that the environment variables (which store the old IAM user credentials) are still in use by the application. - Reasoning: When the application restarts, if the environment variables containing the old IAM user credentials are still set, they would take precedence over the instance role credentials. This would cause the application to try to authenticate using invalid IAM user credentials, leading to AccessDeniedException messages. - Conclusion: This is the most likely cause because environment variables containing IAM user credentials would still be in place and would override the instance role permissions. C) The AWS SDK doe...

Author: ThunderBear · Last updated Jul 14, 2026

A company has an existing application that has hardcoded database credentials. A developer needs to modify the existing application. The application is deployed in two AWS Regions with an active-passive failover configuration to meet company=E2=80=99s disaster recovery strategy. The developer needs a solution to store the credentials outside the cod...

Let's evaluate each option based on the requirements of storing the credentials securely, complying with the disaster recovery strategy, and being as secure as possible. A) Store the credentials in AWS Secrets Manager in the primary Region. Enable secret replication to the secondary Region. Update the application to use the Amazon Resource Name (ARN) based on the Region. - Pros: - AWS Secrets Manager is designed for securely storing sensitive information such as credentials, and it automatically integrates with AWS services to fetch secrets in a secure manner. - Cross-region replication is available in Secrets Manager, which ensures the credentials are available in both the primary and secondary regions, which aligns with the disaster recovery strategy. - Secrets Manager supports fine-grained access control and automatic rotation of secrets, improving security and reducing the risk of exposed credentials. - The ARN-based access to the secret ensures that the application can access the credentials based on the region dynamically. - Cons: - Slightly more expensive than other solutions like Systems Manager Parameter Store, but the added security features (automatic rotation, fine-grained access control) make it a highly secure option. - Conclusion: This is the most secure and disaster recovery-compliant solution because Secrets Manager was designed for storing sensitive credentials, and cross-region replication ensures the credentials are accessible in both regions. B) Store credentials in AWS Systems Manager Parameter Store in the primary Region. Enable parameter replication to the secondary Region. Update the application to use the Amazon Resource Name (ARN) based on the Region. - Pros: - Systems Manager Parameter Store is also a secure option for storing credentials and supports parameter replication across regions. - It integrates with AWS Identity and Access Management (IAM) for access control, and you can configure access policies for better security. - This solution could be less expensive compared to Secrets Manager. - Cons: - Unlike Secrets Manager, Parameter Store does not support automatic secret rotation out-of-the-box. This means that while it provides basic security and cross-region replication, it lacks some advanced security features. - The application would need to manually manage secret rotation and potentially update the credentials in Parameter Store manually. - Conclusion: While this is a secure solution, it is slightly less feature-rich and less secure than Secrets Manager, particularly when it comes to automatic secret rotation and management. C) Store credentials in a config file. Upload the config f...

Author: SilverBear · Last updated Jul 14, 2026

A developer is receiving HTTP 400: ThrottlingException errors intermittently when calling the Amazon CloudWatch API. When a call fails, no data is retrieved. ...

Issue: The developer is receiving HTTP 400: ThrottlingException errors when calling the Amazon CloudWatch API, which means the application is exceeding the allowed request rate for CloudWatch API calls. When this error occurs, no data is retrieved, indicating that the request was rejected due to throttling. Key Considerations: 1. ThrottlingException errors are typically caused when an application exceeds the rate limit of API calls. Amazon CloudWatch has specific rate limits for API requests, and exceeding these limits results in throttling. 2. To resolve this issue, the best approach is to minimize the impact of throttling by handling retries properly, rather than just requesting a higher limit or changing the approach drastically. Option Breakdown: - A) Contact AWS Support for a limit increase: - Explanation: While a limit increase can help resolve issues if the application consistently exceeds the rate limits, requesting a limit increase should not be the first step. It’s better to address the throttling issue programmatically by retrying the request using best practices. - Why it's not ideal initially: Exceeding the limit could be a result of improper handling of API calls, and contacting AWS support may not be necessary if the issue can be solved with proper retry logic. - Conclusion: This option is not the best starting point. It's a more drastic approach, and retrying with exponential backoff is a preferred practice. - B) Use the AWS CLI to get the metrics: - Explanation: Using the AWS CLI to retrieve metrics can help troubleshoot the issue, but it does not solve the problem of throttling within the application. The application will still face throttling unless it implements proper handling for the CloudWatch API limits. - Why it's not ideal: This is more of a troubleshooting step rather than a solution to address the actual throttling issue. It doesn't prevent the intermittent ThrottlingException errors from occurring in the application. - Conclusion...

Author: Emma · Last updated Jul 14, 2026

An application needs to use the IP address of the client in its processing. The application has been moved into AWS and has been placed behind an Application Load Balancer (ALB). However, all the client IP addresses now appear to be the same. The application must maintain t...

In this scenario, the application has been moved behind an Application Load Balancer (ALB), and all client IP addresses appear the same, likely due to the ALB being used as a proxy. The goal is to maintain horizontal scalability while correctly handling the original client IP address. Analysis of Options: - A) Remove the application from the ALB. Delete the ALB and change Amazon Route 53 to direct traffic to the instance running the application. - Rejected: Removing the ALB would eliminate its ability to distribute traffic across multiple instances, which directly contradicts the requirement for horizontal scalability. Additionally, managing the traffic directly to instances can lead to scalability, security, and maintenance challenges. The load balancing aspect would be lost, which is not cost-effective as it could require manual traffic distribution. - B) Remove the application from the ALB. Create a Classic Load Balancer in its place. Direct traffic to the application using the HTTP protocol. - Rejected: While this option would still provide load balancing, it introduces the use of a Classic Load Balancer (CLB), which lacks some of the more advanced features of the ALB (such as support for HTTP/2, WebSockets, or containerized workloads). Moreover, CLBs are typically considered less flexible and cost-effective than ALBs for applications that need to scale horizontally. This option doesn't provide a direct solution to maintaining the original client IP address without further changes. - C) Alter the application code to inspect the X-Forwarded-For header. Ensure that the code can work properly if a list of IP addresses is passed in the header. - Selected: This ...

Author: NightmareDragon2025 · Last updated Jul 14, 2026

A developer is designing a serverless application that customers use to select seats for a concert venue. Customers send the ticket requests to an Amazon API Gateway API with an AWS Lambda function that acknowledges the order and generates an order ID. The application includes two additional Lambda functions: one for inventory management and one for payment processing. These two Lambda functions run in parallel and write the order to an Amazon Dynamo DB table. The application must provide seats to customers according to the following requirements. If a seat is accidently sold more than once, the first order that the application received must get the seat. In these cases, th...

In this scenario, the application must ensure that seats are sold in a manner where the first order is given priority for payment processing, and if the first order is rejected, the second order can still receive the seat. Additionally, the solution must ensure that inventory management and payment processing occur in parallel but with the correct sequence of operations based on the order of receipt. Analysis of Options: - A) Send the order ID to an Amazon Simple Notification Service (Amazon SNS) FIFO topic that fans out to one Amazon Simple Queue Service (Amazon SQS) FIFO queue for inventory management and another SQS FIFO queue for payment processing. - Selected: This option is ideal for meeting the requirements because: - SNS FIFO Topic ensures that messages (order IDs) are processed in the exact order they are received. - The use of SQS FIFO queues for both inventory management and payment processing ensures that each function processes messages in a strict order. - FIFO guarantees the first order gets priority for processing the seat, and if payment for the first order fails, the second order gets the seat and proceeds with payment processing. - This ensures that both processes are parallel, but the seat is not double-booked, and the correct order is processed for payment. The FIFO behavior is crucial in this use case, and SNS and SQS FIFO topics/queues provide the needed message sequencing. - It is highly scalable and manages concurrency while maintaining order. - B) Change the Lambda function that generates the order ID to initiate the Lambda function for inventory management. Then initiate the Lambda function for payment processing. - Rejected: This approach results in a sequential and synchronous process, meaning the second Lambda function (payment processing) would only start after the first one (inventory management) completes. This would introduce unnecessary delays and would not allow parallel processing. Moreover, it doesn’t provide any guarantees on th...

Author: Abigail · Last updated Jul 14, 2026

An application uses AWS X-Ray to generate a large amount of trace data on an hourly basis. A developer wants to use filter expressions to limit the returned results through user-specified custom attribu...

To filter the returned results in AWS X-Ray based on user-specified custom attributes, the developer needs to consider how AWS X-Ray stores and indexes trace data for querying. Analysis of Options: - A) Add custom attributes as annotations in the segment document. - Selected: Annotations are used to store key-value pairs in the segment document that are indexed for efficient filtering. Annotations are ideal for filtering trace results because they are indexed by X-Ray, allowing developers to query traces based on specific values in those attributes. - Why it's selected: Since the goal is to filter traces by custom attributes, annotations are specifically designed to be indexed for filtering. This ensures that custom attributes can be efficiently used in filter expressions to limit results. - When to use: This is the preferred choice when filtering traces based on key-value pairs (such as custom attributes) in AWS X-Ray. - B) Add custom attributes as metadata in the segment document. - Rejected: Metadata is used to store additional, non-indexed information in a segment document. While metadata allows storing custom data, it is not indexed by X-Ray, so it cannot be used effectively in filter expressions. - Why it's rejected: Metadata cannot be used for filtering trace results, as it isn't indexed. It's mainly for storing additional context but not for querying purposes. - C) Add custom attributes as ...

Author: Aarav · Last updated Jul 14, 2026

A web application is using Amazon Kinesis Data Streams for clickstream data that may not be consumed for up to 12 hours. How can the developer imple...

To implement encryption at rest for data within Amazon Kinesis Data Streams, we need to ensure that the data is encrypted while it is stored in the stream, not just during transmission or when being processed by consumers. Analysis of Options: - A) Enable SSL connections to Kinesis. - Rejected: Enabling SSL (Secure Sockets Layer) connections ensures that data is encrypted in transit between the producer and the Kinesis stream. However, this does not address the need for encryption at rest (when the data is stored in the stream). SSL protects the data during transmission, but it doesn’t ensure that the data is encrypted while it is stored in the stream. - Why it's rejected: This option does not meet the requirement for encryption at rest, only encryption in transit. - B) Use Amazon Kinesis Consumer Library. - Rejected: The Amazon Kinesis Consumer Library (KCL) is used to process and consume data from Kinesis streams, and it provides features like load balancing and checkpointing. However, it does not handle encryption of data at rest. KCL is focused on data consumption, not data encryption, so it is not relevant to the encryption of data while it is stored in Kinesis. - Why it's rejected: KCL does not provide encryption at rest for the data in Kinesis. - C) Encrypt the data once it is at rest with a Lambda function. - Rejected: Using a Lambda function to manually encrypt the data after it is at rest would be a complex and inefficient solution. This would require additional infrastructure and ...

Author: Lina Zhang · Last updated Jul 14, 2026

What Our Friends Say

What Our Friends Say

Amazon Practice Questions, Discussions & Exam Topics by our Authors

An application that is deployed to Amazon EC2 is using Amazon DynamoDB. The application calls the DynamoDB REST API. Periodically, the application receives a ProvisionedThroughputExceededException error when the application writes t...

When a developer tries to run an AWS CodeBuild project, it raises an error because the length of all environment variables exceeds the limit for the co...

A developer is working on a Python application that runs on Amazon EC2 instances. The developer wants to enable tracing of application requests to debug performance issues in the code. Which ...

A developer is troubleshooting an Amazon API Gateway API. Clients are receiving HTTP 400 response errors when the clients try to access an endpoint of the...

A company developed an API application on AWS by using Amazon CloudFront, Amazon API Gateway, and AWS Lambda. The API has a minimum of four requests every second. A developer notices that many API users run the same query by using the POST method. The develope...

A developer needs to deploy an application running on AWS Fargate using Amazon ECS. The application has environment variables that must be passed to a container for the application to ...

A developer is storing sensitive data generated by an application in Amazon S3. The developer wants to encrypt the data at rest. A company policy requires an audit trail of when the AWS Key Management Service (...

A company needs to distribute firmware updates to its customers around the world. Which service will allow easy and secure co...

A developer is testing an application that invokes an AWS Lambda function asynchronously. During the testing phase, the Lambda function fails to process af...

A company is migrating its PostgreSQL database into the AWS Cloud. The company wants to use a database that will secure and regularly rotate database credentials. The company wants a solution that does not...

A developer is creating a mobile application that will not require users to log in. What is the MOST efficien...

A company has developed a new serverless application using AWS Lambda functions that will be deployed using the AWS Serverless Application Model (AWS SAM) CLI. Whic...

A company built a new application in the AWS Cloud. The company automated the bootstrapping of new resources with an Auto Scaling group by using AWS CloudFormation templates. The bootstrap scripts contain sensitive data. The company needs a solution that is integrated with CloudFormation...

A company needs to set up secure database credentials for all its AWS Cloud resources. The company=E2=80=99s resources include Amazon RDS DB instances, Amazon DocumentDB clusters, and Amazon Aurora DB instances. The company=E2=80=99s security policy mandates that database credenti...

A developer has created an AWS Lambda function that makes queries to an Amazon Aurora MySQL DB instance. When the developer performs a test, the DB instance shows an error for too many connection...

A developer must provide an API key to an AWS Lambda function to authenticate with a third-party system. The Lambda function will run on a schedule. The developer needs to ensure that the A...

An IT department uses Amazon S3 to store sensitive images. After more than 1 year, the company moves the images into archival storage. The company rarely accesses the images, but the company wants a storage solution that maximizes resiliency. The IT department needs access to the images th...

A developer is setting up infrastructure by using AWS CloudFormation. If an error occurs when the resources described in the Cloud Formation template are provisioned, successfully provisioned resources must be preserved. The developer must provisio...

A developer is preparing to begin development of a new version of an application. The previous version of the application is deployed in a production environment. The developer needs to deploy fixes and updates to the current version during the development of the new version of the application...

A developer is creating an AWS CloudFormation stack. The stack contains IAM resources with custom names. When the developer tries to deploy the stack, they receive an Insufficie...

A company uses Amazon API Gateway to expose a set of APIs to customers. The APIs have caching enabled in API Gateway. Customers need a way to invalidate the cache for each API when they test the API. ...

A developer is creating an AWS Lambda function that will generate and export a file. The function requires 100 MB of temporary storage for temporary files while running. These files will not be needed after the ...

A developer needs to launch a new Amazon EC2 instance by using the AWS CLI. Which AWS CLI command shou...

A developer needs to manage AWS infrastructure as code and must be able to deploy multiple identical copies of the infrastructure, stage changes, and revert t...

A developer is working on an AWS Lambda function that accesses Amazon DynamoDB. The Lambda function must retrieve an item and update some of its attributes, or create the item if it does not exist. The Lambda function has access to the primary key. ...

A developer has built a market application that stores pricing data in Amazon DynamoDB with Amazon ElastiCache in front. The prices of items in the market change frequently. Sellers have begun complaining that, after they update the price of ...

A developer is receiving HTTP 400: ThrottlingException errors intermittently when calling the Amazon CloudWatch API. When a call fails, no data is retrieved. ...

An application needs to use the IP address of the client in its processing. The application has been moved into AWS and has been placed behind an Application Load Balancer (ALB). However, all the client IP addresses now appear to be the same. The application must maintain t...

An application uses AWS X-Ray to generate a large amount of trace data on an hourly basis. A developer wants to use filter expressions to limit the returned results through user-specified custom attribu...

A web application is using Amazon Kinesis Data Streams for clickstream data that may not be consumed for up to 12 hours. How can the developer imple...