Amazon Practice Questions, Discussions & Exam Topics by our Authors
A developer supports an application that accesses data in an Amazon DynamoDB table. One of the item attributes is expirationDate in the timestamp format. The application uses this attribute to find items, archive them, and remove them from the table based on the timestamp value.
The application will be decommissioned soon, and the developer must find another way to i...
In this scenario, the developer is looking for a solution that requires the least amount of code to implement while maintaining the ability to handle items in DynamoDB based on the `expirationDate` attribute. The goal is to automatically delete and potentially process items with minimal custom coding. Let's evaluate each option:
Option A: Enable TTL on the expirationDate attribute in the table. Create a DynamoDB stream. Create an AWS Lambda function to process the deleted items. Create a DynamoDB trigger for the Lambda function.
- Reasoning: Time to Live (TTL) in DynamoDB can automatically delete items when the expiration timestamp is reached. By enabling TTL on the `expirationDate` attribute, items will be automatically deleted without any need for custom deletion logic. Additionally, creating a DynamoDB stream and using a Lambda function to process the deleted items can help in any post-deletion tasks like archiving or logging.
- Best Use Case: This option requires the least amount of custom code because TTL takes care of the deletion automatically. The DynamoDB stream provides an easy mechanism to handle any actions after items are deleted, and Lambda can be used to process them efficiently.
- Explanation: TTL simplifies the deletion process by automatically removing expired items without needing manual intervention. The stream and Lambda function are simply to handle post-deletion tasks, and the setup is straightforward.
Option B: Create two AWS Lambda functions: one to delete the items and one to process the items. Create a DynamoDB stream. Use the DeleteItem API operation to delete the items based on the expirationDate attribute. Use the GetRecords API operation to get the items from the DynamoDB stream and process them.
- Reasoning: This option suggests manually deleting the items with a Lambda function using the `DeleteItem` API and then processing the deleted items via a DynamoDB stream. While this approach works, it involves more custom code than necessary. The manual deletion via `DeleteItem` introduces unnecessary complexity when TTL can handle this automatically.
- Rejection: This option requires more code and logic for manually del...
Author: Leah · Last updated Jul 14, 2026
A developer needs to implement a custom machine learning (ML) library in an application. The size of the library is 15 GB. The size of the library is increasing. The application uses AWS Lambda functions. All the Lamb...
To determine the best solution for meeting the requirements, let's analyze each option:
Option A: Save the library in Lambda layers. Attach the layers to all Lambda functions.
- Limitations: Lambda layers have a maximum size limit of 50 MB for direct uploads and 250 MB for compressed archives. Given that the library is 15 GB and growing, this option is not viable as Lambda layers cannot accommodate such large sizes.
- Use case: Lambda layers are ideal for small, reusable libraries or dependencies shared across Lambda functions, but not for large files.
Rejected because of the size limitation.
Option B: Save the library in Amazon S3. Download the library from Amazon S3 inside the Lambda function.
- Advantages: S3 is highly scalable and can accommodate large files, such as a 15 GB library. However, Lambda functions have a 15-minute execution time limit, so downloading and initializing a large library each time the function is invoked could lead to performance issues or timeouts. Additionally, the function would need to handle the download and unzipping of the library in each invocation, adding overhead.
- Use case: This option is typically used for scenarios where the library is updated frequently or the application does not have strict performance requirements regarding startup time.
Rejected due to the potential for performance degradation and timeouts for large files.
Option C: Save the library as a Lambda container image. Redeploy the ...
Author: Suresh · Last updated Jul 14, 2026
A developer is designing a serverless application for a game in which users register and log in through a web browser. The application makes requests on behalf of users to a set of AWS Lambda functions that run behind an Amazon API Gateway HTTP API.
The developer needs to implement a solution to register and log in users on the application's sign-in page...
The goal is to implement a user registration and login system for a serverless application with minimal operational overhead and ongoing management of user identities. Let’s evaluate each option to see which one best aligns with these requirements.
Option A: Create Amazon Cognito user pools for external social identity providers. Configure IAM roles for the identity pools.
- Reasoning: Amazon Cognito user pools are specifically designed for managing user registration, authentication, and profile management with minimal overhead. With Cognito, you can set up user pools to handle sign-up and sign-in, and you can integrate with external social identity providers (like Google, Facebook, or Amazon) for authentication. This solution also scales automatically and requires minimal maintenance. The use of IAM roles in conjunction with Cognito identity pools allows users to access AWS resources securely based on their roles.
- Why it's selected: This solution is highly suited for managing user identities with minimal operational overhead, as it handles user registration, authentication, and authorization seamlessly. It also integrates with API Gateway and Lambda with ease, making it ideal for serverless applications. The ongoing management of user identities is minimal, as Cognito takes care of it.
Option B: Program the sign-in page to create users' IAM groups with the IAM roles attached to the groups.
- Reasoning: Managing user sign-ins and registrations via IAM groups is not appropriate for most applications, especially serverless ones. IAM is designed for managing permissions for AWS resources rather than for handling user authentication in applications. IAM groups are primarily used for granting access to AWS resources, not for handling user identities in web applications. This approach would require significant custom coding to manage users, roles, and permissions.
- Why it's rejected: This solution adds unnecessary complexity and doesn't provide the speci...
Author: Emma · Last updated Jul 14, 2026
A company has a web application that is hosted on Amazon EC2 instances. The EC2 instances are configured to stream logs to Amazon CloudWatch Logs. The company needs to receive an Amazon Simple Notification Service (Amazon SNS) notification when the number of application...
Let's evaluate each option in the context of receiving an SNS notification when the number of application error messages exceeds a defined threshold within a 5-minute period:
Option A: Rewrite the application code to stream application logs to Amazon SNS. Configure an SNS topic to send a notification when the number of errors exceeds the defined threshold within a 5-minute period.
- Reasoning: This option suggests modifying the application code to stream logs directly to SNS, but SNS is primarily used for sending notifications and not for log management or analysis. SNS cannot efficiently process and filter logs based on patterns such as error messages or thresholds. This would require significant changes to the application and is inefficient for this use case.
- Why it's rejected: SNS is not designed to directly handle log processing or error counting, so this approach would introduce unnecessary complexity and operational overhead.
Option B: Configure a subscription filter on the CloudWatch Logs log group. Configure the filter to send an SNS notification when the number of errors exceeds the defined threshold within a 5-minute period.
- Reasoning: CloudWatch Logs allows you to configure a filter pattern to look for specific log messages (such as error messages) in the log stream. However, the subscription filter feature is mainly used for sending log data to other services like Lambda or Kinesis Streams, and it does not directly support counting events or thresholds within a period.
- Why it's rejected: While the filter pattern could match error messages, subscription filters cannot directly handle the concept of counting errors over a specific time frame (like 5 minutes). You would need an additional step to aggregate and trigger notifications, which complicates the solution.
Option C: Install and configure the Amazon Inspector agent on the EC2 instances to monitor for errors. Configure Amazon Inspector to send an SNS notification when the number of errors exceeds ...
Author: Siddharth · Last updated Jul 14, 2026
A photo sharing application uses Amazon S3 to store image files. All user images are manually audited for inappropriate content by a third-party company. The audits are completed 1-24 hours after user upload and the results are written to an Amazon DynamoDB table, which uses the S3 object key as a primary key. The database items can be queried by using a REST API created by the third-party company.
An application developer needs to im...
The goal is to automate the process of tagging S3 objects based on content audit results stored in DynamoDB, using the most operationally efficient solution. Let’s evaluate the options:
Option A: Create an AWS Lambda function to run in response to the s3:ObjectCreated event type. Write the S3 key to an Amazon Simple Queue Service (Amazon SQS) queue with a visibility timeout of 24 hours. Create and configure a second Lambda function to read items from the queue. Retrieve the results for each item from the DynamoDB table. Tag each S3 object accordingly.
- Reasoning: This option involves using Lambda in response to S3 events to send the S3 key to an SQS queue. The second Lambda reads from the queue, waits for the audit result in DynamoDB, and then tags the object. While this solution could work, the use of SQS with a 24-hour visibility timeout introduces complexity in managing the queue, ensuring that items are not lost or processed too early, and monitoring for failures.
- Why it's rejected: The extra overhead of managing an SQS queue, including the visibility timeout and failure handling, adds complexity that can be avoided in other solutions.
Option B: Create an AWS Lambda function to run in response to the s3:ObjectCreated event type. Integrate the function into an AWS Step Functions standard workflow. Define an AWS Step Functions Wait state and set the value to 24 hours. Create and configure a second Lambda function to retrieve the audit results and tag the S3 objects accordingly after the Wait state is over.
- Reasoning: This solution uses Step Functions with a Wait state to introduce a 24-hour delay before retrieving audit results and tagging the S3 object. While Step Functions provides a nice framework for orchestrating workflows, it introduces additional complexity and costs with the need to manage the Step Functions state machine, especially if the workflow is simple. Step Functions also has execution costs and timeouts that need to be managed carefully.
- Why it's rejected: While functional, Step Functions adds unnecessary complexity for this task, especially given the need to wait for a fixed amount of time (24 hours). Simpler solutions would be more efficient.
Option C: Cre...
Author: Andrew · Last updated Jul 14, 2026
A company has built an AWS Lambda function to convert large image files into output files that can be used in a third-party viewer application. The company recently added a new module to the function to improve the output of the generated files. However, the new module has increased the bundle size and has increased th...
The goal is to increase the speed of Lambda function deployment after a module was added that increased the bundle size and the time needed for deployment. Let's evaluate each option:
Option A: Use AWS CodeDeploy to deploy the function code.
- Reasoning: AWS CodeDeploy is a service designed for automating application deployments across various compute resources such as EC2 instances or Lambda functions. However, it doesn't directly improve the deployment speed itself for Lambda functions; rather, it provides deployment management and monitoring capabilities. It’s more beneficial for managing deployment processes but does not reduce the size of the Lambda deployment package or optimize the deployment time.
- Why it's rejected: CodeDeploy does not directly address the issue of large function packages or reduce the time needed for Lambda code updates. It is more for managing deployment logistics rather than optimizing the deployment speed.
Option B: Use Lambda layers to package and load dependencies.
- Reasoning: Lambda layers allow you to separate dependencies from your function code. By moving the dependencies (e.g., libraries, modules) into a layer, the Lambda function code itself can be kept smaller and only the function-specific code needs to be deployed. This means only the core changes to the function code are deployed, not the entire bundle of dependencies, which speeds up deployment times. Layers can also be shared across multiple functions, further improving operational efficiency.
- Why it's selected: Using Lambda layers reduces the overall size of the Lambda function deployment and can significantly speed up the deployment process ...
Author: CrimsonViperX · Last updated Jul 14, 2026
A developer creates a static website for their department. The developer deploys the static assets for the website to an Amazon S3 bucket and serves the assets with Amazon CloudFront. The developer uses origin access control (OAC) on the CloudFront distribution to access the S3 bucket.
The developer notices users can access the root URL and specific pages but cannot access directories without specifying a file name. For example, /products/index.html works, but...
Let’s analyze each option based on the requirements and explain which one will meet the needs of enabling access to directories without exposing the S3 bucket publicly.
A) Update the CloudFront distribution's settings to index.html as the default root object is set.
- Explanation: This option configures CloudFront to serve the `index.html` file when a directory is requested, like `/products/`. However, it doesn't solve the problem of serving directories without a file being specified. This option would work for requests to the root directory (`/`), but it doesn’t handle cases where a directory is specified but the user doesn’t type `index.html` (e.g., `/products/`).
- Rejected: This option does not address the issue of directory access in general, only the root.
B) Update the Amazon S3 bucket settings and enable static website hosting. Specify index.html as the Index document. Update the S3 bucket policy to enable access. Update the CloudFront distribution's origin to use the S3 website endpoint.
- Explanation: Enabling static website hosting on the S3 bucket and specifying `index.html` as the index document would allow directories to return the `index.html` file when accessed. The S3 website endpoint would then serve the files as a website, and CloudFront would forward requests to that endpoint. However, the problem with this solution is that it exposes the S3 bucket publicly (via the website endpoint), which goes against the requirement to not expose the S3 bucket publicly.
- Rejected: This option would expose the S3 bucket publicly, which contradicts the requirement.
C) Create a CloudFront function that examines the request URL and appends index.html when dir...
Author: RadiantJaguar56 · Last updated Jul 14, 2026
A developer is testing a RESTful application that is deployed by using Amazon API Gateway and AWS Lambda. When the developer tests the user login by using credentials that are not valid, the developer receives an HTTP 405: METHOD_NOT_ALLOWED error. The developer has verified that the test i...
To resolve this issue, let's break down each option and analyze the appropriate error code for the situation where invalid credentials are provided.
A) HTTP 401 (Unauthorized)
- Explanation: HTTP 401 is the most appropriate response when the client request requires authentication, but the credentials provided are either missing, incorrect, or invalid. This is exactly the scenario when a user attempts to log in with invalid credentials, and it is a standard response for failed authentication.
- Selected: This is the correct response because it indicates that the user is not authorized due to incorrect credentials.
B) HTTP 404 (Not Found)
- Explanation: HTTP 404 is used when the requested resource could not be found on the server. It implies that the URL does not exist or is incorrect. In this case, if the URL is correct, but the credentials are wrong, the resource does exist, but access is denied due to invalid credentials. Therefore, HTTP 404 is not appropriate.
- Rejected: This error code would be misleading, as the resource exists b...
Author: Emma · Last updated Jul 14, 2026
A developer must use multi-factor authentication (MFA) to access data in an Amazon S3 bucket that is in another AWS account.
Which AWS Security Token Service (AWS STS) API operati...
To address this requirement, we need to focus on using multi-factor authentication (MFA) with AWS Security Token Service (STS) to access data in an Amazon S3 bucket across AWS accounts. Let's analyze each option in detail.
A) AssumeRoleWithWebIdentity
- Explanation: `AssumeRoleWithWebIdentity` is used for web identity federation (such as logging in with Google or Facebook) to assume an IAM role. It doesn’t directly involve MFA for cross-account access. This API operation is intended for use with federated users (e.g., users authenticated by external identity providers).
- Rejected: This option is irrelevant for multi-factor authentication and cross-account access using MFA.
B) GetFederationToken
- Explanation: `GetFederationToken` is used to create temporary security credentials for federated users. It doesn't require MFA as part of the operation itself. It is commonly used when you want to provide temporary access to AWS resources for users outside of your AWS environment (e.g., employees or systems in a different organization).
- Rejected: This option does not support MFA and is not designed for cross-account access in the way MFA would be used.
C) AssumeRoleWithSAML
- Explanation: `AssumeRoleWithSAML` is used in the context of SA...
Author: Sam · Last updated Jul 14, 2026
A developer designed an application on an Amazon EC2 instance. The application makes API requests to objects in an Amazon S3 bucket.
Which combination of steps will ensure that t...
To ensure the application on an Amazon EC2 instance can make API requests to objects in an Amazon S3 bucket in the most secure manner, let's analyze each option:
A) Create an IAM user that has permissions to the S3 bucket. Add the user to an IAM group.
- Explanation: This approach involves creating an IAM user, granting permissions to the S3 bucket, and then placing the user in an IAM group. However, managing permissions for an application running on EC2 using IAM users and groups isn't the best practice. It involves manual management of credentials, which increases the risk of exposing them.
- Rejected: Storing IAM user credentials on the EC2 instance is not a best practice. It's prone to security risks, such as unintentional exposure of the credentials.
B) Create an IAM role that has permissions to the S3 bucket.
- Explanation: This option is good because creating an IAM role with permissions to the S3 bucket is the right approach for securely granting the EC2 instance permissions to access S3. However, the role by itself needs to be associated with the EC2 instance in some way.
- Partial Selection: This step is important but not sufficient on its own, as the IAM role needs to be attached to the EC2 instance for it to take effect.
C) Add the IAM role to an instance profile. Attach the instance profile to the EC2 instance.
- Explanation: This is the recommended approach. After creating the IAM role with appropriate permissions for the S3 bucket, the next step is to create an instance profile and attach it to the EC2 instance. This allows the EC2 instance to assume t...
Author: Daniel · Last updated Jul 14, 2026
An AWS Lambda function requires read access to an Amazon S3 bucket and requires read/write access to an Amazon DynamoDB table. The correct IAM policy already exists.
What is the MOST secur...
Let's analyze each option and determine the most secure way to grant an AWS Lambda function access to an S3 bucket and a DynamoDB table.
A) Attach the existing IAM policy to the Lambda function.
- Explanation: Lambda functions don’t directly have IAM policies attached to them. Instead, they are granted permissions through an IAM role that is associated with the Lambda function. This option is incorrect because you cannot directly attach IAM policies to the Lambda function.
- Rejected: IAM policies cannot be attached directly to Lambda functions; they must be associated through an IAM role.
B) Create an IAM role for the Lambda function. Attach the existing IAM policy to the role. Attach the role to the Lambda function.
- Explanation: This is the most secure and recommended approach. AWS Lambda functions assume an IAM role to obtain the necessary permissions to interact with other AWS services. By creating a specific IAM role for the Lambda function and attaching the appropriate policy (already existing) to the role, you can securely grant the Lambda function the required read access to S3 and read/write access to DynamoDB.
- Selected: This is the most secure method because it uses IAM roles, which provide a least-privilege approach by granting only the necessary permissions for the function's operations.
C) Create an IAM user with programmatic access. Attach the existing IAM policy to the user. Add the user access key ID and secret access key as environme...
Author: Ishaan · Last updated Jul 14, 2026
A developer is using AWS Step Functions to automate a workflow. The workflow defines each step as an AWS Lambda function task. The developer notices that runs of the Step Functions state machine fail in the GetResource task with either an IllegalArgumentException error or a TooManyRequestsException error.
The developer wants the state machine to stop running when the state machine encounters an IllegalArgumentException error. The state machine needs to retry the GetResource task one additional time after 10 seconds if the state machine encounters a T...
Let’s break down each option based on the requirements and factors involved:
Option A
- What it does: The solution includes adding a Delay task after the GetResource task. The Delay task would be triggered when a `TooManyRequestsException` is encountered. After the delay of 10 seconds, the GetResource task would run again.
- Why this is not ideal: Although this does address the retry with a delay, adding an additional Delay task is not the most straightforward or efficient approach for retrying a task with a specific interval. This adds unnecessary complexity because AWS Step Functions already has built-in retry mechanisms that don’t require explicitly adding a Delay task. Additionally, this solution would need manual configuration for retry logic and doesn’t directly prevent the state machine from failing on the second retry if it fails again.
Option B
- What it does: This solution adds a catcher to handle the `TooManyRequestsException` with a retry configuration of one additional attempt after an interval of 10 seconds.
- Why this is not ideal: This solution doesn't directly address the condition where you need to stop the state machine on the second failure. If the second retry fails, this option doesn't define the failure action well enough. The "catcher" will just handle the exception, and the task will attempt to continue instead of stopping on the second failure. Also, it introduces unnecessary complexity in managing both the "catcher" and retry parameters manually.
Option C (Selected Option)
- What it does: This option uses a retrier to configure retry behavior directly for the GetResource task. It specifies th...
Author: Aarav2020 · Last updated Jul 14, 2026
A developer is creating a serverless application that uses an AWS Lambda function. The developer will use AWS CloudFormation to deploy the application. The application will write logs to Amazon CloudWatch Logs. The developer has created a log group in a CloudFormation template for the application to use. The developer needs to modify th...
Let’s analyze each option based on the requirement to pass the log group name to the Lambda function at runtime.
Option A: Use the AWS::Include transform in CloudFormation to provide the log group's name to the application.
- What it does: The `AWS::Include` transform allows you to include external files (such as templates or scripts) into your CloudFormation template. This can help include pre-existing CloudFormation templates or resources.
- Why this is not ideal: This option is unnecessary for simply passing a log group’s name to the Lambda function. The `AWS::Include` transform is useful for including external files or templates but isn't directly suited for referencing resources like a log group in the current template and passing them to the Lambda function. This adds unnecessary complexity and is not the best fit for the use case.
Option B: Pass the log group's name to the application in the user data section of the CloudFormation template.
- What it does: The `UserData` section is primarily used to specify commands that are executed when launching EC2 instances (e.g., for configuring servers when they start).
- Why this is not ideal: The `UserData` section is not relevant in a serverless context because it's meant for EC2 instances. Lambda functions don’t use EC2-like `UserData` sections. Using `UserData` for a Lambda function is not the correct approach.
Option C: Use the CloudFormation template's Mappings section to specify the log group's name for the application.
- What it does: The Mappings section in a CloudFormation template all...
Author: Julian · Last updated Jul 14, 2026
A developer is creating an Amazon DynamoDB table by using the AWS CLI. The DynamoDB table must use server-side encryption with an AWS owned encryption key.
How sh...
Let's analyze each option based on the requirement to use server-side encryption with an AWS owned encryption key for the DynamoDB table:
Option A: Create an AWS Key Management Service (AWS KMS) customer managed key. Provide the key's Amazon Resource Name (ARN) in the KMSMasterKeyId parameter during creation of the DynamoDB table.
- What it does: This option involves creating a customer managed key in AWS KMS (Key Management Service) and specifying its ARN during the table creation. Customer managed keys are fully under the control of the user, providing more flexibility and fine-grained permissions.
- Why this is not ideal: The requirement specifically asks for an AWS owned encryption key, which means using an AWS managed key rather than a customer-managed key. A customer-managed key involves more complexity, such as managing key rotation, access control, and policy configurations, which is not required in this case. This option is too advanced and unnecessary for the given requirement.
Option B: Create an AWS Key Management Service (AWS KMS) AWS managed key. Provide the key's Amazon Resource Name (ARN) in the KMSMasterKeyId parameter during creation of the DynamoDB table.
- What it does: This option uses an AWS managed key for encryption and specifies the ARN of that key during the table creation.
- Why this is not ideal: AWS managed keys are indeed the proper solution for encryption but, AWS DynamoDB automatically uses an AWS owned encryption key by default, so you don't need to explicitly specify the ARN of a managed key. The scenario call...
Author: IceDragon2023 · Last updated Jul 14, 2026
A company has an application that runs across multiple AWS Regions. The application is experiencing performance issues at irregular intervals. A developer must use AWS X-Ray to implement distributed tracing for the application to troublesh...
Let's analyze each option based on the requirement to implement distributed tracing for the application across multiple AWS Regions to troubleshoot performance issues:
Option A: Use the X-Ray console to add annotations for AWS services and user-defined services.
- What it does: The X-Ray console allows you to visualize and manage traces but does not allow you to directly add annotations for services. Annotations need to be added at the application level, typically through the X-Ray SDK or daemon.
- Why this is not ideal: This option does not fulfill the requirement to add annotations programmatically. Adding annotations in the console is not a method that allows for real-time tracing or capturing data across multiple Regions in the application, so it's not a viable solution for troubleshooting performance issues.
Option B: Use Region annotation that X-Ray adds automatically for AWS services. Add Region annotation for user-defined services.
- What it does: X-Ray automatically adds the Region annotation for AWS services, but for user-defined services, the developer must manually add Region annotations to the traces.
- Why this is ideal: This option is correct for addressing the requirement. AWS X-Ray automatically captures the region information for AWS services, which is useful when tracing performance issues across multiple regions. For user-defined services (like a custom API or application), adding Region annotations manually allows you to correlate traces across regions more accurately. This ensures the developer can trace the flow of requests between services, regardless of the region in which they are running.
...
Author: Siddharth · Last updated Jul 14, 2026
A company runs an application on AWS. The application uses an AWS Lambda function that is configured with an Amazon Simple Queue Service (Amazon SQS) queue called high priority queue as the event source. A developer is updating the Lambda function with another SQS queue called low priority queue as the event source. The Lambda function must always read up to 10 simultaneous messages from the high priority...
Let's evaluate each option to find the best solution for ensuring the Lambda function processes up to 10 simultaneous messages from the high priority queue before reading from the low priority queue, with a maximum of 100 simultaneous invocations.
Option A: Set the event source mapping batch size to 10 for the high priority queue and to 90 for the low priority queue.
- What it does: This sets the batch size (the number of messages Lambda reads at once) for each SQS queue. The batch size for the high priority queue is set to 10, meaning Lambda will read 10 messages at a time from that queue. The low priority queue has a batch size of 90, meaning Lambda can read 90 messages at a time from that queue.
- Why this is not ideal: This does not guarantee that Lambda will process messages from the high priority queue first. It only controls how many messages are processed in each batch but does not control the concurrency or prioritization between queues. This does not directly limit Lambda's simultaneous invocations based on prioritization.
Option B: Set the delivery delay to 0 seconds for the high priority queue and to 10 seconds for the low priority queue.
- What it does: Delivery delay determines how long messages are delayed before they are available for processing in the SQS queue. By setting a delay of 10 seconds on the low priority queue, the messages from that queue will not be processed until the delay expires.
- Why this is not ideal: This approach introduces an artificial delay to the low priority queue, which doesn't provide the fine-grained control over concurrency or ensure that high priority messages are processed first. It also doesn’t meet the requirement of limiting Lambda invocations to 100 simultaneous executions.
Option C: Set the event source mapping maximum concurrency to 10 for the high priority queue and to 90 for the low priority queue.
- What it does...
Author: RadiantJaguar56 · Last updated Jul 14, 2026
A data visualization company wants to strengthen the security of its core applications. The applications are deployed on AWS across its development, staging, pre-production, and production environments. The company needs to encrypt all of its stored sensitive credentials. The sensitive credentials need to be automatically rotated. A version of the...
To meet the company's requirements, the solution needs to encrypt sensitive credentials, automatically rotate them, and store different versions for each environment (development, staging, pre-production, and production). Let’s evaluate the options based on these key factors:
A) Configure AWS Secrets Manager versions to store different copies of the same credentials across multiple environments.
- Encryption & Rotation: AWS Secrets Manager supports encryption and automatic rotation of secrets, which is crucial for sensitive credentials.
- Versioning: Secrets Manager supports versioning, which allows for different versions of the same secret.
- Multiple Environments: However, using the same secret for multiple environments (even with different versions) can create confusion and risks in managing access and identifying the right version for each environment.
- Operational Efficiency: While Secrets Manager does provide versioning, managing versions for each environment in one secret is not ideal for clarity and organization. It can increase the complexity of management and access control.
B) Create a new parameter version in AWS Systems Manager Parameter Store for each environment. Store the environment-specific credentials in the parameter version.
- Encryption & Rotation: AWS Systems Manager Parameter Store supports encryption, but the automatic rotation of credentials is a manual process or requires an additional setup (e.g., Lambda function).
- Versioning: Parameter Store allows versioning, which can be used to track different credentials for each environment. However, the manual process of credential rotation could lead to operational overhead.
- Multiple Environments: This approach could be effective if the company is already using Systems Manager, but it's less scalable compared to Secrets Manager for automated credential rotation.
- Operational Efficiency: Though possible, this option would require more custom automation for rotating credentials and managing ...
Author: Isabella · Last updated Jul 14, 2026
A developer is investigating an issue in part of a company's application. In the application, messages are sent to an Amazon Simple Queue Service (Amazon SQS) queue. The AWS Lambda function polls messages from the SQS queue and sends email messages by using Amazon Simple Email Service (Amazon SES). Users have been rec...
To investigate the issue of duplicate email messages, we need to consider the behavior of the Amazon SQS queue, the AWS Lambda function, and the Amazon SES service. Let's evaluate each option and determine which ones are most likely to explain the duplication:
Option A: Standard SQS queues support at-least-once message delivery.
- Why this is selected: Standard SQS queues guarantee at-least-once delivery of messages, meaning that a message might be delivered multiple times in high-traffic situations. This could lead to duplicate emails being sent if the same message is processed more than once. This is a common issue when using standard SQS queues.
- Key factor: The "at-least-once" delivery policy is a key reason for potential duplication, especially under heavy traffic, because SQS could deliver the same message multiple times.
Option B: Standard SQS queues support exactly-once processing, so the duplicate email messages are because of user error.
- Why it's rejected: Standard SQS queues do not support exactly-once processing. They support at-least-once delivery, which means that duplicate messages are possible. Exactly-once processing is only supported by FIFO queues, not standard queues. Hence, this option is incorrect.
- Key factor: SQS does not guarantee exactly-once processing for standard queues, making this explanation inaccurate.
Option C: Amazon SES has the DomainKeys Identified Mail (DKIM) authentication incorrectly configured.
- Why it's rejected: While DKIM misconfigurations can cause delivery or authenticity issues, they are unlikely to cause duplicate email messages. Duplicat...
Author: Maya · Last updated Jul 14, 2026
A developer is deploying a company's application to Amazon EC2 instances. The application generates gigabytes of data files each day. The files are rarely accessed, but the files must be available to the application's users within minutes of a request during the first year of storage. The company must ...
To implement the application to meet the given requirements in the most cost-effective manner, we need to focus on the following key factors:
1. Data storage: The data files are large (gigabytes per day), and the files are rarely accessed but must be available within minutes.
2. Retention period: The files must be retained for 7 years, which suggests a long-term storage solution.
3. Cost-effectiveness: The solution must be cost-effective because of the large amount of data being generated.
Let's evaluate each option:
Option A: Store the files in an Amazon S3 bucket. Use the S3 Glacier Instant Retrieval storage class. Create an S3 Lifecycle policy to transition the files to the S3 Glacier Deep Archive storage class after 1 year.
- Why this is selected:
- S3 Glacier Instant Retrieval is designed for data that is rarely accessed but needs to be retrieved quickly when needed, which fits the application's requirement of having files available within minutes.
- S3 Glacier Deep Archive offers the lowest cost storage for long-term retention, making it a very cost-effective option for storing data that needs to be retained for 7 years but is rarely accessed.
- Lifecycle policies: The use of S3 Lifecycle policies allows automatic management of transitions from Glacier Instant Retrieval to Glacier Deep Archive after one year, optimizing both access time and cost.
- Key factor: This combination gives quick access when needed (Glacier Instant Retrieval) and long-term, low-cost storage (Glacier Deep Archive) after one year, making it ideal for the application’s needs.
Option B: Store the files in an Amazon S3 bucket. Use the S3 Standard storage class. Create an S3 Lifecycle policy to transition the files to the S3 Glacier Flexible Retrieval storage class after 1 year.
- Why this is rejected:
- S3 Standard is more expensive than the Glacier storage classes. Since the files are rarely accessed, storing them in S3 Standard would not be cost-effective for the application's needs.
- Glacier Flexible Retrieval is more expensive than Glacier Deep Archive and is better suited for use cas...
Author: Olivia · Last updated Jul 14, 2026
A company's developer has deployed an application in AWS by using AWS CloudFormation. The CloudFormation stack includes parameters in AWS Systems Manager Parameter Store that the application uses as configuration settings. The application can modify the parameter values.
When the developer updated the stack to create additional resources with tags, the developer noted that the parameter values were reset and that the values ignored the latest changes made by the application. The developer needs to change...
To address the issue where the application modifies parameters in AWS Systems Manager Parameter Store but the updates are reset when the CloudFormation stack is updated, let's evaluate the solutions based on the requirements:
Key Requirements:
- The developer needs to avoid resetting the parameter values outside the CloudFormation stack.
- The solution should minimize development effort.
A) Modify the CloudFormation stack to set the deletion policy to Retain for the Parameter Store parameters.
- Reasoning:
- The `Retain` deletion policy ensures that resources (like Parameter Store parameters) are not deleted when the stack is deleted or updated.
- Issue: While this will prevent the parameters from being deleted during stack updates, it does not address the problem of parameters being reset (overwritten with default values) when the stack is updated. The issue is about updating the stack, not deleting it.
- Conclusion: This option won't fully solve the problem of preserving the updated parameter values during stack updates.
B) Create an Amazon DynamoDB table as a resource in the CloudFormation stack to hold configuration data for the application. Migrate the parameters that the application is modifying from Parameter Store to the DynamoDB table.
- Reasoning:
- DynamoDB could serve as a highly scalable and easily accessible storage solution for configuration data. It would allow the application to modify the data without risk of overwriting during stack updates.
- Development Effort: This solution requires more work to set up the DynamoDB table, implement read/write access in the application, and migrate existing data. While this approach avoids the reset problem, it adds significant development overhead compared to other options.
- Conclusion: This option solves the issue but involves more development effort, making it less optimal than others.
C) Create an Amazon RDS DB instance as a resource in the CloudFormation stack. Create a table i...
Author: Maya · Last updated Jul 14, 2026
A company has a social media application that receives large amounts of traffic. User posts and interactions are continuously updated in an Amazon RDS database. The data changes frequently, and the data types can be complex. The application must serve read requests with minimal latency.
The application's current architecture struggles to deliver the...
To address the performance challenges of serving rapid read requests with minimal latency in the context of frequently updated data with complex data types, we need to focus on optimizing read performance and reducing the load on the underlying Amazon RDS database.
Let's evaluate each option:
Option A: Use Amazon DynamoDB Accelerator (DAX) in front of the RDS database to provide a caching layer for the high volume of rapidly changing data.
- Why this is rejected: DAX is specifically designed for Amazon DynamoDB, not Amazon RDS. While it provides an in-memory cache for DynamoDB, it does not work with Amazon RDS databases. Since the application uses RDS, DAX is not a suitable solution here.
- Key factor: DAX is incompatible with RDS because it’s built for DynamoDB, making it irrelevant for this use case.
Option B: Set up Amazon S3 Transfer Acceleration on the RDS database to enhance the speed of data transfer from the databases to the application.
- Why this is rejected: S3 Transfer Acceleration is a service designed to speed up transfers of large files to and from Amazon S3 over the internet. It does not apply to RDS databases and would not provide a performance improvement for rapidly changing data or help with read latency issues.
- Key factor: S3 Transfer Acceleration is not relevant to an RDS-based architecture, where the challenge is to improve real-time read performance.
Option C: Add an Amazon CloudFront distribution in front of the RDS database to provide a caching layer for the high volume of rapidly changing data.
- Why this is rejected: CloudFront is a content delivery network (CDN) primarily used ...
Author: Amelia · Last updated Jul 14, 2026
A developer created an AWS Lambda function that performs a series of operations that involve multiple AWS services. The function's duration time is higher than normal. To determine the cause of the issue, the developer must investigate traffic...
To investigate the cause of high duration times in an AWS Lambda function involving multiple services, it's important to trace the traffic and interactions between the services involved. Here’s a breakdown of each option:
A) Enable AWS X-Ray active tracing in the Lambda function. Review the logs in X-Ray.
- Explanation: AWS X-Ray is a service designed specifically for tracing the path of requests as they travel through various AWS services. By enabling active tracing in the Lambda function, you can visualize the time taken by each service in the chain, along with any delays between the services.
- Why it's selected: X-Ray will provide a comprehensive end-to-end trace of the request, showing exactly where the time is spent (e.g., which AWS service is taking longer to respond), and will allow you to analyze and pinpoint bottlenecks between services.
- Why other options are rejected:
- CloudTrail logs (B) give details on AWS API calls, but they won’t help in identifying performance bottlenecks or the specific time taken by different AWS services in a Lambda execution.
- AWS Config logs (C) focus on tracking configuration changes in AWS resources, not the performance or traffic between them.
- CloudWatch logs (D) provide logs from the Lambda execution but do not offer insights into the traffic between services or detailed tracing of performance over time.
B) Configure AWS CloudTrail. View the trail logs that are associated with the Lambda function.
- Explanation: CloudTrail records API calls made on AWS resources. While it can show you when a Lambda function was invoked and what AWS services were called, it does not provide the detailed timing information or performance-related data needed to identify latency ...
Author: Isabella1 · Last updated Jul 14, 2026
A company has on-premises data centers that run an image processing service. The service consists of containerized applications that run on Kubernetes clusters. All the applications have access to the same NFS share for files and data storage.
The company is running out of NFS capacity in the data centers and needs to migrate to AWS as so...
To meet the requirements of migrating to AWS and maintaining high availability for the Kubernetes clusters, it's essential to find solutions that address both the storage needs (due to the NFS capacity issue) and the deployment of the containerized applications on a highly available infrastructure.
Breakdown of each option:
A) Transfer the information that is in the NFS share to an Amazon Elastic Block Store (Amazon EBS) volume. Upload the container images to Amazon Elastic Container Registry (Amazon ECR).
- Why it's rejected:
- Amazon EBS is a block storage service, not designed for sharing data between multiple instances (like the NFS share). EBS volumes are attached to individual EC2 instances, meaning they are not natively scalable or shared in the way NFS is used across multiple Kubernetes pods.
- While ECR is a good solution for storing container images, using EBS for shared storage will not meet the need for high availability across Kubernetes nodes.
B) Transfer the information that is in the NFS share to an Amazon Elastic File System (Amazon EFS) volume. Upload the container images to Amazon Elastic Container Registry (Amazon ECR).
- Why it's selected:
- Amazon EFS is a fully managed, scalable file storage service that is designed for use with multiple EC2 instances (or Kubernetes nodes), which is exactly what is needed to replace the on-premises NFS share.
- EFS supports high availability and scalability, ensuring that the data can be shared across the Kubernetes cluster in AWS without running into capacity issues.
- ECR is the standard AWS service for container image storage, which is a good choice for storing the container images.
C) Create an Amazon Elastic Container Service (Amazon ECS) cluster to run the applications. Configure each node of the cluster to mount the Amazon Elastic Block Store (Amazon EBS) volume at the required path for the container images.
- Why it's rejected:
- ECS can be used to run containerized applications, but it does not natively support the high availability and scaling needs that Kubernetes can provide. The problem is that EBS volumes cannot be shared between multiple ECS...
Author: Leo · Last updated Jul 14, 2026
A company has an analytics application that uses an AWS Lambda function to process transaction data asynchronously. A developer notices that asynchronous invocations of the Lambda function sometimes fail. When failed Lambda function invocations occur, the developer wants...
To address the requirement of handling failed asynchronous Lambda invocations and triggering a second Lambda function to log and process errors, let’s evaluate each option in detail:
A) Configure a Lambda function destination with a failure condition. Specify Lambda function as the destination type. Specify the error-handling Lambda function's Amazon Resource Name (ARN) as the resource.
- Explanation: AWS Lambda provides a built-in destination feature for asynchronous invocations, which allows you to specify a destination for both successful and failed invocations. When a failure occurs, Lambda can send the event data to a specified destination, such as another Lambda function, an SNS topic, or an SQS queue. This feature directly supports handling error scenarios by triggering another Lambda function when the primary function fails.
- Why it's selected: This solution is designed specifically for handling failure scenarios in asynchronous invocations, allowing you to trigger the error-handling Lambda function automatically whenever the primary function fails.
- Why other options are rejected:
- B) Enabling X-Ray active tracing helps you trace the execution of Lambda functions but does not automatically trigger a secondary Lambda function to handle errors. X-Ray captures dia...
Author: Nathan · Last updated Jul 14, 2026
A company introduced a new feature that should be accessible to only a specific group of premium customers. A developer needs the ability to turn the feature on and off in response to performance and feedback. The developer needs a solution to validate and deploy these...
To address the need for managing feature configurations and deploying them quickly, let's break down the options based on the requirements: the ability to turn the feature on and off, quick validation and deployment, and ensuring minimal disruptions to the system.
A) Use AWS AppConfig to manage the feature configuration and to validate and deploy changes. Use feature flags to turn the feature on and off.
- Explanation: AWS AppConfig is a service specifically designed for managing application configurations. It allows you to deploy configurations in a controlled way, validate them before deployment, and use feature flags to toggle features on and off dynamically. This provides a safe way to test new configurations in production environments without disrupting users, and it allows for fast rollbacks or changes based on customer feedback or performance.
- Why it's selected: AWS AppConfig is ideal for managing feature flags, validating configurations, and deploying changes without impacting the overall application performance. It supports use cases where quick changes and toggling of features are required, such as enabling or disabling the new feature for specific customer groups.
- Why other options are rejected:
- B) AWS Secrets Manager is primarily designed for managing sensitive data like passwords, database credentials, and API keys, not...
Author: Olivia · Last updated Jul 14, 2026
A developer needs approval from a product owner before the developer can deploy code for an application to production. The developer uses AWS CodePipeline to deploy the application. The developer configures an Amazon Simple Notification Service (Amazon SNS) topic to send notifications to the produ...
To determine the most operationally efficient way for the developer to get approval from the product owner before deploying code to production, let's evaluate each option:
A) Add a new stage to CodePipeline before the production deployment. Add a manual approval action to the new stage. Add a new notification rule in the pipeline settings. Specify manual approval as the event that initiates the notification. Specify the SNS topic's Amazon Resource Name (ARN) to notify the product owner.
- Explanation: This approach uses CodePipeline’s built-in manual approval action, which is designed specifically to pause the pipeline and wait for an approval before continuing. Adding this action as a new stage before production deployment allows the product owner to review and approve the deployment via an SNS notification. The manual approval step is an efficient, native way to handle such approvals in a continuous delivery pipeline.
- Why it's selected: CodePipeline's manual approval action is directly integrated into the deployment process and is the most operationally efficient solution. It minimizes the need for custom solutions or additional services, making it easy to configure and manage.
- Why other options are rejected:
- B) While AWS Step Functions can be used to orchestrate complex workflows and notifications, this adds unnecessary complexity...
Author: Isabella1 · Last updated Jul 14, 2026
A developer is building a serverless application on AWS for a workflow that processes high volumes of data. In the workflow, an AWS Step Functions state machine invokes several AWS Lambda functions.
One of the Lambda functions occasionally fails because of timeout errors during periods of high demand. The developer must ensure ...
Let's evaluate each option based on the goal: automatically retrying a failed Lambda invocation in the Step Functions workflow when a timeout error occurs.
Option A: Add a Retry field in the Step Functions state machine definition. Configure the state machine with the maximum number of retry attempts and the timeout error type to retry on.
- Explanation: Step Functions allows you to configure retry behavior using a `Retry` field in the state machine definition. You can specify the maximum number of retry attempts, the error types to retry (including timeout errors), and the interval between retries. This option directly supports the requirement, ensuring that when a Lambda function times out, Step Functions will automatically retry it based on the defined conditions.
- Advantages: This option provides a built-in and direct way to handle retries for specific error types such as timeouts. It is native to Step Functions, so it integrates well with the existing workflow.
- Why it's selected: This is the most appropriate solution because it offers precise control over retries based on the error type, directly addressing the problem of Lambda timeout failures.
Option B: Add a Timeout field in the Step Functions state machine definition. Configure the state machine with the maximum number of retry attempts.
- Explanation: A `Timeout` field in Step Functions specifies the maximum amount of time the state machine will wait for a task (like a Lambda function) to complete. While this can prevent a function from running indefinitely, it doesn't directly address retrying after a timeout. Adding retries for timeouts would require using the `Retry` field, not the `Timeout` field.
- Why it's rejected: This option doesn’t solve the problem because it doesn't handle retries specifically after a timeout error;...
Author: Olivia · Last updated Jul 14, 2026
A company runs a serverless application on AWS. The application includes an AWS Lambda function. The Lambda function processes data and stores the data in an Amazon RDS for PostgreSQL database. A developer created a user credentials in the database for the application.
The developer needs to use AWS Secrets Manager to manage the user credentials. The password must to be rotated on a regular basis. The ...
Let's analyze each option and determine the best solution for the developer's requirements:
Key Requirements:
1. Use AWS Secrets Manager to manage the user credentials.
2. Password rotation needs to be automatic and on a regular basis.
3. High availability and no downtime during secret rotation.
4. The credentials are for a single user in an Amazon RDS for PostgreSQL database.
Option A: Configure managed rotation with the single user rotation strategy.
- Explanation: The single user rotation strategy in AWS Secrets Manager involves rotating a single user credential without introducing another user for the rotation process. This is suitable when there is only one user and you want to ensure the password is automatically rotated at regular intervals.
- Advantages: This strategy is simple and works well when there is only one user. Secrets Manager will create a new password, update the secret, and then apply it to the database, all while ensuring no downtime during the process.
- Why it’s rejected: This is actually the most appropriate solution in the case of a single user because it allows seamless rotation with no additional complexity.
Option B: Configure managed rotation with the alternating users rotation strategy.
- Explanation: The alternating users rotation strategy involves rotating between two users—one for the current credential and one for rotation. The process involves one user for normal operations and another user for secret rotation.
- Why it's rejected: This strategy is more complex than needed for a single user. It’s useful for scenarios where mult...
Author: Henry · Last updated Jul 14, 2026
A company runs an application on AWS. The application consists of a static website that is hosted on Amazon S3. The application includes Amazon API Gateway APIs that invoke AWS Lambda functions. During a period of high traffic on the application, application users reported that the application was slow at irregular intervals. There were no...
Let's analyze each option to determine the most suitable solution for finding slow Lambda executions during high traffic:
Key Requirements:
- The goal is to find slow Lambda function executions across all Lambda functions, and the application is experiencing slowdowns during high traffic.
- The solution should provide insights into execution durations of Lambda functions, ideally without failed requests, focusing on performance bottlenecks.
Option A: Perform a query across all the Lambda function log groups by using Amazon CloudWatch Logs Insights. Filter on type of report and sort descending by Lambda function execution duration.
- Explanation: CloudWatch Logs Insights allows you to run queries on logs stored in CloudWatch. You can filter the logs for Lambda functions and query them based on the execution duration, which would help pinpoint slow executions across all functions.
- Advantages: This is a direct and effective way to query logs and identify Lambda functions that are performing poorly. CloudWatch Logs Insights is designed for querying large sets of logs efficiently, making it an ideal solution for this scenario.
- Why it's selected: This option provides a fast and straightforward approach for analyzing Lambda execution times and finding the slow functions by querying the logs. It's simple to implement and provides immediate results without additional configuration or complexity.
Option B: Enable AWS CloudTrail Insights on the account where the Lambda functions are running. After CloudTrail Insights has finished processing, review CloudTrail Insights to find the anomalous functions.
- Explanation: CloudTrail Insights helps detect unusual patterns or anomalies in API activity, such as spikes in invocation counts or error rates. However, it does not directly measure Lambda function execution duration.
- Why it's rejected: CloudTrail Insights is designed to detect anomalies in API activity, but it doesn't provide detailed insights into the execution time of individual Lambda functions. This makes it unsuitable for identifying slow executions.
Option C: Enable AWS X-Ray for all the Lambda functions. Configure an X-Ray insight on a new group that includes all the Lambda...
Author: Ming88 · Last updated Jul 14, 2026
A company is building a serverless application on AWS. The application uses Amazon API Gateway and AWS Lambda. The company wants to deploy the application to its development, test, and production environ...
Let’s evaluate each option to find the solution that will deploy the application to development, test, and production environments with the least development effort:
Key Requirements:
- Deploy a serverless application using Amazon API Gateway and AWS Lambda.
- Deploy the application across multiple environments (development, test, and production).
- The solution should minimize development effort and avoid duplicating code.
Option A: Use API Gateway stage variables and create Lambda aliases to reference environment-specific resources.
- Explanation: API Gateway stage variables allow you to configure environment-specific settings for different stages (e.g., dev, test, prod). Using Lambda aliases to point to different versions of the Lambda functions for each environment ensures that the correct version of the Lambda is invoked based on the environment.
- Advantages: This solution enables managing multiple environments with minimal changes to the codebase. It avoids code duplication and allows for seamless management of different environments within the same API Gateway and Lambda setup. Environment-specific configurations are controlled through API Gateway and Lambda aliases, so deployment effort is low.
- Why it's selected: This option allows the application to be deployed across multiple environments with minimal overhead and is easily scalable, making it the best choice for the least development effort.
Option B: Use Amazon Elastic Container Service (Amazon ECS) to deploy the application to the environments.
- Explanation: ECS is a service used to run containerized applications, typically for applications that require more control over the infrastructure and are not purely serverless.
- Why it's rejected: E...
Author: Harper · Last updated Jul 14, 2026
A developer uses AWS CloudFormation to deploy an Amazon API Gateway API and an AWS Step Functions state machine. The state machine must reference the API Gateway API after the CloudFormation template is deployed. The developer needs a solution that uses the state ma...
Let's evaluate the options for configuring the CloudFormation template to reference the API Gateway endpoint in the AWS Step Functions state machine, considering cost-effectiveness and simplicity.
Key Requirements:
- The state machine must reference the API Gateway endpoint after deployment.
- The solution should be cost-effective and avoid unnecessary complexity.
Option A: Configure the CloudFormation template to reference the API endpoint in the DefinitionSubstitutions property for the AWS::StepFunctions::StateMachine resource.
- Explanation: The DefinitionSubstitutions property allows for dynamic substitution of values (such as the API endpoint) within the state machine definition. This can reference CloudFormation outputs or parameters to inject the API endpoint into the state machine's definition.
- Advantages: This is a direct and simple approach that allows for dynamic referencing without needing to create additional AWS resources like Secrets Manager or environment variables. It is highly cost-effective because it directly substitutes the endpoint in the state machine definition.
- Why it's selected: This solution is cost-effective, direct, and integrates well with CloudFormation without adding unnecessary complexity or resources. It's also very efficient because it does not require extra services or configuration.
Option B: Configure the CloudFormation template to store the API endpoint in an environment variable for the AWS::StepFunctions::StateMachine resource. Configure the state machine to reference the environment variable.
- Explanation: This approach would require setting up an environment variable within the state machine’s execution context, and the state machine would reference that variable.
- Why it's rejected: Step Functions does not support environment variables natively, which means you'd need to either implement a custom solution using Lambda f...
Author: Evelyn · Last updated Jul 14, 2026
A developer is building an application on AWS. The application includes an AWS Lambda function that processes messages from an Amazon Simple Queue Service (Amazon SQS) queue.
The Lambda function sometimes fails or times out. The developer needs to figure out why the Lambda fun...
To determine the best approach to debug the Lambda function failure, let's analyze the given options:
A) Increase the maximum timeout of the Lambda function to 15 minutes. Check the AWS CloudTrail event history for error details.
- Analysis: While increasing the Lambda function timeout may give the function more time to process the messages, this doesn't directly help in identifying the root cause of failures or timeouts. CloudTrail logs may show events related to Lambda invocations, but CloudTrail is not a great tool for detailed error analysis within Lambda itself.
- Why rejected: This option doesn't address the underlying problem (why the Lambda function fails), and CloudTrail is not the most effective tool to debug Lambda processing issues. It also requires manual checks of logs without offering a clear mechanism to handle failures or retries.
B) Increase the visibility timeout of the SQS queue. Check logs in Amazon CloudWatch Logs for error details.
- Analysis: The visibility timeout of the SQS queue determines how long a message remains invisible to other consumers after Lambda starts processing it. Increasing it could allow Lambda more time to process a message before another instance of Lambda tries to process it again. However, this doesn't directly address why the Lambda function is failing. CloudWatch Logs can provide useful error details, but it won't give a clear mechanism to handle the failure either.
- Why rejected: Although this might reduce message reprocessing, it doesn't identify or fix the issue causing the Lambda function to fail. The focus should be on how to effectively capture failed messages for analysis.
C) Create a dead-letter queue. Configure the Lambda function to send the failed messages...
Author: Lucas Carter · Last updated Jul 14, 2026
A developer needs to deploy an application in three AWS Regions by using AWS CloudFormation. Each Region will use an AWS Elastic Beanstalk environment with an Application Load Balancer (ALB). The developer wants to use AWS Certificate ...
To address the requirements of deploying SSL certificates with Elastic Beanstalk environments and Application Load Balancers (ALBs) in multiple AWS Regions using AWS CloudFormation, let's evaluate each option:
A) Create a certificate in ACM in any one of the Regions. Import the certificate into the ALB that is in each Region.
- Analysis: AWS Certificate Manager (ACM) certificates are region-specific, and certificates created in one region cannot be directly imported to other regions. You would need to manually import certificates to each ALB in different regions. This method does not align with the requirement of automatically deploying certificates across multiple regions using CloudFormation.
- Why rejected: This approach is not efficient for managing certificates across multiple regions and requires manual intervention, which is against the goal of automation and simplicity.
B) Create a global certificate in ACM. Update the CloudFormation template to deploy the global certificate to each ALB.
- Analysis: ACM does not support global certificates for ALBs. Certificates created in ACM are tied to a specific region. A "global certificate" doesn’t exist in the context of ACM for this use case, and certificates cannot be directly used across multiple regions in the way suggested here.
- Why rejected: This approach is incorrect as ACM certificates cannot span across multiple regions and there is no concept of "global certificates" in this scenario.
C) Create a certificate in ACM in each Region. Import the certificate into the ALB for each Region.
- Analysis: This ...
Author: Amira · Last updated Jul 14, 2026
A company needs to deploy all its cloud resources by using AWS CloudFormation templates. A developer must create an Amazon Simple Notification Service (Amazon SNS) automatic notification to help enforce this rule. The developer creates an SNS topic and subscribes the email address of the company's security team to the SNS topic.
The security t...
To meet the requirement of notifying the security team whenever an IAM role is created outside of CloudFormation, we need an automated and efficient way to detect the event and trigger the notification. Let’s evaluate each option:
A) Create an AWS Lambda function to filter events from CloudTrail if a role was created without CloudFormation. Configure the Lambda function to publish to the SNS topic. Create an Amazon EventBridge schedule to invoke the Lambda function every 15 minutes.
- Analysis: This option involves using Lambda to filter CloudTrail events, which is a valid solution for detecting IAM role creation outside CloudFormation. However, using EventBridge with a schedule to invoke Lambda every 15 minutes would not provide real-time notifications. This is because the events need to be checked periodically, which means a delay in receiving notifications.
- Why rejected: While this approach is functional, it introduces a delay in notifications due to the polling mechanism, which doesn’t align with the requirement of immediate notifications.
B) Create an AWS Fargate task in Amazon Elastic Container Service (Amazon ECS) to filter events from CloudTrail if a role was created without CloudFormation. Configure the Fargate task to publish to the SNS topic. Create an Amazon EventBridge schedule to run the Fargate task every 15 minutes.
- Analysis: This solution uses ECS with Fargate, which involves setting up a more complex infrastructure and a task to filter CloudTrail events. Like Option A, this approach uses a schedule to periodically check for events, resulting in a delay in notifications.
- Why rejected: While functional, this solution is unnecessarily complex, requires managing ECS tasks, and still introduces a delay in notifications. This also leads to higher operational overhead compared to the simpler solution using E...
Author: Aria · Last updated Jul 14, 2026
A company is adopting serverless computing for some of its new services. A development team needs to create a serverless infrastructure by using AWS Serverless Application Model (AWS SAM). All infrastructure must be deployed by us...
To meet the requirements of adopting serverless computing with AWS Serverless Application Model (AWS SAM) and deploying the infrastructure using AWS CloudFormation, let’s evaluate each option.
A) Add a Resources section to the CloudFormation templates that contains AWS::Lambda::Function resources.
- Analysis: This option is focused on creating specific Lambda resources within a CloudFormation template. While Lambda functions are a core component of serverless applications, it does not directly address the use of AWS SAM, which provides higher-level abstractions for defining serverless components like Lambda, APIs, and more.
- Why rejected: While this is a valid approach for defining Lambda functions, it doesn't take advantage of the AWS SAM framework and syntax, which is designed to simplify serverless application deployment by abstracting away repetitive boilerplate code.
B) Add a Mappings section to the CloudFormation templates that contains AWS::Serverless::Function and AWS::Serverless::API.
- Analysis: The Mappings section in CloudFormation templates is typically used to define key-value pairs for region-specific or environment-specific values, not for defining AWS SAM resources like `AWS::Serverless::Function` or `AWS::Serverless::API`. This would not be an appropriate way to define serverless resources in a CloudFormation template.
- Why rejected: The Mappings section is not intended for the declaration of serverless resources. Instead, the AWS SAM framework provides a special syntax to simplify defining these resources. Using Mappings for serverless resources is not correct.
C) Add a Transform section to the CloudFormation templates. Use ...
Author: Julian · Last updated Jul 14, 2026
A developer is building an application that invokes AWS Lambda functions asynchronously to process events. The developer notices that a Lambda function fails to process some events at random times. The developer needs to investigate the failed events and...
To meet the requirement of capturing failed events when an AWS Lambda function fails to process them asynchronously, let’s review each option:
A) Add an Amazon EventBridge rule for the Lambda function. Configure the EventBridge rule to react to failed events and to store the events in an Amazon DynamoDB table.
- Analysis: EventBridge can capture a variety of events, including Lambda function failures. However, configuring EventBridge directly to capture failed Lambda events is not the most straightforward or recommended solution for this use case. DynamoDB would also not be ideal for this scenario since it is designed for key-value storage, and managing failure logs in it could require extra effort and unnecessary complexity.
- Why rejected: While EventBridge can capture events, using it for logging Lambda failures in DynamoDB adds unnecessary complexity and isn't the typical use case for Lambda failures. There is a more suitable solution for handling Lambda function failures with minimal setup.
B) Configure the Lambda function with a dead-letter queue based in Amazon Kinesis. Update the Lambda function's execution role with the required permissions.
- Analysis: While Kinesis can be used to stream data, it is not the most appropriate service for a dead-letter queue (DLQ) in this context. A dead-letter queue is typically used to store failed messages, and SQS is a more straightforward and appropriate choice for this purpose. Kinesis is more suited for continuous streaming and processing of large volumes of data, not specifically for handling Lambda failures.
- Why rejected: Kinesis is over-complicated for this use case, and using it as a DLQ introduces unnecessary complexity compared to using a simpler, dedicated service like SQS.
C) Configure the Lambda function with an Amazon Simple Queue Ser...
Author: Ishaan · Last updated Jul 14, 2026
A company has built a serverless application for its ecommerce website. The application includes a REST API in Amazon API Gateway that invokes an AWS Lambda function. The Lambda function processes data and stores the data in Amazon DynamoDB table. The Lambda function calls a third-party stock application API to process the order. After the ordered is processed, the Lambda function returns an HTTP 200 status code with no body to the client.
During peak usage when the API calls exceeds a certain threshold, the third-par...
To address the scenario, we need to design a solution that avoids overwhelming the third-party stock application, especially during peak usage. This implies that we need to introduce an approach that can handle backpressure and allow for throttling of requests to the stock application without losing any data. Let’s evaluate each option and consider which one best fits the use case:
Option A: Configure the REST API in API Gateway to write the requests directly into DynamoDB. Configure a DynamoDB intrinsic function to perform the transformation. Set up a DynamoDB stream to call the third-party stock application API with each new row. Delete the Lambda function.
- Pros: DynamoDB streams are useful for triggering actions based on changes to DynamoDB tables. This approach allows for some asynchronous processing, where the Lambda function can be triggered by changes in the database.
- Cons: This approach does not help with throttling or limiting requests to the third-party stock application. It may still lead to overwhelming the stock API during peak times since there is no mechanism in place to control the rate of requests being made.
- Best Use Case: This approach could be useful if DynamoDB was the main source of truth for data and if the goal was simply to process data changes asynchronously, but it is not ideal for handling traffic spikes to a third-party API.
Option B: Configure the REST API in API Gateway to write the requests directly into an Amazon Simple Queue Service (Amazon SQS) queue. Configure the Lambda function with a reserved concurrency equal to the third-party stock application's threshold. Set Lambda function to process the messages from the SQS queue.
- Pros: SQS is a reliable message queue that can buffer requests, allowing them to be processed at a manageable rate. The Lambda function can be configured with reserved concurrency to limit the number of concurrent invocations, which prevents overwhelming the stock API. This solution ensures that the third-party stock application is not bombarded with requests beyond its capacity.
- Cons: Requires setting up the queue, Lambda function, and managing concurrency, but these are manageable tasks. No major drawbacks, as it fits the requirement of rate-limiting requests.
- Best Use Case: This is a perfect use case for preventing overloading of a third-party service by using backpressure and controlled processing. It’s also ideal for decoupling the API calls from the Lambda function’s execution.
Op...
Author: Emma · Last updated Jul 14, 2026
A company hosts its application on AWS. The application runs on an Amazon Elastic Container Service (Amazon ECS) cluster that uses AWS Fargate. The cluster runs behind an Application Load Balancer. The application stores data in an Amazon Aurora database. A developer encrypts and manages database credentials inside the application.
The company wants to use a more s...
To address the company's requirement of securing database credentials with periodic rotation and minimizing operational overhead, let's evaluate each option based on its functionality, integration with other AWS services, and ease of use.
Option A: Migrate the secret credentials to Amazon RDS parameter groups. Encrypt the parameter by using an AWS Key Management Service (AWS KMS) key. Turn on secret rotation. Use IAM policies and roles to grant AWS KMS permissions to access Amazon RDS.
- Pros: Amazon RDS parameter groups are useful for setting configuration options for RDS instances, including database passwords. They can be encrypted with KMS and integrated with IAM policies.
- Cons: RDS parameter groups are not designed for credential management or rotation. While they offer encryption with KMS, they do not provide built-in support for automatic credential rotation like AWS Secrets Manager. This means that manual rotation would be required, increasing operational overhead.
- Best Use Case: This option would be suitable for managing RDS configuration settings but not for managing secure application credentials with automatic rotation.
Option B: Migrate the credentials to AWS Systems Manager Parameter Store. Encrypt the parameter by using an AWS Key Management Service (AWS KMS) key. Turn on secret rotation. Use IAM policies and roles to grant Amazon ECS Fargate permissions to access AWS Secrets Manager.
- Pros: AWS Systems Manager Parameter Store is designed to store configuration and secrets securely. It supports encryption with KMS and is easy to integrate with ECS.
- Cons: Parameter Store supports parameter versioning, but it does not have built-in automatic secret rotation like AWS Secrets Manager. Rotation would need to be managed separately.
- Best Use Case: This option is useful for securely storing configuration data and credentials but would still require custom work for secret rotation, making it a bit more operationally intensive than using Secrets Manager.
Option C: Migrate the credentials to ECS Fargate environment variables. Encrypt the credentials by using an AWS Key Management Service (AWS KMS) key. Turn on secret rotation. Use ...
Author: Amira · Last updated Jul 14, 2026
A company has a mobile app. The app includes an Amazon API Gateway REST API that invokes AWS Lambda functions. The Lambda functions process data from the app.
The company needs to test updated Lambda functions that have new features. The company must conduct these tests with a subset of users before deployment. The...
Let's evaluate the options based on the requirements: testing updated Lambda functions with a subset of users before deployment, minimizing operational effort, and not affecting other users.
Option A: Create a new version of each Lambda function with a weighted alias. Configure a weight value for each version of the Lambda function. Update the new weighted alias Amazon Resource Name (ARN) in the REST API.
- Pros: Weighted aliases in AWS Lambda allow traffic to be split between different versions of a function. This allows for A/B testing or canary releases, where a certain percentage of traffic is routed to the updated version, and the rest goes to the stable version. This option is straightforward and integrates directly with API Gateway by specifying the version’s ARN.
- Cons: It requires some setup of Lambda versions and aliases, but once set up, it provides an efficient way to test new Lambda versions with minimal operational overhead. No need for additional services or complex configuration.
- Best Use Case: This is a perfect fit for testing new Lambda versions with minimal impact on other users. This solution allows for gradual deployment and testing without disrupting the entire user base.
Option B: Create a new REST API in API Gateway. Set up a Lambda proxy integration to connect to multiple Lambda functions. Enable canary settings on the deployment stage. Specify a smaller percentage of API traffic to go to the new version of the Lambda function.
- Pros: Canary deployments in API Gateway allow for testing new versions of the function with a subset of users, providing a controlled rollout. It can be set to route a specific percentage of traffic to the new version.
- Cons: Creating an entirely new REST API might introduce unnecessary complexity and operational overhead. You’d need to manage a separate API and ensure traffic routing between old and new APIs. This increases complexity without adding much value compared to using aliases.
- Best Use Case: Canary deployments are useful in this scenario, but creating a new API is unnecessary, and the added overhead makes it less ideal.
Option C: Creat...
Author: Emma · Last updated Jul 14, 2026
A developer works for a company that only has a single pre-production AWS account with an AWS CloudFormation AWS Serverless Application Model (AWS SAM) stack. The developer made changes to an existing AWS Lambda function specified in the AWS SAM template and additional Amazon Simple Notification service (Amazon SNS) topics.
The developer wants to do a one-time deploy of the changes to test if the changes are working. The developer does ...
The main objective here is to test changes to the AWS SAM stack, including the Lambda function and SNS topics, without impacting the existing pre-production environment. The solution must also be quick, temporary, and not interfere with ongoing application usage by other team members.
Option A: Use the AWS SAM CLI to package and deploy the SAM application to the pre-production AWS account. Specify the debug parameter.
- Pros: The AWS SAM CLI allows you to quickly package and deploy changes. The `debug` parameter provides insights into deployment issues.
- Cons: Deploying directly to the pre-production account, even with debugging, can impact the existing application and other team members if the changes introduce conflicts or errors. This does not meet the requirement to avoid affecting the existing pre-production application.
- Best Use Case: This option is useful for debugging deployments but is not ideal for testing changes without impacting production resources.
Option B: Use the AWS SAM CLI to package and create a change set against the pre-production AWS account. Execute the change set in a new AWS account designated for a development environment.
- Pros: Using a change set ensures that only the intended changes will be deployed. Executing the change set in a separate development account isolates the test environment from the pre-production environment.
- Cons: This solution involves a bit more setup because it requires managing both the change set and a separate development AWS account. The additional step of creating and configuring a new account might introduce some overhead.
- Best Use Case: This approach works well if you want to test changes in a new environment without affecting the existing environment. However, managing a new AWS account just for one-time testing may be overkill for this case.
Option C: Use the AWS SAM CLI to package and deploy the SAM application to a new AWS ac...
Author: ThunderBear · Last updated Jul 14, 2026
A company built an online event platform. For each event, the company organizes quizzes and generates leaderboards that are based on the quiz scores. The company stores the leaderboard data in Amazon DynamoDB and retains the data for 30 days after an event is complete. The company then uses a scheduled job to delete the old leaderboard data.
The DynamoDB table is configured with a fixed write capacity. During the months when many events occur, the DynamoDB write API requests ar...
To meet the requirements of optimizing write throughput while efficiently deleting old leaderboard data in DynamoDB, let's evaluate each of the options based on their suitability for solving the issue of throttling during scheduled deletions:
Option A: Configure a TTL attribute for the leaderboard data.
- Pros: DynamoDB's Time-to-Live (TTL) feature automatically deletes items after a specified expiration time. By setting a TTL attribute, the leaderboard data can be automatically deleted 30 days after an event ends, without requiring manual intervention or additional resources. This solution ensures that data is deleted automatically, reducing the operational overhead and write capacity burden during scheduled deletions.
- Cons: There is a slight delay between the TTL expiration time and the actual deletion, depending on the internal process of DynamoDB. However, this delay is usually minimal and does not cause significant issues.
- Best Use Case: This option is the most efficient for automatically managing data retention without requiring additional jobs or manual deletions. It optimizes write throughput by preventing the need for heavy delete operations during peak times.
Option B: Use DynamoDB Streams to schedule and delete the leaderboard data.
- Pros: DynamoDB Streams allows for real-time tracking of changes to a table, and it could potentially trigger a Lambda function to handle deletions or other actions.
- Cons: While DynamoDB Streams is excellent for capturing changes to the table, using it to schedule and delete data introduces unnecessary complexity. It’s primarily designed for reacting to changes, not for automatic deletion of data after a fixed period. Additionally, managing deletes through streams would likely result in more operational overhead than simply using TTL, making it an overcomplicated solution.
- Best Use Case: DynamoDB Streams is great for real-time data replication or change tracking, but it is not ideal for scheduled deletions of data based on age.
Option ...
Author: Olivia Johnson · Last updated Jul 14, 2026
A company uses an AWS Lambda function that reads messages from an Amazon Simple Queue Service (Amazon SQS) standard queue. The Lambda function makes an HTTP call to a third-party API for each message. The company wants to ensure that the Lambda function does not ove...
The goal is to ensure that the Lambda function does not overwhelm the third-party API with more than two concurrent requests. Let's analyze each option:
A) Configure a provisioned concurrency of two on the Lambda function.
Provisioned concurrency ensures that a set number of Lambda function instances are kept warm and ready to serve requests. While this ensures that Lambda can handle a set number of concurrent executions, it does not limit the concurrency of requests per Lambda invocation when processing messages from Amazon SQS. It only guarantees that two instances of the function are pre-initialized, not that only two concurrent API calls are made to the third-party service. Hence, this option would not directly meet the requirement.
B) Configure a batch size of two on the Amazon SQS event source mapping for the Lambda function.
Configuring a batch size of two means that Lambda will process two messages from the SQS queue at once per invocation. However, this could lead to up to two concurrent HTTP requests to the third-party API, which still meets the requirement of limiting the number of concurrent requests to two. However, if there is a situation where only one message is in the queue, only one HTTP request will be sent, so this is not as flexible as the next option.
C) Configu...
Author: Isabella · Last updated Jul 14, 2026
A company is using Amazon API Gateway to develop an API for its application on AWS. A developer needs to test and generate API responses. Other teams are required to test the ...
To meet the requirements of testing and generating API responses quickly for other teams, let's analyze the options:
A) Set up a mock integration request in API Gateway. Configure the method's integration request and integration response to associate a response with a given status code.
This option is ideal for testing because a mock integration in API Gateway allows the developer to simulate responses for specific HTTP requests without needing to implement backend logic. The developer can define fixed responses, status codes, and body content, providing immediate feedback to the other teams for testing purposes. This solution meets the need for quick testing and response generation.
B) Set up the request validators in the API's OpenAPI definition file. Import the OpenAPI definitions into API Gateway to test the API.
Request validators are useful for validating incoming requests against defined models, but they are focused on ensuring that the request is well-formed. While important for input validation, they do not provide the functionality for generating mock responses or testing responses from the API, so they would not help in this scenario where the goal is to generate responses for testing.
C) Set up a gateway response for the API in API Gateway. Configure response headers with hardcoded HTTP...
Author: Sophia · Last updated Jul 14, 2026
A company is releasing a new feature. Users can request early access to the new feature by using an application form. The company expects a surge of requests when the application form becomes available. Each request will be stored as an item in an Amazon DynamoDB table.
Each item will contain the user's username, the submission date, and a validation status of UNVALIDATED. VALID, or NOT VALID. Each item also will contain the user's rating of the process on a scale of 1 to 5.
Each user can ...
To ensure that the workload is well-distributed across DynamoDB partitions, it’s important to select a partition key that has high cardinality and randomness. Let's analyze each option:
A) Username
Using the `username` as the partition key could lead to uneven distribution if many users have similar usernames or if there are highly active users who repeatedly request access. This could result in "hot" partitions, where a disproportionate number of requests are stored in a few partitions, affecting performance. Therefore, using `username` alone would not effectively distribute the data across partitions.
B) Submission date
The `submission date` would result in poor partition distribution because it would likely cause many items to be grouped together by date. For instance, a surge of requests on the same day would end up in the same partition, causing hotspots. If a large number of requests are submitted within a short time frame, this could lead to throttling and performance degradation.
C) Validation status
Using `validation status` as a partition key would not work well either, as there are only three possible values: `UNVALIDATED`, `VALID`, and `NOT VALID`. This has low cardinality and could lead to skewed partitioni...
Author: Maya · Last updated Jul 14, 2026
A developer is creating a publicly accessible enterprise website consisting of only static assets. The developer is hosting the website in Amazon S3 and serving the website to users through an Amazon CloudFront distribution. The users of this application must not be able to access the application content directly f...
To ensure that users can only access the content through Amazon CloudFront and not directly from the S3 bucket, the solution needs to prevent public access to the S3 bucket while still allowing CloudFront to serve the content. Let’s analyze each option in detail:
A) Create a new origin access control (OAC) in CloudFront. Configure the CloudFront distribution's origin to use the new OAC. Update the S3 bucket policy to allow CloudFront OAC with read and write access to access Amazon S3 as the origin.
This solution is the most secure and best practice approach. Origin Access Control (OAC) provides fine-grained access control and is designed to securely allow CloudFront to access the S3 bucket while preventing direct access to the bucket from users. CloudFront uses OAC to authenticate and access the content, ensuring no direct S3 access. This approach prevents any public access and keeps content only accessible via CloudFront. This option meets the requirements securely.
B) Update the S3 bucket settings. Enable the block all public access setting in Amazon S3. Configure the CloudFront distribution's with Amazon S3 as the origin. Update the S3 bucket policy to allow CloudFront write access.
This approach would block all public access to the S3 bucket and configure CloudFront as the origin, which is a step in the right direction. However, allowing "write access" to CloudFront is unnecessary because CloudFront only needs read access to serve content. Moreover, this solution lacks explicit access control for CloudFront to securely access the S3 bucket. The approach could be made more secure by using OAC (Option A) rather than simply mo...
Author: Chloe · Last updated Jul 14, 2026
A developer built an application that calls an external API to obtain data, processes the data, and saves the result to Amazon S3. The developer built a container image with all of the necessary dependencies to run the application as a container.
The application runs locally and requires minimal CPU and RAM resources. The developer has created an Amazon ECS cluster. The developer needs to run the ap...
In this scenario, the goal is to run the containerized application hourly with the least amount of infrastructure management overhead. Let's evaluate the options:
A) Add a capacity provider to manage instances.
A capacity provider is used to manage the scaling of EC2 instances in an ECS cluster. However, this requires more management overhead compared to serverless options. The developer would need to manage EC2 instances, monitor scaling, and ensure that resources are appropriately allocated, which could increase the operational complexity. This is not the best option if minimal infrastructure management is desired.
B) Add an Amazon EC2 instance that runs the application.
Running the application on an EC2 instance means that the developer would need to manage the EC2 instance, including scaling, patching, and monitoring. This option introduces more infrastructure management overhead because the developer would need to ensure that the EC2 instance is always available and has sufficient resources to handle the application. This is not ideal for minimal infrastructure management.
C) Define a task definition with an AWS Fargate launch type.
AWS Fargate is a serverless compute engine for containers that automatically manages the underlying infrastr...
Author: Joseph · Last updated Jul 14, 2026
A company runs its website on AWS. The company posts daily polls on its website and publishes the poll results next day. The website stores user responses in an Amazon DynamoDB table. After the poll results are published, the company does not need to keep the user responses.
A developer needs to implement a solution that will automatically remove old user responses from the DynamoDB table. The developer adds a new expiration_date at...
Let's break down each option to determine which one meets the requirements with the least development effort:
Option A: Create an AWS Lambda function to delete old user responses based on the expiration_date attribute. Create an Amazon EventBridge schedule to run the Lambda function daily.
- Pros:
- Lambda is easy to set up and does not require infrastructure management.
- EventBridge can trigger the Lambda function on a scheduled basis.
- Highly customizable and flexible.
- Cons:
- Requires additional code to implement the deletion logic.
- Involves managing a scheduled job via EventBridge.
- When to use: This is a reasonable solution, but it requires more effort than other options since you need to write code for Lambda, handle scheduling with EventBridge, and potentially monitor the Lambda function for errors.
Option B: Create an AWS Fargate task in Amazon Elastic Container Service (Amazon ECS) to delete old user responses based on the expiration_date attribute. Create an Amazon EventBridge schedule to run the Fargate task daily.
- Pros:
- Fargate abstracts away the infrastructure management.
- Suitable for running containerized tasks.
- Cons:
- Overkill for a task that simply needs to delete old data from DynamoDB.
- More complex setup (you would need to containerize the code, configure ECS, etc.).
- Higher development and operational overhead compared to other options.
- When to use: This approach is better suited for more complex, containerized workloads, but it’s unnecessary for this straightforward data deletion task.
Option C: Create an AWS Glue job to delete old user respo...
Author: MoonlitPantherX · Last updated Jul 14, 2026
A developer is creating a simple proof-of-concept demo by using AWS CloudFormation and AWS Lambda functions. The demo will use a CloudFormation template to deploy an existing Lambda function. The Lambda function uses deployment packages and dependencies stored in Amazon S3. The developer defined an AWS::Lambda::Function resource in a CloudFormation template. The dev...
Let's evaluate each option to determine which one meets the requirements with the least development effort:
Option A: Add the function code in the CloudFormation template inline as the `code` property.
- Pros:
- Inline code is easy to include directly in the CloudFormation template.
- Cons:
- For larger Lambda functions or those with dependencies, this method is not practical. The code could become cumbersome to manage and difficult to maintain within the template.
- The size of inline code in a CloudFormation template is limited (typically a few kilobytes), making this unsuitable for most production-level Lambda functions.
- When to use: This approach could work for very small Lambda functions without dependencies, but it is not suitable for production scenarios where the code or dependencies are stored in Amazon S3.
Option B: Add the function code in the CloudFormation template as the `ZipFile` property.
- Pros:
- Similar to Option A, this would allow you to include the code inline, using the `ZipFile` property.
- Cons:
- The `ZipFile` property allows inline code only, and similar to Option A, it is not practical for larger Lambda functions or when dependencies are stored externally, such as in Amazon S3.
- For larger or production-grade Lambda functions, it’s better to reference external locations (like S3) for the function code.
- When to use: This could be used for small Lambda functions, but it's still impractical when dealing with larger packages or dependenci...
Author: CrystalWolfX · Last updated Jul 14, 2026
A developer is building a microservices-based application by using Python on AWS and several AWS services. The developer must use AWS X-Ray. The developer views the service map by using the console to view the service dependencies. During testing, the developer notices that some services...
Let's analyze each option to determine the best course of action for ensuring that all services appear in the X-Ray service map:
Option A: Modify the X-Ray Python agent configuration in each service to increase the sampling rate.
- Pros:
- Increasing the sampling rate might result in more traces being captured, which could help provide more detailed insights into the services.
- Cons:
- Not directly related to missing services: While increasing the sampling rate can capture more traces, it does not necessarily address the issue of services being completely missing from the X-Ray service map.
- Potential over-sampling: If the sampling rate is increased too much, it can result in unnecessary data, leading to higher costs and potentially noisy metrics.
- When to use: This could be useful for ensuring that more traces are captured, but it won't directly solve the problem of services not appearing in the service map if they are not instrumented or integrated correctly.
Option B: Instrument the application by using the X-Ray SDK for Python. Install the X-Ray SDK for all the services that the application uses.
- Pros:
- Correct approach: For services to appear in the X-Ray service map, they need to be properly instrumented with the X-Ray SDK. This ensures that the services can emit trace data to X-Ray.
- Ensures all services are traced: By installing and using the X-Ray SDK in all the services, the developer will ensure that they send trace data to X-Ray, which will populate the service map.
- Cons:
- Development effort required: This option requires the developer to instrument all the services with the X-Ray SDK. However, this is a standard best practice when using AWS X-Ray to gain visibility into the application's behavior.
- When to use: This is the most suitable sol...
Author: Sofia · Last updated Jul 14, 2026
A developer is building a containerized application on AWS. The application communicates with a third-party service by using API keys. The developer needs a secure way to store the API keys and pass the API keys to ...
To securely store API keys and pass them to a containerized application, the solution must ensure that the API keys are kept secure while still being accessible to the application at runtime. Let's evaluate the options based on security, best practices, and usability.
Option A: Store the API keys as a SecureString parameter in AWS Systems Manager Parameter Store. Grant the application access to retrieve the value from Parameter Store.
- Why this is selected: AWS Systems Manager Parameter Store can store sensitive data like API keys securely as a SecureString. The parameter is encrypted using AWS KMS (Key Management Service), ensuring the keys are protected. By granting the application the appropriate IAM permissions to retrieve the value, this method allows the application to access the API keys securely at runtime.
- Key factor: Parameter Store provides an easy and secure way to store sensitive data and allows controlled access using IAM policies, making it ideal for passing API keys to containerized applications.
Option B: Store the API keys in AWS CloudFormation templates by using base64 encoding. Pass the API keys to the application through container definition environment variables.
- Why this is rejected: Storing API keys directly in CloudFormation templates (even if base64 encoded) is not secure. CloudFormation templates are often stored in version control systems or shared environments, and base64 encoding does not provide real encryption, making the keys potentially exposed to unauthorized users. Environment variables can also be easily accessed if someone gains access to the container, adding security risks.
- Key factor: Base64 encoding is not secure and does not provide proper encryption, so this is not recommended for sensitive information like API keys.
Option C: Add a new AWS CloudFormation parameter to the CloudFormation template. Pass the API keys to the application by using the container definition environment variables.
- Why this is rejected: Passing API keys directly in CloudFormation templates as parameters is a poor practice for security reasons. This method does not provide encryption for the k...
