Amazon Practice Questions, Discussions & Exam Topics by our Authors
A company is developing an application that will be accessed through the Amazon API Gateway REST API. Registered users should be the only ones who can access certain resources of this API. The token being used should expire aut...
Let’s evaluate each option in the context of meeting the requirements of allowing only registered users to access certain API resources, using a token that expires and can be refreshed periodically.
Option A:
Create an Amazon Cognito identity pool, configure the Amazon Cognito Authorizer in API Gateway, and use the temporary credentials generated by the identity pool.
- Explanation: Amazon Cognito identity pools provide temporary AWS credentials for authenticated users, enabling access to AWS resources. However, this option is better suited for scenarios where users need direct access to AWS services like S3, DynamoDB, etc., rather than just restricting access to the API Gateway. It does not focus on user authentication with token expiration and refreshment for API access.
- Key Reasoning: While identity pools are useful for temporary access credentials, they are not designed to manage API access with token expiration and refresh. This is not the most appropriate option for managing API access based on user tokens.
Option B:
Create and maintain a database record for each user with a corresponding token and use an AWS Lambda authorizer in API Gateway.
- Explanation: This option involves using a Lambda authorizer to authenticate users based on a custom database of tokens. While this approach offers flexibility, it introduces complexity in maintaining a custom authentication system, including managing token expiration and refresh processes manually. It would require custom code to handle token validation, expiration, and refresh, which could increase the development and maintenance overhead.
- Key Reasoning: This approach could work, but it requires custom implementation and manual management of token expiration and refresh, which is less efficient compared to using a managed service like Amazon Cognito that handles this functionality natively.
Option C:
Create an Amazon Cognito user pool, configure the Cognito Authorizer in API Gateway, and use the identity or access ...
Author: Julian · Last updated Jul 14, 2026
A company used AWS to develop an application for customers. The application includes an Amazon API Gateway API that invokes AWS Lambda functions. The Lambda functions process data and store the data in Amazon DynamoDB tables.
The company must monitor the entire application to identify potential bottlenecks in...
To solve this problem, the company needs to monitor the entire architecture to identify potential bottlenecks and issues that may affect customers. Here's the reasoning for each option:
Option A: Instrument the application with AWS X-Ray. Inspect the service map to identify errors and issues.
- Reasoning: AWS X-Ray provides detailed tracing of requests as they travel through an application, showing how services such as Lambda, API Gateway, and DynamoDB interact. It can identify bottlenecks, latency, and errors within the system. This option requires minimal development effort since X-Ray automatically instruments many AWS services, and the service map can give a clear visualization of the performance of each component.
- Why not others:
- Lambda: Tracing is built-in with minimal configuration.
- API Gateway and DynamoDB: Both services integrate well with X-Ray, allowing you to see a clear service map of the entire flow.
Use case for other options: This is ideal when needing a comprehensive and holistic view of the architecture. It can easily detect where performance bottlenecks occur and help identify latency across multiple AWS services.
Option B: Configure Lambda exceptions and additional logging to Amazon CloudWatch. Use CloudWatch Logs Insights to query the logs.
- Reasoning: This solution involves adding extra logging and then using CloudWatch Logs Insights to query those logs for errors or performance issues. However, this solution does not provide a high-level, visual view of the entire system and may require more manual effort i...
Author: Nathan · Last updated Jul 14, 2026
A company launched an online portal to announce a new product that the company will release in 6 months. The portal requests that users enter an email address to receive communications about the product. The company needs to create a REST API that will store the email addresses in Amazon DynamoDB.
A developer has created an AWS Lambda function that can store the email addresses. The developer will deploy the Lambda function by using the AWS Serverless A...
In this scenario, the developer needs to expose the AWS Lambda function over HTTP so that it can handle requests from users entering their email addresses. Let's evaluate the options and determine which ones meet the requirements with the least additional configuration:
Option A: Expose the Lambda function by using function URLs.
- Why this is selected: Lambda function URLs is a relatively new feature that allows you to expose a Lambda function directly over HTTP(S) without needing any additional configuration like API Gateway or Load Balancers. It provides a simple and cost-effective way to access Lambda functions via HTTP endpoints. This solution minimizes the setup and is perfect for scenarios where only basic HTTP access to a Lambda function is required.
- Key factor: Lambda function URLs are easy to configure, making it a great fit for this use case, where minimal setup is desired and the goal is to expose the Lambda function over HTTP.
Option B: Expose the Lambda function by using a Gateway Load Balancer.
- Why this is rejected: A Gateway Load Balancer is designed primarily for routing traffic to third-party virtual appliances or for managing network traffic in complex architectures. It’s not typically used for exposing Lambda functions directly. The solution requires more configuration and complexity than necessary for simply exposing a Lambda function.
- Key factor: Gateway Load Balancer is not designed for this specific use case and introduces unnecessary complexity for simply exposing a Lambda function over HTTP.
Option C: Expose the Lambda function by using a Network Load Balancer.
- Why this is rejected: A Network Load Balancer operates at the network layer (Layer 4) and is generally used for TCP/UDP traffic management. It is not designed to directly invoke Lambda functions over HTTP. While Lambda can be used with an NLB via an integration, this setup requires more configuration and management than using a simpler solution like Lambda fun...
Author: VioletCheetah55 · Last updated Jul 14, 2026
A company has a website that displays a daily newsletter. When a user visits the website, an AWS Lambda function processes the browser's request and queries the company's on-premises database to obtain the current newsletter. The newsletters are stored in English. The Lambda function uses the Amazon Translate TranslateText API operation to translate the newsletters, and the translation is displayed to the user.
Due to an increase in popularity, the website's response ...
To address the performance issue and improve the response time of the Lambda function, we need to look for solutions that reduce the load on the database and optimize the translation process.
Option A: Change to asynchronous Lambda function invocation.
- Reasoning: Asynchronous invocation would change the Lambda function to run in the background without waiting for a response, but this does not necessarily solve the problem of the database overload or improve the Lambda function's response time for the user. The Lambda function would still need to query the database and perform the translation, just not in a synchronous manner. It could lead to a delayed user experience instead of improving response time.
- Why rejected: This option does not address the root problem (database load and slow response times). It could potentially worsen the user experience by introducing delays, especially if the Lambda function still needs to query the database during processing.
Option B: Cache the translated newsletters in the Lambda/tmp directory.
- Reasoning: Storing the translated newsletters in the `tmp` directory of the Lambda function can help temporarily store the results, but this directory is not persistent across invocations. Additionally, since Lambda functions can be invoked multiple times and across multiple instances, caching the data in this temporary storage would not persist across invocations or for multiple users. This solution would not be scalable or efficient in the long term.
- Why rejected: Lambda's `tmp` directory is not ideal for caching because it's temporary, not shared across invocations, and can only store up to 512 MB of data. It also would not address the over...
Author: Elijah · Last updated Jul 14, 2026
A developer is monitoring an application that runs on an Amazon EC2 instance. The developer has configured a custom Amazon CloudWatch metric with data granularity of 1 second. If any issues occur, the developer wants to be notified within 30 seconds b...
To meet the requirement of receiving a notification within 30 seconds when an issue occurs based on a custom CloudWatch metric with a 1-second granularity, we need to focus on solutions that can handle high-resolution metrics efficiently and trigger notifications quickly. Let's review each option:
Option A: Configure a high-resolution CloudWatch alarm.
- Reasoning: CloudWatch alarms can be configured with high-resolution metrics (1-second granularity), which allows for the detection of changes in metric data at a very fine level of detail. High-resolution alarms can trigger actions such as sending notifications via Amazon SNS. With a 1-second metric granularity, a high-resolution CloudWatch alarm can detect issues very quickly and notify the developer within the 30-second time frame.
- Why selected: High-resolution CloudWatch alarms are designed to handle metrics with a granularity as fine as 1 second. This is the best fit for the requirement to monitor the application closely and receive notifications within a short time (30 seconds).
Option B: Set up a custom CloudWatch dashboard.
- Reasoning: A CloudWatch dashboard allows for visualizing metrics but does not trigger alarms or notifications. It provides a way to monitor and view metrics but does not directly address the requirement of receiving notifications based on metric thresholds.
- ...
Author: Zara · Last updated Jul 14, 2026
A company has a web application that contains an Amazon API Gateway REST API. A developer has created an AWS CloudFormation template for the initial deployment of the application. The developer has deployed the application successfully as part of an AWS CodePipeline continuous integration and continuous delivery (CI/CD) process. All resources and methods are available through the deployed stage endpoint.
The CloudFormation template contains the following resource types:
=E2=80=A2 AWS::ApiGateway::RestApi
=E2=80=A2 AWS::ApiGateway::Resource
=E2=80=A2 AWS::ApiGateway::Method
=E2=80=A2 AWS::ApiGateway::Stage
=E2=80=A2 AWS::ApiGateway::Deployment
The developer adds a new resource to the REST...
To solve the issue where new methods are returning 404 (Not Found) errors after redeploying the CloudFormation stack, we need to ensure that the API Gateway deployment properly reflects the newly added resources and methods.
Option A: Specify the disable-rollback option during the update-stack operation.
- Reasoning: The `--disable-rollback` option prevents CloudFormation from rolling back the stack if there is an error during the deployment. This could potentially allow for more debugging if the stack update fails. However, it is not relevant to the issue of the API Gateway methods not being available after deployment. The issue is more about the deployment process not being triggered properly, not a rollback issue.
- Why rejected: Disabling rollback does not address the issue of making new methods available through the API Gateway after deployment.
Option B: Unset the CloudFormation stack failure options.
- Reasoning: Stack failure options (such as rollback) control the behavior of the CloudFormation stack when it encounters an issue. This option does not solve the problem of new API methods not being available. The issue lies in the API Gateway deployment process and not in the failure options of the CloudFormation stack.
- Why rejected: This option does not directly address the cause of the 404 errors in the new API methods. It only impacts how CloudFormation behaves when a failure occurs, which is unrelated to the deployment issue.
Option C: Add an AWS CodeBuild stage to CodePipeline to run the aws apigateway create-deployment AWS CLI command.
- Reasonin...
Author: Ryan · Last updated Jul 14, 2026
A developer updates an AWS Lambda function that an Amazon API Gateway API uses. The API is the backend for a web application.
The developer needs to test the updated Lambda function before deploying the Lambda function to production. The testing must not affect any producti...
Let's analyze each option:
A) Create a canary release deployment for the existing API stage. Deploy the API to the existing stage. Test the updated Lambda function by using the existing URL.
- Key Factors: Canary deployments are used to gradually release changes to a small subset of users. This means that a small percentage of users would be routed to the updated Lambda function, while the majority would still interact with the production version.
- Operational Efficiency: This option allows you to test the new Lambda function in a controlled way, with minimal disruption to production traffic. However, canary releases are generally more suited for gradual rollouts rather than pre-deployment testing.
- Use Case: This could be useful for controlled rollouts to a small portion of users, but not for testing in isolation before full deployment. It risks affecting production users during the test phase, even if only a small percentage is impacted.
B) Update the API Gateway API endpoint type to private. Deploy the changes to the existing API stage. Test the API by using the existing URL.
- Key Factors: Setting the API endpoint to private would restrict access to only authorized VPC or IP addresses. It would limit the potential users who could access the API.
- Operational Efficiency: This is not an ideal solution for testing because it introduces complexity in network configuration and doesn't fully isolate the testing environment from the production environment.
- Use Case: This might be useful if you need to restrict access to the API, but it’s still not the most efficient way to test a Lambda function before deployment. It doesn’t offer clear separation between production and test environments.
C) Create a new test API stage in API Gateway. Add stage variables to deploy the updated Lambda function to only the test stage. Test the updated Lambda function by using the new stag...
Author: Max · Last updated Jul 14, 2026
A developer wants the ability to roll back to a previous version of an AWS Lambda function in the event of errors caused by a new deployment.
H...
Let's evaluate each option:
A) Change the application to use an alias that points to the current version. Deploy the new version of the code. Update the alias to use the newly deployed version. If too many errors are encountered, point the alias back to the previous version.
- Key Factors: Using an alias with versions is an efficient way to manage deployments and rollbacks. The alias ensures that you can smoothly switch between versions without changing the application itself. If issues occur with the new version, you can quickly revert to the previous one.
- Operational Efficiency: This approach minimizes impact because the alias enables a quick rollback, without needing to change application code or configurations. It's also simple to implement and manage.
- Use Case: This works well when you need to roll back quickly with minimal downtime or impact on users, as it offers a direct and straightforward way to revert to the previous version with little disruption.
B) Change the application to use an alias that points to the current version. Deploy the new version of the code. Update the alias to direct 10% of users to the newly deployed version. If too many errors are encountered, send 100% of traffic to the previous version.
- Key Factors: This method uses a canary deployment by routing a small percentage of traffic to the new version. It’s useful when you want to test the new version with a subset of users first. If errors are detected, you can route all traffic back to the previous version.
- Operational Efficiency: This offers a gradual rollout and a safe way to test the new version, but it is slightly more complex than simply switching to a new version directly. It can minimize impact by limiting exposure to only a small portion of users initially.
- Use Case: This is ideal for cases where you want to test the new version with a small group of users before fully rolling it out. However, it’s more complex than option A for a minimal impact rollback.
C) Do not make any changes to the application. Deploy the new version of the code. If too many errors are encountered, point the application back to the previous version using the version number in the Amazon Resourc...
Author: Akash · Last updated Jul 14, 2026
A company maintains a REST service using Amazon API Gateway and the API Gateway native API key validation. The company recently launched a new registration page, which allows users to sign up for the service. The registration page creates a new API key using CreateApiKey and sends the new key to the user. When the user attempts to call the API using this key, the us...
Let's evaluate each option:
A) The createDeployment method must be called so the API can be redeployed to include the newly created API key.
- Key Factors: Calling `createDeployment` redeploys the API, but it does not specifically address the need to associate the new API key with a usage plan, which is the root cause of the issue here. Redeploying without associating the API key with a usage plan would not resolve the 403 Forbidden error.
- Operational Efficiency: This is not the correct solution because redeploying the API does not resolve the issue of API key association. The issue likely lies in the API key not being properly associated with a usage plan.
- Use Case: This could be helpful in other cases where the API changes need to be applied, but it won't resolve the permission issue for new users.
B) The updateAuthorizer method must be called to update the API's authorizer to include the newly created API key.
- Key Factors: The API key is typically validated by the API Gateway’s native API key validation mechanism, not through an authorizer. Authorizers are typically used for custom authentication (e.g., Cognito or Lambda authorizers) and would not directly impact the validation of an API key.
- Operational Efficiency: This would be an incorrect approach because the API key validation doesn’t involve updating the authorizer.
- Use Case: Authorizers are needed for more complex authentication mechanisms but are not required for API key validation.
C) The importApiKeys method must be called to import all newly created API keys into the current stage of the ...
Author: Sophia Clark · Last updated Jul 14, 2026
A company uses an AWS CloudFormation template to deploy and manage its AWS infrastructure. The CloudFormation template creates Amazon VPC security groups and Amazon EC2 security groups.
A manager finds out that some engineers modified the security groups of a few EC2 instances for ...
Let's evaluate each option:
A) Add a Conditions section statement in the source YAML file of the template. Run the CloudFormation stack.
- Key Factors: The `Conditions` section in a CloudFormation template is used to control the creation of resources based on parameters or other conditions. However, this only affects resource creation at the time of stack deployment and does not track changes to existing resources.
- Operational Efficiency: This solution would not help in detecting modifications made to security groups after the stack was deployed. The `Conditions` section is meant for controlling resource creation during the initial deployment, not for tracking subsequent changes.
- Use Case: This would be applicable only during initial stack deployment or when specific conditions control the resource creation, but not for monitoring existing resources after deployment.
B) Perform a drift detection operation on the CloudFormation stack.
- Key Factors: Drift detection is a feature of CloudFormation that allows you to detect whether the configuration of resources in a stack has been modified outside of CloudFormation. This would directly allow you to identify if and how the EC2 or VPC security groups have been changed.
- Operational Efficiency: Drift detection compares the current configuration of resources with the expected configuration defined in the CloudFormation template. If modifications were made to the security groups (e.g., by the engineers for testing), drift detection will identify those changes.
- Use Case: This is the best solution for identifying changes to the security groups managed by CloudFormation. It provides a way to detect and report modifications to resources that have drifted from the...
Author: Elizabeth · Last updated Jul 14, 2026
An IAM role is attached to an Amazon EC2 instance that explicitly denies access to all Amazon S3 API actions. The EC2 instance credentials file specifies the IAM access key and secret access key, which allow full administrative access.
Give...
Let's evaluate the scenario:
The key point here is that multiple IAM access modes exist for the EC2 instance. This means the EC2 instance has:
1. An IAM role attached to the instance that explicitly denies access to all Amazon S3 API actions.
2. Explicit access credentials (IAM access key and secret access key) specifying full administrative access, which allows unrestricted access to S3 and other AWS resources.
How IAM Policy Evaluation Works:
IAM policies are evaluated based on a deny-over-permit model. In this case:
- The IAM role attached to the EC2 instance explicitly denies access to all S3 actions. Deny statements in IAM policies take precedence over Allow statements.
- The credentials file containing the IAM access key and secret access key that allows full administrative access would normally permit the instance to perform any S3 action, including access to all buckets. However, this is overridden by the explicit deny present in the IAM role policy, which prevents any S3 actions regardless of the administrative permissions granted by the access key and secret key.
Option Analysis:
A) The EC2 instance will only be able to list the S3 buckets.
- Reasoning: Since there is an explicit deny on all S3 actions from the IAM role, this option is incorrect. The deny takes precedence, so the EC2 instance won't be able to perform any S3 actions at all, including listing the buckets.
- Use Case: This would be true if there were an Allow policy overriding the deny, but it’s not the case here.
B) The EC2 instance will only be able to list the contents of one S3 bucket at a time.
- Reasoning: L...
Author: Zara · Last updated Jul 14, 2026
A company uses an AWS Lambda function to transfer files from an Amazon S3 bucket to the company's SFTP server. The Lambda function connects to the SFTP server by using credentials such as username and password. The company uses Lambda environment variables to store these credentials.
...
To address the requirement of implementing encrypted username and password credentials for the AWS Lambda function, let's evaluate the options based on security, scalability, and best practices.
A) Remove the user credentials from the Lambda environment. Implement IAM database authentication.
- Analysis: This option suggests replacing the use of credentials (username and password) for connecting to the SFTP server with IAM database authentication. However, IAM database authentication is typically used for database connections (such as RDS, Redshift, or Aurora) and not for connecting to an SFTP server. SFTP servers do not support IAM authentication natively. Therefore, this solution is not applicable for the current use case.
- Rejection Reason: IAM database authentication is irrelevant to the SFTP connection.
B) Move the user credentials from Lambda environment variables to AWS Systems Manager Parameter Store.
- Analysis: AWS Systems Manager Parameter Store allows you to securely store configuration data, such as database credentials, API keys, or in this case, SFTP credentials. You can store the credentials as SecureString (which encrypts them using KMS), and Lambda can retrieve them programmatically at runtime. This method ensures that sensitive information is not exposed in the environment variables and provides encryption both at rest and in transit.
- Strengths: Parameter Store offers encryption, version control, and fine-grained access controls via IAM policies.
- Selected Option Rationale: This option meets the encryption and security requirements and follows best practices for storing sensitive data.
...
Author: Aarav · Last updated Jul 14, 2026
A developer is creating a new batch application that will run on an Amazon EC2 instance. The application requires read access to an Amazon S3 bucket. The developer needs to follow security best practices...
To grant the EC2 instance read access to the Amazon S3 bucket, we need to follow AWS security best practices, such as using IAM roles for resource access. Let's evaluate each option based on security, scalability, and compliance with AWS best practices.
A) Add the permissions to an IAM policy. Attach the policy to a role. Attach the role to the EC2 instance profile.
- Analysis: This is the recommended and most secure approach. An IAM role can be created with the appropriate S3 permissions and then associated with an EC2 instance profile. This way, the EC2 instance assumes the role at runtime to get the necessary permissions to access the S3 bucket. It avoids hardcoding credentials in the instance and ensures that permissions are dynamically granted.
- Strengths: It follows the principle of least privilege, is scalable, and avoids unnecessary exposure of credentials. Additionally, roles can be easily audited and tracked.
- Selected Option Rationale: This is the correct, secure, and scalable method, as it allows for fine-grained access control with minimal security risks.
B) Add the permissions inline to an IAM group. Attach the group to the EC2 instance profile.
- Analysis: IAM groups are intended for managing permissions for users, not EC2 instances. IAM groups are used for aggregating permissions for multiple IAM users, not EC2 instances. Attaching an IAM group to an EC2 instance profile is not valid because groups cannot be directly assigned to EC2 instances.
- Rejection Reason: This approach is not applicable to EC2 instances, as IAM gr...
Author: Sam · Last updated Jul 14, 2026
A company has an application that receives batches of orders from partners every day. The application uses an AWS Lambda function to process the batches.
If a batch contains no orders, the Lambda function must publish to an Amazon Simple Notification Service (Amazon SNS) topic as soo...
To meet the requirement with the least implementation effort, we need to design a solution that can quickly identify batches with no orders and then trigger a notification via Amazon SNS. Let’s analyze the options in detail:
A) Update the existing Lambda function's code to send an Amazon CloudWatch custom metric for the number of orders in a batch for each partner.
- Analysis: By updating the Lambda function to send a custom metric to CloudWatch, we can track the number of orders in each batch. This would allow us to monitor the metric and trigger alerts when the number of orders is zero. However, this solution introduces additional complexity because we would still need to set up a CloudWatch alarm (in another step) to act on the custom metric. It is not a complete solution on its own.
- Strengths: It can be useful if the company wants to monitor order counts over time, but it doesn’t meet the "immediate" notification requirement without additional steps (like setting up an alarm).
- Rejection Reason: While a valid solution, it involves multiple steps and doesn't provide the immediate action required by the problem statement without additional configuration.
B) Create a new Lambda function as an Amazon Kinesis data stream consumer. Configure the new Lambda function to track orders and to publish to the SNS topic when a batch contains no orders.
- Analysis: This option would involve setting up a Kinesis data stream to track each batch of orders. The new Lambda function would consume data from the stream and check whether there are any orders in the batch. If no orders are found, it would publish to SNS. However, this is over-engineered for the use case. Setting up a Kinesis stream adds unnecessary complexity for just tracking batches with no orders.
- Rejection Reason: While effective, it introduces unnecessary complexity (e.g., Kinesis setup and stream management) for this use case. The goal is to minimize implementation effort.
C) Set up an Amazon CloudWatch alarm that will send a notification to the SNS topic when the value of the custom metric is 0.
- Analysis: This option works well in conjunction with Option A. If you send a custom metric (like the number of order...
Author: BlazingPhoenix22 · Last updated Jul 14, 2026
A developer has an application that uses an Amazon DynamoDB table with a configured local secondary index (LSI). During application testing, the DynamoDB table metrics report a ProvisionedThroughputExceededException error message. The number of requests mad...
Let's analyze each option based on the error message and the scenario provided:
A) The data in the table's partition key column is not evenly distributed.
- Analysis: This option suggests that the issue may be caused by an uneven distribution of data across the table's partitions, which can result in "hot partitions" that exceed the provisioned throughput. When there is an uneven distribution, some partitions receive more requests than others, causing throttling on those partitions.
- Rejection Reason: While this can be a cause of throughput issues, the error specifically mentioned that the ProvisionedThroughputExceededException was triggered, and it was not due to exceeding the table's overall provisioned capacity. If the table's partition key was skewed, you would typically see issues with the table's primary key, not with a local secondary index (LSI). LSIs also use the same partition key as the table, so the root cause here is more likely related to the LSI itself.
B) The LSI's capacity is different from the table's capacity.
- Analysis: This is a key point to consider. When using LSIs in DynamoDB, the capacity for the LSI is separate from the table's main capacity. If the LSI experiences a higher request rate than its provisioned throughput limits, it can result in a ProvisionedThroughputExceededException on the LSI, even though the table's capacity is not exceeded.
- Strengths: The table and LSI have separate throughput limits, so if the LSI is not provisioned with enough read/write capacity units, it can result in throttling even if the table's provisioned capacity is not exceeded.
- Selected Option Rationale: ...
Author: GlowingTiger · Last updated Jul 14, 2026
A developer manages a website that distributes its content by using Amazon CloudFront. The website's static artifacts are stored in an Amazon S3 bucket.
The developer deploys some changes and can see the new artifacts in the S3 bucket. However, the changes do no...
To resolve the issue where changes to the static content in an Amazon S3 bucket are not reflecting on a website served by Amazon CloudFront, let’s evaluate each option based on how CloudFront and S3 work together:
A) Configure S3 Object Lock to update to the latest version of the files every time an S3 object is updated.
- Analysis: S3 Object Lock is used to prevent objects from being deleted or overwritten for a specified period, typically for compliance purposes. This option does not directly address CloudFront caching behavior or the issue of outdated content being served from the CloudFront cache.
- Rejection Reason: Object Lock does not help with caching or the distribution of new content. It is primarily a security measure to prevent accidental deletion or modification, not a solution for content delivery issues.
B) Configure the S3 bucket to clear all old objects from the bucket before new artifacts are uploaded.
- Analysis: This option is unnecessary and not recommended. S3 can store multiple versions of objects, and CloudFront serves content based on the version available, even if the object is not removed. Clearing all old objects would remove historical content, which could break references or links. Moreover, it doesn't directly solve the caching issue with CloudFront.
- Rejection Reason: Clearing all objects is disruptive and unnecessary, especially since CloudFront's caching behavior is the root cause here, not the S3 bucket content itself.
C) Set CloudFront to invalidate the cache...
Author: Nathan · Last updated Jul 14, 2026
A company has a development team that uses AWS CodeCommit for version control. The development team has CodeCommit repositories in multiple AWS accounts. The team is expanding to include developers who work in various locations.
The company must ensure that the developers have s...
To determine the most operationally efficient solution, let's review the options in detail:
A) Configure IAM roles for each developer and grant access individually.
- Pros: This approach provides fine-grained control over access. Each developer would have individual IAM roles that allow access to specific CodeCommit repositories across multiple AWS accounts. This is a secure method and follows the principle of least privilege.
- Cons: The administrative overhead increases significantly as the team expands. Each developer would require their own role and permissions across multiple accounts, which could be cumbersome to manage and scale. Additionally, as new developers join or leave, the roles must be adjusted manually, increasing the potential for errors.
- Best use case: This is a good option for a smaller, highly controlled environment, where there is a need for custom roles per developer, but it does not scale well for a large, geographically distributed team.
B) Configure permission sets in AWS IAM Identity Center to grant access to the accounts.
- Pros: AWS IAM Identity Center (formerly AWS SSO) allows centralized user management and access control, which is highly scalable. Developers can access repositories across multiple AWS accounts using a single set of credentials, significantly reducing administrative overhead. IAM Identity Center integrates with various identity providers (like Active Directory or SAML) for single sign-on (SSO), providing both security and ease of use.
- Cons: This solution requires setup and configuration of IAM Identity Center, but once set up, it is much easier to manage user access at scale.
- Best use case: Ideal for large teams across multiple locations that need cent...
Author: Olivia Johnson · Last updated Jul 14, 2026
A developer received the following error message during an AWS CloudFormation deployment:
DELETE_FAILED (The following resource(s) failed to delete: [ASGInstanceRole12...
To resolve the issue of a CloudFormation deployment failing to delete the ASGInstanceRole12345678 resource, let's analyze the available options:
A) Contact AWS Support to report an issue with the Auto Scaling Groups (ASG) service.
- Reasoning: Contacting AWS Support could be a last resort if the issue is complex and cannot be resolved through other means. However, this should not be the first action. The issue described is likely related to resource dependencies, and it's typically something that can be fixed by adjusting the CloudFormation template or settings.
- Best use case: This is not the best option for resolving this specific error as it is a common issue related to dependencies or resource deletion policies, not an issue with the ASG service itself.
B) Add a DependsOn attribute to the ASGInstanceRole12345678 resource in the CloudFormation template. Then delete the stack.
- Reasoning: The `DependsOn` attribute specifies that a particular resource should be created or deleted before or after another resource. However, this would not solve the issue of deletion failure if the problem is related to the resource not being cleaned up correctly. The error message indicates a deletion failure, not a creation failure. Therefore, adding a `DependsOn` would not address the root cause of the issue.
- Best use case: This is generally useful when you want to control the order of resource creation or deletion, but it does not directly resolve issues related to resources that cannot be deleted due to dependencies or other configurations.
C) Modify the CloudFormation template to retain the ASGInstanceRole12345678 resource. Then manually delete the resource...
Author: Leah · Last updated Jul 14, 2026
A company runs a critical application on Amazon Elastic Container Service (Amazon ECS) by using Amazon EC2 instances. The company needs to migrate the application to Amazon ECS on AWS Fargate. A developer is configuring Fargate and the ECS capacity provide...
To migrate an application to Amazon ECS on AWS Fargate with the least downtime, the solution must allow the application to run both on EC2 and Fargate during the migration process and ensure that the ECS cluster is properly associated with the correct capacity providers.
Let's break down each option and evaluate its merits:
Option A: Use the PutClusterCapacityProviders API operation to associate the ECS cluster with the FARGATE and FARGATE_SPOT capacity provider strategies. Use FARGATE as Provider 1 with a base value. Use FARGATE_SPOT as Provider 2 for failover.
- Why this is rejected: This approach uses FARGATE as the primary capacity provider (Provider 1) and FARGATE_SPOT as a failover provider. While this does provide failover in case of issues with FARGATE, it is not optimal for minimizing downtime during migration. The configuration could lead to instances being scheduled on FARGATE_SPOT only when FARGATE is unavailable, which doesn't support a smooth transition during migration.
- Key factor: The failover approach doesn't allow both capacity providers to actively manage tasks across Fargate and EC2 in a way that facilitates a smooth, gradual migration.
Option B: Use the CreateCapacityProvider API operation to associate the ECS cluster with the FARGATE and FARGATE_SPOT capacity provider strategies. Use FARGATE as Provider 1 with a base value. Use FARGATE_SPOT as Provider 2 for failover.
- Why this is rejected: This option uses CreateCapacityProvider API to define the capacity providers, but it still prioritizes FARGATE and FARGATE_SPOT in a failover scenario (with FARGATE as Provider 1). Although this solution might ensure availability of tasks when transitioning, it doesn't fully support a seamless migration from EC2 to Fargate because FARGATE_SPOT would only be used in the event of failure, potentially causing instability during the migration.
- Key factor: Similar to Option A, it lacks a more controlled approach for gradually shifting workloads to Fargate.
Option C: Use the PutClusterCapacityProviders API operation to associate t...
Author: Sofia2021 · Last updated Jul 14, 2026
A company has a web application that is hosted on AWS. The application is behind an Amazon CloudFront distribution. A developer needs a dashboard to monitor error rates and anomalies of the CloudFront distribution as frequently as possi...
To meet the requirement of monitoring error rates and anomalies of a CloudFront distribution as frequently as possible, let's break down each option:
A) Stream the CloudFront distribution logs to an Amazon S3 bucket. Detect anomalies and error rates by using Amazon Athena.
- Reasoning: CloudFront access logs can be streamed to Amazon S3, and Amazon Athena can be used to run queries on the logs to detect errors and anomalies. While this setup would allow you to analyze log data, it isn't real-time. Athena queries can be scheduled, but they don't offer near-real-time monitoring. The query execution might also have a delay between log generation and detection, so this option is less suitable for real-time anomaly detection.
- Best use case: This is suitable for periodic log analysis or long-term trends, but it does not meet the "real-time" monitoring requirement.
B) Enable real-time logs on the CloudFront distribution. Create a data stream in Amazon Kinesis Data Streams.
- Reasoning: Enabling real-time logging on CloudFront and streaming the logs to Amazon Kinesis Data Streams provides near-instant data flow, which is crucial for detecting anomalies and errors immediately. This approach provides a continuous stream of CloudFront logs and can be integrated with various services for analysis in real-time.
- Best use case: This is ideal for real-time error and anomaly detection, as the data is available for immediate analysis. The use of Kinesis Data Streams provides the scalability and speed necessary for real-time processing.
C) Set up Amazon Kinesis Data Streams to send the logs to Amazon OpenSearch Service by using an AWS Lambda function. Make a dashboard in OpenSearch Dashboards.
- Reasoning: This is a powerful solution for real-time monitoring. Kinesis Data Streams can be used to stream logs to Amazon OpenSearch Service, where the logs are indexed and made available for querying. By using AWS Lambda, you can perform custom processing of the logs before storing them in OpenSearch. OpenSearch Dashboards can then be used to create real-time visualizations and dashboards to monitor error rates and anomalies. This setup is highly scalable and provides real-time insi...
Author: Manish · Last updated Jul 14, 2026
A developer creates an Amazon DynamoDB table. The table has OrderID as the partition key and NumberOfItemsPurchased as the sort key. The data type of the partition key and the sort key is Number.
When the developer queries the table, the results are sorted by NumberOfItemsPurchased in ascending order. The deve...
To meet the requirement of sorting the query results by NumberOfItemsPurchased in descending order, let's evaluate each option:
A) Create a local secondary index (LSI) on the NumberOfItemsPurchased sort key.
- Reasoning: A Local Secondary Index (LSI) allows you to query the table with a different sort key and can be sorted in either ascending or descending order. However, LSIs are only useful when you want an alternative sort key to query by, and since the problem is specifically about changing the order of the results, simply creating an LSI on the same sort key does not solve the sorting issue directly.
- Best use case: This would be useful if you wanted a completely different query pattern (i.e., querying by a different sort key), but it is unnecessary for changing the sorting order of the NumberOfItemsPurchased.
B) Change the sort key from NumberOfItemsPurchased to NumberOfItemsPurchasedDescending.
- Reasoning: Changing the sort key to NumberOfItemsPurchasedDescending is not an effective approach, as DynamoDB does not support dynamic descending order within the same query. The sort key’s data type and value determine how the records are stored, and you cannot reverse the order simply by changing the name of the key. Additionally, this would require changes to how data is structured, which might not be desirable.
- Best use case: This is a suboptimal solution because it requires modifying the table structure, which is unnecessary and impractical for just sorting query results in descending order.
...
Author: Emma · Last updated Jul 14, 2026
A developer needs to use a code template to create an automated deployment of an application onto Amazon EC2 instances. The template must be configured to repeat deployment, installation, and updates of resources for the application. The template must be able to ...
Let's analyze each option based on the requirements mentioned:
A) Use AWS Amplify for automatic deployment templates. Use a traffic-splitting deployment to copy any deployments. Modify any resources created by Amplify, if necessary.
- Reasoning: AWS Amplify is typically used for developing and deploying web and mobile applications, particularly with frontend development. It automatically manages backend resources (like API, authentication, storage, etc.), but it is not specifically designed to manage EC2-based infrastructure or repetitive deployment of complex environments across multiple instances.
- Why rejected: Amplify is not suited for the requirement of creating EC2 instances and managing rollbacks for such infrastructure, nor for the level of fine-grained control needed over EC2 instances for app deployment, installation, and updates.
- Scenario: Suitable for web and mobile apps with backend integration, but not ideal for EC2 infrastructure and full environment control.
B) Use AWS CodeBuild for automatic deployment. Upload the required AppSpec file template. Save the appspec.yml file in the root directory folder of the revision. Specify the deployment group that includes the EC2 instances for the deployment.
- Reasoning: AWS CodeBuild is a service for building, testing, and packaging code. While it can automate build processes, it doesn't directly handle the creation of EC2 instances or manage infrastructure deployment and updates like the scenario describes. It can be part of a CI/CD pipeline, but it's not a deployment template solution by itself.
- Why rejected: CodeBuild focuses on the build process and not the complete management of deployment, rollback, and EC2 infrastructure. This lacks the broader automation and repeatability needed for entire EC2 environment management.
- Scenario: Ideal for CI/CD pipeline integration, but not for creating EC2 instances or managing infrastr...
Author: StarryEagle42 · Last updated Jul 14, 2026
A developer has a continuous integration and continuous delivery (CI/CD) pipeline that uses AWS CodeArtifact and AWS CodeBuild. The build artifacts are between 0.5 GB and 1.5 GB in size. The builds happen frequently and retrieve many dependencies from CodeArtifact each time.
The builds have been slow because of the time it takes to transfer dependencies. The devel...
Let’s analyze the given options based on the goal of improving build performance by reducing the time it takes to transfer dependencies during frequent builds.
A) Specify an Amazon S3 cache in CodeBuild. Add the S3 cache folder path to the buildspec.yaml file for the build project.
- Reasoning: Amazon S3 can be used to store build artifacts, but using it as a cache for CodeBuild dependencies isn't the most efficient way to reduce dependency retrieval times from CodeArtifact. Each build would still need to fetch the dependencies from CodeArtifact first and store them in the S3 cache. While the S3 cache is helpful for storing artifacts between builds, it doesn’t directly improve the dependency management between CodeArtifact and CodeBuild.
- Why rejected: S3 is not optimized for caching dependencies specifically from CodeArtifact, so the improvement in build speed wouldn't be as significant compared to a local cache. This is not the best approach for dependency reuse.
B) Specify a local cache in CodeBuild. Add the CodeArtifact repository name to the buildspec.yaml file for the build project.
- Reasoning: CodeBuild supports local caching, which can store dependencies on the build environment's local disk and avoid repeatedly downloading them from the remote repository. This option is effective because it directly caches the dependencies pulled from CodeArtifact in the local build environment, so future builds will reuse these cached dependencies.
- Why selected: This solution directly addresses the issue by using a local cache for dependencies. By specifying the CodeArtifact repository in the buildspec file, it ensures that CodeBuild only retrieves dependencies from CodeArtifact that aren’t already cached locally. This...
Author: Leo · Last updated Jul 14, 2026
A company that has large online business uses an Amazon DynamoDB table to store sales data. The company enabled Amazon DynamoDB Streams on the table. The transaction status of each sale is stored in a TransactionStatus attribute in the table. The value of the TransactionStatus attribute must be either failed, pending, or completed.
The company wants to be notified of failed sales where the Price attribut...
Let’s review the options based on the goal of notifying the company about failed sales with a price above a specific threshold, while ensuring minimal development effort.
A) Create an event source mapping between DynamoDB Streams and an AWS Lambda function. Use Lambda event filtering to trigger the Lambda function only if sales fail when the price is above the specified threshold. Configure the Lambda function to publish the data to an Amazon Simple Notification Service (Amazon SNS) topic.
- Reasoning: Using DynamoDB Streams with Lambda is a good approach because DynamoDB Streams can trigger Lambda functions in response to changes in the table. Lambda event filtering would allow you to specify the conditions (such as `TransactionStatus` being "failed" and `Price` exceeding a threshold). Then, the Lambda function can publish the notification to SNS.
- Why selected: This option provides flexibility, and event filtering within Lambda reduces unnecessary invocations. It’s relatively simple to implement and ensures that notifications are sent only when the specific conditions are met.
- Scenario: Ideal for situations where fine-grained control over the events (like filtering based on attributes) is required, and where Lambda is already being used for business logic.
B) Create an event source mapping between DynamoDB Streams and an AWS Lambda function. Configure the Lambda function handler code to publish to an Amazon Simple Notification Service (Amazon SNS) topic if sales fail when price is above the specified threshold.
- Reasoning: Similar to Option A, this option also uses DynamoDB Streams with Lambda. However, in this case, the filtering would need to be handled entirely within the Lambda function handler code. While this still works, it involves slightly more development effort compared to using Lambda event filtering, which can be done declaratively without needing additional code logic.
- Why rejected: While this approach works, it requires writing custom co...
Author: Ella · Last updated Jul 14, 2026
An AWS Lambda function is invoked asynchronously to process events. Occasionally, the Lambda function falls to process events. A developer needs to collect and analyze these failed events to fix the issue.
...
Let's review the options based on the need to collect and analyze failed events from an AWS Lambda function invoked asynchronously.
A) Add logging statements for all events in the Lambda function. Filter AWS CloudTrail logs for errors.
- Reasoning: While logging in Lambda is a good practice, it only captures logs during execution and doesn’t provide an effective mechanism to track failed asynchronous events. AWS CloudTrail primarily logs API calls and not the details of individual Lambda function invocations. Filtering CloudTrail logs for errors would require complex queries, and the failure details might not be sufficient for analysis.
- Why rejected: This method doesn't specifically address collecting failed events in a structured way for later analysis. It also requires manual log filtering and doesn’t handle the failure events as efficiently as other options.
B) Configure the Lambda function to start an AWS Step Functions workflow with retries for failed events.
- Reasoning: AWS Step Functions can be used for orchestration, and retries are useful for handling transient failures. However, it adds complexity in terms of design and development. While this could help with retries, it doesn’t focus on collecting failed events for analysis directly. This setup is more complex and may not be necessary just for tracking failed events.
- Why rejected: While Step Functions provides retries and monitoring, it requires more development and infrastructure setup than needed just to collect and analyze failed Lambda events. It’s an over-engineered solution for this use case...
Author: Nia · Last updated Jul 14, 2026
A company has an application that uses an Amazon S3 bucket for object storage. A developer needs to configure in-transit encryption for the S3 bucket. All the S3 objects containing personal data needs to be encrypted at rest with AWS Key Management Service (AWS KM...
Let’s analyze each option in terms of meeting the requirements for both in-transit encryption and encryption at rest using AWS KMS for S3 objects.
A) Write an S3 bucket policy to allow only encrypted connections over HTTPS by using permissions boundary.
- Reasoning: This option mentions using a permissions boundary for enforcing encryption over HTTPS. However, permissions boundaries are typically used for restricting IAM role permissions, not for enforcing HTTPS encryption. For enforcing secure connections (HTTPS), an S3 bucket policy can use the `aws:SecureTransport` condition, but permissions boundaries don't apply directly to this requirement.
- Why rejected: The use of permissions boundaries is not relevant for enforcing HTTPS connections, which is best handled through a bucket policy with the `aws:SecureTransport` condition.
B) Configure an S3 bucket policy to enable client-side encryption for the objects containing personal data by using an AWS KMS customer managed key.
- Reasoning: This option mentions client-side encryption, which means the data is encrypted by the client before being uploaded to S3. While it allows for the use of an AWS KMS key, it’s not a requirement for server-side encryption (which is the focus here). The bucket policy should focus on server-side encryption settings, and client-side encryption would involve changes to the application itself, not just the bucket policy.
- Why rejected: Client-side encryption is not necessary for the requirement. The goal is to ensure server-side encryption at rest with KMS, which is configured differently.
C) Configure the application to encrypt the objects by using an AWS KMS customer managed key before uploading the objects containing perso...
Author: ThunderBear · Last updated Jul 14, 2026
A company has a monolithic desktop-based application that processes images. A developer is converting the application into an AWS Lambda function by using Python. Currently, the desktop application runs every 5 minutes to process the latest image from an Amazon S3 bucket. The desktop application completes the image processing task within 1 minute.
During testing on AWS, the developer notices that the Lambda function runs at the specified 5-minute interval. However, the Lam...
To address the issue where the AWS Lambda function is taking more than 2 minutes to complete the image processing task, it's important to focus on optimizing the Lambda function’s performance, particularly by addressing computational resource constraints. Below are the possible options:
A) Update the instance type of the Lambda function to a compute optimized instance with at least eight virtual CPU (vCPU).
- Rejection Reason: Lambda does not allow you to directly choose the type of instance or vCPUs. Lambda scaling is done through memory allocation, not by choosing an instance type. The vCPU resources are automatically allocated based on the memory settings, but you cannot directly specify the number of vCPUs.
- Scenario: This option is not viable because AWS Lambda abstracts instance configuration, and there is no option to select a specific vCPU or compute optimized instance.
B) Update the configuration of the Lambda function to use the latest Python runtime.
- Rejection Reason: While it is generally a good practice to keep the runtime up-to-date, this will not significantly impact the performance of the function unless the new runtime has optimizations specifically relevant to the image processing task. It's unlikely to reduce processing time considerably for this use case.
- Scenario: This option is useful for general performance improvements or bug fixes in the runtime but does not directly address computational resource constraints or optimize the image processing task.
C) Increase the memory that is a...
Author: CrystalWolfX · Last updated Jul 14, 2026
A company uses AWS CloudFormation templates to manage infrastructure for a public-facing application in its development, pre-production, and production environments. The company needs to scale for increasing customer demand. A developer must upgrade the Amazon RDS DB instance type to a larger instance.
The developer deploys an update to the CloudFormation stack with the instance size change i...
When the AWS CloudFormation stack enters the UPDATE_ROLLBACK_FAILED state, it indicates that the update operation failed and that CloudFormation could not successfully roll back to the previous state. In this case, the issue occurs when the developer tries to upgrade the Amazon RDS DB instance type in the pre-production environment. Here are the possible causes and their explanations:
A) The new instance type specified in the CloudFormation template is invalid.
- Rejection Reason: If the instance type specified in the template were invalid (e.g., a non-existent instance type or one incompatible with RDS), CloudFormation would typically provide a more specific error message indicating the invalid parameter. While this could theoretically be an issue, it’s unlikely to cause the UPDATE_ROLLBACK_FAILED state without additional context, and the error would normally be more clear.
- Scenario: This might be possible but does not fully explain the rollback failure. CloudFormation generally provides specific feedback for invalid configurations, rather than putting the stack in UPDATE_ROLLBACK_FAILED.
B) The database was deleted or modified manually outside of the CloudFormation stack.
- Selection Reason: If the RDS instance or any other related resource was modified or deleted manually outside of CloudFormation (e.g., using the AWS Management Console or AWS CLI), CloudFormation will not be aware of those changes. When CloudFormation tries to update the resource, it will detect a discrepancy between the stack's desired state and the actual state of the resource. This mismatch can cause the UPDATE_ROLLBACK_FAILED state.
- Scenario: This is the most likely caus...
Author: Lucas Carter · Last updated Jul 14, 2026
A developer needs to store files in an Amazon S3 bucket for a company's application. Each S3 object can have multiple versions. The objects must be permanently removed 1 year after object creation.
The developer creates an S3 bucket tha...
To meet the requirement of permanently removing objects 1 year after creation, the developer needs a solution that automatically manages object expiration and deletion in an Amazon S3 bucket with versioning enabled. Here's a breakdown of each option:
A) Create an S3 Lifecycle rule on the S3 bucket. Configure the rule to expire current versions of objects and permanently delete noncurrent versions 1 year after object creation.
- Selection Reason: This option is the most suitable because it leverages S3 Lifecycle rules to automatically manage the expiration of objects and deletion of noncurrent versions. With versioning enabled, S3 can retain multiple versions of objects. The rule will handle expiring the current version and removing noncurrent versions after 1 year, ensuring that all versions are properly deleted after the specified retention period.
- Scenario: This is the ideal approach for automatic and scheduled expiration and deletion of both current and noncurrent versions of objects in the bucket.
B) Create an event notification for all object creation events in the S3 bucket. Configure the event notification to invoke an AWS Lambda function. Program the Lambda function to check the object creation date and to delete the object if the object is older than 1 year.
- Rejection Reason: This approach involves manually checking the object creation date each time an object is created, which is not ideal for this scenario. Lambda functions would need to be programmed to track and delete objects after 1 year, introducing unnecessary complexity. Additionally, it would be difficult to handle versioning properly using this method, especially for objects that have multiple versions.
- Scenario: While Lambda can be useful for certain custom tasks, this option is more complicated than needed and does not leverage the...
Author: Amelia · Last updated Jul 14, 2026
A company uses AWS X-Ray to monitor a serverless application. The components of the application have different request rates. The user interactions and transactions are important to trace, but they are low in volume. The background processes such as application health checks, polling, and connection maintenance generate high volumes of read-only requests.
Currently, the default X-Ray sampling rules are universal for all requests. Only the first request per second and some additional requests are recorded. This setup is not helping the company review the requests based on service or request type.
...
The goal is to fine-tune AWS X-Ray sampling rules to trace the right requests—specifically, user interactions and transactions—while minimizing the unnecessary overhead of high-volume, low-priority background tasks (such as health checks or polling). The current setup uses universal sampling, which doesn't differentiate between important transactions and less important background tasks.
Let's break down each option:
A) Disable sampling for high-volume read-only requests. Sample at a lower rate for all requests that handle user interactions or transactions.
- Rejection Reason: Disabling sampling for high-volume, read-only requests could reduce unnecessary traces for background tasks. However, lowering the sampling rate for user interactions and transactions could lead to missing important traces, as the system could skip valuable data that helps in troubleshooting and analysis.
- Scenario: This option is not ideal because it risks losing important traces related to user interactions and transactions by applying a lower sampling rate.
B) Disable sampling and trace all requests for requests that handle user interactions or transactions. Sample high-volume read-only requests at a higher rate.
- Rejection Reason: Disabling sampling for user interactions and transactions and tracing all requests is a good approach for ensuring important data is fully captured. However, sampling high-volume read-only requests at a higher rate is inefficient because it would unnecessarily record a large volume of low-value background tasks.
- Scenario: Tracing high-volume read-only requests at a higher rate is not needed, as these are not critical interactions, and tracing them excessively could overwhelm the system with unnecessary da...
Author: Sophia Clark · Last updated Jul 14, 2026
A developer uses an AWS Lambda function in an application to edit users' uploaded photos. The developer needs to update the Lambda function code and needs to test the updates.
For testing, the developer must divide the user traffic between the original version of the Lambda func...
To divide traffic between two versions of an AWS Lambda function for testing purposes, we need to implement versioning and routing mechanisms to control which version of the Lambda function receives traffic. Here's a breakdown of each option:
A) Publish a version of the original Lambda function. Make the necessary changes to the Lambda code. Publish a new version of the Lambda function.
- Selection Reason: This step is important because in order to manage multiple versions of a Lambda function, the developer must publish the original version and the updated version. After publishing both versions, the developer can configure traffic routing to shift traffic between them. This approach ensures that both the original and new versions are available for testing.
- Scenario: This option is necessary to create stable, immutable versions of the Lambda function to control traffic flow between them.
B) Use AWS CodeBuild to detect updates to the Lambda function. Configure CodeBuild to incrementally shift traffic from the original version of the Lambda function to the new version of the Lambda function.
- Rejection Reason: AWS CodeBuild is typically used for building and testing code, but it is not used for managing traffic between Lambda function versions. Traffic shifting is typically done using Lambda aliases, not CodeBuild. While CodeBuild can help with continuous integration and deployment (CI/CD), it does not handle the task of splitting traffic between Lambda function versions.
- Scenario: This option is not suitable because it is not the right tool for traffic shifting. Instead, Lambda aliases should be used to handle traffic routing.
C) Update the original version of the Lambda function to add a function URL. Make the necessary changes to the Lambda code. Publish another function URL for the updated Lambda code.
- Rejection Reason: While AWS Lambda function URLs provide a direct endpoint for invoking a function, they are not the correct method to split traffic between versions. The solution described here focuses on creating separate URLs for different Lambda versions, which is not the intend...
Author: Sophia · Last updated Jul 14, 2026
A company had an Amazon RDS for MySQL DB instance that was named mysql-db. The DB instance was deleted within the past 90 days.
A developer needs to find which IAM user or role deleted the D...
To find out which IAM user or role deleted the DB instance in an AWS environment, we need to focus on the solution that tracks API activity for AWS services such as Amazon RDS. Let's review each option:
Option A: Retrieve the AWS CloudTrail events for the resource mysql-db where the event name is DeleteDBInstance. Inspect each event.
- Why it is selected: AWS CloudTrail records API calls for AWS services, including delete actions such as deleting an RDS DB instance. By looking at the CloudTrail logs, we can easily determine which IAM user or role initiated the `DeleteDBInstance` operation. The event logs provide detailed information such as the action taken, the requester (IAM user or role), and the time of the action.
- Why other options are rejected:
- Option B (CloudWatch logs): Amazon CloudWatch logs track application-level logs, not management-level actions li...
Author: Matthew · Last updated Jul 14, 2026
A company has an ecommerce web application that uses an on-premises MySQL database as a data store. The company migrates the on-premises MySQL database to Amazon RDS for MySQL.
A developer needs to configure the application's access to the RDS for MySQL datab...
To meet the requirement of configuring the application's access to the Amazon RDS for MySQL database without using long-term credentials, let's evaluate each option based on the key factors:
Option A: Enable IAM database authentication on the RDS for MySQL DB instance. Create an IAM role that has the minimum required permissions. Assign the role to the application.
- Why it is selected: IAM database authentication allows the application to authenticate to the RDS for MySQL instance using temporary credentials, which eliminates the need for long-term credentials. This option is specifically designed to provide a secure and scalable method of database access, leveraging AWS IAM for authentication.
- Why other options are rejected:
- Option B (Secrets Manager): While AWS Secrets Manager securely stores credentials and provides temporary access to them, this solution still involves retrieving the credentials (user/password) and using them within the application. Although not long-term cr...
Author: Charlotte · Last updated Jul 14, 2026
A developer is creating an application that must transfer expired items from Amazon DynamoDB to Amazon S3. The developer sets up the DynamoDB table to automatically delete items after a specific TTL. The application must process the items in DynamoDB and then must store the expired items in Amazon S3. The entire process, including it...
Let's evaluate each option based on the key factors such as operational overhead, ease of implementation, scalability, and the specific requirements (processing expired items and storing them in Amazon S3 within 5 minutes):
Option A: Configure DynamoDB Accelerator (DAX) to query for expired items based on the TTL. Save the results to Amazon S3.
- Why it is rejected: DAX is an in-memory caching layer for DynamoDB that accelerates read-heavy workloads. However, it does not provide a mechanism to automatically process expired items from DynamoDB or store them in S3. DAX is primarily used to speed up queries rather than automate the handling of TTL-based expirations. This option would still require additional development effort to monitor and query for expired items, adding unnecessary complexity.
Option B: Configure DynamoDB Streams to invoke an AWS Lambda function. Program the Lambda function to process the items and to store the expired items in Amazon S3.
- Why it is rejected: DynamoDB Streams can capture changes to DynamoDB tables, including deletions, but it does not directly capture items that expire due to TTL. Since expired items are automatically deleted by DynamoDB when their TTL expires, they would not appear in DynamoDB Streams. This solution would require a workaround to detect expired items, adding complexity and not aligning with the requirement for low operational overhead.
Option C: Deploy a custom application on an A...
Author: Ravi Patel · Last updated Jul 14, 2026
A developer has an application that uses WebSocket APIs in Amazon API Gateway. The developer wants to use an API Gateway Lambda authorizer to control access to the application.
The developer needs to add credential caching and reduce repeated usage of secret keys and authorization...
To meet the requirements of using a Lambda authorizer with WebSocket APIs in Amazon API Gateway while adding credential caching to reduce repeated usage of secret keys and authorization tokens, we need to carefully configure the authorizer and ensure that tokens can be efficiently cached.
Let's analyze each option:
Option A: Use a token-based Lambda authorizer.
- Why this is selected: A token-based Lambda authorizer is a suitable choice for WebSocket APIs in API Gateway. This type of authorizer uses a token (typically a JWT or OAuth token) provided in the request header. The authorizer can validate the token and then return an IAM policy. One of the key benefits of using a token-based authorizer is that API Gateway supports credential caching for token-based authorizers, which reduces repeated checks against the token for each new request, improving performance.
- Key factor: Token-based Lambda authorizers are ideal for caching credentials and reducing the overhead of repeated authorization token checks.
Option B: Use a request parameter-based Lambda authorizer.
- Why this is rejected: A request parameter-based Lambda authorizer uses query string parameters or headers to pass the token to the authorizer. While this is a valid way to pass data for authorization, it does not directly support credential caching in the same manner that token-based Lambda authorizers do. Additionally, this approach would typically not reduce the need for repeated usage of secret keys and tokens as efficiently as a token-based authorizer.
- Key factor: This option doesn't leverage the caching benefits offered by token-based Lambda authorizers, making it less ideal for reducing repeated use of credentials and tokens.
Option C: Configure an integration request mapping template to reference the context map from the API Gateway Lambda authorizer.
- Why this is selected: The context map in API Gateway contains information about the request, including metadata and authorization-related information. By configuring the integration request mapping template to reference this map, you can ef...
Author: Maya · Last updated Jul 14, 2026
A developer builds a serverless application on AWS by using Amazon API Gateway, AWS Lambda functions, and Amazon Route 53. During testing, the developer notices errors but cannot immediately locate the root cause.
To identify the errors, the developer needs to search all ...
To address the need for identifying errors in the serverless application with the least operational overhead, let's analyze each option:
Key Considerations:
- Operational Overhead: The goal is to find a solution that minimizes the setup and ongoing maintenance of the system while still enabling the developer to quickly locate and analyze errors in the application.
- Error Identification: The developer needs to search through all the logs from the relevant AWS services (API Gateway, Lambda, Route 53, etc.) to trace errors.
- Real-time Monitoring: While searching for logs, the solution should be easy to query and efficient in terms of querying log data for troubleshooting.
Evaluation of Options:
Option A: Set up API Gateway health checks to monitor the application's availability. Use the Amazon CloudWatch PutMetricData API operation to publish the logs to CloudWatch. Search and query the logs by using Amazon Athena.
- Reasoning:
- API Gateway health checks only monitor availability, not logs or errors directly.
- The solution requires using CloudWatch PutMetricData to manually publish logs, which could lead to added complexity and potential for operational overhead.
- Amazon Athena can be used to query log data in S3, but the logs need to be correctly structured and pushed to S3 beforehand. This is more complex and requires custom solutions for log management.
- Con: The setup of log aggregation and querying with Athena is more complex and introduces unnecessary overhead for a simple log search use case.
Option B: Set up Route 53 health checks to monitor the application's availability. Turn on AWS CloudTrail logs for all the AWS services that the application uses. Send the logs to a specified Amazon S3 bucket. Use Amazon Athena to query the log files directly from Amazon S3.
- Reasoning:
- Route 53 health checks are useful for DNS-level monitoring but do not help in identifying specific errors within application logs.
- CloudTrail logs track API calls, but this is not sufficient for troubleshooting specific application errors. CloudTrail logs can be noisy and not provide enough detail for troubleshooting application logic errors, like those that occur in Lambda functions or API Gateway.
- Amazon Athena for querying log files from S3 is possible but would require significant effort to properly structure and store logs in S3, adding operational overhead.
- Con: The combination of CloudTrail...
Author: Akash · Last updated Jul 14, 2026
A developer needs to freeze changes to an AWS CodeCommit repository before a production release. The developer will work on new features while a quality assurance (QA) team tests the release.
The QA testing and all bug fixes must take place in isolation from the main branch. After th...
Let's analyze each option carefully based on the requirements:
Key Requirements:
1. Freeze changes to the main branch before a production release.
2. The developer should work on new features during QA testing (isolated from the main branch).
3. QA testing and bug fixes must happen in isolation from the main branch.
4. After the release, all bug fixes must be merged into the main branch.
Option A:
Create a release branch from the latest Git commit that will be in the release. Apply fixes to the release branch. Continue developing new features, and merge the features into the main branch. Merge the release branch into the main branch after the release.
Analysis:
- This option involves creating a separate release branch for the QA team to apply bug fixes.
- New feature development continues independently on the main branch.
- Once the release is finalized, the release branch is merged back into the main branch, ensuring bug fixes from QA are integrated into the main branch.
Why it's suitable:
- It isolates the main branch from QA fixes during testing, pr...
Author: Daniel · Last updated Jul 14, 2026
A developer is setting up AWS CodePipeline for a new application. During each build, the developer must generate a test r...
Key Requirements:
- The developer must generate a test report during each build in AWS CodePipeline.
Analysis of Each Option:
Option A: Create an AWS CodeBuild build project that runs tests. Configure the buildspec file with the test report information.
Analysis:
- AWS CodeBuild is specifically designed to run builds and can execute tests during the build process.
- The buildspec file is a configuration file used in CodeBuild to define the phases of the build (install, pre_build, build, post_build). This file allows you to define how to run tests and store the results.
- The test report can be generated by adding the necessary commands in the buildspec file (e.g., generating test reports in formats such as JUnit or others).
Why it's suitable:
- CodeBuild is designed for such tasks, and by configuring the buildspec file with appropriate steps, you can ensure that the test report is generated and made available after the build completes.
- This integrates well into CodePipeline, as CodeBuild can run tests as part of the pipeline.
Option B: Create an AWS CodeDeploy deployment that runs tests. Configure the AppSpec file with the test report information.
Analysis:
- AWS CodeDeploy is primarily used for deployment automation rather than for running tests. While you can use it to deploy your application, it's not typically used for continuous testing during a build phase.
- The AppSpec file in CodeDeploy is used to define deployment hooks (e.g., after or before deployment) and is not intended for configuring build-time test execution or generating test reports.
Why it's not...
Author: RadiantPhoenixX · Last updated Jul 14, 2026
A developer built an application by using multiple AWS Lambda functions. The Lambda functions must access dynamic configuration data at runtime. The data is maintained as a 6 KB JSON document in AWS AppConfig. The configuration data needs to be updated without requiring the redeployment of the application.
The developer needs a solution that will give th...
Key Requirements:
- The Lambda functions need access to dynamic configuration data at runtime.
- The configuration data is stored in AWS AppConfig as a 6 KB JSON document.
- The data must be updated without requiring redeployment of the application.
- Least development effort is preferred.
Analysis of Each Option:
Option A: Migrate the document from AWS AppConfig to a Lambda environment variable. Read the document at runtime.
Analysis:
- Lambda environment variables are static and cannot be easily updated without redeploying the function.
- Since the configuration data needs to be updated dynamically, using environment variables would require redeploying the Lambda function every time the configuration changes, which contradicts the requirement for no redeployment.
Why it's not suitable:
- Environment variables are not designed for dynamic updates, and they wouldn't meet the need for runtime configuration changes without redeployment.
Option B: Configure the AWS AppConfig Agent Lambda extension. Access the dynamic configuration data by calling the extension on a local host.
Analysis:
- The AWS AppConfig Lambda extension is designed specifically for Lambda functions to access dynamic configurations from AWS AppConfig.
- The extension allows Lambda functions to fetch the configuration data dynamically without requiring redeployment.
- This solution integrates well with AWS AppConfig and minimizes the development overhead by leveraging a pre-built extension.
Why it's suitable:
- The Lambda extension allows the Lambda functions to access the dynamic configuration at runtime and automatically updates the configuration as ...
Author: Leah · Last updated Jul 14, 2026
A developer has AWS Lambda functions that need to access a company's internal data science libraries and reference data. Separate teams manage the libraries and the data. The teams must be able to update and upload new data independently. The Lambda functions are connected t...
To determine the best solution for providing AWS Lambda functions with access to the company's internal data science libraries and reference data, let's analyze each option and consider key factors such as the need for independent updates by teams, scalability, and ease of access.
Option A:
- Attach an Amazon Elastic Block Store (Amazon EBS) volume to the Lambda functions using EBS Multi-Attach.
- Advantages:
- EBS volumes provide block-level storage that is highly durable.
- Disadvantages:
- EBS volumes are designed for attaching to EC2 instances, not directly to Lambda functions. AWS Lambda does not natively support mounting EBS volumes. Furthermore, using EBS Multi-Attach for this use case is not viable because Lambda functions cannot share access to EBS volumes in the same way EC2 instances can.
- Managing updates to EBS volumes would require complex workflows and is not the most appropriate choice for Lambda functions.
Option B:
- Compress libraries and reference data in a Lambda /tmp folder.
- Advantages:
- The `/tmp` folder provides temporary storage up to 512 MB, which could store compressed data and libraries during Lambda function execution.
- Disadvantages:
- The `/tmp` folder is ephemeral, meaning data will not persist across invocations. The Lambda function would lose access to the libraries and reference data once the function execution ends.
- This solution doesn't allow the teams to update or manage the libraries and data independently, as it requires uploading data each time a function runs, which isn't scalable or practical for dynamic data that needs frequent updates.
Option C:
- Set up an Amazon Elastic File System (Amazon EFS) file system with mount targets in the central VPC. Configure the Lambda functions to mount the EFS ...
Author: Lina Zhang · Last updated Jul 14, 2026
A company has an application that uses an AWS Lambda function to consume messages from an Amazon Simple Queue Service (Amazon SQS) queue. The SQS queue is configured with a dead-letter queue. Due to a defect in the application, AWS Lambda failed to process some messages. A d...
Key Requirements:
- The Lambda function failed to process messages from an Amazon SQS queue.
- The SQS queue has a dead-letter queue (DLQ) configured.
- The bug in the Lambda function has been fixed, and the developer wants to reprocess the failed messages.
Analysis of Each Option:
Option A: Use the SendMessageBatch API to send messages from the dead-letter queue to the original SQS queue.
Analysis:
- The SendMessageBatch API is used to send messages in batches to an SQS queue. However, this API does not directly work with dead-letter queues (DLQs).
- The developer would have to manually retrieve messages from the DLQ and use this API to re-send them to the original SQS queue.
Why it's not ideal:
- This approach would require additional manual steps to read messages from the DLQ and re-send them to the main queue, introducing more complexity than necessary.
- It is not the most efficient or automated way to process the failed messages again.
Option B: Use the ChangeMessageVisibility API to configure messages in the dead-letter queue to be visible in the original SQS queue.
Analysis:
- The ChangeMessageVisibility API is used to modify the visibility timeout of a message in the queue, i.e., how long a message is hidden from other consumers.
- This API does not support moving messages from a dead-letter queue to the original queue. It only affects the visibility of messages that are already in a queue.
Why it's not suitable:
- The ChangeMessageVisibility API is not designed to move messages between the DLQ and the main queue, making it ineffective for reprocessing messages in the scenario described.
Option C: ...
Author: Carlos Garcia · Last updated Jul 14, 2026
A developer is working on an application that will be deployed on AWS. The developer needs to test and debug the code locally. The code is packaged and stored in an Amazon S3 bucket.
How can t...
To select the best option, let's evaluate each one based on factors like ease of use, configuration complexity, and relevance to local testing and debugging.
Option A: AWS CodeDeploy
- How it works: CodeDeploy is used to automate application deployments to compute services such as EC2 instances or on-premises servers. This option involves creating an application and deployment group, specifying the local machine as the target.
- Why it’s rejected: While it is designed for deployment automation, it requires substantial configuration (setting up CodeDeploy agents, a deployment group, and specifying settings for the local machine). It also involves a more complex deployment pipeline, which isn’t ideal for a simple local testing and debugging setup.
Option B: AWS CodeArtifact
- How it works: CodeArtifact is used to store and share software packages. This option involves creating a repository to store code packages and publishing the application to test it.
- Why it’s rejected: CodeArtifact is primarily used for managing dependencies rather than for testing or debugging code locally. This option is more about managing artifact storage and does not directly facilitate local testing or debugging.
Option C: AWS CodeBuild with CodePipeline
- How it works: CodeBuild is a build service that automates the bu...
Author: RadiantPhoenixX · Last updated Jul 14, 2026
A developer is creating an application on Amazon Elastic Container Service (Amazon ECS). The developer needs to configure the application parameters. The developer must configure limits for the application's maximum number of simultaneous connections and maximum number of transactions per second.
The maximum number of connections and transactions can change in the future. The develop...
To select the best solution, let's evaluate each option based on the requirements: the need to change application parameters dynamically, apply changes automatically, and ensure zero downtime during the deployment process.
Option A: AWS CodeDeploy with In-Place Deployment
- How it works: In an in-place deployment, AWS CodeDeploy updates the application on the running EC2 instances or containers without launching new instances.
- Why it’s rejected: While CodeDeploy can manage deployment configurations and apply updates, the in-place deployment method does not align well with zero-downtime deployment requirements for dynamic configuration changes. CodeDeploy would likely cause service interruptions during deployment, making this less ideal for automatic, uninterrupted parameter updates like maximum connections or transactions per second.
Option B: AWS Cloud Development Kit (AWS CDK) with ECS Canary Deployment
- How it works: The AWS CDK provides infrastructure as code (IaC) for deploying applications. The ECSCanary10Percent15Minutes deployment strategy would apply the change to 10% of instances for 15 minutes before rolling it out to the rest, allowing for gradual updates.
- Why it’s rejected: While this strategy is useful for ECS container deployments, it requires manual intervention for configuration changes and is more appropriate for infrastructure changes rather than ongoing application configuration management. For dynamic configuration changes like the maximum connections or transactions, the solution would not be as flexible or automatic as needed.
Option C: AWS AppConfig with ECS Integration
- How it works: AWS AppConfig a...
Author: Henry · Last updated Jul 14, 2026
A developer has built an application running on AWS Lambda using AWS Serverless Application Model (AWS SAM).
What is the correct ...
To determine the correct sequence of steps for successfully deploying an AWS Lambda application using AWS Serverless Application Model (AWS SAM), let's review each option in light of the best practices for working with AWS SAM.
Option A: Build on EC2, Package to EBS, Deploy from EBS
- How it works: This option suggests building the SAM template on an EC2 instance, then packaging it to Amazon EBS storage and deploying from EBS.
- Why it’s rejected: This option is not suitable for a typical SAM deployment. EBS is not used for packaging and deploying serverless applications in the SAM workflow. AWS SAM relies on Amazon S3 for packaging and storage, not EBS. Additionally, building directly on EC2 introduces unnecessary complexity compared to local or CI/CD-based workflows.
Option B: Build Locally, Package to S3, Deploy from S3
- How it works: This option suggests building the SAM template locally, then packaging it to Amazon S3, and finally deploying it from S3.
- Why it’s selected: This is the correct and recommended sequence for working with AWS SAM. The developer can build the SAM application locally using `sam build`, package the application (including dependencies and Lambda function code) to an S3 bucket using `sam package`, and deploy the application using `sam deploy` with the S3 location as the source for the deployment. This aligns with the typical serverless deploy...
Author: StarlightBear · Last updated Jul 14, 2026
A developer needs to deploy the code for a new application on an AWS Lambda function. The application needs a dependency file that is 500 MB to run th...
Let's evaluate each option based on the requirements of deploying an AWS Lambda function with a 500 MB dependency file:
Option A: Compress the application code and dependencies into a .zip file and upload it directly to Lambda
- How it works: This approach suggests uploading the compressed .zip file directly to AWS Lambda as the deployment package.
- Why it’s rejected: AWS Lambda has a deployment package size limit of 50 MB when uploading directly through the AWS Management Console or 250 MB when using the AWS CLI or API. Since the dependency file is 500 MB, it exceeds the Lambda limit for deployment packages. This option does not meet the requirements for large packages.
Option B: Compress the application code and dependencies into a .zip file and upload it to an Amazon S3 bucket
- How it works: This method involves uploading the .zip file to S3 and configuring the Lambda function to retrieve and run the code from S3.
- Why it’s rejected: Although this allows for larger deployment packages (up to 3 GB for Lambda functions), Lambda still has an upper limit of 250 MB for direct file uploads. Using S3 in this case would not help with managing the 500 MB dependency file because Lambda functions do not run the code directly from S3; instead, the entire package must be uploaded to Lambda, and S3 is simply used for storage. This option is not ideal for such a large dependency.
Option C: Package the application code and dependencies into a container image, upload the image to S3, and configure Lambda to run from the image
- How it works: This option involves creating a container ...
Author: SilverBear · Last updated Jul 14, 2026
A company is developing a publicly accessible single-page application. The application makes calls from a client web browser to backend services to provide a user interface to customers. The application depends on a third-party web service exposed as an HTTP API. The web client must provide an API key to the third-party web service by using the HTTP header as part of the H...
Let's evaluate each option based on the requirement to ensure the company’s API key is not exposed to users, while also providing a solution that is cost-effective for a publicly accessible single-page application.
Option A: Amazon API Gateway with HTTP Integration (Private REST API)
- How it works: This option uses Amazon API Gateway to create a private REST API, which means that the API is not publicly accessible. The company’s API key is added to the HTTP headers list for integration with the third-party HTTP API.
- Why it’s rejected: While this approach would prevent the API key from being exposed directly to the client, using a private API means the API would not be accessible from the public internet, which is a requirement since the application is publicly accessible. Additionally, this option requires extra configuration for handling authentication and access control that could complicate the solution.
Option B: Amazon API Gateway with AWS Lambda Proxy Integration (Private API)
- How it works: This approach uses Amazon API Gateway to create a private REST API that integrates with AWS Lambda via a proxy integration. The Lambda function makes the actual call to the third-party API using the company’s API key.
- Why it’s rejected: Similar to Option A, this option uses a private API, which means it wouldn’t be accessible to the public users of the web application. While Lambda can securely store and manage the API key, the private API would prevent the application from making calls from the client web browser, which is required in this scenario.
Option C: Amazon API Gateway with HTTP Integration (Public REST API)
- How it works: This option uses Amazon API Gat...
Author: Sam · Last updated Jul 14, 2026
A developer is setting up the deployment of application stacks to new test environments by using the AWS Cloud Development Kit (AWS CDK). The application contains the code for several AWS Lambda functions that will be deployed as assets. Each Lambda function is defined by using the AWS CDK Lambda construct library.
The developer has already successfully deployed the application stacks to the alpha environment in the first account by using the AWS CDK CLI's cdk deploy command. The developer is preparing to deploy to the beta environment in a second account for the first time. The deve...
The error NoSuchBucket indicates that the Lambda functions are trying to be deployed using assets (such as Lambda function code) that depend on an S3 bucket that doesn't exist in the target AWS account or region. When deploying with AWS CDK, assets (like Lambda code) are typically uploaded to an S3 bucket in the account where the CDK is being deployed. Since the error mentions NoSuchBucket, it suggests that the required S3 bucket hasn't been set up in the second (beta) AWS account yet.
Let's break down the options:
A) `cdk synth`
- This command synthesizes an AWS CloudFormation template from the CDK app, showing what AWS resources will be deployed. However, this doesn't resolve any bucket-related issues. It doesn't create the necessary resources (like the S3 bucket). So, this option won't help resolve the NoSuchBucket error.
- Rejected.
B) `cdk bootstrap`
- The `cdk bootstrap` command sets up resources required by AWS CDK for deployment, such as an S3 bucket for asset storage, an ECR repository for container images, and IAM roles for deploying resources. This is th...
Author: Ella · Last updated Jul 14, 2026
A developer is automating a new application deployment with AWS Serverless Application Model (AWS SAM). The new application has one AWS Lambda function and one Amazon S3 bucket. The Lambda function must access the S3 bucket to only read objec...
In this case, the Lambda function needs to access an Amazon S3 bucket with read-only permissions. Let's analyze each option to determine the best solution.
A) Reference a second Lambda authorizer function.
- Explanation: Lambda authorizers are typically used in API Gateway to authorize access to APIs. This is unrelated to granting read access to an S3 bucket. The Lambda function needs permission to access S3, not to authorize an API request.
- Rejected: This option is irrelevant to the requirement and is not a valid solution.
B) Add a custom S3 bucket policy to the Lambda function.
- Explanation: AWS recommends granting permissions to resources (like S3 buckets) through IAM roles and policies, rather than directly modifying the bucket policy for Lambda's access. Adding a custom S3 bucket policy directly to the Lambda function would not be the best practice in this scenario.
- Rejected: This is not the recommended or efficient way to configure access in AWS SAM and could lead to unnecessary complexity.
C) Create an Amazon Simple Queue Service (SQS) topic for only S3 object reads. Reference the topic in the template.
- Explanation: Amazon SQS is a message queue service, and it is not necessary for this use case. The Lambda function does n...
Author: Carlos Garcia · Last updated Jul 14, 2026
A development team wants to immediately build and deploy an application whenever there is a change to the source code.
Which approac...
To achieve continuous deployment, the goal is to trigger an automated pipeline whenever there is a change in the source code. Let's review the options and evaluate them based on this requirement.
A) Store the source code in an Amazon S3 bucket. Configure AWS CodePipeline to start whenever a file in the bucket changes.
- Explanation: Amazon S3 can be used to store source code. While AWS CodePipeline can be configured to detect changes in an S3 bucket, it is important to note that S3 does not natively provide a mechanism to trigger a pipeline based on file changes, unless using an event like an object creation or modification. This could be set up through Amazon S3 events or other mechanisms, but the exact behavior may not be as seamless as with version-controlled repositories (e.g., CodeCommit).
- Selected: This option can work, though it's less common and might require additional configuration, like triggering the pipeline based on events (e.g., via Lambda or S3 events) when a file is uploaded or modified in the S3 bucket.
B) Store the source code in an encrypted Amazon EBS volume. Configure AWS CodePipeline to start whenever a file in the volume changes.
- Explanation: Amazon EBS volumes are primarily used for storage with EC2 instances, and they do not provide native integration or support for triggering events like file changes to initiate AWS CodePipeline. EBS is typically used for block-level storage, not for continuous integration/continuous deployment (CI/CD) workflows.
- Rejected: This is not a suitable solution for triggering AWS CodePipeline, and EBS does not integrate directly in this manner.
C) Store the source code in an AWS CodeCommit repository. Configure AWS CodePipeline to start whenever a change is committed to the repository.
- Explanation: AWS CodeCommit is a fully managed source control service that integrates directly with AWS CodePipeline. Whenever a commit is made to...
Author: Kunal · Last updated Jul 14, 2026
A developer is building an application integrating an Amazon API Gateway with an AWS Lambda function. When calling the API, the developer receives the following error:
Wed Nov 08 01:13:00 UTC 2017 : ...
The error message `502` typically indicates a Bad Gateway error, which occurs when there is an issue with the integration between API Gateway and the Lambda function. This can happen if the Lambda function is not responding correctly, or the response format does not meet the expectations of API Gateway.
Let's review the options:
A) Change the HTTP endpoint of the API to an HTTPS endpoint.
- Explanation: This is unlikely to resolve the issue. API Gateway supports both HTTP and HTTPS endpoints, but a `502` error usually suggests that the API Gateway could not correctly integrate with the Lambda function, not an issue related to the protocol (HTTP vs HTTPS).
- Rejected: This option is not related to the cause of the `502` error.
B) Change the format of the payload sent to the API Gateway.
- Explanation: The payload format could be a potential issue, especially if the Lambda function expects a specific structure. However, a `502` error generally indicates a problem with the Lambda function's response rather than the input. The payload format typically impacts how the API Gateway processes incoming requests, but it doesn't directly cause a `502` when the issue lies with Lambda's response format.
- Rejected: This is unlikely to be the root cause of the issue.
C) Change the format of the Lambda function response to the API call.
- Explanation: A common cause of a `502` error is an incorrect or improperly formatted response from ...
